Trojan.DownLoader33.5099

Technical Information

Modifies file system

Creates the following files

<Current directory>\d.cab
<Current directory>\$dpx$.tmp\5f50a46d702b3b469388a8f50db155cc.tmp
<Current directory>\$dpx$.tmp\8e1bdb397364e84799735b38f054233a.tmp
<Current directory>\$dpx$.tmp\19874bcbfd32344a9435a2026e393882.tmp
<Current directory>\$dpx$.tmp\023f936640d4a84ab3e13d5268147267.tmp
<Current directory>\$dpx$.tmp\72ade103a0b48a4d851b85a1eefa82b3.tmp
<Current directory>\$dpx$.tmp\d5eaed918626d74fb24a32efac824f20.tmp
<Current directory>\$dpx$.tmp\b24124ab5bcef84ea0c1115f41ed12ff.tmp
<Current directory>\$dpx$.tmp\c58b1e902d2cd6418c64cdd939c8bda2.tmp
<Current directory>\$dpx$.tmp\305a962fab36d54a82c00e46d5041f0a.tmp
<Current directory>\$dpx$.tmp\6f360af5e20c5a468ed707564b819bc9.tmp
<Current directory>\$dpx$.tmp\1738bfc305489842986320205742a46b.tmp
<Current directory>\$dpx$.tmp\e6df4ee9ab9a1e419d88232ada5bf443.tmp
<Current directory>\$dpx$.tmp\63fac4ee1620084d87ea3600c258fddf.tmp
<Current directory>\$dpx$.tmp\a547a4434245684a92cbcf78a6426ef9.tmp
<Current directory>\$dpx$.tmp\52bb8309c912f94193a479a5a1721454.tmp
<Current directory>\$dpx$.tmp\cd6edbe764ac4746ac69c09084987b29.tmp
<Current directory>\$dpx$.tmp\0b6c11ba26bfee49b44939dbb6694fbf.tmp
<Current directory>\$dpx$.tmp\5bf5698d1822e2469b9f9ee7d1fe91ad.tmp
<Current directory>\$dpx$.tmp\5956206858ad9649badd28d806ff824e.tmp
<Current directory>\$dpx$.tmp\3037ca7d5df04a4c820fc4980412c9df.tmp
<Current directory>\$dpx$.tmp\21c2080e4703b04f8d19df8d4dea2700.tmp
<Current directory>\$dpx$.tmp\a2c4a5cf8c198348914442b0ea2f5f97.tmp
<Current directory>\$dpx$.tmp\e107be4c4d458b47aae40460541f0677.tmp
<Current directory>\$dpx$.tmp\3985ec97ea531848aeb1d7ea0333f51b.tmp
<Current directory>\$dpx$.tmp\f88a209b99309246bffc0515b984b3d3.tmp
<Current directory>\$dpx$.tmp\fa2efcafb78034479784851e0b223a13.tmp
<Current directory>\$dpx$.tmp\8eae0799a64f38408e2e943a316b284f.tmp
<Current directory>\$dpx$.tmp\b65f3d352ea97d4f91933d34b79be1e9.tmp
<Current directory>\$dpx$.tmp\961f988066279746b683c61f7fdd4e4b.tmp
<Current directory>\$dpx$.tmp\f91a3abe2f515b4aadf9cd997cf9d850.tmp
<Current directory>\$dpx$.tmp\1c7693c1b13c434c95c6c989f76281c5.tmp
<Current directory>\$dpx$.tmp\af0ec18c95926044b621174ebfb07d10.tmp
<Current directory>\$dpx$.tmp\572f86697d773743959eb903d6313d00.tmp
<Current directory>\$dpx$.tmp\258859f2c78b7c4483d1303d34ec02a0.tmp
<Current directory>\$dpx$.tmp\8e68c102ed48ab4b9305549d09445261.tmp
<Current directory>\$dpx$.tmp\cc90bfbad07d584eb8b38f2ee6333e07.tmp
<Current directory>\$dpx$.tmp\676fec7c3a91284ba2239e87d789113c.tmp
<Current directory>\$dpx$.tmp\3c13755268b11a4cbcee6ffa0b79e429.tmp
<Current directory>\$dpx$.tmp\74d6fd02ef30bd4785fb7b0dd246fabc.tmp
<Current directory>\$dpx$.tmp\447069195b84a94ca812327dfee6116d.tmp
<Current directory>\$dpx$.tmp\5440b7f2ae69ae409b76fde44cdce249.tmp
<Current directory>\$dpx$.tmp\f7f5440bbbfd9043bde131b6814afab3.tmp
<Current directory>\$dpx$.tmp\4d81aaf3017a7f45a321850b12ac66d0.tmp
<Current directory>\$dpx$.tmp\56bc8ab229fc094a82e2657e807f7d19.tmp

Sets the 'hidden' attribute to the following files

<Current directory>\api-ms-win-core-console-l1-1-0.dll
<Current directory>\api-ms-win-crt-conio-l1-1-0.dll
<Current directory>\api-ms-win-crt-convert-l1-1-0.dll
<Current directory>\api-ms-win-crt-environment-l1-1-0.dll
<Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
<Current directory>\api-ms-win-crt-heap-l1-1-0.dll
<Current directory>\api-ms-win-crt-locale-l1-1-0.dll
<Current directory>\api-ms-win-crt-math-l1-1-0.dll
<Current directory>\api-ms-win-core-timezone-l1-1-0.dll
<Current directory>\api-ms-win-core-util-l1-1-0.dll
<Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
<Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
<Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
<Current directory>\api-ms-win-crt-string-l1-1-0.dll
<Current directory>\api-ms-win-crt-time-l1-1-0.dll
<Current directory>\api-ms-win-crt-utility-l1-1-0.dll
<Current directory>\msvcp140.dll
<Current directory>\opencl.dll
<Current directory>\api-ms-win-crt-private-l1-1-0.dll
<Current directory>\api-ms-win-crt-process-l1-1-0.dll
<Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
<Current directory>\api-ms-win-core-synch-l1-2-0.dll
<Current directory>\api-ms-win-core-synch-l1-1-0.dll
<Current directory>\api-ms-win-core-debug-l1-1-0.dll
<Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-2-0.dll
<Current directory>\api-ms-win-core-file-l2-1-0.dll
<Current directory>\api-ms-win-core-handle-l1-1-0.dll
<Current directory>\api-ms-win-core-heap-l1-1-0.dll
<Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
<Current directory>\api-ms-win-core-datetime-l1-1-0.dll
<Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
<Current directory>\api-ms-win-core-memory-l1-1-0.dll
<Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
<Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
<Current directory>\api-ms-win-core-profile-l1-1-0.dll
<Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
<Current directory>\api-ms-win-core-string-l1-1-0.dll
<Current directory>\api-ms-win-core-localization-l1-2-0.dll
<Current directory>\ucrtbase.dll
<Current directory>\vcruntime140.dll

Deletes the following files

<Current directory>\d.cab

Moves the following files

from <Current directory>\$dpx$.tmp\3985ec97ea531848aeb1d7ea0333f51b.tmp to <Current directory>\api-ms-win-core-console-l1-1-0.dll
from <Current directory>\$dpx$.tmp\19874bcbfd32344a9435a2026e393882.tmp to <Current directory>\api-ms-win-crt-conio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\023f936640d4a84ab3e13d5268147267.tmp to <Current directory>\api-ms-win-crt-convert-l1-1-0.dll
from <Current directory>\$dpx$.tmp\72ade103a0b48a4d851b85a1eefa82b3.tmp to <Current directory>\api-ms-win-crt-environment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\d5eaed918626d74fb24a32efac824f20.tmp to <Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b24124ab5bcef84ea0c1115f41ed12ff.tmp to <Current directory>\api-ms-win-crt-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c58b1e902d2cd6418c64cdd939c8bda2.tmp to <Current directory>\api-ms-win-crt-locale-l1-1-0.dll
from <Current directory>\$dpx$.tmp\305a962fab36d54a82c00e46d5041f0a.tmp to <Current directory>\api-ms-win-crt-math-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5f50a46d702b3b469388a8f50db155cc.tmp to <Current directory>\api-ms-win-core-timezone-l1-1-0.dll
from <Current directory>\$dpx$.tmp\8e1bdb397364e84799735b38f054233a.tmp to <Current directory>\api-ms-win-core-util-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6f360af5e20c5a468ed707564b819bc9.tmp to <Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
from <Current directory>\$dpx$.tmp\63fac4ee1620084d87ea3600c258fddf.tmp to <Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a547a4434245684a92cbcf78a6426ef9.tmp to <Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\52bb8309c912f94193a479a5a1721454.tmp to <Current directory>\api-ms-win-crt-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\cd6edbe764ac4746ac69c09084987b29.tmp to <Current directory>\api-ms-win-crt-time-l1-1-0.dll
from <Current directory>\$dpx$.tmp\0b6c11ba26bfee49b44939dbb6694fbf.tmp to <Current directory>\api-ms-win-crt-utility-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5bf5698d1822e2469b9f9ee7d1fe91ad.tmp to <Current directory>\msvcp140.dll
from <Current directory>\$dpx$.tmp\5956206858ad9649badd28d806ff824e.tmp to <Current directory>\opencl.dll
from <Current directory>\$dpx$.tmp\1738bfc305489842986320205742a46b.tmp to <Current directory>\api-ms-win-crt-private-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e6df4ee9ab9a1e419d88232ada5bf443.tmp to <Current directory>\api-ms-win-crt-process-l1-1-0.dll
from <Current directory>\$dpx$.tmp\3037ca7d5df04a4c820fc4980412c9df.tmp to <Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a2c4a5cf8c198348914442b0ea2f5f97.tmp to <Current directory>\api-ms-win-core-synch-l1-2-0.dll
from <Current directory>\$dpx$.tmp\4d81aaf3017a7f45a321850b12ac66d0.tmp to <Current directory>\api-ms-win-core-synch-l1-1-0.dll
from <Current directory>\$dpx$.tmp\fa2efcafb78034479784851e0b223a13.tmp to <Current directory>\api-ms-win-core-debug-l1-1-0.dll
from <Current directory>\$dpx$.tmp\8eae0799a64f38408e2e943a316b284f.tmp to <Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b65f3d352ea97d4f91933d34b79be1e9.tmp to <Current directory>\api-ms-win-core-file-l1-1-0.dll
from <Current directory>\$dpx$.tmp\961f988066279746b683c61f7fdd4e4b.tmp to <Current directory>\api-ms-win-core-file-l1-2-0.dll
from <Current directory>\$dpx$.tmp\f91a3abe2f515b4aadf9cd997cf9d850.tmp to <Current directory>\api-ms-win-core-file-l2-1-0.dll
from <Current directory>\$dpx$.tmp\1c7693c1b13c434c95c6c989f76281c5.tmp to <Current directory>\api-ms-win-core-handle-l1-1-0.dll
from <Current directory>\$dpx$.tmp\af0ec18c95926044b621174ebfb07d10.tmp to <Current directory>\api-ms-win-core-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\572f86697d773743959eb903d6313d00.tmp to <Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f88a209b99309246bffc0515b984b3d3.tmp to <Current directory>\api-ms-win-core-datetime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\258859f2c78b7c4483d1303d34ec02a0.tmp to <Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
from <Current directory>\$dpx$.tmp\cc90bfbad07d584eb8b38f2ee6333e07.tmp to <Current directory>\api-ms-win-core-memory-l1-1-0.dll
from <Current directory>\$dpx$.tmp\676fec7c3a91284ba2239e87d789113c.tmp to <Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
from <Current directory>\$dpx$.tmp\3c13755268b11a4cbcee6ffa0b79e429.tmp to <Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\74d6fd02ef30bd4785fb7b0dd246fabc.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
from <Current directory>\$dpx$.tmp\447069195b84a94ca812327dfee6116d.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
from <Current directory>\$dpx$.tmp\5440b7f2ae69ae409b76fde44cdce249.tmp to <Current directory>\api-ms-win-core-profile-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f7f5440bbbfd9043bde131b6814afab3.tmp to <Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e107be4c4d458b47aae40460541f0677.tmp to <Current directory>\api-ms-win-core-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\8e68c102ed48ab4b9305549d09445261.tmp to <Current directory>\api-ms-win-core-localization-l1-2-0.dll
from <Current directory>\$dpx$.tmp\21c2080e4703b04f8d19df8d4dea2700.tmp to <Current directory>\ucrtbase.dll
from <Current directory>\$dpx$.tmp\56bc8ab229fc094a82e2657e807f7d19.tmp to <Current directory>\vcruntime140.dll

Network activity

Connects to

'lp##.haqo.net':443

TCP

'lp##.abbny.com':443

UDP

DNS ASK lp##.beahh.com
DNS ASK lp##.abbny.com
DNS ASK lp##.haqo.net

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a
'<SYSTEM32>\expand.exe' d.cab -f:* .

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней