Trojan.DownLoader30.38381

Technical Information

Modifies file system

Creates the following files

<Current directory>\d.cab
<Current directory>\$dpx$.tmp\dba9fc1acab7f546b3f78b4f6bdc9799.tmp
<Current directory>\$dpx$.tmp\72ae85aed9ad0b4eab7cf924baf12b96.tmp
<Current directory>\$dpx$.tmp\82124b931e785b478cb9c9a1f6c8d2ab.tmp
<Current directory>\$dpx$.tmp\8c933f06eb312847a232b2049c40ffb3.tmp
<Current directory>\$dpx$.tmp\8351cdcbeb67fe4da65cabe4cc71d62a.tmp
<Current directory>\$dpx$.tmp\9dea517a96a901419c98538496cc697d.tmp
<Current directory>\$dpx$.tmp\e4183b656c63a548af99f71b0ef9844c.tmp
<Current directory>\$dpx$.tmp\2f724d7b1bdf4548b4203b43e84b665b.tmp
<Current directory>\$dpx$.tmp\4bc90fdb44657f44be4aae28c0598911.tmp
<Current directory>\$dpx$.tmp\66925944ef5d864c8dc266b625fb5f2c.tmp
<Current directory>\$dpx$.tmp\ff88a9fea7abbd4186d0f35a55c5149f.tmp
<Current directory>\$dpx$.tmp\03a75e6859c6964d987243585b44e98d.tmp
<Current directory>\$dpx$.tmp\c2b52f4cefde844a8d1c7a0579d1234d.tmp
<Current directory>\$dpx$.tmp\4a3fc4aba79bef41905696ed09c16ba9.tmp
<Current directory>\$dpx$.tmp\942d72d14dcba9499f571c92806e7881.tmp
<Current directory>\$dpx$.tmp\d736fd4498d9254386c2ab31853be145.tmp
<Current directory>\$dpx$.tmp\00a97120799c8f458f1d218214aaed36.tmp
<Current directory>\$dpx$.tmp\332f122864a4ad4fbe7ffd08f83553ec.tmp
<Current directory>\$dpx$.tmp\5a3b10ed8ead754481fa037ef0e34029.tmp
<Current directory>\$dpx$.tmp\6c167bb637fec94cb8005c630a0f608f.tmp
<Current directory>\$dpx$.tmp\86fd200739c2684eb21fe4b51263936d.tmp
<Current directory>\$dpx$.tmp\eda1b182a8b36147b8e7607902cf9901.tmp
<Current directory>\$dpx$.tmp\c696d53b2ce8764ca72e8d4d89cc3363.tmp
<Current directory>\$dpx$.tmp\9938c0c044a42d43a7518cf042a31a40.tmp
<Current directory>\$dpx$.tmp\83e22d614463f34b8f214d4fb8fe08e5.tmp
<Current directory>\$dpx$.tmp\7aed769e88042f489b52913cc908f978.tmp
<Current directory>\$dpx$.tmp\118ba8371577cf478c524959feba5f1a.tmp
<Current directory>\$dpx$.tmp\e2ca86688fcc1f4194c4f2cbea26a587.tmp
<Current directory>\$dpx$.tmp\5df89b46af0cf940b7d950317d03d32a.tmp
<Current directory>\$dpx$.tmp\d8e2c3354cd92a4c891f73939348f76d.tmp
<Current directory>\$dpx$.tmp\7cbf291792bff34d8d8b147f040f1dd5.tmp
<Current directory>\$dpx$.tmp\8169e9577147bb4280e8dfe0095c93fe.tmp
<Current directory>\$dpx$.tmp\85593bbb810fd84db53974552bf89041.tmp
<Current directory>\$dpx$.tmp\9dd7157be200ac4087164a028b6b13cb.tmp
<Current directory>\$dpx$.tmp\eb5f31fc3c90eb408f3e0a65a784c2d7.tmp
<Current directory>\$dpx$.tmp\ab80382beb012644988ac538b4c8ca72.tmp
<Current directory>\$dpx$.tmp\caaf880a8fe985438c2178e0bf8dea10.tmp
<Current directory>\$dpx$.tmp\0cb4db45e12da9439e49aa43e73990bb.tmp
<Current directory>\$dpx$.tmp\4a53a481c35c7d46ae38c0613d87e4c1.tmp
<Current directory>\$dpx$.tmp\01dc872669318c4386929aad3232f957.tmp
<Current directory>\$dpx$.tmp\5dde3ff7a220404587a70024361b6bb8.tmp
<Current directory>\$dpx$.tmp\3fa4db7274ba64418766bad2ecdffe4a.tmp
<Current directory>\$dpx$.tmp\c8773622569cd34d9e9a8d528a492943.tmp
<Current directory>\$dpx$.tmp\744fbfb8311b35468854b7aa02ae9d91.tmp

Sets the 'hidden' attribute to the following files

<Current directory>\api-ms-win-core-console-l1-1-0.dll
<Current directory>\api-ms-win-crt-conio-l1-1-0.dll
<Current directory>\api-ms-win-crt-convert-l1-1-0.dll
<Current directory>\api-ms-win-crt-environment-l1-1-0.dll
<Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
<Current directory>\api-ms-win-crt-heap-l1-1-0.dll
<Current directory>\api-ms-win-crt-locale-l1-1-0.dll
<Current directory>\api-ms-win-crt-math-l1-1-0.dll
<Current directory>\api-ms-win-core-timezone-l1-1-0.dll
<Current directory>\api-ms-win-core-util-l1-1-0.dll
<Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
<Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
<Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
<Current directory>\api-ms-win-crt-string-l1-1-0.dll
<Current directory>\api-ms-win-crt-time-l1-1-0.dll
<Current directory>\api-ms-win-crt-utility-l1-1-0.dll
<Current directory>\msvcp140.dll
<Current directory>\opencl.dll
<Current directory>\api-ms-win-crt-private-l1-1-0.dll
<Current directory>\api-ms-win-crt-process-l1-1-0.dll
<Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
<Current directory>\api-ms-win-core-synch-l1-2-0.dll
<Current directory>\api-ms-win-core-synch-l1-1-0.dll
<Current directory>\api-ms-win-core-debug-l1-1-0.dll
<Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-2-0.dll
<Current directory>\api-ms-win-core-file-l2-1-0.dll
<Current directory>\api-ms-win-core-handle-l1-1-0.dll
<Current directory>\api-ms-win-core-heap-l1-1-0.dll
<Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
<Current directory>\api-ms-win-core-datetime-l1-1-0.dll
<Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
<Current directory>\api-ms-win-core-memory-l1-1-0.dll
<Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
<Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
<Current directory>\api-ms-win-core-profile-l1-1-0.dll
<Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
<Current directory>\api-ms-win-core-string-l1-1-0.dll
<Current directory>\api-ms-win-core-localization-l1-2-0.dll
<Current directory>\ucrtbase.dll
<Current directory>\vcruntime140.dll

Deletes the following files

<Current directory>\d.cab

Moves the following files

from <Current directory>\$dpx$.tmp\9938c0c044a42d43a7518cf042a31a40.tmp to <Current directory>\api-ms-win-core-console-l1-1-0.dll
from <Current directory>\$dpx$.tmp\82124b931e785b478cb9c9a1f6c8d2ab.tmp to <Current directory>\api-ms-win-crt-conio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\8c933f06eb312847a232b2049c40ffb3.tmp to <Current directory>\api-ms-win-crt-convert-l1-1-0.dll
from <Current directory>\$dpx$.tmp\8351cdcbeb67fe4da65cabe4cc71d62a.tmp to <Current directory>\api-ms-win-crt-environment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9dea517a96a901419c98538496cc697d.tmp to <Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e4183b656c63a548af99f71b0ef9844c.tmp to <Current directory>\api-ms-win-crt-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\2f724d7b1bdf4548b4203b43e84b665b.tmp to <Current directory>\api-ms-win-crt-locale-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4bc90fdb44657f44be4aae28c0598911.tmp to <Current directory>\api-ms-win-crt-math-l1-1-0.dll
from <Current directory>\$dpx$.tmp\dba9fc1acab7f546b3f78b4f6bdc9799.tmp to <Current directory>\api-ms-win-core-timezone-l1-1-0.dll
from <Current directory>\$dpx$.tmp\72ae85aed9ad0b4eab7cf924baf12b96.tmp to <Current directory>\api-ms-win-core-util-l1-1-0.dll
from <Current directory>\$dpx$.tmp\66925944ef5d864c8dc266b625fb5f2c.tmp to <Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c2b52f4cefde844a8d1c7a0579d1234d.tmp to <Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4a3fc4aba79bef41905696ed09c16ba9.tmp to <Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\942d72d14dcba9499f571c92806e7881.tmp to <Current directory>\api-ms-win-crt-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\d736fd4498d9254386c2ab31853be145.tmp to <Current directory>\api-ms-win-crt-time-l1-1-0.dll
from <Current directory>\$dpx$.tmp\00a97120799c8f458f1d218214aaed36.tmp to <Current directory>\api-ms-win-crt-utility-l1-1-0.dll
from <Current directory>\$dpx$.tmp\332f122864a4ad4fbe7ffd08f83553ec.tmp to <Current directory>\msvcp140.dll
from <Current directory>\$dpx$.tmp\5a3b10ed8ead754481fa037ef0e34029.tmp to <Current directory>\opencl.dll
from <Current directory>\$dpx$.tmp\ff88a9fea7abbd4186d0f35a55c5149f.tmp to <Current directory>\api-ms-win-crt-private-l1-1-0.dll
from <Current directory>\$dpx$.tmp\03a75e6859c6964d987243585b44e98d.tmp to <Current directory>\api-ms-win-crt-process-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6c167bb637fec94cb8005c630a0f608f.tmp to <Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
from <Current directory>\$dpx$.tmp\eda1b182a8b36147b8e7607902cf9901.tmp to <Current directory>\api-ms-win-core-synch-l1-2-0.dll
from <Current directory>\$dpx$.tmp\c8773622569cd34d9e9a8d528a492943.tmp to <Current directory>\api-ms-win-core-synch-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7aed769e88042f489b52913cc908f978.tmp to <Current directory>\api-ms-win-core-debug-l1-1-0.dll
from <Current directory>\$dpx$.tmp\118ba8371577cf478c524959feba5f1a.tmp to <Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e2ca86688fcc1f4194c4f2cbea26a587.tmp to <Current directory>\api-ms-win-core-file-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5df89b46af0cf940b7d950317d03d32a.tmp to <Current directory>\api-ms-win-core-file-l1-2-0.dll
from <Current directory>\$dpx$.tmp\d8e2c3354cd92a4c891f73939348f76d.tmp to <Current directory>\api-ms-win-core-file-l2-1-0.dll
from <Current directory>\$dpx$.tmp\7cbf291792bff34d8d8b147f040f1dd5.tmp to <Current directory>\api-ms-win-core-handle-l1-1-0.dll
from <Current directory>\$dpx$.tmp\8169e9577147bb4280e8dfe0095c93fe.tmp to <Current directory>\api-ms-win-core-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\85593bbb810fd84db53974552bf89041.tmp to <Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
from <Current directory>\$dpx$.tmp\83e22d614463f34b8f214d4fb8fe08e5.tmp to <Current directory>\api-ms-win-core-datetime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9dd7157be200ac4087164a028b6b13cb.tmp to <Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ab80382beb012644988ac538b4c8ca72.tmp to <Current directory>\api-ms-win-core-memory-l1-1-0.dll
from <Current directory>\$dpx$.tmp\caaf880a8fe985438c2178e0bf8dea10.tmp to <Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
from <Current directory>\$dpx$.tmp\0cb4db45e12da9439e49aa43e73990bb.tmp to <Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4a53a481c35c7d46ae38c0613d87e4c1.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
from <Current directory>\$dpx$.tmp\01dc872669318c4386929aad3232f957.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
from <Current directory>\$dpx$.tmp\5dde3ff7a220404587a70024361b6bb8.tmp to <Current directory>\api-ms-win-core-profile-l1-1-0.dll
from <Current directory>\$dpx$.tmp\3fa4db7274ba64418766bad2ecdffe4a.tmp to <Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c696d53b2ce8764ca72e8d4d89cc3363.tmp to <Current directory>\api-ms-win-core-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\eb5f31fc3c90eb408f3e0a65a784c2d7.tmp to <Current directory>\api-ms-win-core-localization-l1-2-0.dll
from <Current directory>\$dpx$.tmp\86fd200739c2684eb21fe4b51263936d.tmp to <Current directory>\ucrtbase.dll
from <Current directory>\$dpx$.tmp\744fbfb8311b35468854b7aa02ae9d91.tmp to <Current directory>\vcruntime140.dll

Network activity

Connects to

'localhost':443

UDP

DNS ASK lp##.beahh.com
DNS ASK lp##.abbny.com
DNS ASK lp##.haqo.net

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a
'<SYSTEM32>\expand.exe' d.cab -f:* .

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней