Trojan.DownLoader33.6484

Technical Information

Modifies file system

Creates the following files

<Current directory>\d.cab
<Current directory>\$dpx$.tmp\3f3474d5e3715740866bcd1f8c0d4a72.tmp
<Current directory>\$dpx$.tmp\568993f682144745b01da5c9c7cf3190.tmp
<Current directory>\$dpx$.tmp\d4250ad4e43bb24a9f53cd016c1de033.tmp
<Current directory>\$dpx$.tmp\25f94a4ddee9554eb922504120cfbd6f.tmp
<Current directory>\$dpx$.tmp\933c883fe646ed4f81e98017d0579788.tmp
<Current directory>\$dpx$.tmp\353dff4b49b60a4ea15c6a09afe612dd.tmp
<Current directory>\$dpx$.tmp\9829f956bb8b4844b00e2db917b07af3.tmp
<Current directory>\$dpx$.tmp\764e445d965b0e4ca86e379253ca31eb.tmp
<Current directory>\$dpx$.tmp\01e2a205e8c7cc45bae85b02c01ff1b7.tmp
<Current directory>\$dpx$.tmp\3573c92bced8214ea9b344440a8c7614.tmp
<Current directory>\$dpx$.tmp\c06606ae99586c40b757dfb17f5932c9.tmp
<Current directory>\$dpx$.tmp\1d1242b5d4fe1044a07a44d5c22da63d.tmp
<Current directory>\$dpx$.tmp\692aadb0e75dbf48844fc9a6264181cf.tmp
<Current directory>\$dpx$.tmp\e7ba0604cbf4374182db843a08e543a9.tmp
<Current directory>\$dpx$.tmp\071f1075c11e2c40bef6ba2261619625.tmp
<Current directory>\$dpx$.tmp\3ebcd8393d7b4b4297a9f1c83dea75d4.tmp
<Current directory>\$dpx$.tmp\f3ed254b656d934aa3b3ca3c5acaf970.tmp
<Current directory>\$dpx$.tmp\5590bd9642f4a14290836aa8b29bd862.tmp
<Current directory>\$dpx$.tmp\f8a9432cd287ef4ab4a3e8986df66c8b.tmp
<Current directory>\$dpx$.tmp\6a843d7838c91f418e2be3ae0b95a474.tmp
<Current directory>\$dpx$.tmp\443318ecb2735247ae646378c119f310.tmp
<Current directory>\$dpx$.tmp\b0505edfd736604c86c88854d4329cc5.tmp
<Current directory>\$dpx$.tmp\c482c4de1dbc8e41bcf48782d1a2f3d9.tmp
<Current directory>\$dpx$.tmp\276ceb6d72770b40bad6da68937b4c3a.tmp
<Current directory>\$dpx$.tmp\1265b354b1ec3a45b8190e4113f1ed01.tmp
<Current directory>\$dpx$.tmp\be482c8b88c80a4198525a5852cc2866.tmp
<Current directory>\$dpx$.tmp\9342cc339d64264a93c9c5049c5e1e0f.tmp
<Current directory>\$dpx$.tmp\20ff71a7722b4a479e327656f3ad45fa.tmp
<Current directory>\$dpx$.tmp\f9a31f5cae2de640943cd7583d88a56d.tmp
<Current directory>\$dpx$.tmp\aef77abef8668948a70f952a515fc404.tmp
<Current directory>\$dpx$.tmp\298f81f788d402419be81a733e7c34fd.tmp
<Current directory>\$dpx$.tmp\d3d2b2b32608e24c97cd134b59f74499.tmp
<Current directory>\$dpx$.tmp\339b3e85f7aad841b6d1fe53a5938be1.tmp
<Current directory>\$dpx$.tmp\825f1b2398a48f4c9ae6a737a23e737a.tmp
<Current directory>\$dpx$.tmp\0c315f32424b5840a546b51f76d1beac.tmp
<Current directory>\$dpx$.tmp\337168609861ba41b2541c2f0290ab68.tmp
<Current directory>\$dpx$.tmp\a4245febe0fd4b4ca11c4f826affbb47.tmp
<Current directory>\$dpx$.tmp\b789d32326a8144da8f6e01d7e42a8d9.tmp
<Current directory>\$dpx$.tmp\55ba39bcf90a7e4cbcf29fda2ba11d08.tmp
<Current directory>\$dpx$.tmp\473529a44c08464e91079b844d6615c4.tmp
<Current directory>\$dpx$.tmp\84882263d593a84d86c093d2cee4c6d0.tmp
<Current directory>\$dpx$.tmp\50b92e5090a9144485b471fc9cfcd3fc.tmp
<Current directory>\$dpx$.tmp\664c2c84fa5454489a01bcf54c3cba61.tmp
<Current directory>\$dpx$.tmp\613943f740a51443b0275416a5d0da26.tmp

Sets the 'hidden' attribute to the following files

<Current directory>\api-ms-win-core-console-l1-1-0.dll
<Current directory>\api-ms-win-crt-conio-l1-1-0.dll
<Current directory>\api-ms-win-crt-convert-l1-1-0.dll
<Current directory>\api-ms-win-crt-environment-l1-1-0.dll
<Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
<Current directory>\api-ms-win-crt-heap-l1-1-0.dll
<Current directory>\api-ms-win-crt-locale-l1-1-0.dll
<Current directory>\api-ms-win-crt-math-l1-1-0.dll
<Current directory>\api-ms-win-core-timezone-l1-1-0.dll
<Current directory>\api-ms-win-core-util-l1-1-0.dll
<Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
<Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
<Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
<Current directory>\api-ms-win-crt-string-l1-1-0.dll
<Current directory>\api-ms-win-crt-time-l1-1-0.dll
<Current directory>\api-ms-win-crt-utility-l1-1-0.dll
<Current directory>\msvcp140.dll
<Current directory>\opencl.dll
<Current directory>\api-ms-win-crt-private-l1-1-0.dll
<Current directory>\api-ms-win-crt-process-l1-1-0.dll
<Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
<Current directory>\api-ms-win-core-synch-l1-2-0.dll
<Current directory>\api-ms-win-core-synch-l1-1-0.dll
<Current directory>\api-ms-win-core-debug-l1-1-0.dll
<Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-2-0.dll
<Current directory>\api-ms-win-core-file-l2-1-0.dll
<Current directory>\api-ms-win-core-handle-l1-1-0.dll
<Current directory>\api-ms-win-core-heap-l1-1-0.dll
<Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
<Current directory>\api-ms-win-core-datetime-l1-1-0.dll
<Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
<Current directory>\api-ms-win-core-memory-l1-1-0.dll
<Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
<Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
<Current directory>\api-ms-win-core-profile-l1-1-0.dll
<Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
<Current directory>\api-ms-win-core-string-l1-1-0.dll
<Current directory>\api-ms-win-core-localization-l1-2-0.dll
<Current directory>\ucrtbase.dll
<Current directory>\vcruntime140.dll

Deletes the following files

<Current directory>\d.cab

Moves the following files

from <Current directory>\$dpx$.tmp\276ceb6d72770b40bad6da68937b4c3a.tmp to <Current directory>\api-ms-win-core-console-l1-1-0.dll
from <Current directory>\$dpx$.tmp\d4250ad4e43bb24a9f53cd016c1de033.tmp to <Current directory>\api-ms-win-crt-conio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\25f94a4ddee9554eb922504120cfbd6f.tmp to <Current directory>\api-ms-win-crt-convert-l1-1-0.dll
from <Current directory>\$dpx$.tmp\933c883fe646ed4f81e98017d0579788.tmp to <Current directory>\api-ms-win-crt-environment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\353dff4b49b60a4ea15c6a09afe612dd.tmp to <Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9829f956bb8b4844b00e2db917b07af3.tmp to <Current directory>\api-ms-win-crt-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\764e445d965b0e4ca86e379253ca31eb.tmp to <Current directory>\api-ms-win-crt-locale-l1-1-0.dll
from <Current directory>\$dpx$.tmp\01e2a205e8c7cc45bae85b02c01ff1b7.tmp to <Current directory>\api-ms-win-crt-math-l1-1-0.dll
from <Current directory>\$dpx$.tmp\3f3474d5e3715740866bcd1f8c0d4a72.tmp to <Current directory>\api-ms-win-core-timezone-l1-1-0.dll
from <Current directory>\$dpx$.tmp\568993f682144745b01da5c9c7cf3190.tmp to <Current directory>\api-ms-win-core-util-l1-1-0.dll
from <Current directory>\$dpx$.tmp\3573c92bced8214ea9b344440a8c7614.tmp to <Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
from <Current directory>\$dpx$.tmp\692aadb0e75dbf48844fc9a6264181cf.tmp to <Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e7ba0604cbf4374182db843a08e543a9.tmp to <Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\071f1075c11e2c40bef6ba2261619625.tmp to <Current directory>\api-ms-win-crt-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\3ebcd8393d7b4b4297a9f1c83dea75d4.tmp to <Current directory>\api-ms-win-crt-time-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f3ed254b656d934aa3b3ca3c5acaf970.tmp to <Current directory>\api-ms-win-crt-utility-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5590bd9642f4a14290836aa8b29bd862.tmp to <Current directory>\msvcp140.dll
from <Current directory>\$dpx$.tmp\f8a9432cd287ef4ab4a3e8986df66c8b.tmp to <Current directory>\opencl.dll
from <Current directory>\$dpx$.tmp\c06606ae99586c40b757dfb17f5932c9.tmp to <Current directory>\api-ms-win-crt-private-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1d1242b5d4fe1044a07a44d5c22da63d.tmp to <Current directory>\api-ms-win-crt-process-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6a843d7838c91f418e2be3ae0b95a474.tmp to <Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b0505edfd736604c86c88854d4329cc5.tmp to <Current directory>\api-ms-win-core-synch-l1-2-0.dll
from <Current directory>\$dpx$.tmp\664c2c84fa5454489a01bcf54c3cba61.tmp to <Current directory>\api-ms-win-core-synch-l1-1-0.dll
from <Current directory>\$dpx$.tmp\be482c8b88c80a4198525a5852cc2866.tmp to <Current directory>\api-ms-win-core-debug-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9342cc339d64264a93c9c5049c5e1e0f.tmp to <Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
from <Current directory>\$dpx$.tmp\20ff71a7722b4a479e327656f3ad45fa.tmp to <Current directory>\api-ms-win-core-file-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f9a31f5cae2de640943cd7583d88a56d.tmp to <Current directory>\api-ms-win-core-file-l1-2-0.dll
from <Current directory>\$dpx$.tmp\aef77abef8668948a70f952a515fc404.tmp to <Current directory>\api-ms-win-core-file-l2-1-0.dll
from <Current directory>\$dpx$.tmp\298f81f788d402419be81a733e7c34fd.tmp to <Current directory>\api-ms-win-core-handle-l1-1-0.dll
from <Current directory>\$dpx$.tmp\d3d2b2b32608e24c97cd134b59f74499.tmp to <Current directory>\api-ms-win-core-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\339b3e85f7aad841b6d1fe53a5938be1.tmp to <Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1265b354b1ec3a45b8190e4113f1ed01.tmp to <Current directory>\api-ms-win-core-datetime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\825f1b2398a48f4c9ae6a737a23e737a.tmp to <Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
from <Current directory>\$dpx$.tmp\337168609861ba41b2541c2f0290ab68.tmp to <Current directory>\api-ms-win-core-memory-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a4245febe0fd4b4ca11c4f826affbb47.tmp to <Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b789d32326a8144da8f6e01d7e42a8d9.tmp to <Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\55ba39bcf90a7e4cbcf29fda2ba11d08.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
from <Current directory>\$dpx$.tmp\473529a44c08464e91079b844d6615c4.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
from <Current directory>\$dpx$.tmp\84882263d593a84d86c093d2cee4c6d0.tmp to <Current directory>\api-ms-win-core-profile-l1-1-0.dll
from <Current directory>\$dpx$.tmp\50b92e5090a9144485b471fc9cfcd3fc.tmp to <Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c482c4de1dbc8e41bcf48782d1a2f3d9.tmp to <Current directory>\api-ms-win-core-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\0c315f32424b5840a546b51f76d1beac.tmp to <Current directory>\api-ms-win-core-localization-l1-2-0.dll
from <Current directory>\$dpx$.tmp\443318ecb2735247ae646378c119f310.tmp to <Current directory>\ucrtbase.dll
from <Current directory>\$dpx$.tmp\613943f740a51443b0275416a5d0da26.tmp to <Current directory>\vcruntime140.dll

Network activity

Connects to

'lp##.haqo.net':443

TCP

'lp##.abbny.com':443

UDP

DNS ASK lp##.beahh.com
DNS ASK lp##.abbny.com
DNS ASK lp##.haqo.net

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a
'<SYSTEM32>\expand.exe' d.cab -f:* .

Технології

Терміни

Навчання

Міфи

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней