Trojan.DownLoader30.37716

Technical Information

Modifies file system

Creates the following files

<Current directory>\d.cab
<Current directory>\$dpx$.tmp\810fe5ef6af9694a9fc3755a3e8995fe.tmp
<Current directory>\$dpx$.tmp\5a496be97b181849b05e278831cecc13.tmp
<Current directory>\$dpx$.tmp\8bd6e8ae5cada94f97cc28c9b6068d30.tmp
<Current directory>\$dpx$.tmp\7c9af2cfa0da89429c46505b9e1adab2.tmp
<Current directory>\$dpx$.tmp\b1a6e09eb4a5f548a2da132ddff33fdb.tmp
<Current directory>\$dpx$.tmp\6749dc8e9b381d4ead31ed50dd061177.tmp
<Current directory>\$dpx$.tmp\59ad384141401f4e8e6118e888202a9c.tmp
<Current directory>\$dpx$.tmp\11db5eb1a0a2d04c8607c4c54bd5416d.tmp
<Current directory>\$dpx$.tmp\14d10c4f66193b419207cc890b5b3bb1.tmp
<Current directory>\$dpx$.tmp\56834e353aa27442adeabf8380624729.tmp
<Current directory>\$dpx$.tmp\462878db0f26744c9325233a05d5fd23.tmp
<Current directory>\$dpx$.tmp\7c1cbae388394141836ecca9ec570720.tmp
<Current directory>\$dpx$.tmp\5a81608c611d8b45805c39fd56f15bb7.tmp
<Current directory>\$dpx$.tmp\4b6bc4d39c2bf842b73433f826e7b57c.tmp
<Current directory>\$dpx$.tmp\c28fe21aa4ba1244be0c5c83a22bcc49.tmp
<Current directory>\$dpx$.tmp\82de55a37d06684188931d04d3b5471c.tmp
<Current directory>\$dpx$.tmp\c3e2b1bc06db4741bd58f606e4f22240.tmp
<Current directory>\$dpx$.tmp\8e90d77f4d2a3f43bbca3fdf80fc0fe7.tmp
<Current directory>\$dpx$.tmp\7797252928abde4ba30606bba73f4936.tmp
<Current directory>\$dpx$.tmp\45f61445190bdc4eb87b045a4f0aac6f.tmp
<Current directory>\$dpx$.tmp\0bce6b909de04a45aa92d288d25034f0.tmp
<Current directory>\$dpx$.tmp\6e60362eb0a5e24c9ff88657ec0a9792.tmp
<Current directory>\$dpx$.tmp\9227a06127ff3547855377a303d4f546.tmp
<Current directory>\$dpx$.tmp\1a01ad9c9dacd34388fbb4a36e8444a8.tmp
<Current directory>\$dpx$.tmp\cf22194286968e48bf06004c8207648e.tmp
<Current directory>\$dpx$.tmp\f0b6f40050f93742be74eb56de698860.tmp
<Current directory>\$dpx$.tmp\b5ce468393d2c04b80fcab33e11c3415.tmp
<Current directory>\$dpx$.tmp\c2ffec23ba95ca458a8fd91517831c69.tmp
<Current directory>\$dpx$.tmp\7f6226c3233247459d18939e5e336691.tmp
<Current directory>\$dpx$.tmp\d5c8afa24990ad4e9cc254e72c8014ce.tmp
<Current directory>\$dpx$.tmp\df0a645e3365e34fa1cfdfa39ed83d32.tmp
<Current directory>\$dpx$.tmp\5be2a0431cce4347bbbb9ec7c5440019.tmp
<Current directory>\$dpx$.tmp\2dcab7d59eb83243ba757bf3808918fe.tmp
<Current directory>\$dpx$.tmp\dd9ff9a7d0c1a149854802f9f96879d2.tmp
<Current directory>\$dpx$.tmp\2cbe8c36735cb14ea6ec184426f14f9f.tmp
<Current directory>\$dpx$.tmp\6f23cbaf4ffe164fa55bce15d2490d93.tmp
<Current directory>\$dpx$.tmp\b21f7d9a9a560842bcef5d7f6414e52c.tmp
<Current directory>\$dpx$.tmp\d4e3fbe78f82a1419f1039eab2dcfb1b.tmp
<Current directory>\$dpx$.tmp\7536d50152695a4fa88330843d065caa.tmp
<Current directory>\$dpx$.tmp\10d4c0051fe92d4fa3ae02790e5835a8.tmp
<Current directory>\$dpx$.tmp\efee98f211122b419c461585cfc3876c.tmp
<Current directory>\$dpx$.tmp\2462a20854a8a34c8d97d14db2af17d9.tmp
<Current directory>\$dpx$.tmp\ed94fd1bd92c2c49bb931c26c50930da.tmp
<Current directory>\$dpx$.tmp\240b54a999248f49978d4b44b311dee7.tmp

Sets the 'hidden' attribute to the following files

<Current directory>\api-ms-win-core-console-l1-1-0.dll
<Current directory>\api-ms-win-crt-conio-l1-1-0.dll
<Current directory>\api-ms-win-crt-convert-l1-1-0.dll
<Current directory>\api-ms-win-crt-environment-l1-1-0.dll
<Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
<Current directory>\api-ms-win-crt-heap-l1-1-0.dll
<Current directory>\api-ms-win-crt-locale-l1-1-0.dll
<Current directory>\api-ms-win-crt-math-l1-1-0.dll
<Current directory>\api-ms-win-core-timezone-l1-1-0.dll
<Current directory>\api-ms-win-core-util-l1-1-0.dll
<Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
<Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
<Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
<Current directory>\api-ms-win-crt-string-l1-1-0.dll
<Current directory>\api-ms-win-crt-time-l1-1-0.dll
<Current directory>\api-ms-win-crt-utility-l1-1-0.dll
<Current directory>\msvcp140.dll
<Current directory>\opencl.dll
<Current directory>\api-ms-win-crt-private-l1-1-0.dll
<Current directory>\api-ms-win-crt-process-l1-1-0.dll
<Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
<Current directory>\api-ms-win-core-synch-l1-2-0.dll
<Current directory>\api-ms-win-core-synch-l1-1-0.dll
<Current directory>\api-ms-win-core-debug-l1-1-0.dll
<Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-2-0.dll
<Current directory>\api-ms-win-core-file-l2-1-0.dll
<Current directory>\api-ms-win-core-handle-l1-1-0.dll
<Current directory>\api-ms-win-core-heap-l1-1-0.dll
<Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
<Current directory>\api-ms-win-core-datetime-l1-1-0.dll
<Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
<Current directory>\api-ms-win-core-memory-l1-1-0.dll
<Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
<Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
<Current directory>\api-ms-win-core-profile-l1-1-0.dll
<Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
<Current directory>\api-ms-win-core-string-l1-1-0.dll
<Current directory>\api-ms-win-core-localization-l1-2-0.dll
<Current directory>\ucrtbase.dll
<Current directory>\vcruntime140.dll

Deletes the following files

<Current directory>\d.cab

Moves the following files

from <Current directory>\$dpx$.tmp\1a01ad9c9dacd34388fbb4a36e8444a8.tmp to <Current directory>\api-ms-win-core-console-l1-1-0.dll
from <Current directory>\$dpx$.tmp\8bd6e8ae5cada94f97cc28c9b6068d30.tmp to <Current directory>\api-ms-win-crt-conio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7c9af2cfa0da89429c46505b9e1adab2.tmp to <Current directory>\api-ms-win-crt-convert-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b1a6e09eb4a5f548a2da132ddff33fdb.tmp to <Current directory>\api-ms-win-crt-environment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6749dc8e9b381d4ead31ed50dd061177.tmp to <Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
from <Current directory>\$dpx$.tmp\59ad384141401f4e8e6118e888202a9c.tmp to <Current directory>\api-ms-win-crt-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\11db5eb1a0a2d04c8607c4c54bd5416d.tmp to <Current directory>\api-ms-win-crt-locale-l1-1-0.dll
from <Current directory>\$dpx$.tmp\14d10c4f66193b419207cc890b5b3bb1.tmp to <Current directory>\api-ms-win-crt-math-l1-1-0.dll
from <Current directory>\$dpx$.tmp\810fe5ef6af9694a9fc3755a3e8995fe.tmp to <Current directory>\api-ms-win-core-timezone-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5a496be97b181849b05e278831cecc13.tmp to <Current directory>\api-ms-win-core-util-l1-1-0.dll
from <Current directory>\$dpx$.tmp\56834e353aa27442adeabf8380624729.tmp to <Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5a81608c611d8b45805c39fd56f15bb7.tmp to <Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4b6bc4d39c2bf842b73433f826e7b57c.tmp to <Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c28fe21aa4ba1244be0c5c83a22bcc49.tmp to <Current directory>\api-ms-win-crt-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\82de55a37d06684188931d04d3b5471c.tmp to <Current directory>\api-ms-win-crt-time-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c3e2b1bc06db4741bd58f606e4f22240.tmp to <Current directory>\api-ms-win-crt-utility-l1-1-0.dll
from <Current directory>\$dpx$.tmp\8e90d77f4d2a3f43bbca3fdf80fc0fe7.tmp to <Current directory>\msvcp140.dll
from <Current directory>\$dpx$.tmp\7797252928abde4ba30606bba73f4936.tmp to <Current directory>\opencl.dll
from <Current directory>\$dpx$.tmp\462878db0f26744c9325233a05d5fd23.tmp to <Current directory>\api-ms-win-crt-private-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7c1cbae388394141836ecca9ec570720.tmp to <Current directory>\api-ms-win-crt-process-l1-1-0.dll
from <Current directory>\$dpx$.tmp\45f61445190bdc4eb87b045a4f0aac6f.tmp to <Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6e60362eb0a5e24c9ff88657ec0a9792.tmp to <Current directory>\api-ms-win-core-synch-l1-2-0.dll
from <Current directory>\$dpx$.tmp\ed94fd1bd92c2c49bb931c26c50930da.tmp to <Current directory>\api-ms-win-core-synch-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f0b6f40050f93742be74eb56de698860.tmp to <Current directory>\api-ms-win-core-debug-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b5ce468393d2c04b80fcab33e11c3415.tmp to <Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c2ffec23ba95ca458a8fd91517831c69.tmp to <Current directory>\api-ms-win-core-file-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7f6226c3233247459d18939e5e336691.tmp to <Current directory>\api-ms-win-core-file-l1-2-0.dll
from <Current directory>\$dpx$.tmp\d5c8afa24990ad4e9cc254e72c8014ce.tmp to <Current directory>\api-ms-win-core-file-l2-1-0.dll
from <Current directory>\$dpx$.tmp\df0a645e3365e34fa1cfdfa39ed83d32.tmp to <Current directory>\api-ms-win-core-handle-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5be2a0431cce4347bbbb9ec7c5440019.tmp to <Current directory>\api-ms-win-core-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\2dcab7d59eb83243ba757bf3808918fe.tmp to <Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
from <Current directory>\$dpx$.tmp\cf22194286968e48bf06004c8207648e.tmp to <Current directory>\api-ms-win-core-datetime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\dd9ff9a7d0c1a149854802f9f96879d2.tmp to <Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6f23cbaf4ffe164fa55bce15d2490d93.tmp to <Current directory>\api-ms-win-core-memory-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b21f7d9a9a560842bcef5d7f6414e52c.tmp to <Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
from <Current directory>\$dpx$.tmp\d4e3fbe78f82a1419f1039eab2dcfb1b.tmp to <Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7536d50152695a4fa88330843d065caa.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
from <Current directory>\$dpx$.tmp\10d4c0051fe92d4fa3ae02790e5835a8.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
from <Current directory>\$dpx$.tmp\efee98f211122b419c461585cfc3876c.tmp to <Current directory>\api-ms-win-core-profile-l1-1-0.dll
from <Current directory>\$dpx$.tmp\2462a20854a8a34c8d97d14db2af17d9.tmp to <Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9227a06127ff3547855377a303d4f546.tmp to <Current directory>\api-ms-win-core-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\2cbe8c36735cb14ea6ec184426f14f9f.tmp to <Current directory>\api-ms-win-core-localization-l1-2-0.dll
from <Current directory>\$dpx$.tmp\0bce6b909de04a45aa92d288d25034f0.tmp to <Current directory>\ucrtbase.dll
from <Current directory>\$dpx$.tmp\240b54a999248f49978d4b44b311dee7.tmp to <Current directory>\vcruntime140.dll

Network activity

Connects to

'localhost':443

UDP

DNS ASK lp##.beahh.com
DNS ASK lp##.abbny.com
DNS ASK lp##.haqo.net

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a
'<SYSTEM32>\expand.exe' d.cab -f:* .

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней