Trojan.DownLoader30.37703

Technical Information

Modifies file system

Creates the following files

<Current directory>\d.cab
<Current directory>\$dpx$.tmp\57c9289c0f350e419aba3438d5603fc4.tmp
<Current directory>\$dpx$.tmp\2947d7867628614bb5dcded8e3059507.tmp
<Current directory>\$dpx$.tmp\728f70c3f8634c43b4e87d46fecb0ba7.tmp
<Current directory>\$dpx$.tmp\cc26f4acc4fd134f9b2ba67df2050fe3.tmp
<Current directory>\$dpx$.tmp\1b911781315ff74880f5fae8b8d83ee0.tmp
<Current directory>\$dpx$.tmp\113264386d327347b3c757000e05d875.tmp
<Current directory>\$dpx$.tmp\792f3b0649bc3f498e7f9a06fefb2b4a.tmp
<Current directory>\$dpx$.tmp\fdffd39f354243428f14fdbdc4dc9cfa.tmp
<Current directory>\$dpx$.tmp\5623ad4766205c4c975f6a3de63e4b4c.tmp
<Current directory>\$dpx$.tmp\1499dd6464a3f549b3c9b08a78a1b744.tmp
<Current directory>\$dpx$.tmp\f358cc604feeb24dbc75cfff858e2617.tmp
<Current directory>\$dpx$.tmp\d8324fb50f7b6e439a732a92aa514895.tmp
<Current directory>\$dpx$.tmp\11769f2ce926a643a72b29ffd8f4d68d.tmp
<Current directory>\$dpx$.tmp\d655484484656c4484281c10bd88914d.tmp
<Current directory>\$dpx$.tmp\ca42eff436f875479dc77c36b8fe15c7.tmp
<Current directory>\$dpx$.tmp\174756074daa41488bc6bc7db41ebd29.tmp
<Current directory>\$dpx$.tmp\8c38ebbed822714394b5ee375cfebef4.tmp
<Current directory>\$dpx$.tmp\1f7bc09b80a0984e965b786890e56122.tmp
<Current directory>\$dpx$.tmp\391982a5cd368342a54f013cc068a088.tmp
<Current directory>\$dpx$.tmp\5e9d711f0bc6fe48ba4fa8aa6b351a04.tmp
<Current directory>\$dpx$.tmp\a13ec7bc9a09fa48a6a6f4cdbe1ae1b0.tmp
<Current directory>\$dpx$.tmp\fbcc1b8e2ef5d94c8b35ed26776390ab.tmp
<Current directory>\$dpx$.tmp\a4191b6146d53544a8451fc55c9b38bf.tmp
<Current directory>\$dpx$.tmp\00d3ae9cd3e2314fbeb5bc39ae0cc8d0.tmp
<Current directory>\$dpx$.tmp\cc424a74e0ade64b8a1800bb9ca6ba26.tmp
<Current directory>\$dpx$.tmp\1a4809b1b592954896f2d4b33abb1a7f.tmp
<Current directory>\$dpx$.tmp\bbe8e9126f05354893dbf360e89c88ee.tmp
<Current directory>\$dpx$.tmp\ac9c55e77d172d42892e38e7aab586d4.tmp
<Current directory>\$dpx$.tmp\777c2b7ad8bc974d94645cc75d873989.tmp
<Current directory>\$dpx$.tmp\94e2018308affc47a25ef3d0b9522fff.tmp
<Current directory>\$dpx$.tmp\892b080b37fab44ca77af1932e4a93e9.tmp
<Current directory>\$dpx$.tmp\4772466e0cb01a449f8ff7a466407c43.tmp
<Current directory>\$dpx$.tmp\aa2fe5c1be22ba45a84c3fce7e6baea3.tmp
<Current directory>\$dpx$.tmp\b0185bef728f814891d21dd923a7c530.tmp
<Current directory>\$dpx$.tmp\c34959fde6afe64d9a1dd0dec0321040.tmp
<Current directory>\$dpx$.tmp\751eefac657a4642b45aba8f3708a5a9.tmp
<Current directory>\$dpx$.tmp\aef61b2807bb234ca4d152e3fb24052e.tmp
<Current directory>\$dpx$.tmp\639083e88867184ebe256f7a6854e8cd.tmp
<Current directory>\$dpx$.tmp\8c75cd65e8d05841b119cede5889fc5d.tmp
<Current directory>\$dpx$.tmp\35a746c4e1b1764c8c9a4e37dc137c45.tmp
<Current directory>\$dpx$.tmp\b4ee95e7ace9e84a99c30e2e4147025f.tmp
<Current directory>\$dpx$.tmp\8da19c17ed38874eb59c3e05a9953a71.tmp
<Current directory>\$dpx$.tmp\95f95de5cd479146aa984048620ae048.tmp
<Current directory>\$dpx$.tmp\03b5f8a2b71e094e8c94b85d114a23d2.tmp

Sets the 'hidden' attribute to the following files

<Current directory>\api-ms-win-core-console-l1-1-0.dll
<Current directory>\api-ms-win-crt-conio-l1-1-0.dll
<Current directory>\api-ms-win-crt-convert-l1-1-0.dll
<Current directory>\api-ms-win-crt-environment-l1-1-0.dll
<Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
<Current directory>\api-ms-win-crt-heap-l1-1-0.dll
<Current directory>\api-ms-win-crt-locale-l1-1-0.dll
<Current directory>\api-ms-win-crt-math-l1-1-0.dll
<Current directory>\api-ms-win-core-timezone-l1-1-0.dll
<Current directory>\api-ms-win-core-util-l1-1-0.dll
<Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
<Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
<Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
<Current directory>\api-ms-win-crt-string-l1-1-0.dll
<Current directory>\api-ms-win-crt-time-l1-1-0.dll
<Current directory>\api-ms-win-crt-utility-l1-1-0.dll
<Current directory>\msvcp140.dll
<Current directory>\opencl.dll
<Current directory>\api-ms-win-crt-private-l1-1-0.dll
<Current directory>\api-ms-win-crt-process-l1-1-0.dll
<Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
<Current directory>\api-ms-win-core-synch-l1-2-0.dll
<Current directory>\api-ms-win-core-synch-l1-1-0.dll
<Current directory>\api-ms-win-core-debug-l1-1-0.dll
<Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-2-0.dll
<Current directory>\api-ms-win-core-file-l2-1-0.dll
<Current directory>\api-ms-win-core-handle-l1-1-0.dll
<Current directory>\api-ms-win-core-heap-l1-1-0.dll
<Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
<Current directory>\api-ms-win-core-datetime-l1-1-0.dll
<Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
<Current directory>\api-ms-win-core-memory-l1-1-0.dll
<Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
<Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
<Current directory>\api-ms-win-core-profile-l1-1-0.dll
<Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
<Current directory>\api-ms-win-core-string-l1-1-0.dll
<Current directory>\api-ms-win-core-localization-l1-2-0.dll
<Current directory>\ucrtbase.dll
<Current directory>\vcruntime140.dll

Deletes the following files

<Current directory>\d.cab

Moves the following files

from <Current directory>\$dpx$.tmp\00d3ae9cd3e2314fbeb5bc39ae0cc8d0.tmp to <Current directory>\api-ms-win-core-console-l1-1-0.dll
from <Current directory>\$dpx$.tmp\728f70c3f8634c43b4e87d46fecb0ba7.tmp to <Current directory>\api-ms-win-crt-conio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\cc26f4acc4fd134f9b2ba67df2050fe3.tmp to <Current directory>\api-ms-win-crt-convert-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1b911781315ff74880f5fae8b8d83ee0.tmp to <Current directory>\api-ms-win-crt-environment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\113264386d327347b3c757000e05d875.tmp to <Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
from <Current directory>\$dpx$.tmp\792f3b0649bc3f498e7f9a06fefb2b4a.tmp to <Current directory>\api-ms-win-crt-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\fdffd39f354243428f14fdbdc4dc9cfa.tmp to <Current directory>\api-ms-win-crt-locale-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5623ad4766205c4c975f6a3de63e4b4c.tmp to <Current directory>\api-ms-win-crt-math-l1-1-0.dll
from <Current directory>\$dpx$.tmp\57c9289c0f350e419aba3438d5603fc4.tmp to <Current directory>\api-ms-win-core-timezone-l1-1-0.dll
from <Current directory>\$dpx$.tmp\2947d7867628614bb5dcded8e3059507.tmp to <Current directory>\api-ms-win-core-util-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1499dd6464a3f549b3c9b08a78a1b744.tmp to <Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
from <Current directory>\$dpx$.tmp\11769f2ce926a643a72b29ffd8f4d68d.tmp to <Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\d655484484656c4484281c10bd88914d.tmp to <Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ca42eff436f875479dc77c36b8fe15c7.tmp to <Current directory>\api-ms-win-crt-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\174756074daa41488bc6bc7db41ebd29.tmp to <Current directory>\api-ms-win-crt-time-l1-1-0.dll
from <Current directory>\$dpx$.tmp\8c38ebbed822714394b5ee375cfebef4.tmp to <Current directory>\api-ms-win-crt-utility-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1f7bc09b80a0984e965b786890e56122.tmp to <Current directory>\msvcp140.dll
from <Current directory>\$dpx$.tmp\391982a5cd368342a54f013cc068a088.tmp to <Current directory>\opencl.dll
from <Current directory>\$dpx$.tmp\f358cc604feeb24dbc75cfff858e2617.tmp to <Current directory>\api-ms-win-crt-private-l1-1-0.dll
from <Current directory>\$dpx$.tmp\d8324fb50f7b6e439a732a92aa514895.tmp to <Current directory>\api-ms-win-crt-process-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5e9d711f0bc6fe48ba4fa8aa6b351a04.tmp to <Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
from <Current directory>\$dpx$.tmp\fbcc1b8e2ef5d94c8b35ed26776390ab.tmp to <Current directory>\api-ms-win-core-synch-l1-2-0.dll
from <Current directory>\$dpx$.tmp\95f95de5cd479146aa984048620ae048.tmp to <Current directory>\api-ms-win-core-synch-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1a4809b1b592954896f2d4b33abb1a7f.tmp to <Current directory>\api-ms-win-core-debug-l1-1-0.dll
from <Current directory>\$dpx$.tmp\bbe8e9126f05354893dbf360e89c88ee.tmp to <Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ac9c55e77d172d42892e38e7aab586d4.tmp to <Current directory>\api-ms-win-core-file-l1-1-0.dll
from <Current directory>\$dpx$.tmp\777c2b7ad8bc974d94645cc75d873989.tmp to <Current directory>\api-ms-win-core-file-l1-2-0.dll
from <Current directory>\$dpx$.tmp\94e2018308affc47a25ef3d0b9522fff.tmp to <Current directory>\api-ms-win-core-file-l2-1-0.dll
from <Current directory>\$dpx$.tmp\892b080b37fab44ca77af1932e4a93e9.tmp to <Current directory>\api-ms-win-core-handle-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4772466e0cb01a449f8ff7a466407c43.tmp to <Current directory>\api-ms-win-core-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\aa2fe5c1be22ba45a84c3fce7e6baea3.tmp to <Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
from <Current directory>\$dpx$.tmp\cc424a74e0ade64b8a1800bb9ca6ba26.tmp to <Current directory>\api-ms-win-core-datetime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b0185bef728f814891d21dd923a7c530.tmp to <Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
from <Current directory>\$dpx$.tmp\751eefac657a4642b45aba8f3708a5a9.tmp to <Current directory>\api-ms-win-core-memory-l1-1-0.dll
from <Current directory>\$dpx$.tmp\aef61b2807bb234ca4d152e3fb24052e.tmp to <Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
from <Current directory>\$dpx$.tmp\639083e88867184ebe256f7a6854e8cd.tmp to <Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\8c75cd65e8d05841b119cede5889fc5d.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
from <Current directory>\$dpx$.tmp\35a746c4e1b1764c8c9a4e37dc137c45.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
from <Current directory>\$dpx$.tmp\b4ee95e7ace9e84a99c30e2e4147025f.tmp to <Current directory>\api-ms-win-core-profile-l1-1-0.dll
from <Current directory>\$dpx$.tmp\8da19c17ed38874eb59c3e05a9953a71.tmp to <Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a4191b6146d53544a8451fc55c9b38bf.tmp to <Current directory>\api-ms-win-core-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c34959fde6afe64d9a1dd0dec0321040.tmp to <Current directory>\api-ms-win-core-localization-l1-2-0.dll
from <Current directory>\$dpx$.tmp\a13ec7bc9a09fa48a6a6f4cdbe1ae1b0.tmp to <Current directory>\ucrtbase.dll
from <Current directory>\$dpx$.tmp\03b5f8a2b71e094e8c94b85d114a23d2.tmp to <Current directory>\vcruntime140.dll

Network activity

Connects to

'localhost':443

UDP

DNS ASK lp##.beahh.com
DNS ASK lp##.abbny.com
DNS ASK lp##.haqo.net

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a
'<SYSTEM32>\expand.exe' d.cab -f:* .

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней