Trojan.DownLoader33.5794

Technical Information

Modifies file system

Creates the following files

<Current directory>\d.cab
<Current directory>\$dpx$.tmp\756a200f8567e04f8b5f1ddafd288ab8.tmp
<Current directory>\$dpx$.tmp\b14d7cc6bb3b94438b3a83b255316959.tmp
<Current directory>\$dpx$.tmp\02de0e3b6eb8b946b960328299cce8c2.tmp
<Current directory>\$dpx$.tmp\6f7b2763723df34b97da8df6641d89a9.tmp
<Current directory>\$dpx$.tmp\7cb829bd70b3f14a9fc562ae5d1dccd5.tmp
<Current directory>\$dpx$.tmp\3bea312141be824ca9015775411b9b1d.tmp
<Current directory>\$dpx$.tmp\336e6dd9a04293439914e4feeb443c4c.tmp
<Current directory>\$dpx$.tmp\c76b46050b8a5a46b4e8218425cf9128.tmp
<Current directory>\$dpx$.tmp\96971da658028d4ea746c9f2d8487643.tmp
<Current directory>\$dpx$.tmp\1ebc8313bcf39943958cae3053d7d6aa.tmp
<Current directory>\$dpx$.tmp\d76cae7356e8b74fa4967030ba988ca1.tmp
<Current directory>\$dpx$.tmp\fd6df9fce563f1408f85b4393bfc1589.tmp
<Current directory>\$dpx$.tmp\fb898bfba02fa74b96ab8482d1e8941c.tmp
<Current directory>\$dpx$.tmp\af64d1d329a72a4aac2eb096ce49047b.tmp
<Current directory>\$dpx$.tmp\df2e42590552014b9f2cb1ef2238681e.tmp
<Current directory>\$dpx$.tmp\991dd2eee003364e887ca64dae6923a5.tmp
<Current directory>\$dpx$.tmp\32a0bdd35e3d0b4386c4ea1f2f4a4946.tmp
<Current directory>\$dpx$.tmp\2a0fb217ffdb9944aa192e73dfe0cb6b.tmp
<Current directory>\$dpx$.tmp\6c2518d03b8fad458080b3af3ddc6e4b.tmp
<Current directory>\$dpx$.tmp\1654f402c62fba469fb494766757d787.tmp
<Current directory>\$dpx$.tmp\3867d35acfff2e4588c99d7763c9e793.tmp
<Current directory>\$dpx$.tmp\0863f3175a869b4b9848b7c9bbfbbf82.tmp
<Current directory>\$dpx$.tmp\c60a2781a53fcf4db045d35c6916a175.tmp
<Current directory>\$dpx$.tmp\26c0dd63bf22f2459418e26ae6969bda.tmp
<Current directory>\$dpx$.tmp\3204787ccc9a2c4b8d71bedbe7fa756d.tmp
<Current directory>\$dpx$.tmp\49448dd0c91d0242bd32c0517fbaad29.tmp
<Current directory>\$dpx$.tmp\32712647aacc694f8f681f0ad246b77e.tmp
<Current directory>\$dpx$.tmp\5f4c1a4aadb8d6498b51a54e427730d8.tmp
<Current directory>\$dpx$.tmp\1a53b7d052650b4e85282ad98dfab110.tmp
<Current directory>\$dpx$.tmp\4b7b920ac352f84d86011bc9f244eee4.tmp
<Current directory>\$dpx$.tmp\d173a06a59b6fc4c84633c8a584f49db.tmp
<Current directory>\$dpx$.tmp\420f801264ceaa4fb27c6fed4fa12804.tmp
<Current directory>\$dpx$.tmp\a33e2261978e4c45861e9aa5f48201ce.tmp
<Current directory>\$dpx$.tmp\2568271d0a25f14bbd83d39082d2d0ae.tmp
<Current directory>\$dpx$.tmp\ab27ca036764bb4da072461e327f46cb.tmp
<Current directory>\$dpx$.tmp\3a3d8037490ac24995c03b1bfb1d9357.tmp
<Current directory>\$dpx$.tmp\aa960e740c0d6a4790f4e6cb6b60243c.tmp
<Current directory>\$dpx$.tmp\e6a94d8c9cf5054690631a2cca5d6ae6.tmp
<Current directory>\$dpx$.tmp\1ce684a85ee3d94e9eb9da4e8e746b4a.tmp
<Current directory>\$dpx$.tmp\f8f117dbe84b914396db19009f995f72.tmp
<Current directory>\$dpx$.tmp\acf3e6f264ad2545ae527a08350b4535.tmp
<Current directory>\$dpx$.tmp\3b1bee5fcbe10044abd0dc0249f0046f.tmp
<Current directory>\$dpx$.tmp\e38f958085010e4a9af847e06b325120.tmp
<Current directory>\$dpx$.tmp\fa79f8f606ba1c49a7cef09d260ab199.tmp

Sets the 'hidden' attribute to the following files

<Current directory>\api-ms-win-core-console-l1-1-0.dll
<Current directory>\api-ms-win-crt-conio-l1-1-0.dll
<Current directory>\api-ms-win-crt-convert-l1-1-0.dll
<Current directory>\api-ms-win-crt-environment-l1-1-0.dll
<Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
<Current directory>\api-ms-win-crt-heap-l1-1-0.dll
<Current directory>\api-ms-win-crt-locale-l1-1-0.dll
<Current directory>\api-ms-win-crt-math-l1-1-0.dll
<Current directory>\api-ms-win-core-timezone-l1-1-0.dll
<Current directory>\api-ms-win-core-util-l1-1-0.dll
<Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
<Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
<Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
<Current directory>\api-ms-win-crt-string-l1-1-0.dll
<Current directory>\api-ms-win-crt-time-l1-1-0.dll
<Current directory>\api-ms-win-crt-utility-l1-1-0.dll
<Current directory>\msvcp140.dll
<Current directory>\opencl.dll
<Current directory>\api-ms-win-crt-private-l1-1-0.dll
<Current directory>\api-ms-win-crt-process-l1-1-0.dll
<Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
<Current directory>\api-ms-win-core-synch-l1-2-0.dll
<Current directory>\api-ms-win-core-synch-l1-1-0.dll
<Current directory>\api-ms-win-core-debug-l1-1-0.dll
<Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-2-0.dll
<Current directory>\api-ms-win-core-file-l2-1-0.dll
<Current directory>\api-ms-win-core-handle-l1-1-0.dll
<Current directory>\api-ms-win-core-heap-l1-1-0.dll
<Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
<Current directory>\api-ms-win-core-datetime-l1-1-0.dll
<Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
<Current directory>\api-ms-win-core-memory-l1-1-0.dll
<Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
<Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
<Current directory>\api-ms-win-core-profile-l1-1-0.dll
<Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
<Current directory>\api-ms-win-core-string-l1-1-0.dll
<Current directory>\api-ms-win-core-localization-l1-2-0.dll
<Current directory>\ucrtbase.dll
<Current directory>\vcruntime140.dll

Deletes the following files

<Current directory>\d.cab

Moves the following files

from <Current directory>\$dpx$.tmp\26c0dd63bf22f2459418e26ae6969bda.tmp to <Current directory>\api-ms-win-core-console-l1-1-0.dll
from <Current directory>\$dpx$.tmp\02de0e3b6eb8b946b960328299cce8c2.tmp to <Current directory>\api-ms-win-crt-conio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6f7b2763723df34b97da8df6641d89a9.tmp to <Current directory>\api-ms-win-crt-convert-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7cb829bd70b3f14a9fc562ae5d1dccd5.tmp to <Current directory>\api-ms-win-crt-environment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\3bea312141be824ca9015775411b9b1d.tmp to <Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
from <Current directory>\$dpx$.tmp\336e6dd9a04293439914e4feeb443c4c.tmp to <Current directory>\api-ms-win-crt-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c76b46050b8a5a46b4e8218425cf9128.tmp to <Current directory>\api-ms-win-crt-locale-l1-1-0.dll
from <Current directory>\$dpx$.tmp\96971da658028d4ea746c9f2d8487643.tmp to <Current directory>\api-ms-win-crt-math-l1-1-0.dll
from <Current directory>\$dpx$.tmp\756a200f8567e04f8b5f1ddafd288ab8.tmp to <Current directory>\api-ms-win-core-timezone-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b14d7cc6bb3b94438b3a83b255316959.tmp to <Current directory>\api-ms-win-core-util-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1ebc8313bcf39943958cae3053d7d6aa.tmp to <Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
from <Current directory>\$dpx$.tmp\fb898bfba02fa74b96ab8482d1e8941c.tmp to <Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\af64d1d329a72a4aac2eb096ce49047b.tmp to <Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\df2e42590552014b9f2cb1ef2238681e.tmp to <Current directory>\api-ms-win-crt-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\991dd2eee003364e887ca64dae6923a5.tmp to <Current directory>\api-ms-win-crt-time-l1-1-0.dll
from <Current directory>\$dpx$.tmp\32a0bdd35e3d0b4386c4ea1f2f4a4946.tmp to <Current directory>\api-ms-win-crt-utility-l1-1-0.dll
from <Current directory>\$dpx$.tmp\2a0fb217ffdb9944aa192e73dfe0cb6b.tmp to <Current directory>\msvcp140.dll
from <Current directory>\$dpx$.tmp\6c2518d03b8fad458080b3af3ddc6e4b.tmp to <Current directory>\opencl.dll
from <Current directory>\$dpx$.tmp\d76cae7356e8b74fa4967030ba988ca1.tmp to <Current directory>\api-ms-win-crt-private-l1-1-0.dll
from <Current directory>\$dpx$.tmp\fd6df9fce563f1408f85b4393bfc1589.tmp to <Current directory>\api-ms-win-crt-process-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1654f402c62fba469fb494766757d787.tmp to <Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
from <Current directory>\$dpx$.tmp\0863f3175a869b4b9848b7c9bbfbbf82.tmp to <Current directory>\api-ms-win-core-synch-l1-2-0.dll
from <Current directory>\$dpx$.tmp\e38f958085010e4a9af847e06b325120.tmp to <Current directory>\api-ms-win-core-synch-l1-1-0.dll
from <Current directory>\$dpx$.tmp\49448dd0c91d0242bd32c0517fbaad29.tmp to <Current directory>\api-ms-win-core-debug-l1-1-0.dll
from <Current directory>\$dpx$.tmp\32712647aacc694f8f681f0ad246b77e.tmp to <Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5f4c1a4aadb8d6498b51a54e427730d8.tmp to <Current directory>\api-ms-win-core-file-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1a53b7d052650b4e85282ad98dfab110.tmp to <Current directory>\api-ms-win-core-file-l1-2-0.dll
from <Current directory>\$dpx$.tmp\4b7b920ac352f84d86011bc9f244eee4.tmp to <Current directory>\api-ms-win-core-file-l2-1-0.dll
from <Current directory>\$dpx$.tmp\d173a06a59b6fc4c84633c8a584f49db.tmp to <Current directory>\api-ms-win-core-handle-l1-1-0.dll
from <Current directory>\$dpx$.tmp\420f801264ceaa4fb27c6fed4fa12804.tmp to <Current directory>\api-ms-win-core-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a33e2261978e4c45861e9aa5f48201ce.tmp to <Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
from <Current directory>\$dpx$.tmp\3204787ccc9a2c4b8d71bedbe7fa756d.tmp to <Current directory>\api-ms-win-core-datetime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\2568271d0a25f14bbd83d39082d2d0ae.tmp to <Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
from <Current directory>\$dpx$.tmp\3a3d8037490ac24995c03b1bfb1d9357.tmp to <Current directory>\api-ms-win-core-memory-l1-1-0.dll
from <Current directory>\$dpx$.tmp\aa960e740c0d6a4790f4e6cb6b60243c.tmp to <Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e6a94d8c9cf5054690631a2cca5d6ae6.tmp to <Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1ce684a85ee3d94e9eb9da4e8e746b4a.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f8f117dbe84b914396db19009f995f72.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
from <Current directory>\$dpx$.tmp\acf3e6f264ad2545ae527a08350b4535.tmp to <Current directory>\api-ms-win-core-profile-l1-1-0.dll
from <Current directory>\$dpx$.tmp\3b1bee5fcbe10044abd0dc0249f0046f.tmp to <Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c60a2781a53fcf4db045d35c6916a175.tmp to <Current directory>\api-ms-win-core-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ab27ca036764bb4da072461e327f46cb.tmp to <Current directory>\api-ms-win-core-localization-l1-2-0.dll
from <Current directory>\$dpx$.tmp\3867d35acfff2e4588c99d7763c9e793.tmp to <Current directory>\ucrtbase.dll
from <Current directory>\$dpx$.tmp\fa79f8f606ba1c49a7cef09d260ab199.tmp to <Current directory>\vcruntime140.dll

Network activity

TCP

'lp##.abbny.com':443

UDP

DNS ASK lp##.beahh.com
DNS ASK lp##.abbny.com
DNS ASK lp##.haqo.net

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a
'<SYSTEM32>\expand.exe' d.cab -f:* .

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней