Trojan.DownLoader33.8147

Technical Information

Modifies file system

Creates the following files

<Current directory>\d.cab
<Current directory>\$dpx$.tmp\432374cc30222943b221ba7fc672429d.tmp
<Current directory>\$dpx$.tmp\00aa56a9cf03d04ca45935dec47f518a.tmp
<Current directory>\$dpx$.tmp\9927f6bdb80e3e47b29dc5aa76fd5963.tmp
<Current directory>\$dpx$.tmp\11c649977b324840a1548fc92de8f784.tmp
<Current directory>\$dpx$.tmp\3fd0ecc4eb12c14f9614dbafb6b2a983.tmp
<Current directory>\$dpx$.tmp\46c70627e55b374bbe0e86b12be1db0d.tmp
<Current directory>\$dpx$.tmp\ba33e908d85edd48ae94a40ba3a32471.tmp
<Current directory>\$dpx$.tmp\e1f3ad5151a1954e8285df305442e1ef.tmp
<Current directory>\$dpx$.tmp\2aba46f15449b74c8d5ec212c01a9837.tmp
<Current directory>\$dpx$.tmp\2c7bc027a130a8439663d7fe95f5cc94.tmp
<Current directory>\$dpx$.tmp\45adccbe2f48b64a8769311edbdb7d2c.tmp
<Current directory>\$dpx$.tmp\b51d12cb1fc0a747ad6f54cb509704dd.tmp
<Current directory>\$dpx$.tmp\ceb3bd8997975c42903778f2e39020b1.tmp
<Current directory>\$dpx$.tmp\04b2d90d604694429678896d544eddb8.tmp
<Current directory>\$dpx$.tmp\924f9dc096d92e42ad47d6bfab44efa3.tmp
<Current directory>\$dpx$.tmp\03a439e24f6cf543a88fac08b1d23234.tmp
<Current directory>\$dpx$.tmp\7dbfac66551f8943933ca7064e1f9d87.tmp
<Current directory>\$dpx$.tmp\fc7e471ff769714aad65715296df3e17.tmp
<Current directory>\$dpx$.tmp\489f39a2fe84fd4bb5d02764e1605b07.tmp
<Current directory>\$dpx$.tmp\42a8b36e511bea41860039192a085922.tmp
<Current directory>\$dpx$.tmp\6fa65509a6799444a6af05624d4ee193.tmp
<Current directory>\$dpx$.tmp\f636ff6db564814a9d613bbcf2e9c2a7.tmp
<Current directory>\$dpx$.tmp\3eecede749223c4999c0b8c34ed28fee.tmp
<Current directory>\$dpx$.tmp\7ade299911581544adea739588e6e3fd.tmp
<Current directory>\$dpx$.tmp\6afd0edbf735194497541c3c5bce26c8.tmp
<Current directory>\$dpx$.tmp\8006e876d67c8349a78d845de0e87b73.tmp
<Current directory>\$dpx$.tmp\92f33871c0212f40912d5b98005abe29.tmp
<Current directory>\$dpx$.tmp\2d4f5154cf6555469435737f40fef85c.tmp
<Current directory>\$dpx$.tmp\fe67b16cb0f26e46b9f9bcbadd0b80e5.tmp
<Current directory>\$dpx$.tmp\45853957add51e44a9230304c131bc95.tmp
<Current directory>\$dpx$.tmp\5231b8000dffee4496a42ac5ff5e8c1a.tmp
<Current directory>\$dpx$.tmp\7dfdd834eeea4c44ac07bb8d94a95211.tmp
<Current directory>\$dpx$.tmp\284ce45769ef0048b96bfcf7fe040f42.tmp
<Current directory>\$dpx$.tmp\1a1403d4c093194f8106dad81e4cacf3.tmp
<Current directory>\$dpx$.tmp\443b6c388753d942a6cbca24b6a0e093.tmp
<Current directory>\$dpx$.tmp\416269053972634b9d140df3f7824a22.tmp
<Current directory>\$dpx$.tmp\0355f2a7a46af74d86ec1a4ae923304a.tmp
<Current directory>\$dpx$.tmp\aa7e4aeef734de4a920d49ddf0074f8a.tmp
<Current directory>\$dpx$.tmp\9f2c83a43e4a2748b2cc631b77df57e8.tmp
<Current directory>\$dpx$.tmp\097c51f2700af343b497b3f27a91dc10.tmp
<Current directory>\$dpx$.tmp\07cc607d2d9428498c615aa399c09dac.tmp
<Current directory>\$dpx$.tmp\8b1f3d44df91fb4dadaea28440615b33.tmp
<Current directory>\$dpx$.tmp\b77c8974e1285e41806d329342036077.tmp
<Current directory>\$dpx$.tmp\bf7bfa59dbbce945867f875923134ba4.tmp

Sets the 'hidden' attribute to the following files

<Current directory>\api-ms-win-core-console-l1-1-0.dll
<Current directory>\api-ms-win-crt-conio-l1-1-0.dll
<Current directory>\api-ms-win-crt-convert-l1-1-0.dll
<Current directory>\api-ms-win-crt-environment-l1-1-0.dll
<Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
<Current directory>\api-ms-win-crt-heap-l1-1-0.dll
<Current directory>\api-ms-win-crt-locale-l1-1-0.dll
<Current directory>\api-ms-win-crt-math-l1-1-0.dll
<Current directory>\api-ms-win-core-timezone-l1-1-0.dll
<Current directory>\api-ms-win-core-util-l1-1-0.dll
<Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
<Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
<Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
<Current directory>\api-ms-win-crt-string-l1-1-0.dll
<Current directory>\api-ms-win-crt-time-l1-1-0.dll
<Current directory>\api-ms-win-crt-utility-l1-1-0.dll
<Current directory>\msvcp140.dll
<Current directory>\opencl.dll
<Current directory>\api-ms-win-crt-private-l1-1-0.dll
<Current directory>\api-ms-win-crt-process-l1-1-0.dll
<Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
<Current directory>\api-ms-win-core-synch-l1-2-0.dll
<Current directory>\api-ms-win-core-synch-l1-1-0.dll
<Current directory>\api-ms-win-core-debug-l1-1-0.dll
<Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-2-0.dll
<Current directory>\api-ms-win-core-file-l2-1-0.dll
<Current directory>\api-ms-win-core-handle-l1-1-0.dll
<Current directory>\api-ms-win-core-heap-l1-1-0.dll
<Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
<Current directory>\api-ms-win-core-datetime-l1-1-0.dll
<Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
<Current directory>\api-ms-win-core-memory-l1-1-0.dll
<Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
<Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
<Current directory>\api-ms-win-core-profile-l1-1-0.dll
<Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
<Current directory>\api-ms-win-core-string-l1-1-0.dll
<Current directory>\api-ms-win-core-localization-l1-2-0.dll
<Current directory>\ucrtbase.dll
<Current directory>\vcruntime140.dll

Deletes the following files

<Current directory>\d.cab

Moves the following files

from <Current directory>\$dpx$.tmp\7ade299911581544adea739588e6e3fd.tmp to <Current directory>\api-ms-win-core-console-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9927f6bdb80e3e47b29dc5aa76fd5963.tmp to <Current directory>\api-ms-win-crt-conio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\11c649977b324840a1548fc92de8f784.tmp to <Current directory>\api-ms-win-crt-convert-l1-1-0.dll
from <Current directory>\$dpx$.tmp\3fd0ecc4eb12c14f9614dbafb6b2a983.tmp to <Current directory>\api-ms-win-crt-environment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\46c70627e55b374bbe0e86b12be1db0d.tmp to <Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ba33e908d85edd48ae94a40ba3a32471.tmp to <Current directory>\api-ms-win-crt-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e1f3ad5151a1954e8285df305442e1ef.tmp to <Current directory>\api-ms-win-crt-locale-l1-1-0.dll
from <Current directory>\$dpx$.tmp\2aba46f15449b74c8d5ec212c01a9837.tmp to <Current directory>\api-ms-win-crt-math-l1-1-0.dll
from <Current directory>\$dpx$.tmp\432374cc30222943b221ba7fc672429d.tmp to <Current directory>\api-ms-win-core-timezone-l1-1-0.dll
from <Current directory>\$dpx$.tmp\00aa56a9cf03d04ca45935dec47f518a.tmp to <Current directory>\api-ms-win-core-util-l1-1-0.dll
from <Current directory>\$dpx$.tmp\2c7bc027a130a8439663d7fe95f5cc94.tmp to <Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ceb3bd8997975c42903778f2e39020b1.tmp to <Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\04b2d90d604694429678896d544eddb8.tmp to <Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\924f9dc096d92e42ad47d6bfab44efa3.tmp to <Current directory>\api-ms-win-crt-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\03a439e24f6cf543a88fac08b1d23234.tmp to <Current directory>\api-ms-win-crt-time-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7dbfac66551f8943933ca7064e1f9d87.tmp to <Current directory>\api-ms-win-crt-utility-l1-1-0.dll
from <Current directory>\$dpx$.tmp\fc7e471ff769714aad65715296df3e17.tmp to <Current directory>\msvcp140.dll
from <Current directory>\$dpx$.tmp\489f39a2fe84fd4bb5d02764e1605b07.tmp to <Current directory>\opencl.dll
from <Current directory>\$dpx$.tmp\45adccbe2f48b64a8769311edbdb7d2c.tmp to <Current directory>\api-ms-win-crt-private-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b51d12cb1fc0a747ad6f54cb509704dd.tmp to <Current directory>\api-ms-win-crt-process-l1-1-0.dll
from <Current directory>\$dpx$.tmp\42a8b36e511bea41860039192a085922.tmp to <Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f636ff6db564814a9d613bbcf2e9c2a7.tmp to <Current directory>\api-ms-win-core-synch-l1-2-0.dll
from <Current directory>\$dpx$.tmp\b77c8974e1285e41806d329342036077.tmp to <Current directory>\api-ms-win-core-synch-l1-1-0.dll
from <Current directory>\$dpx$.tmp\8006e876d67c8349a78d845de0e87b73.tmp to <Current directory>\api-ms-win-core-debug-l1-1-0.dll
from <Current directory>\$dpx$.tmp\92f33871c0212f40912d5b98005abe29.tmp to <Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
from <Current directory>\$dpx$.tmp\2d4f5154cf6555469435737f40fef85c.tmp to <Current directory>\api-ms-win-core-file-l1-1-0.dll
from <Current directory>\$dpx$.tmp\fe67b16cb0f26e46b9f9bcbadd0b80e5.tmp to <Current directory>\api-ms-win-core-file-l1-2-0.dll
from <Current directory>\$dpx$.tmp\45853957add51e44a9230304c131bc95.tmp to <Current directory>\api-ms-win-core-file-l2-1-0.dll
from <Current directory>\$dpx$.tmp\5231b8000dffee4496a42ac5ff5e8c1a.tmp to <Current directory>\api-ms-win-core-handle-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7dfdd834eeea4c44ac07bb8d94a95211.tmp to <Current directory>\api-ms-win-core-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\284ce45769ef0048b96bfcf7fe040f42.tmp to <Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6afd0edbf735194497541c3c5bce26c8.tmp to <Current directory>\api-ms-win-core-datetime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1a1403d4c093194f8106dad81e4cacf3.tmp to <Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
from <Current directory>\$dpx$.tmp\416269053972634b9d140df3f7824a22.tmp to <Current directory>\api-ms-win-core-memory-l1-1-0.dll
from <Current directory>\$dpx$.tmp\0355f2a7a46af74d86ec1a4ae923304a.tmp to <Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
from <Current directory>\$dpx$.tmp\aa7e4aeef734de4a920d49ddf0074f8a.tmp to <Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9f2c83a43e4a2748b2cc631b77df57e8.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
from <Current directory>\$dpx$.tmp\097c51f2700af343b497b3f27a91dc10.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
from <Current directory>\$dpx$.tmp\07cc607d2d9428498c615aa399c09dac.tmp to <Current directory>\api-ms-win-core-profile-l1-1-0.dll
from <Current directory>\$dpx$.tmp\8b1f3d44df91fb4dadaea28440615b33.tmp to <Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
from <Current directory>\$dpx$.tmp\3eecede749223c4999c0b8c34ed28fee.tmp to <Current directory>\api-ms-win-core-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\443b6c388753d942a6cbca24b6a0e093.tmp to <Current directory>\api-ms-win-core-localization-l1-2-0.dll
from <Current directory>\$dpx$.tmp\6fa65509a6799444a6af05624d4ee193.tmp to <Current directory>\ucrtbase.dll
from <Current directory>\$dpx$.tmp\bf7bfa59dbbce945867f875923134ba4.tmp to <Current directory>\vcruntime140.dll

Network activity

TCP

'lp##.abbny.com':443

UDP

DNS ASK lp##.beahh.com
DNS ASK lp##.abbny.com
DNS ASK lp##.haqo.net

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a
'<SYSTEM32>\expand.exe' d.cab -f:* .

Технології

Терміни

Навчання

Міфи

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней