Trojan.DownLoader36.33248

Technical Information

Modifies file system

Creates the following files

<Current directory>\d.cab
<Current directory>\$dpx$.tmp\50a9bc69cc8c314eba8b4fdc6595cbec.tmp
<Current directory>\$dpx$.tmp\4f397856d941de4299c1970c0168145d.tmp
<Current directory>\$dpx$.tmp\f0a69aeb3957154f81b114d5b3533054.tmp
<Current directory>\$dpx$.tmp\ddc45dbcb71924478f4096fe01bb6a86.tmp
<Current directory>\$dpx$.tmp\d5525d3fd738a24f95184375083a3336.tmp
<Current directory>\$dpx$.tmp\19ffbbed04b60542a4e7e2737da17d4d.tmp
<Current directory>\$dpx$.tmp\58c1171a1855094b90d0ec7fdf41e87e.tmp
<Current directory>\$dpx$.tmp\db7d532ecf8e5b49973f2326ac81af70.tmp
<Current directory>\$dpx$.tmp\fa1e390633280d43819af6ce36af4eb7.tmp
<Current directory>\$dpx$.tmp\58bced0c7457d848a56c10681031e822.tmp
<Current directory>\$dpx$.tmp\a5edb3190b417148ad490e39b098762a.tmp
<Current directory>\$dpx$.tmp\9fb61b685d66ae44b05004c085aa571e.tmp
<Current directory>\$dpx$.tmp\01ca275ecf2ff34fbedab94acc5dcd82.tmp
<Current directory>\$dpx$.tmp\8b045cc0479fbd44bf01316735d70bf5.tmp
<Current directory>\$dpx$.tmp\7ff300acc3a96b4da522a0fac66fe9e5.tmp
<Current directory>\$dpx$.tmp\82cbcf0cee0f884a9442b0899aa60053.tmp
<Current directory>\$dpx$.tmp\85efa6869b02d9478b9fa244f36b8489.tmp
<Current directory>\$dpx$.tmp\df820b54c3f87e4ea5fa7ddbed32ec65.tmp
<Current directory>\$dpx$.tmp\74b20bbf75ab02489b262698f7dce217.tmp
<Current directory>\$dpx$.tmp\dfd63edabc281148947c7c6823c4488d.tmp
<Current directory>\$dpx$.tmp\c796c2d90d22814dae49899902564e67.tmp
<Current directory>\$dpx$.tmp\4a466087bb81754fa4453d6e68860042.tmp
<Current directory>\$dpx$.tmp\1d46e8e95f527f4d877fc94dc19e1592.tmp
<Current directory>\$dpx$.tmp\95e201ab4a31e242a911214be0fa3c0f.tmp
<Current directory>\$dpx$.tmp\9b9b3a03efed18488ddf2b28514900a3.tmp
<Current directory>\$dpx$.tmp\58ae2eea98473940a2b4557218cc4d58.tmp
<Current directory>\$dpx$.tmp\c71c4ca6a39b3247b5189d522a37a60f.tmp
<Current directory>\$dpx$.tmp\f51b1f4e7034bb4b898b5f1226f6724f.tmp
<Current directory>\$dpx$.tmp\82c1a6bd8c2a9d43825ff556b66afe65.tmp
<Current directory>\$dpx$.tmp\8b72b2361a190b4e918fd06129060fce.tmp
<Current directory>\$dpx$.tmp\2fbb58df8f4a9e4e93b6c28e5bad8c5b.tmp
<Current directory>\$dpx$.tmp\b11ffa21af00f64daa9c3916e5505c79.tmp
<Current directory>\$dpx$.tmp\92f63c2a147dd444b8f07e5c2d1b7dd7.tmp
<Current directory>\$dpx$.tmp\e89a72328d55fe48be09b1f7eeecd93c.tmp
<Current directory>\$dpx$.tmp\4354a24482febf4b94991c920e4fe6f5.tmp
<Current directory>\$dpx$.tmp\9462f3f8fd6e9147aa178ca45ca7d399.tmp
<Current directory>\$dpx$.tmp\c2d98f1018534e40950fa1beed11333d.tmp
<Current directory>\$dpx$.tmp\c74d736ef2278b428830e8dadaa6873b.tmp
<Current directory>\$dpx$.tmp\bc29d085eb211c498bc51f6e548c1299.tmp
<Current directory>\$dpx$.tmp\ac7d8d7ba116dc448ffa24449220170d.tmp
<Current directory>\$dpx$.tmp\dd65c6e95d57014daa18c5092dd903f8.tmp
<Current directory>\$dpx$.tmp\72e8caa6ad28af498d48433de4986242.tmp
<Current directory>\$dpx$.tmp\9c564b04b43e9a47bbe2dbe187b0e693.tmp
<Current directory>\$dpx$.tmp\c143a56c6313454f9c7b289373672a39.tmp

Sets the 'hidden' attribute to the following files

<Current directory>\api-ms-win-core-console-l1-1-0.dll
<Current directory>\api-ms-win-crt-conio-l1-1-0.dll
<Current directory>\api-ms-win-crt-convert-l1-1-0.dll
<Current directory>\api-ms-win-crt-environment-l1-1-0.dll
<Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
<Current directory>\api-ms-win-crt-heap-l1-1-0.dll
<Current directory>\api-ms-win-crt-locale-l1-1-0.dll
<Current directory>\api-ms-win-crt-math-l1-1-0.dll
<Current directory>\api-ms-win-core-timezone-l1-1-0.dll
<Current directory>\api-ms-win-core-util-l1-1-0.dll
<Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
<Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
<Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
<Current directory>\api-ms-win-crt-string-l1-1-0.dll
<Current directory>\api-ms-win-crt-time-l1-1-0.dll
<Current directory>\api-ms-win-crt-utility-l1-1-0.dll
<Current directory>\msvcp140.dll
<Current directory>\opencl.dll
<Current directory>\api-ms-win-crt-private-l1-1-0.dll
<Current directory>\api-ms-win-crt-process-l1-1-0.dll
<Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
<Current directory>\api-ms-win-core-synch-l1-2-0.dll
<Current directory>\api-ms-win-core-synch-l1-1-0.dll
<Current directory>\api-ms-win-core-debug-l1-1-0.dll
<Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-2-0.dll
<Current directory>\api-ms-win-core-file-l2-1-0.dll
<Current directory>\api-ms-win-core-handle-l1-1-0.dll
<Current directory>\api-ms-win-core-heap-l1-1-0.dll
<Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
<Current directory>\api-ms-win-core-datetime-l1-1-0.dll
<Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
<Current directory>\api-ms-win-core-memory-l1-1-0.dll
<Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
<Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
<Current directory>\api-ms-win-core-profile-l1-1-0.dll
<Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
<Current directory>\api-ms-win-core-string-l1-1-0.dll
<Current directory>\api-ms-win-core-localization-l1-2-0.dll
<Current directory>\ucrtbase.dll
<Current directory>\vcruntime140.dll

Deletes the following files

<Current directory>\d.cab

Moves the following files

from <Current directory>\$dpx$.tmp\95e201ab4a31e242a911214be0fa3c0f.tmp to <Current directory>\api-ms-win-core-console-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f0a69aeb3957154f81b114d5b3533054.tmp to <Current directory>\api-ms-win-crt-conio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ddc45dbcb71924478f4096fe01bb6a86.tmp to <Current directory>\api-ms-win-crt-convert-l1-1-0.dll
from <Current directory>\$dpx$.tmp\d5525d3fd738a24f95184375083a3336.tmp to <Current directory>\api-ms-win-crt-environment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\19ffbbed04b60542a4e7e2737da17d4d.tmp to <Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
from <Current directory>\$dpx$.tmp\58c1171a1855094b90d0ec7fdf41e87e.tmp to <Current directory>\api-ms-win-crt-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\db7d532ecf8e5b49973f2326ac81af70.tmp to <Current directory>\api-ms-win-crt-locale-l1-1-0.dll
from <Current directory>\$dpx$.tmp\fa1e390633280d43819af6ce36af4eb7.tmp to <Current directory>\api-ms-win-crt-math-l1-1-0.dll
from <Current directory>\$dpx$.tmp\50a9bc69cc8c314eba8b4fdc6595cbec.tmp to <Current directory>\api-ms-win-core-timezone-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4f397856d941de4299c1970c0168145d.tmp to <Current directory>\api-ms-win-core-util-l1-1-0.dll
from <Current directory>\$dpx$.tmp\58bced0c7457d848a56c10681031e822.tmp to <Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
from <Current directory>\$dpx$.tmp\01ca275ecf2ff34fbedab94acc5dcd82.tmp to <Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\8b045cc0479fbd44bf01316735d70bf5.tmp to <Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7ff300acc3a96b4da522a0fac66fe9e5.tmp to <Current directory>\api-ms-win-crt-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\82cbcf0cee0f884a9442b0899aa60053.tmp to <Current directory>\api-ms-win-crt-time-l1-1-0.dll
from <Current directory>\$dpx$.tmp\85efa6869b02d9478b9fa244f36b8489.tmp to <Current directory>\api-ms-win-crt-utility-l1-1-0.dll
from <Current directory>\$dpx$.tmp\df820b54c3f87e4ea5fa7ddbed32ec65.tmp to <Current directory>\msvcp140.dll
from <Current directory>\$dpx$.tmp\74b20bbf75ab02489b262698f7dce217.tmp to <Current directory>\opencl.dll
from <Current directory>\$dpx$.tmp\a5edb3190b417148ad490e39b098762a.tmp to <Current directory>\api-ms-win-crt-private-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9fb61b685d66ae44b05004c085aa571e.tmp to <Current directory>\api-ms-win-crt-process-l1-1-0.dll
from <Current directory>\$dpx$.tmp\dfd63edabc281148947c7c6823c4488d.tmp to <Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4a466087bb81754fa4453d6e68860042.tmp to <Current directory>\api-ms-win-core-synch-l1-2-0.dll
from <Current directory>\$dpx$.tmp\9c564b04b43e9a47bbe2dbe187b0e693.tmp to <Current directory>\api-ms-win-core-synch-l1-1-0.dll
from <Current directory>\$dpx$.tmp\58ae2eea98473940a2b4557218cc4d58.tmp to <Current directory>\api-ms-win-core-debug-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c71c4ca6a39b3247b5189d522a37a60f.tmp to <Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f51b1f4e7034bb4b898b5f1226f6724f.tmp to <Current directory>\api-ms-win-core-file-l1-1-0.dll
from <Current directory>\$dpx$.tmp\82c1a6bd8c2a9d43825ff556b66afe65.tmp to <Current directory>\api-ms-win-core-file-l1-2-0.dll
from <Current directory>\$dpx$.tmp\8b72b2361a190b4e918fd06129060fce.tmp to <Current directory>\api-ms-win-core-file-l2-1-0.dll
from <Current directory>\$dpx$.tmp\2fbb58df8f4a9e4e93b6c28e5bad8c5b.tmp to <Current directory>\api-ms-win-core-handle-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b11ffa21af00f64daa9c3916e5505c79.tmp to <Current directory>\api-ms-win-core-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\92f63c2a147dd444b8f07e5c2d1b7dd7.tmp to <Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9b9b3a03efed18488ddf2b28514900a3.tmp to <Current directory>\api-ms-win-core-datetime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e89a72328d55fe48be09b1f7eeecd93c.tmp to <Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9462f3f8fd6e9147aa178ca45ca7d399.tmp to <Current directory>\api-ms-win-core-memory-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c2d98f1018534e40950fa1beed11333d.tmp to <Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c74d736ef2278b428830e8dadaa6873b.tmp to <Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\bc29d085eb211c498bc51f6e548c1299.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ac7d8d7ba116dc448ffa24449220170d.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
from <Current directory>\$dpx$.tmp\dd65c6e95d57014daa18c5092dd903f8.tmp to <Current directory>\api-ms-win-core-profile-l1-1-0.dll
from <Current directory>\$dpx$.tmp\72e8caa6ad28af498d48433de4986242.tmp to <Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1d46e8e95f527f4d877fc94dc19e1592.tmp to <Current directory>\api-ms-win-core-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4354a24482febf4b94991c920e4fe6f5.tmp to <Current directory>\api-ms-win-core-localization-l1-2-0.dll
from <Current directory>\$dpx$.tmp\c796c2d90d22814dae49899902564e67.tmp to <Current directory>\ucrtbase.dll
from <Current directory>\$dpx$.tmp\c143a56c6313454f9c7b289373672a39.tmp to <Current directory>\vcruntime140.dll

Network activity

TCP

'lp##.abbny.com':443

UDP

DNS ASK lp##.beahh.com
DNS ASK lp##.abbny.com
DNS ASK lp##.haqo.net

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a
'<SYSTEM32>\expand.exe' d.cab -f:* .

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней