Trojan.DownLoader30.37702

Technical Information

Modifies file system

Creates the following files

<Current directory>\d.cab
<Current directory>\$dpx$.tmp\84374ac87b86c74e99b7cfd9bcdfa3b2.tmp
<Current directory>\$dpx$.tmp\2ac00235aba1c543b489d283f679f388.tmp
<Current directory>\$dpx$.tmp\a6b42d886e3c064e8311527a675a6be0.tmp
<Current directory>\$dpx$.tmp\14ce6bebb4e67a4ba047f7d44469aefa.tmp
<Current directory>\$dpx$.tmp\c13729ca91d7f8429947166f12e5c631.tmp
<Current directory>\$dpx$.tmp\f658b09ce544394d842e110016ae4624.tmp
<Current directory>\$dpx$.tmp\1a168a8a2613c944896183ababdfae99.tmp
<Current directory>\$dpx$.tmp\45524861aff3054db952a9b61b7dc643.tmp
<Current directory>\$dpx$.tmp\a66f413449c5a843b079a8ac39a72b5e.tmp
<Current directory>\$dpx$.tmp\db9306056228b54db327f74143f60462.tmp
<Current directory>\$dpx$.tmp\9e30da3399cfda40ab103bd7433cb486.tmp
<Current directory>\$dpx$.tmp\04482375fd6b8b44be7119e5ddd2661a.tmp
<Current directory>\$dpx$.tmp\639134d8dea50947bc515d7487924441.tmp
<Current directory>\$dpx$.tmp\9a6d0f1aa9e90d4d8a6c108daae2f804.tmp
<Current directory>\$dpx$.tmp\b728b14ab35d5b4db27411d823ce1a6b.tmp
<Current directory>\$dpx$.tmp\22895c4b34bcac4fac26d8479354c80f.tmp
<Current directory>\$dpx$.tmp\b1921d7225ee7c41a6a78a0c12fff381.tmp
<Current directory>\$dpx$.tmp\2056d747d3818c4f84e89cf7d90297f0.tmp
<Current directory>\$dpx$.tmp\70da4613624be74aaaf6a55b56fcc26f.tmp
<Current directory>\$dpx$.tmp\d2e1fdf1c91ab049abe910ba4371acfd.tmp
<Current directory>\$dpx$.tmp\e94638203bed9843b76a0c50885612ab.tmp
<Current directory>\$dpx$.tmp\5c8ad29928d25041adb690d83adc946e.tmp
<Current directory>\$dpx$.tmp\86adc999ba1e3543b42659428192e5cb.tmp
<Current directory>\$dpx$.tmp\b6c50b041441ad40b2f548e42f834f73.tmp
<Current directory>\$dpx$.tmp\931b5345c492ff4f9fda1f685d469cf3.tmp
<Current directory>\$dpx$.tmp\d1d459fce5b56d4187dab7cfe859ab4e.tmp
<Current directory>\$dpx$.tmp\32d430eed7e76146aa1da7f413b498be.tmp
<Current directory>\$dpx$.tmp\c2592a5b8efd6e46bdd43c72d0cf7774.tmp
<Current directory>\$dpx$.tmp\e8b563d0cb29c44f9bc039c33e6ca445.tmp
<Current directory>\$dpx$.tmp\29d57a5998226841b9dedfff49f56cdd.tmp
<Current directory>\$dpx$.tmp\7bdb94475e90a84dbaeeacfc4245a1d7.tmp
<Current directory>\$dpx$.tmp\6483b31919704944ada86680edd8b982.tmp
<Current directory>\$dpx$.tmp\23bd462fefb06b4cb8717c098e3f1f5a.tmp
<Current directory>\$dpx$.tmp\10780d97dfce6f42a58a119ae187fca7.tmp
<Current directory>\$dpx$.tmp\61622b531f6ab54db3e5a7d551b21cb5.tmp
<Current directory>\$dpx$.tmp\8c75130cd34f94458c49ec263a1be423.tmp
<Current directory>\$dpx$.tmp\e5adb081be1df140bf52b195eca4a688.tmp
<Current directory>\$dpx$.tmp\63ea58519c3d79459fffbe7220b3866f.tmp
<Current directory>\$dpx$.tmp\75535f39521e5f408caf06bf3e294e89.tmp
<Current directory>\$dpx$.tmp\ebfb5d24e7ec8b419ca1a742be11b71d.tmp
<Current directory>\$dpx$.tmp\8bb7387174633d4b91a5c204001bca01.tmp
<Current directory>\$dpx$.tmp\0b65bed374def34fb9b4b0bd4b15c5d2.tmp
<Current directory>\$dpx$.tmp\c034be520d0fc846a2cecd5f5cac07d1.tmp
<Current directory>\$dpx$.tmp\084cfdcac7e9164c8087fbb8c0e5956c.tmp

Sets the 'hidden' attribute to the following files

<Current directory>\api-ms-win-core-console-l1-1-0.dll
<Current directory>\api-ms-win-crt-conio-l1-1-0.dll
<Current directory>\api-ms-win-crt-convert-l1-1-0.dll
<Current directory>\api-ms-win-crt-environment-l1-1-0.dll
<Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
<Current directory>\api-ms-win-crt-heap-l1-1-0.dll
<Current directory>\api-ms-win-crt-locale-l1-1-0.dll
<Current directory>\api-ms-win-crt-math-l1-1-0.dll
<Current directory>\api-ms-win-core-timezone-l1-1-0.dll
<Current directory>\api-ms-win-core-util-l1-1-0.dll
<Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
<Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
<Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
<Current directory>\api-ms-win-crt-string-l1-1-0.dll
<Current directory>\api-ms-win-crt-time-l1-1-0.dll
<Current directory>\api-ms-win-crt-utility-l1-1-0.dll
<Current directory>\msvcp140.dll
<Current directory>\opencl.dll
<Current directory>\api-ms-win-crt-private-l1-1-0.dll
<Current directory>\api-ms-win-crt-process-l1-1-0.dll
<Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
<Current directory>\api-ms-win-core-synch-l1-2-0.dll
<Current directory>\api-ms-win-core-synch-l1-1-0.dll
<Current directory>\api-ms-win-core-debug-l1-1-0.dll
<Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-2-0.dll
<Current directory>\api-ms-win-core-file-l2-1-0.dll
<Current directory>\api-ms-win-core-handle-l1-1-0.dll
<Current directory>\api-ms-win-core-heap-l1-1-0.dll
<Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
<Current directory>\api-ms-win-core-datetime-l1-1-0.dll
<Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
<Current directory>\api-ms-win-core-memory-l1-1-0.dll
<Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
<Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
<Current directory>\api-ms-win-core-profile-l1-1-0.dll
<Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
<Current directory>\api-ms-win-core-string-l1-1-0.dll
<Current directory>\api-ms-win-core-localization-l1-2-0.dll
<Current directory>\ucrtbase.dll
<Current directory>\vcruntime140.dll

Deletes the following files

<Current directory>\d.cab

Moves the following files

from <Current directory>\$dpx$.tmp\b6c50b041441ad40b2f548e42f834f73.tmp to <Current directory>\api-ms-win-core-console-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a6b42d886e3c064e8311527a675a6be0.tmp to <Current directory>\api-ms-win-crt-conio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\14ce6bebb4e67a4ba047f7d44469aefa.tmp to <Current directory>\api-ms-win-crt-convert-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c13729ca91d7f8429947166f12e5c631.tmp to <Current directory>\api-ms-win-crt-environment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f658b09ce544394d842e110016ae4624.tmp to <Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1a168a8a2613c944896183ababdfae99.tmp to <Current directory>\api-ms-win-crt-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\45524861aff3054db952a9b61b7dc643.tmp to <Current directory>\api-ms-win-crt-locale-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a66f413449c5a843b079a8ac39a72b5e.tmp to <Current directory>\api-ms-win-crt-math-l1-1-0.dll
from <Current directory>\$dpx$.tmp\84374ac87b86c74e99b7cfd9bcdfa3b2.tmp to <Current directory>\api-ms-win-core-timezone-l1-1-0.dll
from <Current directory>\$dpx$.tmp\2ac00235aba1c543b489d283f679f388.tmp to <Current directory>\api-ms-win-core-util-l1-1-0.dll
from <Current directory>\$dpx$.tmp\db9306056228b54db327f74143f60462.tmp to <Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
from <Current directory>\$dpx$.tmp\639134d8dea50947bc515d7487924441.tmp to <Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9a6d0f1aa9e90d4d8a6c108daae2f804.tmp to <Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b728b14ab35d5b4db27411d823ce1a6b.tmp to <Current directory>\api-ms-win-crt-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\22895c4b34bcac4fac26d8479354c80f.tmp to <Current directory>\api-ms-win-crt-time-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b1921d7225ee7c41a6a78a0c12fff381.tmp to <Current directory>\api-ms-win-crt-utility-l1-1-0.dll
from <Current directory>\$dpx$.tmp\2056d747d3818c4f84e89cf7d90297f0.tmp to <Current directory>\msvcp140.dll
from <Current directory>\$dpx$.tmp\70da4613624be74aaaf6a55b56fcc26f.tmp to <Current directory>\opencl.dll
from <Current directory>\$dpx$.tmp\9e30da3399cfda40ab103bd7433cb486.tmp to <Current directory>\api-ms-win-crt-private-l1-1-0.dll
from <Current directory>\$dpx$.tmp\04482375fd6b8b44be7119e5ddd2661a.tmp to <Current directory>\api-ms-win-crt-process-l1-1-0.dll
from <Current directory>\$dpx$.tmp\d2e1fdf1c91ab049abe910ba4371acfd.tmp to <Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5c8ad29928d25041adb690d83adc946e.tmp to <Current directory>\api-ms-win-core-synch-l1-2-0.dll
from <Current directory>\$dpx$.tmp\c034be520d0fc846a2cecd5f5cac07d1.tmp to <Current directory>\api-ms-win-core-synch-l1-1-0.dll
from <Current directory>\$dpx$.tmp\d1d459fce5b56d4187dab7cfe859ab4e.tmp to <Current directory>\api-ms-win-core-debug-l1-1-0.dll
from <Current directory>\$dpx$.tmp\32d430eed7e76146aa1da7f413b498be.tmp to <Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c2592a5b8efd6e46bdd43c72d0cf7774.tmp to <Current directory>\api-ms-win-core-file-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e8b563d0cb29c44f9bc039c33e6ca445.tmp to <Current directory>\api-ms-win-core-file-l1-2-0.dll
from <Current directory>\$dpx$.tmp\29d57a5998226841b9dedfff49f56cdd.tmp to <Current directory>\api-ms-win-core-file-l2-1-0.dll
from <Current directory>\$dpx$.tmp\7bdb94475e90a84dbaeeacfc4245a1d7.tmp to <Current directory>\api-ms-win-core-handle-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6483b31919704944ada86680edd8b982.tmp to <Current directory>\api-ms-win-core-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\23bd462fefb06b4cb8717c098e3f1f5a.tmp to <Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
from <Current directory>\$dpx$.tmp\931b5345c492ff4f9fda1f685d469cf3.tmp to <Current directory>\api-ms-win-core-datetime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\10780d97dfce6f42a58a119ae187fca7.tmp to <Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
from <Current directory>\$dpx$.tmp\8c75130cd34f94458c49ec263a1be423.tmp to <Current directory>\api-ms-win-core-memory-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e5adb081be1df140bf52b195eca4a688.tmp to <Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
from <Current directory>\$dpx$.tmp\63ea58519c3d79459fffbe7220b3866f.tmp to <Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\75535f39521e5f408caf06bf3e294e89.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ebfb5d24e7ec8b419ca1a742be11b71d.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
from <Current directory>\$dpx$.tmp\8bb7387174633d4b91a5c204001bca01.tmp to <Current directory>\api-ms-win-core-profile-l1-1-0.dll
from <Current directory>\$dpx$.tmp\0b65bed374def34fb9b4b0bd4b15c5d2.tmp to <Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
from <Current directory>\$dpx$.tmp\86adc999ba1e3543b42659428192e5cb.tmp to <Current directory>\api-ms-win-core-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\61622b531f6ab54db3e5a7d551b21cb5.tmp to <Current directory>\api-ms-win-core-localization-l1-2-0.dll
from <Current directory>\$dpx$.tmp\e94638203bed9843b76a0c50885612ab.tmp to <Current directory>\ucrtbase.dll
from <Current directory>\$dpx$.tmp\084cfdcac7e9164c8087fbb8c0e5956c.tmp to <Current directory>\vcruntime140.dll

Network activity

Connects to

'localhost':443

UDP

DNS ASK lp##.beahh.com
DNS ASK lp##.abbny.com
DNS ASK lp##.haqo.net

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a
'<SYSTEM32>\expand.exe' d.cab -f:* .

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней