Trojan.DownLoader33.32245

Technical Information

Modifies file system

Creates the following files

<Current directory>\mddxab.exe
<SYSTEM32>\api_ms_win_core_file_l1_2_0.dll
<SYSTEM32>\api_ms_win_core_file_l1_1_0.dll
<SYSTEM32>\api_ms_win_core_localization_l1_2_0.dll
<SYSTEM32>\api_ms_win_core_file_l2_1_0.dll
<SYSTEM32>\api_ms_win_core_processenvironment_l1_1_0.dll
<SYSTEM32>\api_ms_win_core_memory_l1_1_0.dll
<SYSTEM32>\api_ms_win_core_interlocked_l1_1_0.dll
<SYSTEM32>\api_ms_win_core_datetime_l1_1_0.dll
<SYSTEM32>\api_ms_win_core_debug_l1_1_0.dll
<SYSTEM32>\api_ms_win_core_synch_l1_2_0.dll
<SYSTEM32>\api_ms_win_core_synch_l1_1_0.dll
<SYSTEM32>\api_ms_win_crt_math_l1_1_0.dll
<SYSTEM32>\api_ms_win_crt_multibyte_l1_1_0.dll
<SYSTEM32>\api_ms_win_core_sysinfo_l1_1_0.dll
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
%LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
%LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\qiyhgkqj\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\n8pruura\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\ry83pjjq\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\qw8zw4d2\desktop.ini
<SYSTEM32>\api_ms_win_crt_heap_l1_1_0.dll
%APPDATA%\microsoft\windows\cookies\low\index.dat
<SYSTEM32>\api_ms_win_crt_process_l1_1_0.dll
<SYSTEM32>\api_ms_win_core_processthreads_l1_1_0.dll
<SYSTEM32>\api_ms_win_core_string_l1_1_0.dll
<SYSTEM32>\api_ms_win_core_util_l1_1_0.dll
<SYSTEM32>\api_ms_win_crt_time_l1_1_0.dll
<SYSTEM32>\api_ms_win_core_timezone_l1_1_0.dll
<SYSTEM32>\api_ms_win_crt_filesystem_l1_1_0.dll
<SYSTEM32>\api_ms_win_core_namedpipe_l1_1_0.dll
<SYSTEM32>\api_ms_win_core_handle_l1_1_0.dll
<SYSTEM32>\api_ms_win_core_console_l1_1_0.dll
<SYSTEM32>\api_ms_win_crt_runtime_l1_1_0.dll
<SYSTEM32>\api_ms_win_crt_string_l1_1_0.dll
<SYSTEM32>\api_ms_win_crt_environment_l1_1_0.dll
<SYSTEM32>\api_ms_win_core_libraryloader_l1_1_0.dll
<SYSTEM32>\api_ms_win_crt_locale_l1_1_0.dll
<SYSTEM32>\api_ms_win_crt_convert_l1_1_0.dll
<SYSTEM32>\vcruntime140_1.dll
<SYSTEM32>\api_ms_win_crt_private_l1_1_0.dll
<SYSTEM32>\api_ms_win_core_errorhandling_l1_1_0.dll
<SYSTEM32>\api_ms_win_crt_utility_l1_1_0.dll
<SYSTEM32>\api_ms_win_core_rtlsupport_l1_1_0.dll
<SYSTEM32>\api_ms_win_crt_stdio_l1_1_0.dll
<SYSTEM32>\api_ms_win_core_profile_l1_1_0.dll
<SYSTEM32>\api_ms_win_core_heap_l1_1_0.dll
<SYSTEM32>\api_ms_win_core_processthreads_l1_1_1.dll
<SYSTEM32>\api_ms_win_crt_conio_l1_1_0.dll
%LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat

Sets the 'hidden' attribute to the following files

%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\qiyhgkqj\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\n8pruura\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\ry83pjjq\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\qw8zw4d2\desktop.ini
%LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
%LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini

Deletes the following files