Trojan.DownLoader33.5093

Technical Information

Modifies file system

Creates the following files

<Current directory>\d.cab
<Current directory>\$dpx$.tmp\0092875e5d49484cb781a0e9db4fc79e.tmp
<Current directory>\$dpx$.tmp\9f8b220973b1d74dbb578adde970ba28.tmp
<Current directory>\$dpx$.tmp\64342a4a406419439a9dd73a9b1f546d.tmp
<Current directory>\$dpx$.tmp\2d0388adfd6abb42920b4c7fbd266d7f.tmp
<Current directory>\$dpx$.tmp\efb308cb3c5c56489cfefda859af4062.tmp
<Current directory>\$dpx$.tmp\39a5cfeceabe924e882c455dfde1b435.tmp
<Current directory>\$dpx$.tmp\ac50abce83f4ba43a763b51564b4dc06.tmp
<Current directory>\$dpx$.tmp\3068160ef363704a84b7abd2b1f9b608.tmp
<Current directory>\$dpx$.tmp\38683a4615677243865789fe0ad11bbd.tmp
<Current directory>\$dpx$.tmp\688a4342a7b92c4ba26dedbf8f7a9426.tmp
<Current directory>\$dpx$.tmp\94995bccae3741478d6748fc5197921e.tmp
<Current directory>\$dpx$.tmp\89f2052063565e4ebc25b35383fbb0bd.tmp
<Current directory>\$dpx$.tmp\100fed15c33ad3408bb35e2569992508.tmp
<Current directory>\$dpx$.tmp\f28b3e19bc585646b2183ff0b7cd87ce.tmp
<Current directory>\$dpx$.tmp\c1bb7b1c54c5ca4da84c6b306dee01e4.tmp
<Current directory>\$dpx$.tmp\0ec7f45202274a41aed22aa849a5e735.tmp
<Current directory>\$dpx$.tmp\88ca3c156e849e47b6aee5c4f9e20945.tmp
<Current directory>\$dpx$.tmp\fa9f8a418db0a74692382d4e49e4649b.tmp
<Current directory>\$dpx$.tmp\b15690f98f042044b7aa4b4318c7226b.tmp
<Current directory>\$dpx$.tmp\bbd3a7e4c5cef54b8d2ed88adfad7829.tmp
<Current directory>\$dpx$.tmp\f89989df2b1bf7438af3c952776c1f91.tmp
<Current directory>\$dpx$.tmp\ad3b908f5bf1384b805a893528c407c5.tmp
<Current directory>\$dpx$.tmp\798deb68abe7be4aab86ec058cea1118.tmp
<Current directory>\$dpx$.tmp\7f4ad34ab730c043a6b4b3726645de02.tmp
<Current directory>\$dpx$.tmp\fbe3a647d055ad4daa0a86296d8fc77f.tmp
<Current directory>\$dpx$.tmp\e86fdae44428014c83b392163156de6c.tmp
<Current directory>\$dpx$.tmp\9079e3cbbb01404d9eb04cc9a19cad5d.tmp
<Current directory>\$dpx$.tmp\2de6784023d6ad42b96976b725fdd522.tmp
<Current directory>\$dpx$.tmp\7a7c452f2d0bcc47be653bf5051df4b7.tmp
<Current directory>\$dpx$.tmp\be8ee62bb66820498fd87ee1376fc011.tmp
<Current directory>\$dpx$.tmp\66686180fe9c8b40b1227c3ec0883528.tmp
<Current directory>\$dpx$.tmp\ccbc5144bd841e46a02582651c53e08a.tmp
<Current directory>\$dpx$.tmp\e41e9e55382a3c42905bccb170f2bc77.tmp
<Current directory>\$dpx$.tmp\d37722de6ecb794bb97ec2bde1d2e518.tmp
<Current directory>\$dpx$.tmp\b4471e7c2df3844cb3740eb758a668d4.tmp
<Current directory>\$dpx$.tmp\b10cb12b14814248ae370e4422ff29ae.tmp
<Current directory>\$dpx$.tmp\aff3458b08a1e14eb25483cc27c3fbbc.tmp
<Current directory>\$dpx$.tmp\b29969576a4e7940987bb64143b70465.tmp
<Current directory>\$dpx$.tmp\d636b84f6ec8e6419c849770e3c35a04.tmp
<Current directory>\$dpx$.tmp\547baf83c46f9e44ac650e169e86659b.tmp
<Current directory>\$dpx$.tmp\a4249dd25001154488c4784b250bb9a9.tmp
<Current directory>\$dpx$.tmp\f8538eb88d52a74ead41b8957c3cfff6.tmp
<Current directory>\$dpx$.tmp\883fcd8c19af124096f7b75aba4c8312.tmp
<Current directory>\$dpx$.tmp\022f036868476d4aa0aeb35a84bf28f8.tmp

Sets the 'hidden' attribute to the following files

<Current directory>\api-ms-win-core-console-l1-1-0.dll
<Current directory>\api-ms-win-crt-conio-l1-1-0.dll
<Current directory>\api-ms-win-crt-convert-l1-1-0.dll
<Current directory>\api-ms-win-crt-environment-l1-1-0.dll
<Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
<Current directory>\api-ms-win-crt-heap-l1-1-0.dll
<Current directory>\api-ms-win-crt-locale-l1-1-0.dll
<Current directory>\api-ms-win-crt-math-l1-1-0.dll
<Current directory>\api-ms-win-core-timezone-l1-1-0.dll
<Current directory>\api-ms-win-core-util-l1-1-0.dll
<Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
<Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
<Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
<Current directory>\api-ms-win-crt-string-l1-1-0.dll
<Current directory>\api-ms-win-crt-time-l1-1-0.dll
<Current directory>\api-ms-win-crt-utility-l1-1-0.dll
<Current directory>\msvcp140.dll
<Current directory>\opencl.dll
<Current directory>\api-ms-win-crt-private-l1-1-0.dll
<Current directory>\api-ms-win-crt-process-l1-1-0.dll
<Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
<Current directory>\api-ms-win-core-synch-l1-2-0.dll
<Current directory>\api-ms-win-core-synch-l1-1-0.dll
<Current directory>\api-ms-win-core-debug-l1-1-0.dll
<Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-2-0.dll
<Current directory>\api-ms-win-core-file-l2-1-0.dll
<Current directory>\api-ms-win-core-handle-l1-1-0.dll
<Current directory>\api-ms-win-core-heap-l1-1-0.dll
<Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
<Current directory>\api-ms-win-core-datetime-l1-1-0.dll
<Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
<Current directory>\api-ms-win-core-memory-l1-1-0.dll
<Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
<Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
<Current directory>\api-ms-win-core-profile-l1-1-0.dll
<Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
<Current directory>\api-ms-win-core-string-l1-1-0.dll
<Current directory>\api-ms-win-core-localization-l1-2-0.dll
<Current directory>\ucrtbase.dll
<Current directory>\vcruntime140.dll

Deletes the following files

<Current directory>\d.cab

Moves the following files

from <Current directory>\$dpx$.tmp\7f4ad34ab730c043a6b4b3726645de02.tmp to <Current directory>\api-ms-win-core-console-l1-1-0.dll
from <Current directory>\$dpx$.tmp\64342a4a406419439a9dd73a9b1f546d.tmp to <Current directory>\api-ms-win-crt-conio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\2d0388adfd6abb42920b4c7fbd266d7f.tmp to <Current directory>\api-ms-win-crt-convert-l1-1-0.dll
from <Current directory>\$dpx$.tmp\efb308cb3c5c56489cfefda859af4062.tmp to <Current directory>\api-ms-win-crt-environment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\39a5cfeceabe924e882c455dfde1b435.tmp to <Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ac50abce83f4ba43a763b51564b4dc06.tmp to <Current directory>\api-ms-win-crt-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\3068160ef363704a84b7abd2b1f9b608.tmp to <Current directory>\api-ms-win-crt-locale-l1-1-0.dll
from <Current directory>\$dpx$.tmp\38683a4615677243865789fe0ad11bbd.tmp to <Current directory>\api-ms-win-crt-math-l1-1-0.dll
from <Current directory>\$dpx$.tmp\0092875e5d49484cb781a0e9db4fc79e.tmp to <Current directory>\api-ms-win-core-timezone-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9f8b220973b1d74dbb578adde970ba28.tmp to <Current directory>\api-ms-win-core-util-l1-1-0.dll
from <Current directory>\$dpx$.tmp\688a4342a7b92c4ba26dedbf8f7a9426.tmp to <Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
from <Current directory>\$dpx$.tmp\100fed15c33ad3408bb35e2569992508.tmp to <Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f28b3e19bc585646b2183ff0b7cd87ce.tmp to <Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c1bb7b1c54c5ca4da84c6b306dee01e4.tmp to <Current directory>\api-ms-win-crt-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\0ec7f45202274a41aed22aa849a5e735.tmp to <Current directory>\api-ms-win-crt-time-l1-1-0.dll
from <Current directory>\$dpx$.tmp\88ca3c156e849e47b6aee5c4f9e20945.tmp to <Current directory>\api-ms-win-crt-utility-l1-1-0.dll
from <Current directory>\$dpx$.tmp\fa9f8a418db0a74692382d4e49e4649b.tmp to <Current directory>\msvcp140.dll
from <Current directory>\$dpx$.tmp\b15690f98f042044b7aa4b4318c7226b.tmp to <Current directory>\opencl.dll
from <Current directory>\$dpx$.tmp\94995bccae3741478d6748fc5197921e.tmp to <Current directory>\api-ms-win-crt-private-l1-1-0.dll
from <Current directory>\$dpx$.tmp\89f2052063565e4ebc25b35383fbb0bd.tmp to <Current directory>\api-ms-win-crt-process-l1-1-0.dll
from <Current directory>\$dpx$.tmp\bbd3a7e4c5cef54b8d2ed88adfad7829.tmp to <Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ad3b908f5bf1384b805a893528c407c5.tmp to <Current directory>\api-ms-win-core-synch-l1-2-0.dll
from <Current directory>\$dpx$.tmp\883fcd8c19af124096f7b75aba4c8312.tmp to <Current directory>\api-ms-win-core-synch-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e86fdae44428014c83b392163156de6c.tmp to <Current directory>\api-ms-win-core-debug-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9079e3cbbb01404d9eb04cc9a19cad5d.tmp to <Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
from <Current directory>\$dpx$.tmp\2de6784023d6ad42b96976b725fdd522.tmp to <Current directory>\api-ms-win-core-file-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7a7c452f2d0bcc47be653bf5051df4b7.tmp to <Current directory>\api-ms-win-core-file-l1-2-0.dll
from <Current directory>\$dpx$.tmp\be8ee62bb66820498fd87ee1376fc011.tmp to <Current directory>\api-ms-win-core-file-l2-1-0.dll
from <Current directory>\$dpx$.tmp\66686180fe9c8b40b1227c3ec0883528.tmp to <Current directory>\api-ms-win-core-handle-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ccbc5144bd841e46a02582651c53e08a.tmp to <Current directory>\api-ms-win-core-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e41e9e55382a3c42905bccb170f2bc77.tmp to <Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
from <Current directory>\$dpx$.tmp\fbe3a647d055ad4daa0a86296d8fc77f.tmp to <Current directory>\api-ms-win-core-datetime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\d37722de6ecb794bb97ec2bde1d2e518.tmp to <Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b10cb12b14814248ae370e4422ff29ae.tmp to <Current directory>\api-ms-win-core-memory-l1-1-0.dll
from <Current directory>\$dpx$.tmp\aff3458b08a1e14eb25483cc27c3fbbc.tmp to <Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b29969576a4e7940987bb64143b70465.tmp to <Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\d636b84f6ec8e6419c849770e3c35a04.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
from <Current directory>\$dpx$.tmp\547baf83c46f9e44ac650e169e86659b.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
from <Current directory>\$dpx$.tmp\a4249dd25001154488c4784b250bb9a9.tmp to <Current directory>\api-ms-win-core-profile-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f8538eb88d52a74ead41b8957c3cfff6.tmp to <Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
from <Current directory>\$dpx$.tmp\798deb68abe7be4aab86ec058cea1118.tmp to <Current directory>\api-ms-win-core-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b4471e7c2df3844cb3740eb758a668d4.tmp to <Current directory>\api-ms-win-core-localization-l1-2-0.dll
from <Current directory>\$dpx$.tmp\f89989df2b1bf7438af3c952776c1f91.tmp to <Current directory>\ucrtbase.dll
from <Current directory>\$dpx$.tmp\022f036868476d4aa0aeb35a84bf28f8.tmp to <Current directory>\vcruntime140.dll

Network activity

TCP

'lp##.abbny.com':443

UDP

DNS ASK lp##.beahh.com
DNS ASK lp##.abbny.com
DNS ASK lp##.haqo.net

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a
'<SYSTEM32>\expand.exe' d.cab -f:* .

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней