Trojan.DownLoader33.7473

Technical Information

Modifies file system

Creates the following files

<Current directory>\d.cab
<Current directory>\$dpx$.tmp\3d9628c7f5f8074bb048c434315ae146.tmp
<Current directory>\$dpx$.tmp\3afef547b7e24e45b256557d208d2522.tmp
<Current directory>\$dpx$.tmp\c29e0b1cec53e04da83d37813271e64f.tmp
<Current directory>\$dpx$.tmp\d473a30556ae324f8f4d47dc492a340a.tmp
<Current directory>\$dpx$.tmp\d3fcd9003a82ff46aaa9c099c74da17d.tmp
<Current directory>\$dpx$.tmp\0ef0effb8016374fa0b63c4ea7d68246.tmp
<Current directory>\$dpx$.tmp\617e2c7c479be045b6e651597f7e26de.tmp
<Current directory>\$dpx$.tmp\35fe6983e1883640a84aa0714ea100f1.tmp
<Current directory>\$dpx$.tmp\be3cd4fc2c252b42bd37eeabe66db6c2.tmp
<Current directory>\$dpx$.tmp\426bf72bb9823c41999cadb1d9f7b1ed.tmp
<Current directory>\$dpx$.tmp\1d86ec269cdb7641983e5a603ef08a2d.tmp
<Current directory>\$dpx$.tmp\41ee92eaa59506458ae7e282dda94a90.tmp
<Current directory>\$dpx$.tmp\15c3fbe6f6fc4b4bae6804ec698d902b.tmp
<Current directory>\$dpx$.tmp\db154ddd12d5674cb1048899cf300bc6.tmp
<Current directory>\$dpx$.tmp\734e03e2d75a0744bffb6ea0d15c8e45.tmp
<Current directory>\$dpx$.tmp\6b6c1db64ede864183b2d57d8681e63e.tmp
<Current directory>\$dpx$.tmp\dffdc67296c86f43840ef2c229b0cbf6.tmp
<Current directory>\$dpx$.tmp\a6073874ec20e24cb0b9d477ef241001.tmp
<Current directory>\$dpx$.tmp\42c53e25c291a1418b7b32f0612783bf.tmp
<Current directory>\$dpx$.tmp\b8b88e1750bf474ebebb31f4aa0583d8.tmp
<Current directory>\$dpx$.tmp\22ffbd555ab9a74dbeb65ac97d1e961a.tmp
<Current directory>\$dpx$.tmp\870858d7a8a3a24198a4a92367e23cfd.tmp
<Current directory>\$dpx$.tmp\24b36c0b18e7b040af930290e6e98dc5.tmp
<Current directory>\$dpx$.tmp\f47934522d291247ab646b22c5eadcb5.tmp
<Current directory>\$dpx$.tmp\8d1bd4b91577fa4589ee7ab4528b6e79.tmp
<Current directory>\$dpx$.tmp\6d1eb5732ecd324c9aea6d4e95ab9d3a.tmp
<Current directory>\$dpx$.tmp\41dd9d8eb7b02448baaaaa41c688616b.tmp
<Current directory>\$dpx$.tmp\6aa7baeb6bdd644781546bcf9505d31d.tmp
<Current directory>\$dpx$.tmp\e7768cc60451a44da38609b3a631ee6f.tmp
<Current directory>\$dpx$.tmp\e6ffa19ecc925346a84e23008fa14c70.tmp
<Current directory>\$dpx$.tmp\a7d5bc2b47ad5943930df1686153ea40.tmp
<Current directory>\$dpx$.tmp\04193699a12b104b974ecc2699d39d0f.tmp
<Current directory>\$dpx$.tmp\fd5f8a2fc5036b468a6f16f8681575d5.tmp
<Current directory>\$dpx$.tmp\03da7a2481eaf942a903581cb3e8e2e0.tmp
<Current directory>\$dpx$.tmp\155f4ed80b609f4fa52aac64aa7eca91.tmp
<Current directory>\$dpx$.tmp\09de65846912dc4cafffc248f032ff70.tmp
<Current directory>\$dpx$.tmp\6d2ade32a65c9c4caa3c0ed3470367d6.tmp
<Current directory>\$dpx$.tmp\80284fe9b9a6ab43a17d102ea0b143a1.tmp
<Current directory>\$dpx$.tmp\6e85388771fb644bb669ade3e60fe90f.tmp
<Current directory>\$dpx$.tmp\6e9e3a8331524449b722c519f4d0a60b.tmp
<Current directory>\$dpx$.tmp\d80fc5017020ea4f9125a3dd3f5a7183.tmp
<Current directory>\$dpx$.tmp\24b9edba503db749962fb9760a868dd5.tmp
<Current directory>\$dpx$.tmp\841de7288ff675489228f7e5149aecfc.tmp
<Current directory>\$dpx$.tmp\1ab05507a22660449fbd904358838736.tmp

Sets the 'hidden' attribute to the following files

<Current directory>\api-ms-win-core-console-l1-1-0.dll
<Current directory>\api-ms-win-crt-conio-l1-1-0.dll
<Current directory>\api-ms-win-crt-convert-l1-1-0.dll
<Current directory>\api-ms-win-crt-environment-l1-1-0.dll
<Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
<Current directory>\api-ms-win-crt-heap-l1-1-0.dll
<Current directory>\api-ms-win-crt-locale-l1-1-0.dll
<Current directory>\api-ms-win-crt-math-l1-1-0.dll
<Current directory>\api-ms-win-core-timezone-l1-1-0.dll
<Current directory>\api-ms-win-core-util-l1-1-0.dll
<Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
<Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
<Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
<Current directory>\api-ms-win-crt-string-l1-1-0.dll
<Current directory>\api-ms-win-crt-time-l1-1-0.dll
<Current directory>\api-ms-win-crt-utility-l1-1-0.dll
<Current directory>\msvcp140.dll
<Current directory>\opencl.dll
<Current directory>\api-ms-win-crt-private-l1-1-0.dll
<Current directory>\api-ms-win-crt-process-l1-1-0.dll
<Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
<Current directory>\api-ms-win-core-synch-l1-2-0.dll
<Current directory>\api-ms-win-core-synch-l1-1-0.dll
<Current directory>\api-ms-win-core-debug-l1-1-0.dll
<Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-2-0.dll
<Current directory>\api-ms-win-core-file-l2-1-0.dll
<Current directory>\api-ms-win-core-handle-l1-1-0.dll
<Current directory>\api-ms-win-core-heap-l1-1-0.dll
<Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
<Current directory>\api-ms-win-core-datetime-l1-1-0.dll
<Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
<Current directory>\api-ms-win-core-memory-l1-1-0.dll
<Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
<Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
<Current directory>\api-ms-win-core-profile-l1-1-0.dll
<Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
<Current directory>\api-ms-win-core-string-l1-1-0.dll
<Current directory>\api-ms-win-core-localization-l1-2-0.dll
<Current directory>\ucrtbase.dll
<Current directory>\vcruntime140.dll

Deletes the following files

<Current directory>\d.cab

Moves the following files

from <Current directory>\$dpx$.tmp\f47934522d291247ab646b22c5eadcb5.tmp to <Current directory>\api-ms-win-core-console-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c29e0b1cec53e04da83d37813271e64f.tmp to <Current directory>\api-ms-win-crt-conio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\d473a30556ae324f8f4d47dc492a340a.tmp to <Current directory>\api-ms-win-crt-convert-l1-1-0.dll
from <Current directory>\$dpx$.tmp\d3fcd9003a82ff46aaa9c099c74da17d.tmp to <Current directory>\api-ms-win-crt-environment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\0ef0effb8016374fa0b63c4ea7d68246.tmp to <Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
from <Current directory>\$dpx$.tmp\617e2c7c479be045b6e651597f7e26de.tmp to <Current directory>\api-ms-win-crt-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\35fe6983e1883640a84aa0714ea100f1.tmp to <Current directory>\api-ms-win-crt-locale-l1-1-0.dll
from <Current directory>\$dpx$.tmp\be3cd4fc2c252b42bd37eeabe66db6c2.tmp to <Current directory>\api-ms-win-crt-math-l1-1-0.dll
from <Current directory>\$dpx$.tmp\3d9628c7f5f8074bb048c434315ae146.tmp to <Current directory>\api-ms-win-core-timezone-l1-1-0.dll
from <Current directory>\$dpx$.tmp\3afef547b7e24e45b256557d208d2522.tmp to <Current directory>\api-ms-win-core-util-l1-1-0.dll
from <Current directory>\$dpx$.tmp\426bf72bb9823c41999cadb1d9f7b1ed.tmp to <Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
from <Current directory>\$dpx$.tmp\15c3fbe6f6fc4b4bae6804ec698d902b.tmp to <Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\db154ddd12d5674cb1048899cf300bc6.tmp to <Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\734e03e2d75a0744bffb6ea0d15c8e45.tmp to <Current directory>\api-ms-win-crt-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6b6c1db64ede864183b2d57d8681e63e.tmp to <Current directory>\api-ms-win-crt-time-l1-1-0.dll
from <Current directory>\$dpx$.tmp\dffdc67296c86f43840ef2c229b0cbf6.tmp to <Current directory>\api-ms-win-crt-utility-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a6073874ec20e24cb0b9d477ef241001.tmp to <Current directory>\msvcp140.dll
from <Current directory>\$dpx$.tmp\42c53e25c291a1418b7b32f0612783bf.tmp to <Current directory>\opencl.dll
from <Current directory>\$dpx$.tmp\1d86ec269cdb7641983e5a603ef08a2d.tmp to <Current directory>\api-ms-win-crt-private-l1-1-0.dll
from <Current directory>\$dpx$.tmp\41ee92eaa59506458ae7e282dda94a90.tmp to <Current directory>\api-ms-win-crt-process-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b8b88e1750bf474ebebb31f4aa0583d8.tmp to <Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
from <Current directory>\$dpx$.tmp\870858d7a8a3a24198a4a92367e23cfd.tmp to <Current directory>\api-ms-win-core-synch-l1-2-0.dll
from <Current directory>\$dpx$.tmp\841de7288ff675489228f7e5149aecfc.tmp to <Current directory>\api-ms-win-core-synch-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6d1eb5732ecd324c9aea6d4e95ab9d3a.tmp to <Current directory>\api-ms-win-core-debug-l1-1-0.dll
from <Current directory>\$dpx$.tmp\41dd9d8eb7b02448baaaaa41c688616b.tmp to <Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6aa7baeb6bdd644781546bcf9505d31d.tmp to <Current directory>\api-ms-win-core-file-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e7768cc60451a44da38609b3a631ee6f.tmp to <Current directory>\api-ms-win-core-file-l1-2-0.dll
from <Current directory>\$dpx$.tmp\e6ffa19ecc925346a84e23008fa14c70.tmp to <Current directory>\api-ms-win-core-file-l2-1-0.dll
from <Current directory>\$dpx$.tmp\a7d5bc2b47ad5943930df1686153ea40.tmp to <Current directory>\api-ms-win-core-handle-l1-1-0.dll
from <Current directory>\$dpx$.tmp\04193699a12b104b974ecc2699d39d0f.tmp to <Current directory>\api-ms-win-core-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\fd5f8a2fc5036b468a6f16f8681575d5.tmp to <Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
from <Current directory>\$dpx$.tmp\8d1bd4b91577fa4589ee7ab4528b6e79.tmp to <Current directory>\api-ms-win-core-datetime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\03da7a2481eaf942a903581cb3e8e2e0.tmp to <Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
from <Current directory>\$dpx$.tmp\09de65846912dc4cafffc248f032ff70.tmp to <Current directory>\api-ms-win-core-memory-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6d2ade32a65c9c4caa3c0ed3470367d6.tmp to <Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
from <Current directory>\$dpx$.tmp\80284fe9b9a6ab43a17d102ea0b143a1.tmp to <Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6e85388771fb644bb669ade3e60fe90f.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6e9e3a8331524449b722c519f4d0a60b.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
from <Current directory>\$dpx$.tmp\d80fc5017020ea4f9125a3dd3f5a7183.tmp to <Current directory>\api-ms-win-core-profile-l1-1-0.dll
from <Current directory>\$dpx$.tmp\24b9edba503db749962fb9760a868dd5.tmp to <Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
from <Current directory>\$dpx$.tmp\24b36c0b18e7b040af930290e6e98dc5.tmp to <Current directory>\api-ms-win-core-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\155f4ed80b609f4fa52aac64aa7eca91.tmp to <Current directory>\api-ms-win-core-localization-l1-2-0.dll
from <Current directory>\$dpx$.tmp\22ffbd555ab9a74dbeb65ac97d1e961a.tmp to <Current directory>\ucrtbase.dll
from <Current directory>\$dpx$.tmp\1ab05507a22660449fbd904358838736.tmp to <Current directory>\vcruntime140.dll

Network activity

TCP

'lp##.abbny.com':443

UDP

DNS ASK lp##.beahh.com
DNS ASK lp##.abbny.com
DNS ASK lp##.haqo.net

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a
'<SYSTEM32>\expand.exe' d.cab -f:* .

Технології

Терміни

Навчання

Міфи

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней