Trojan.DownLoader33.6478

Technical Information

Modifies file system

Creates the following files

<Current directory>\d.cab
<Current directory>\$dpx$.tmp\0ff63a0e79206e4a8d000b6700560390.tmp
<Current directory>\$dpx$.tmp\04398592d70e9449b90749d827e19250.tmp
<Current directory>\$dpx$.tmp\811ee0cee0c77549bfb603951e982341.tmp
<Current directory>\$dpx$.tmp\f2c6828f5deef84e847403fd50d32781.tmp
<Current directory>\$dpx$.tmp\1ac318aa079dc849aca127c1071de96c.tmp
<Current directory>\$dpx$.tmp\0edbc68b726e6647acb40db533a0b664.tmp
<Current directory>\$dpx$.tmp\f9e0d59feebbba428c6b6f203a06bf7e.tmp
<Current directory>\$dpx$.tmp\4fb630aec96b2f4faee4a487edc00994.tmp
<Current directory>\$dpx$.tmp\4ac7d2529ab3d845a1a71b40af8e32ae.tmp
<Current directory>\$dpx$.tmp\b20a4321bfe0644eb71bed6b4f4540bb.tmp
<Current directory>\$dpx$.tmp\32309542d351204f9f6088ea159121d7.tmp
<Current directory>\$dpx$.tmp\a0831c9a52ae5d4d8456c4134e5cd411.tmp
<Current directory>\$dpx$.tmp\3884569f8976c3488c3e3aeaec9d8df6.tmp
<Current directory>\$dpx$.tmp\1e7aaefa9bf442469f5176f776c5ad4f.tmp
<Current directory>\$dpx$.tmp\93cff2857a69d64a842113ee4724ca6e.tmp
<Current directory>\$dpx$.tmp\c963729630a6cc478e3a437dbe4ba463.tmp
<Current directory>\$dpx$.tmp\06b29457fbd48943bd78bde5a9ddb4e7.tmp
<Current directory>\$dpx$.tmp\b15246dcbfa774408b5ae54d36bc7fef.tmp
<Current directory>\$dpx$.tmp\03effc123c66bb4ab1ef96e9aeddeec0.tmp
<Current directory>\$dpx$.tmp\567928a4a678614d89738555f73a91f8.tmp
<Current directory>\$dpx$.tmp\95a4ca0c692da54db79f56baf3106dda.tmp
<Current directory>\$dpx$.tmp\c0f38756b508c247860acd6885c5d328.tmp
<Current directory>\$dpx$.tmp\a222544c7df2e740a62a28249d70dd8d.tmp
<Current directory>\$dpx$.tmp\26dc3277e41d20478ef59f8483e41a88.tmp
<Current directory>\$dpx$.tmp\3f0931206b6d0d488c4e3b2d7378be89.tmp
<Current directory>\$dpx$.tmp\853152078323df488fe672711722e9d7.tmp
<Current directory>\$dpx$.tmp\82b96481c24205449e7c723900f5bbc3.tmp
<Current directory>\$dpx$.tmp\b21a26b1ff81364399c1fcf151236abd.tmp
<Current directory>\$dpx$.tmp\c41df5c328baf54d969d3bb76eca1655.tmp
<Current directory>\$dpx$.tmp\d323fd2cc921e04faaf63739cfaf1c95.tmp
<Current directory>\$dpx$.tmp\295030282565514994bcf96caa99a28e.tmp
<Current directory>\$dpx$.tmp\1387075ef253144ab34949a8bbc749b9.tmp
<Current directory>\$dpx$.tmp\ccd4820b2527d74c99c4912bb76c5cbe.tmp
<Current directory>\$dpx$.tmp\0683223d19ecdf419ae5b7bc7b01732f.tmp
<Current directory>\$dpx$.tmp\e8297f6736b833468859a15f17e767dd.tmp
<Current directory>\$dpx$.tmp\3dbbe0c9f96ea84789888a199bc98abc.tmp
<Current directory>\$dpx$.tmp\fc7755090b936b4b80378e2cc6298c3e.tmp
<Current directory>\$dpx$.tmp\98a6fe3a3e54c94f9214564a19eaa8ce.tmp
<Current directory>\$dpx$.tmp\741cf71c6b33724291fbf5dbcb099179.tmp
<Current directory>\$dpx$.tmp\6d1d800bc7e86d4c84068d469e1365c2.tmp
<Current directory>\$dpx$.tmp\27d3094a6e33a645bd9a8fc012d2bd68.tmp
<Current directory>\$dpx$.tmp\9d59ca0c4eeb3c4fa5f87d793eb81065.tmp
<Current directory>\$dpx$.tmp\9687ec3ae04f1043a3d81ea6c5cc21e3.tmp
<Current directory>\$dpx$.tmp\977264bc36614445ae321b39eeb7f70f.tmp

Sets the 'hidden' attribute to the following files

<Current directory>\api-ms-win-core-console-l1-1-0.dll
<Current directory>\api-ms-win-crt-conio-l1-1-0.dll
<Current directory>\api-ms-win-crt-convert-l1-1-0.dll
<Current directory>\api-ms-win-crt-environment-l1-1-0.dll
<Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
<Current directory>\api-ms-win-crt-heap-l1-1-0.dll
<Current directory>\api-ms-win-crt-locale-l1-1-0.dll
<Current directory>\api-ms-win-crt-math-l1-1-0.dll
<Current directory>\api-ms-win-core-timezone-l1-1-0.dll
<Current directory>\api-ms-win-core-util-l1-1-0.dll
<Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
<Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
<Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
<Current directory>\api-ms-win-crt-string-l1-1-0.dll
<Current directory>\api-ms-win-crt-time-l1-1-0.dll
<Current directory>\api-ms-win-crt-utility-l1-1-0.dll
<Current directory>\msvcp140.dll
<Current directory>\opencl.dll
<Current directory>\api-ms-win-crt-private-l1-1-0.dll
<Current directory>\api-ms-win-crt-process-l1-1-0.dll
<Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
<Current directory>\api-ms-win-core-synch-l1-2-0.dll
<Current directory>\api-ms-win-core-synch-l1-1-0.dll
<Current directory>\api-ms-win-core-debug-l1-1-0.dll
<Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-2-0.dll
<Current directory>\api-ms-win-core-file-l2-1-0.dll
<Current directory>\api-ms-win-core-handle-l1-1-0.dll
<Current directory>\api-ms-win-core-heap-l1-1-0.dll
<Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
<Current directory>\api-ms-win-core-datetime-l1-1-0.dll
<Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
<Current directory>\api-ms-win-core-memory-l1-1-0.dll
<Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
<Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
<Current directory>\api-ms-win-core-profile-l1-1-0.dll
<Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
<Current directory>\api-ms-win-core-string-l1-1-0.dll
<Current directory>\api-ms-win-core-localization-l1-2-0.dll
<Current directory>\ucrtbase.dll
<Current directory>\vcruntime140.dll

Deletes the following files

<Current directory>\d.cab

Moves the following files

from <Current directory>\$dpx$.tmp\26dc3277e41d20478ef59f8483e41a88.tmp to <Current directory>\api-ms-win-core-console-l1-1-0.dll
from <Current directory>\$dpx$.tmp\811ee0cee0c77549bfb603951e982341.tmp to <Current directory>\api-ms-win-crt-conio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f2c6828f5deef84e847403fd50d32781.tmp to <Current directory>\api-ms-win-crt-convert-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1ac318aa079dc849aca127c1071de96c.tmp to <Current directory>\api-ms-win-crt-environment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\0edbc68b726e6647acb40db533a0b664.tmp to <Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f9e0d59feebbba428c6b6f203a06bf7e.tmp to <Current directory>\api-ms-win-crt-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4fb630aec96b2f4faee4a487edc00994.tmp to <Current directory>\api-ms-win-crt-locale-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4ac7d2529ab3d845a1a71b40af8e32ae.tmp to <Current directory>\api-ms-win-crt-math-l1-1-0.dll
from <Current directory>\$dpx$.tmp\0ff63a0e79206e4a8d000b6700560390.tmp to <Current directory>\api-ms-win-core-timezone-l1-1-0.dll
from <Current directory>\$dpx$.tmp\04398592d70e9449b90749d827e19250.tmp to <Current directory>\api-ms-win-core-util-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b20a4321bfe0644eb71bed6b4f4540bb.tmp to <Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
from <Current directory>\$dpx$.tmp\3884569f8976c3488c3e3aeaec9d8df6.tmp to <Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1e7aaefa9bf442469f5176f776c5ad4f.tmp to <Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\93cff2857a69d64a842113ee4724ca6e.tmp to <Current directory>\api-ms-win-crt-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c963729630a6cc478e3a437dbe4ba463.tmp to <Current directory>\api-ms-win-crt-time-l1-1-0.dll
from <Current directory>\$dpx$.tmp\06b29457fbd48943bd78bde5a9ddb4e7.tmp to <Current directory>\api-ms-win-crt-utility-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b15246dcbfa774408b5ae54d36bc7fef.tmp to <Current directory>\msvcp140.dll
from <Current directory>\$dpx$.tmp\03effc123c66bb4ab1ef96e9aeddeec0.tmp to <Current directory>\opencl.dll
from <Current directory>\$dpx$.tmp\32309542d351204f9f6088ea159121d7.tmp to <Current directory>\api-ms-win-crt-private-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a0831c9a52ae5d4d8456c4134e5cd411.tmp to <Current directory>\api-ms-win-crt-process-l1-1-0.dll
from <Current directory>\$dpx$.tmp\567928a4a678614d89738555f73a91f8.tmp to <Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c0f38756b508c247860acd6885c5d328.tmp to <Current directory>\api-ms-win-core-synch-l1-2-0.dll
from <Current directory>\$dpx$.tmp\9687ec3ae04f1043a3d81ea6c5cc21e3.tmp to <Current directory>\api-ms-win-core-synch-l1-1-0.dll
from <Current directory>\$dpx$.tmp\853152078323df488fe672711722e9d7.tmp to <Current directory>\api-ms-win-core-debug-l1-1-0.dll
from <Current directory>\$dpx$.tmp\82b96481c24205449e7c723900f5bbc3.tmp to <Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b21a26b1ff81364399c1fcf151236abd.tmp to <Current directory>\api-ms-win-core-file-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c41df5c328baf54d969d3bb76eca1655.tmp to <Current directory>\api-ms-win-core-file-l1-2-0.dll
from <Current directory>\$dpx$.tmp\d323fd2cc921e04faaf63739cfaf1c95.tmp to <Current directory>\api-ms-win-core-file-l2-1-0.dll
from <Current directory>\$dpx$.tmp\295030282565514994bcf96caa99a28e.tmp to <Current directory>\api-ms-win-core-handle-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1387075ef253144ab34949a8bbc749b9.tmp to <Current directory>\api-ms-win-core-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ccd4820b2527d74c99c4912bb76c5cbe.tmp to <Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
from <Current directory>\$dpx$.tmp\3f0931206b6d0d488c4e3b2d7378be89.tmp to <Current directory>\api-ms-win-core-datetime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\0683223d19ecdf419ae5b7bc7b01732f.tmp to <Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
from <Current directory>\$dpx$.tmp\3dbbe0c9f96ea84789888a199bc98abc.tmp to <Current directory>\api-ms-win-core-memory-l1-1-0.dll
from <Current directory>\$dpx$.tmp\fc7755090b936b4b80378e2cc6298c3e.tmp to <Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
from <Current directory>\$dpx$.tmp\98a6fe3a3e54c94f9214564a19eaa8ce.tmp to <Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\741cf71c6b33724291fbf5dbcb099179.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6d1d800bc7e86d4c84068d469e1365c2.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
from <Current directory>\$dpx$.tmp\27d3094a6e33a645bd9a8fc012d2bd68.tmp to <Current directory>\api-ms-win-core-profile-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9d59ca0c4eeb3c4fa5f87d793eb81065.tmp to <Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a222544c7df2e740a62a28249d70dd8d.tmp to <Current directory>\api-ms-win-core-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e8297f6736b833468859a15f17e767dd.tmp to <Current directory>\api-ms-win-core-localization-l1-2-0.dll
from <Current directory>\$dpx$.tmp\95a4ca0c692da54db79f56baf3106dda.tmp to <Current directory>\ucrtbase.dll
from <Current directory>\$dpx$.tmp\977264bc36614445ae321b39eeb7f70f.tmp to <Current directory>\vcruntime140.dll

Network activity

Connects to

'lp##.beahh.com':443
'lp##.haqo.net':443

TCP

'lp##.abbny.com':443

UDP

DNS ASK lp##.beahh.com
DNS ASK lp##.abbny.com
DNS ASK lp##.haqo.net

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a
'<SYSTEM32>\expand.exe' d.cab -f:* .

Технології

Терміни

Навчання

Міфи

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней