Trojan.DownLoader33.7474

Technical Information

Modifies file system

Creates the following files

<Current directory>\d.cab
<Current directory>\$dpx$.tmp\ce441c1cf5f3a540ba885a9a010296e2.tmp
<Current directory>\$dpx$.tmp\29063ed8a272824dab3101510e612cfc.tmp
<Current directory>\$dpx$.tmp\2360e0aa5d6d3d478e388be2bd27cd87.tmp
<Current directory>\$dpx$.tmp\69bd9716fa97124db9c0667923642a25.tmp
<Current directory>\$dpx$.tmp\439d52caa3a5924286fbaabe76d94576.tmp
<Current directory>\$dpx$.tmp\4a8419a66e97884582514086844728e1.tmp
<Current directory>\$dpx$.tmp\e02fca55b4362547b173fbcb9f94ec08.tmp
<Current directory>\$dpx$.tmp\8f1e6dc4e4edfe44a00e337bfa17af94.tmp
<Current directory>\$dpx$.tmp\703b0c6e7a55fe4f8d2d98e12a035075.tmp
<Current directory>\$dpx$.tmp\8a1757aabe21364eb1112ba7a2ca7147.tmp
<Current directory>\$dpx$.tmp\65b7d14830294f419835150b2301d166.tmp
<Current directory>\$dpx$.tmp\6f5c72354f5a4d4198d389864ebca68f.tmp
<Current directory>\$dpx$.tmp\35eecbb0ed99f3449764fd79c3d53e7a.tmp
<Current directory>\$dpx$.tmp\d37dbfe3b852d54b9d2f5404b5bd8e92.tmp
<Current directory>\$dpx$.tmp\2d5fb4635faca64abe81cd2d7ea4844d.tmp
<Current directory>\$dpx$.tmp\6bed7b18d28dc74591d96bec81099da0.tmp
<Current directory>\$dpx$.tmp\afea1edf3eef8146b8065e4fe1f0952d.tmp
<Current directory>\$dpx$.tmp\0ead08532607924ea93209dcd31ff662.tmp
<Current directory>\$dpx$.tmp\73a8e67bb2b17e4f9d12cd5b49c1e868.tmp
<Current directory>\$dpx$.tmp\747ac4e3be9d8f489ea11231d018cbb1.tmp
<Current directory>\$dpx$.tmp\c2dfcfb24170df44945ebaef8d3bf094.tmp
<Current directory>\$dpx$.tmp\bad399d6a5dc9141b4a05ba320bf0115.tmp
<Current directory>\$dpx$.tmp\bcadef0d2a69204f83afab555c71574e.tmp
<Current directory>\$dpx$.tmp\095dcefe81eb1d4db744faf9593eda9e.tmp
<Current directory>\$dpx$.tmp\8caae827d873a444a9c5475da5286067.tmp
<Current directory>\$dpx$.tmp\0143b3107eafc440a614d4f2df72b032.tmp
<Current directory>\$dpx$.tmp\911aa89b0b194b48a1105085ecd3fdd1.tmp
<Current directory>\$dpx$.tmp\7bf52a93fd4c3849a1b4864028e65809.tmp
<Current directory>\$dpx$.tmp\a7eba399269af04e83bfe516cf9a4dff.tmp
<Current directory>\$dpx$.tmp\a169d29e39e40d4ca7d922499e81f94e.tmp
<Current directory>\$dpx$.tmp\edcfc773789a4e49a4b9e70bcb7494bc.tmp
<Current directory>\$dpx$.tmp\8e02d19b7a2e6b4cbe91de2f80c6c395.tmp
<Current directory>\$dpx$.tmp\94b795836fd56948b6060fb50b0c0d14.tmp
<Current directory>\$dpx$.tmp\9ea4887e45b8a94387800dd30be8fcc7.tmp
<Current directory>\$dpx$.tmp\b657f82a722bf245a30a3e054e20e7de.tmp
<Current directory>\$dpx$.tmp\18a72c016d07494fbaef2510764c9842.tmp
<Current directory>\$dpx$.tmp\81775d2c712c134a84d6c5b2c893f143.tmp
<Current directory>\$dpx$.tmp\ff079b9678ac274aafea0b6cb5c389a6.tmp
<Current directory>\$dpx$.tmp\ad6913863c7ade4fa0d0a4ccb1d5c7f8.tmp
<Current directory>\$dpx$.tmp\14891b24acef1643be0895a72e92634f.tmp
<Current directory>\$dpx$.tmp\95c90eff60bccc4ebe7d38a38355ce93.tmp
<Current directory>\$dpx$.tmp\d674d7a8cc1e54429d04b2bd77d7228c.tmp
<Current directory>\$dpx$.tmp\8d8a445f12c0424a922314b7b6fd0c7a.tmp
<Current directory>\$dpx$.tmp\c879fec321dbeb4090dad6cc141777f8.tmp

Sets the 'hidden' attribute to the following files

<Current directory>\api-ms-win-core-console-l1-1-0.dll
<Current directory>\api-ms-win-crt-conio-l1-1-0.dll
<Current directory>\api-ms-win-crt-convert-l1-1-0.dll
<Current directory>\api-ms-win-crt-environment-l1-1-0.dll
<Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
<Current directory>\api-ms-win-crt-heap-l1-1-0.dll
<Current directory>\api-ms-win-crt-locale-l1-1-0.dll
<Current directory>\api-ms-win-crt-math-l1-1-0.dll
<Current directory>\api-ms-win-core-timezone-l1-1-0.dll
<Current directory>\api-ms-win-core-util-l1-1-0.dll
<Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
<Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
<Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
<Current directory>\api-ms-win-crt-string-l1-1-0.dll
<Current directory>\api-ms-win-crt-time-l1-1-0.dll
<Current directory>\api-ms-win-crt-utility-l1-1-0.dll
<Current directory>\msvcp140.dll
<Current directory>\opencl.dll
<Current directory>\api-ms-win-crt-private-l1-1-0.dll
<Current directory>\api-ms-win-crt-process-l1-1-0.dll
<Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
<Current directory>\api-ms-win-core-synch-l1-2-0.dll
<Current directory>\api-ms-win-core-synch-l1-1-0.dll
<Current directory>\api-ms-win-core-debug-l1-1-0.dll
<Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-2-0.dll
<Current directory>\api-ms-win-core-file-l2-1-0.dll
<Current directory>\api-ms-win-core-handle-l1-1-0.dll
<Current directory>\api-ms-win-core-heap-l1-1-0.dll
<Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
<Current directory>\api-ms-win-core-datetime-l1-1-0.dll
<Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
<Current directory>\api-ms-win-core-memory-l1-1-0.dll
<Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
<Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
<Current directory>\api-ms-win-core-profile-l1-1-0.dll
<Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
<Current directory>\api-ms-win-core-string-l1-1-0.dll
<Current directory>\api-ms-win-core-localization-l1-2-0.dll
<Current directory>\ucrtbase.dll
<Current directory>\vcruntime140.dll

Deletes the following files

<Current directory>\d.cab

Moves the following files

from <Current directory>\$dpx$.tmp\095dcefe81eb1d4db744faf9593eda9e.tmp to <Current directory>\api-ms-win-core-console-l1-1-0.dll
from <Current directory>\$dpx$.tmp\2360e0aa5d6d3d478e388be2bd27cd87.tmp to <Current directory>\api-ms-win-crt-conio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\69bd9716fa97124db9c0667923642a25.tmp to <Current directory>\api-ms-win-crt-convert-l1-1-0.dll
from <Current directory>\$dpx$.tmp\439d52caa3a5924286fbaabe76d94576.tmp to <Current directory>\api-ms-win-crt-environment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4a8419a66e97884582514086844728e1.tmp to <Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e02fca55b4362547b173fbcb9f94ec08.tmp to <Current directory>\api-ms-win-crt-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\8f1e6dc4e4edfe44a00e337bfa17af94.tmp to <Current directory>\api-ms-win-crt-locale-l1-1-0.dll
from <Current directory>\$dpx$.tmp\703b0c6e7a55fe4f8d2d98e12a035075.tmp to <Current directory>\api-ms-win-crt-math-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ce441c1cf5f3a540ba885a9a010296e2.tmp to <Current directory>\api-ms-win-core-timezone-l1-1-0.dll
from <Current directory>\$dpx$.tmp\29063ed8a272824dab3101510e612cfc.tmp to <Current directory>\api-ms-win-core-util-l1-1-0.dll
from <Current directory>\$dpx$.tmp\8a1757aabe21364eb1112ba7a2ca7147.tmp to <Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
from <Current directory>\$dpx$.tmp\35eecbb0ed99f3449764fd79c3d53e7a.tmp to <Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\d37dbfe3b852d54b9d2f5404b5bd8e92.tmp to <Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\2d5fb4635faca64abe81cd2d7ea4844d.tmp to <Current directory>\api-ms-win-crt-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6bed7b18d28dc74591d96bec81099da0.tmp to <Current directory>\api-ms-win-crt-time-l1-1-0.dll
from <Current directory>\$dpx$.tmp\afea1edf3eef8146b8065e4fe1f0952d.tmp to <Current directory>\api-ms-win-crt-utility-l1-1-0.dll
from <Current directory>\$dpx$.tmp\0ead08532607924ea93209dcd31ff662.tmp to <Current directory>\msvcp140.dll
from <Current directory>\$dpx$.tmp\73a8e67bb2b17e4f9d12cd5b49c1e868.tmp to <Current directory>\opencl.dll
from <Current directory>\$dpx$.tmp\65b7d14830294f419835150b2301d166.tmp to <Current directory>\api-ms-win-crt-private-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6f5c72354f5a4d4198d389864ebca68f.tmp to <Current directory>\api-ms-win-crt-process-l1-1-0.dll
from <Current directory>\$dpx$.tmp\747ac4e3be9d8f489ea11231d018cbb1.tmp to <Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
from <Current directory>\$dpx$.tmp\bad399d6a5dc9141b4a05ba320bf0115.tmp to <Current directory>\api-ms-win-core-synch-l1-2-0.dll
from <Current directory>\$dpx$.tmp\8d8a445f12c0424a922314b7b6fd0c7a.tmp to <Current directory>\api-ms-win-core-synch-l1-1-0.dll
from <Current directory>\$dpx$.tmp\0143b3107eafc440a614d4f2df72b032.tmp to <Current directory>\api-ms-win-core-debug-l1-1-0.dll
from <Current directory>\$dpx$.tmp\911aa89b0b194b48a1105085ecd3fdd1.tmp to <Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7bf52a93fd4c3849a1b4864028e65809.tmp to <Current directory>\api-ms-win-core-file-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a7eba399269af04e83bfe516cf9a4dff.tmp to <Current directory>\api-ms-win-core-file-l1-2-0.dll
from <Current directory>\$dpx$.tmp\a169d29e39e40d4ca7d922499e81f94e.tmp to <Current directory>\api-ms-win-core-file-l2-1-0.dll
from <Current directory>\$dpx$.tmp\edcfc773789a4e49a4b9e70bcb7494bc.tmp to <Current directory>\api-ms-win-core-handle-l1-1-0.dll
from <Current directory>\$dpx$.tmp\8e02d19b7a2e6b4cbe91de2f80c6c395.tmp to <Current directory>\api-ms-win-core-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\94b795836fd56948b6060fb50b0c0d14.tmp to <Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
from <Current directory>\$dpx$.tmp\8caae827d873a444a9c5475da5286067.tmp to <Current directory>\api-ms-win-core-datetime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9ea4887e45b8a94387800dd30be8fcc7.tmp to <Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
from <Current directory>\$dpx$.tmp\18a72c016d07494fbaef2510764c9842.tmp to <Current directory>\api-ms-win-core-memory-l1-1-0.dll
from <Current directory>\$dpx$.tmp\81775d2c712c134a84d6c5b2c893f143.tmp to <Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ff079b9678ac274aafea0b6cb5c389a6.tmp to <Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ad6913863c7ade4fa0d0a4ccb1d5c7f8.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
from <Current directory>\$dpx$.tmp\14891b24acef1643be0895a72e92634f.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
from <Current directory>\$dpx$.tmp\95c90eff60bccc4ebe7d38a38355ce93.tmp to <Current directory>\api-ms-win-core-profile-l1-1-0.dll
from <Current directory>\$dpx$.tmp\d674d7a8cc1e54429d04b2bd77d7228c.tmp to <Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
from <Current directory>\$dpx$.tmp\bcadef0d2a69204f83afab555c71574e.tmp to <Current directory>\api-ms-win-core-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b657f82a722bf245a30a3e054e20e7de.tmp to <Current directory>\api-ms-win-core-localization-l1-2-0.dll
from <Current directory>\$dpx$.tmp\c2dfcfb24170df44945ebaef8d3bf094.tmp to <Current directory>\ucrtbase.dll
from <Current directory>\$dpx$.tmp\c879fec321dbeb4090dad6cc141777f8.tmp to <Current directory>\vcruntime140.dll

Network activity

Connects to

'lp##.haqo.net':443

TCP

'lp##.abbny.com':443

UDP

DNS ASK lp##.beahh.com
DNS ASK lp##.abbny.com
DNS ASK lp##.haqo.net

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a
'<SYSTEM32>\expand.exe' d.cab -f:* .

Технології

Терміни

Навчання

Міфи

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней