Trojan.DownLoader33.5096

Technical Information

Modifies file system

Creates the following files

<Current directory>\d.cab
<Current directory>\$dpx$.tmp\aba766810167a34abd96e42bae4c6b13.tmp
<Current directory>\$dpx$.tmp\6faacd485505e047abd5f1936e855eaf.tmp
<Current directory>\$dpx$.tmp\9c6377379a7bec4a97314a9bac12a0b7.tmp
<Current directory>\$dpx$.tmp\7a7975970ee2234da0cbd230c6e016c4.tmp
<Current directory>\$dpx$.tmp\c499d27c623ea042a8451d7c695750ac.tmp
<Current directory>\$dpx$.tmp\ccf0e32272c8b0488b495ecda2beff8b.tmp
<Current directory>\$dpx$.tmp\e6142ef4a6dcc349b3086f020fe35cbf.tmp
<Current directory>\$dpx$.tmp\ed46fbc1410f7e41a5ee49df26da8ec3.tmp
<Current directory>\$dpx$.tmp\e746dca9f13b3041969be958cff81c26.tmp
<Current directory>\$dpx$.tmp\c9c75edf64a84b40886b7f64c4e55a85.tmp
<Current directory>\$dpx$.tmp\4795c8d310aa9344a7702b73fd8d2d3c.tmp
<Current directory>\$dpx$.tmp\6f523d5202467e4791eeae6ac71fb68f.tmp
<Current directory>\$dpx$.tmp\173c014b8a1c884086e2b02dd3521f78.tmp
<Current directory>\$dpx$.tmp\e40be992373ccf42ace37b25cd791d0f.tmp
<Current directory>\$dpx$.tmp\bf8b581b4915904cba3849f0da21da85.tmp
<Current directory>\$dpx$.tmp\ae8583561f64c4418fd5234369949741.tmp
<Current directory>\$dpx$.tmp\68d31b2c255fb543a86f1ce313035fc2.tmp
<Current directory>\$dpx$.tmp\b39560bcf0c201479750323c93bffa6e.tmp
<Current directory>\$dpx$.tmp\b041858a9ff5ac49bca42c5339903267.tmp
<Current directory>\$dpx$.tmp\725594e1d949c54b8c46768f1dd11761.tmp
<Current directory>\$dpx$.tmp\7370e2cbd829904daf35409983de3d6f.tmp
<Current directory>\$dpx$.tmp\40b080702273304cbd5cc999aa7f8427.tmp
<Current directory>\$dpx$.tmp\89f0fdce10406344bac1c2b56ccb5292.tmp
<Current directory>\$dpx$.tmp\6b28415b63b7034eb748aa7435cd31bf.tmp
<Current directory>\$dpx$.tmp\0b15aa67cd38b84cb1f211807a2df836.tmp
<Current directory>\$dpx$.tmp\83514399af329544af02c7e54e11ab40.tmp
<Current directory>\$dpx$.tmp\a7ccb3f9a263e243b3174af15916e7c1.tmp
<Current directory>\$dpx$.tmp\7404730ad7c5b142ba25e78ee723d09f.tmp
<Current directory>\$dpx$.tmp\9b97a096cc489a41942f9c6bbd72f787.tmp
<Current directory>\$dpx$.tmp\94c6de9fb6278241a9a09f2cedf66d17.tmp
<Current directory>\$dpx$.tmp\9735833226298849842b3b80bf2d87ff.tmp
<Current directory>\$dpx$.tmp\e5070b0416969546a652a527e1f8f622.tmp
<Current directory>\$dpx$.tmp\61d1c281040df640b2257efce774caea.tmp
<Current directory>\$dpx$.tmp\266979e2fcc3574c8af182034666ca37.tmp
<Current directory>\$dpx$.tmp\0ae6a5d71677824689e78f6c555ce8c6.tmp
<Current directory>\$dpx$.tmp\75792ddf6578324ba2f98eaa1530e1ae.tmp
<Current directory>\$dpx$.tmp\67678bc94f0dbe438cb582a826168008.tmp
<Current directory>\$dpx$.tmp\efa04da33d013c44a92208f6f427fe95.tmp
<Current directory>\$dpx$.tmp\e25487540e351b46a8a3e725dd03d19c.tmp
<Current directory>\$dpx$.tmp\f002b92bb5565644bf2757578f52dc25.tmp
<Current directory>\$dpx$.tmp\41fdb16c4027aa47ba73c61d8318bf09.tmp
<Current directory>\$dpx$.tmp\f8aeed54aa69754f915731e3bb0bbfa9.tmp
<Current directory>\$dpx$.tmp\fd8a5268759c6f4381b13ba437d7af49.tmp
<Current directory>\$dpx$.tmp\7435207a356e8e4eb4be24a73bb32f0b.tmp

Sets the 'hidden' attribute to the following files

<Current directory>\api-ms-win-core-console-l1-1-0.dll
<Current directory>\api-ms-win-crt-conio-l1-1-0.dll
<Current directory>\api-ms-win-crt-convert-l1-1-0.dll
<Current directory>\api-ms-win-crt-environment-l1-1-0.dll
<Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
<Current directory>\api-ms-win-crt-heap-l1-1-0.dll
<Current directory>\api-ms-win-crt-locale-l1-1-0.dll
<Current directory>\api-ms-win-crt-math-l1-1-0.dll
<Current directory>\api-ms-win-core-timezone-l1-1-0.dll
<Current directory>\api-ms-win-core-util-l1-1-0.dll
<Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
<Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
<Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
<Current directory>\api-ms-win-crt-string-l1-1-0.dll
<Current directory>\api-ms-win-crt-time-l1-1-0.dll
<Current directory>\api-ms-win-crt-utility-l1-1-0.dll
<Current directory>\msvcp140.dll
<Current directory>\opencl.dll
<Current directory>\api-ms-win-crt-private-l1-1-0.dll
<Current directory>\api-ms-win-crt-process-l1-1-0.dll
<Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
<Current directory>\api-ms-win-core-synch-l1-2-0.dll
<Current directory>\api-ms-win-core-synch-l1-1-0.dll
<Current directory>\api-ms-win-core-debug-l1-1-0.dll
<Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-2-0.dll
<Current directory>\api-ms-win-core-file-l2-1-0.dll
<Current directory>\api-ms-win-core-handle-l1-1-0.dll
<Current directory>\api-ms-win-core-heap-l1-1-0.dll
<Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
<Current directory>\api-ms-win-core-datetime-l1-1-0.dll
<Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
<Current directory>\api-ms-win-core-memory-l1-1-0.dll
<Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
<Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
<Current directory>\api-ms-win-core-profile-l1-1-0.dll
<Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
<Current directory>\api-ms-win-core-string-l1-1-0.dll
<Current directory>\api-ms-win-core-localization-l1-2-0.dll
<Current directory>\ucrtbase.dll
<Current directory>\vcruntime140.dll

Deletes the following files

<Current directory>\d.cab

Moves the following files

from <Current directory>\$dpx$.tmp\6b28415b63b7034eb748aa7435cd31bf.tmp to <Current directory>\api-ms-win-core-console-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9c6377379a7bec4a97314a9bac12a0b7.tmp to <Current directory>\api-ms-win-crt-conio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7a7975970ee2234da0cbd230c6e016c4.tmp to <Current directory>\api-ms-win-crt-convert-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c499d27c623ea042a8451d7c695750ac.tmp to <Current directory>\api-ms-win-crt-environment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ccf0e32272c8b0488b495ecda2beff8b.tmp to <Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e6142ef4a6dcc349b3086f020fe35cbf.tmp to <Current directory>\api-ms-win-crt-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ed46fbc1410f7e41a5ee49df26da8ec3.tmp to <Current directory>\api-ms-win-crt-locale-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e746dca9f13b3041969be958cff81c26.tmp to <Current directory>\api-ms-win-crt-math-l1-1-0.dll
from <Current directory>\$dpx$.tmp\aba766810167a34abd96e42bae4c6b13.tmp to <Current directory>\api-ms-win-core-timezone-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6faacd485505e047abd5f1936e855eaf.tmp to <Current directory>\api-ms-win-core-util-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c9c75edf64a84b40886b7f64c4e55a85.tmp to <Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
from <Current directory>\$dpx$.tmp\173c014b8a1c884086e2b02dd3521f78.tmp to <Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e40be992373ccf42ace37b25cd791d0f.tmp to <Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\bf8b581b4915904cba3849f0da21da85.tmp to <Current directory>\api-ms-win-crt-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ae8583561f64c4418fd5234369949741.tmp to <Current directory>\api-ms-win-crt-time-l1-1-0.dll
from <Current directory>\$dpx$.tmp\68d31b2c255fb543a86f1ce313035fc2.tmp to <Current directory>\api-ms-win-crt-utility-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b39560bcf0c201479750323c93bffa6e.tmp to <Current directory>\msvcp140.dll
from <Current directory>\$dpx$.tmp\b041858a9ff5ac49bca42c5339903267.tmp to <Current directory>\opencl.dll
from <Current directory>\$dpx$.tmp\4795c8d310aa9344a7702b73fd8d2d3c.tmp to <Current directory>\api-ms-win-crt-private-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6f523d5202467e4791eeae6ac71fb68f.tmp to <Current directory>\api-ms-win-crt-process-l1-1-0.dll
from <Current directory>\$dpx$.tmp\725594e1d949c54b8c46768f1dd11761.tmp to <Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
from <Current directory>\$dpx$.tmp\40b080702273304cbd5cc999aa7f8427.tmp to <Current directory>\api-ms-win-core-synch-l1-2-0.dll
from <Current directory>\$dpx$.tmp\fd8a5268759c6f4381b13ba437d7af49.tmp to <Current directory>\api-ms-win-core-synch-l1-1-0.dll
from <Current directory>\$dpx$.tmp\83514399af329544af02c7e54e11ab40.tmp to <Current directory>\api-ms-win-core-debug-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a7ccb3f9a263e243b3174af15916e7c1.tmp to <Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7404730ad7c5b142ba25e78ee723d09f.tmp to <Current directory>\api-ms-win-core-file-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9b97a096cc489a41942f9c6bbd72f787.tmp to <Current directory>\api-ms-win-core-file-l1-2-0.dll
from <Current directory>\$dpx$.tmp\94c6de9fb6278241a9a09f2cedf66d17.tmp to <Current directory>\api-ms-win-core-file-l2-1-0.dll
from <Current directory>\$dpx$.tmp\9735833226298849842b3b80bf2d87ff.tmp to <Current directory>\api-ms-win-core-handle-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e5070b0416969546a652a527e1f8f622.tmp to <Current directory>\api-ms-win-core-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\61d1c281040df640b2257efce774caea.tmp to <Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
from <Current directory>\$dpx$.tmp\0b15aa67cd38b84cb1f211807a2df836.tmp to <Current directory>\api-ms-win-core-datetime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\266979e2fcc3574c8af182034666ca37.tmp to <Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
from <Current directory>\$dpx$.tmp\75792ddf6578324ba2f98eaa1530e1ae.tmp to <Current directory>\api-ms-win-core-memory-l1-1-0.dll
from <Current directory>\$dpx$.tmp\67678bc94f0dbe438cb582a826168008.tmp to <Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
from <Current directory>\$dpx$.tmp\efa04da33d013c44a92208f6f427fe95.tmp to <Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e25487540e351b46a8a3e725dd03d19c.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f002b92bb5565644bf2757578f52dc25.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
from <Current directory>\$dpx$.tmp\41fdb16c4027aa47ba73c61d8318bf09.tmp to <Current directory>\api-ms-win-core-profile-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f8aeed54aa69754f915731e3bb0bbfa9.tmp to <Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
from <Current directory>\$dpx$.tmp\89f0fdce10406344bac1c2b56ccb5292.tmp to <Current directory>\api-ms-win-core-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\0ae6a5d71677824689e78f6c555ce8c6.tmp to <Current directory>\api-ms-win-core-localization-l1-2-0.dll
from <Current directory>\$dpx$.tmp\7370e2cbd829904daf35409983de3d6f.tmp to <Current directory>\ucrtbase.dll
from <Current directory>\$dpx$.tmp\7435207a356e8e4eb4be24a73bb32f0b.tmp to <Current directory>\vcruntime140.dll

Network activity

Connects to

'lp##.haqo.net':443

TCP

'lp##.abbny.com':443

UDP

DNS ASK lp##.beahh.com
DNS ASK lp##.abbny.com
DNS ASK lp##.haqo.net

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a
'<SYSTEM32>\expand.exe' d.cab -f:* .

Технології

Терміни

Навчання

Міфи

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней