Trojan.DownLoader33.1035

Technical Information

Modifies file system

Creates the following files

<Current directory>\d.cab
<Current directory>\$dpx$.tmp\a3a357bca2aaea40a9ead66d888744c0.tmp
<Current directory>\$dpx$.tmp\a3cd59ab712f3e438fd3e7768f4a7f96.tmp
<Current directory>\$dpx$.tmp\1356892d024d3645bd2900e5616995fd.tmp
<Current directory>\$dpx$.tmp\e063ea566c8bba4cb907f79bd3557e1c.tmp
<Current directory>\$dpx$.tmp\2c9036f2770a2d4198ba80888e7f0235.tmp
<Current directory>\$dpx$.tmp\91d99728ae0b324da9df7a4034bcfe75.tmp
<Current directory>\$dpx$.tmp\49c51446fa06e94fb127b88d37d2a793.tmp
<Current directory>\$dpx$.tmp\e643d510e7a25f4ca15ca4c7af64cea4.tmp
<Current directory>\$dpx$.tmp\dd32d32f5965ac4fbcf867e4eab58f87.tmp
<Current directory>\$dpx$.tmp\f9081b677396b64d85d34d2ffa73f8ea.tmp
<Current directory>\$dpx$.tmp\106db1e51863f242ab4df00f5296012d.tmp
<Current directory>\$dpx$.tmp\f288bb621d02c74eaa84ae3dd190a1d4.tmp
<Current directory>\$dpx$.tmp\9b3e5bdc4895f7409ca0d2056d12fc33.tmp
<Current directory>\$dpx$.tmp\01b6a50ab8619648bec4a14747a170e2.tmp
<Current directory>\$dpx$.tmp\450ce488e369db4d8a01f55e2694bd7c.tmp
<Current directory>\$dpx$.tmp\a165a3f15b3eee4e90c95800a2b0f71d.tmp
<Current directory>\$dpx$.tmp\f95476313b4c0449ae0ce05f8e32f039.tmp
<Current directory>\$dpx$.tmp\57728f8559f9bf489c30c96b87fd85a5.tmp
<Current directory>\$dpx$.tmp\3bd23eebccd9ce48be12332057ca0a8e.tmp
<Current directory>\$dpx$.tmp\d0bc77eb23e1bb46b99be0c86745f1de.tmp
<Current directory>\$dpx$.tmp\eac3019ce8714048bc25ca0908f9cadf.tmp
<Current directory>\$dpx$.tmp\8f7de75329001d45adcd96869361965f.tmp
<Current directory>\$dpx$.tmp\c89ef31d3ee20f4ead5c7179f8a8c731.tmp
<Current directory>\$dpx$.tmp\206fbf363ce6fb47bb956ba853439c73.tmp
<Current directory>\$dpx$.tmp\5f29f4859ab6c84987b6b13362f71ef2.tmp
<Current directory>\$dpx$.tmp\964f4beecfaa8d4da0b71b9d20a51e3a.tmp
<Current directory>\$dpx$.tmp\c97d690a8397ee4cab127b33a7e41861.tmp
<Current directory>\$dpx$.tmp\9f0b15f3bc91334baec8847c3ca5af5b.tmp
<Current directory>\$dpx$.tmp\caabeb84a877f5429ae89eafc64b9c46.tmp
<Current directory>\$dpx$.tmp\b02aa80f792f7c40bb74b3062c72cfe6.tmp
<Current directory>\$dpx$.tmp\ee99144c71064441b13811050d74163d.tmp
<Current directory>\$dpx$.tmp\c5bf22e183eb934fab74ed561f91aede.tmp
<Current directory>\$dpx$.tmp\c7cf6bc3938e774eb1fd4be91de804d1.tmp
<Current directory>\$dpx$.tmp\34b399f3597dd74d8b9b2737604f6560.tmp
<Current directory>\$dpx$.tmp\6556317e495d8843833cc968a33f09a0.tmp
<Current directory>\$dpx$.tmp\833eeba8d4776f41bc56eb94e7d17b7e.tmp
<Current directory>\$dpx$.tmp\014a001aeec0074abc27519d2c107ef7.tmp
<Current directory>\$dpx$.tmp\27f746541c407e41acf45bcda36a212c.tmp
<Current directory>\$dpx$.tmp\1f3857d850ec6048a5908ddc2b91e1d4.tmp
<Current directory>\$dpx$.tmp\7b3660ba65677946a363bbb429afac1b.tmp
<Current directory>\$dpx$.tmp\0e8d624352a1fc418150fbd35350dba5.tmp
<Current directory>\$dpx$.tmp\f5b930ff9efeb14281d755a781c4e8d4.tmp
<Current directory>\$dpx$.tmp\ae49a284f3d350458bfbf1003bfdc1c3.tmp
<Current directory>\$dpx$.tmp\acffa566de7c3c4dbc9783f98f1d175e.tmp

Sets the 'hidden' attribute to the following files

<Current directory>\api-ms-win-core-console-l1-1-0.dll
<Current directory>\api-ms-win-crt-conio-l1-1-0.dll
<Current directory>\api-ms-win-crt-convert-l1-1-0.dll
<Current directory>\api-ms-win-crt-environment-l1-1-0.dll
<Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
<Current directory>\api-ms-win-crt-heap-l1-1-0.dll
<Current directory>\api-ms-win-crt-locale-l1-1-0.dll
<Current directory>\api-ms-win-crt-math-l1-1-0.dll
<Current directory>\api-ms-win-core-timezone-l1-1-0.dll
<Current directory>\api-ms-win-core-util-l1-1-0.dll
<Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
<Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
<Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
<Current directory>\api-ms-win-crt-string-l1-1-0.dll
<Current directory>\api-ms-win-crt-time-l1-1-0.dll
<Current directory>\api-ms-win-crt-utility-l1-1-0.dll
<Current directory>\msvcp140.dll
<Current directory>\opencl.dll
<Current directory>\api-ms-win-crt-private-l1-1-0.dll
<Current directory>\api-ms-win-crt-process-l1-1-0.dll
<Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
<Current directory>\api-ms-win-core-synch-l1-2-0.dll
<Current directory>\api-ms-win-core-synch-l1-1-0.dll
<Current directory>\api-ms-win-core-debug-l1-1-0.dll
<Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-2-0.dll
<Current directory>\api-ms-win-core-file-l2-1-0.dll
<Current directory>\api-ms-win-core-handle-l1-1-0.dll
<Current directory>\api-ms-win-core-heap-l1-1-0.dll
<Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
<Current directory>\api-ms-win-core-datetime-l1-1-0.dll
<Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
<Current directory>\api-ms-win-core-memory-l1-1-0.dll
<Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
<Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
<Current directory>\api-ms-win-core-profile-l1-1-0.dll
<Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
<Current directory>\api-ms-win-core-string-l1-1-0.dll
<Current directory>\api-ms-win-core-localization-l1-2-0.dll
<Current directory>\ucrtbase.dll
<Current directory>\vcruntime140.dll

Deletes the following files

<Current directory>\d.cab

Moves the following files

from <Current directory>\$dpx$.tmp\206fbf363ce6fb47bb956ba853439c73.tmp to <Current directory>\api-ms-win-core-console-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1356892d024d3645bd2900e5616995fd.tmp to <Current directory>\api-ms-win-crt-conio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e063ea566c8bba4cb907f79bd3557e1c.tmp to <Current directory>\api-ms-win-crt-convert-l1-1-0.dll
from <Current directory>\$dpx$.tmp\2c9036f2770a2d4198ba80888e7f0235.tmp to <Current directory>\api-ms-win-crt-environment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\91d99728ae0b324da9df7a4034bcfe75.tmp to <Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
from <Current directory>\$dpx$.tmp\49c51446fa06e94fb127b88d37d2a793.tmp to <Current directory>\api-ms-win-crt-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e643d510e7a25f4ca15ca4c7af64cea4.tmp to <Current directory>\api-ms-win-crt-locale-l1-1-0.dll
from <Current directory>\$dpx$.tmp\dd32d32f5965ac4fbcf867e4eab58f87.tmp to <Current directory>\api-ms-win-crt-math-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a3a357bca2aaea40a9ead66d888744c0.tmp to <Current directory>\api-ms-win-core-timezone-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a3cd59ab712f3e438fd3e7768f4a7f96.tmp to <Current directory>\api-ms-win-core-util-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f9081b677396b64d85d34d2ffa73f8ea.tmp to <Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9b3e5bdc4895f7409ca0d2056d12fc33.tmp to <Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\01b6a50ab8619648bec4a14747a170e2.tmp to <Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\450ce488e369db4d8a01f55e2694bd7c.tmp to <Current directory>\api-ms-win-crt-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a165a3f15b3eee4e90c95800a2b0f71d.tmp to <Current directory>\api-ms-win-crt-time-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f95476313b4c0449ae0ce05f8e32f039.tmp to <Current directory>\api-ms-win-crt-utility-l1-1-0.dll
from <Current directory>\$dpx$.tmp\57728f8559f9bf489c30c96b87fd85a5.tmp to <Current directory>\msvcp140.dll
from <Current directory>\$dpx$.tmp\3bd23eebccd9ce48be12332057ca0a8e.tmp to <Current directory>\opencl.dll
from <Current directory>\$dpx$.tmp\106db1e51863f242ab4df00f5296012d.tmp to <Current directory>\api-ms-win-crt-private-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f288bb621d02c74eaa84ae3dd190a1d4.tmp to <Current directory>\api-ms-win-crt-process-l1-1-0.dll
from <Current directory>\$dpx$.tmp\d0bc77eb23e1bb46b99be0c86745f1de.tmp to <Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
from <Current directory>\$dpx$.tmp\8f7de75329001d45adcd96869361965f.tmp to <Current directory>\api-ms-win-core-synch-l1-2-0.dll
from <Current directory>\$dpx$.tmp\ae49a284f3d350458bfbf1003bfdc1c3.tmp to <Current directory>\api-ms-win-core-synch-l1-1-0.dll
from <Current directory>\$dpx$.tmp\964f4beecfaa8d4da0b71b9d20a51e3a.tmp to <Current directory>\api-ms-win-core-debug-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c97d690a8397ee4cab127b33a7e41861.tmp to <Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9f0b15f3bc91334baec8847c3ca5af5b.tmp to <Current directory>\api-ms-win-core-file-l1-1-0.dll
from <Current directory>\$dpx$.tmp\caabeb84a877f5429ae89eafc64b9c46.tmp to <Current directory>\api-ms-win-core-file-l1-2-0.dll
from <Current directory>\$dpx$.tmp\b02aa80f792f7c40bb74b3062c72cfe6.tmp to <Current directory>\api-ms-win-core-file-l2-1-0.dll
from <Current directory>\$dpx$.tmp\ee99144c71064441b13811050d74163d.tmp to <Current directory>\api-ms-win-core-handle-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c5bf22e183eb934fab74ed561f91aede.tmp to <Current directory>\api-ms-win-core-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c7cf6bc3938e774eb1fd4be91de804d1.tmp to <Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5f29f4859ab6c84987b6b13362f71ef2.tmp to <Current directory>\api-ms-win-core-datetime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\34b399f3597dd74d8b9b2737604f6560.tmp to <Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
from <Current directory>\$dpx$.tmp\833eeba8d4776f41bc56eb94e7d17b7e.tmp to <Current directory>\api-ms-win-core-memory-l1-1-0.dll
from <Current directory>\$dpx$.tmp\014a001aeec0074abc27519d2c107ef7.tmp to <Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
from <Current directory>\$dpx$.tmp\27f746541c407e41acf45bcda36a212c.tmp to <Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1f3857d850ec6048a5908ddc2b91e1d4.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7b3660ba65677946a363bbb429afac1b.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
from <Current directory>\$dpx$.tmp\0e8d624352a1fc418150fbd35350dba5.tmp to <Current directory>\api-ms-win-core-profile-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f5b930ff9efeb14281d755a781c4e8d4.tmp to <Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c89ef31d3ee20f4ead5c7179f8a8c731.tmp to <Current directory>\api-ms-win-core-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6556317e495d8843833cc968a33f09a0.tmp to <Current directory>\api-ms-win-core-localization-l1-2-0.dll
from <Current directory>\$dpx$.tmp\eac3019ce8714048bc25ca0908f9cadf.tmp to <Current directory>\ucrtbase.dll
from <Current directory>\$dpx$.tmp\acffa566de7c3c4dbc9783f98f1d175e.tmp to <Current directory>\vcruntime140.dll

Network activity

Connects to

'lp##.beahh.com':443

TCP

'lp##.abbny.com':443
'lp##.haqo.net':443

UDP

DNS ASK lp##.beahh.com
DNS ASK lp##.abbny.com
DNS ASK lp##.haqo.net

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a
'<SYSTEM32>\expand.exe' d.cab -f:* .

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней