Trojan.DownLoader33.23836

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Run' = ''

Modifies file system

Creates the following files

%TEMP%\{22ce17f4-08b6-4b24-a063-9ebf4a60fc14}
<Current directory>\$$iutemp\drm_goldragon_umbrella_mask2.zip
<Current directory>\$$iutemp\dw_goldragon_dualsickle.zip
<Current directory>\$$iutemp\dw_goldragon_dualsickle_e.zip
<Current directory>\$$iutemp\dw_goldragon_dualsickle_mask2.zip
<Current directory>\$$iutemp\fsdw_goldragon_knife.zip
<Current directory>\$$iutemp\fsdw_goldragon_knife_e.zip
<Current directory>\$$iutemp\fsdw_goldragon_knife_mask2.zip
<Current directory>\$$iutemp\ks_goldragon_sword.zip
<Current directory>\$$iutemp\ks_goldragon_sword_e.zip
<Current directory>\$$iutemp\ks_goldragon_sword_mask2.zip
<Current directory>\$$iutemp\m_cos_as_goldragon_acc.zip
<Current directory>\$$iutemp\m_cos_as_goldragon_acc_e.zip
<Current directory>\$$iutemp\m_cos_as_goldragon_acc_mask2.zip
<Current directory>\$$iutemp\m_cos_as_goldragon_body.zip
<Current directory>\$$iutemp\m_cos_as_goldragon_body_e.zip
<Current directory>\$$iutemp\cos_goldragon_glass.zip
<Current directory>\$$iutemp\m_cos_as_goldragon_body_mask2.zip
<Current directory>\$$iutemp\as_goldragon_bow_mask2.zip
<Current directory>\$$iutemp\as_goldragon_bow.zip
<Current directory>\$$iutemp\s_w_cos_tc_goldragon.zip
<Current directory>\$$iutemp\s_w_dw_goldragon_circleknife.zip
<Current directory>\$$iutemp\s_w_dw_goldragon_dualspear.zip
<Current directory>\$$iutemp\s_w_dw_goldragon_scythe.zip
<Current directory>\$$iutemp\s_w_fs_goldragon_gauntlet.zip
<Current directory>\$$iutemp\s_w_kk_goldragon_gauntlet.zip
<Current directory>\$$iutemp\s_w_ks_goldragon_sword.zip
<Current directory>\$$iutemp\s_w_ss_goldragon_staff.zip
<Current directory>\$$iutemp\s_w_tc_goldragon_box.zip
<Current directory>\$$iutemp\s_w_tc_goldragon_stick.zip
<Current directory>\$$iutemp\s_w_tc_goldragon_whip.zip
<Current directory>\$$iutemp\skinobject.zip
<Current directory>\$$iutemp\launcher1.zip
<Current directory>\$$iutemp\minia.zip
<Current directory>\$$iutemp\param.zip
<Current directory>\$$iutemp\as_goldragon_bow_e.zip
<Current directory>\$$iutemp\m_cos_fs_goldragon_leg_e.zip
<Current directory>\$$iutemp\m_cos_sc_goldragon_body_mask2.zip
<Current directory>\$$iutemp\m_cos_as_goldragon_leg_mask2.zip
<Current directory>\$$iutemp\m_cos_kk_goldragon_acc_e.zip
<Current directory>\$$iutemp\m_cos_kk_goldragon_acc_mask2.zip
<Current directory>\$$iutemp\m_cos_kk_goldragon_all.zip
<Current directory>\$$iutemp\m_cos_kk_goldragon_all_e.zip
<Current directory>\$$iutemp\m_cos_kk_goldragon_all_mask1.zip
<Current directory>\$$iutemp\m_cos_kk_goldragon_all_mask2.zip
<Current directory>\$$iutemp\m_cos_ks_goldragon_acc.zip
<Current directory>\$$iutemp\m_cos_ks_goldragon_acc_e.zip
<Current directory>\$$iutemp\m_cos_ks_goldragon_acc_mask2.zip
<Current directory>\$$iutemp\m_cos_ks_goldragon_all.zip
<Current directory>\$$iutemp\m_cos_ks_goldragon_all_e.zip
<Current directory>\$$iutemp\m_cos_ks_goldragon_all_mask1.zip
<Current directory>\$$iutemp\m_cos_ks_goldragon_all_mask2.zip
<Current directory>\$$iutemp\m_cos_sc_goldragon_body.zip
<Current directory>\$$iutemp\m_cos_sc_goldragon_body_e.zip
<Current directory>\$$iutemp\m_cos_kk_goldragon_acc.zip
<Current directory>\$$iutemp\s_w_cos_ss_goldragon.zip
<Current directory>\$$iutemp\m_cos_fs_goldragon_leg_mask2.zip
<Current directory>\$$iutemp\m_cos_fs_goldragon_leg.zip
<Current directory>\$$iutemp\m_cos_dw_goldragon_acc.zip
<Current directory>\$$iutemp\m_cos_dw_goldragon_acc_e.zip
<Current directory>\$$iutemp\m_cos_dw_goldragon_acc_mask2.zip
<Current directory>\$$iutemp\m_cos_dw_goldragon_body.zip
<Current directory>\$$iutemp\m_cos_dw_goldragon_body_e.zip
<Current directory>\$$iutemp\m_cos_dw_goldragon_body_mask2.zip
<Current directory>\$$iutemp\m_cos_dw_goldragon_leg.zip
<Current directory>\$$iutemp\m_cos_dw_goldragon_leg_e.zip
<Current directory>\$$iutemp\m_cos_dw_goldragon_leg_mask2.zip
<Current directory>\$$iutemp\m_cos_fs_goldragon_acc.zip
<Current directory>\$$iutemp\m_cos_fs_goldragon_acc_e.zip
<Current directory>\$$iutemp\m_cos_fs_goldragon_acc_mask2.zip
<Current directory>\$$iutemp\m_cos_fs_goldragon_body.zip
<Current directory>\$$iutemp\m_cos_fs_goldragon_body_e.zip
<Current directory>\$$iutemp\m_cos_fs_goldragon_body_mask2.zip
<Current directory>\$$iutemp\m_cos_as_goldragon_leg.zip
<Current directory>\$$iutemp\m_cos_as_goldragon_leg_e.zip
<Current directory>\$$iutemp\s_w_cos_sc_goldragon.zip
<Current directory>\$$iutemp\uiextcfg1.zip
%TEMP%\{31d23f42-30ab-4b40-b8b1-f412eed205fc}
<Current directory>\$$iutemp\bugtrap.zip
<Current directory>\$$iutemp\animation.zip
<Current directory>\$$iutemp\effectchar.zip
<Current directory>\$$iutemp\effect.zip
<Current directory>\$$iutemp\activity.zip
<Current directory>\$$iutemp\glogic.zip
<Current directory>\$$iutemp\level.zip
<Current directory>\$$iutemp\npctalk.zip
<Current directory>\$$iutemp\quest.zip
<Current directory>\$$iutemp\gameextext.zip
<Current directory>\$$iutemp\gameintext.zip
<Current directory>\$$iutemp\gameword.zip
<Current directory>\$$iutemp\interface_cfg.zip
<Current directory>\$$iutemp\launcher.zip
%TEMP%\{691dbe2b-fe95-4d40-88f1-e43117d240c0}
<Current directory>\$$iutemp\servertext.zip
%TEMP%\{2215dc34-29ce-4050-a85a-47fd9a08c868}
%TEMP%\sblcopyf.ini
<Current directory>\$$iutemp\update.urs
%TEMP%\update.urs.$$$.$$$
%TEMP%\update.urs.$$$
%TEMP%\update.ini
%TEMP%\incupdate_tempimg1.jpg
%TEMP%\incupdate_tempimg2.jpg
%TEMP%\incupdate_tempimg3.jpg
%TEMP%\incupdate_tempimg4.jpg
%TEMP%\{68a03243-8e7f-400b-bcfa-db0c31033526}
%TEMP%\{ff6c4d14-4f35-4e7c-a18d-4d1dd7b860fe}
%TEMP%\incupdate.idx
%TEMP%\updateidx.$$$
%TEMP%\updateidx.ini
%TEMP%\update.zip
%TEMP%\update.exe
%TEMP%\sblcopyf.exe
<Current directory>\$$iutemp\s_m_cos_ss_goldragon.zip
<Current directory>\$$iutemp\s_w_cos_kk_goldragon.zip
<Current directory>\$$iutemp\uiinnercfg.zip
<Current directory>\$$iutemp\s_m_dw_goldragon_dualspear.zip
<Current directory>\$$iutemp\s_m_dw_goldragon_scythe.zip
<Current directory>\$$iutemp\s_m_fs_goldragon_gauntlet.zip
<Current directory>\$$iutemp\s_m_kk_goldragon_gauntlet.zip
<Current directory>\$$iutemp\s_m_ks_goldragon_sword.zip
<Current directory>\$$iutemp\s_m_ss_goldragon_staff.zip
<Current directory>\$$iutemp\s_m_tc_goldragon_box.zip
<Current directory>\$$iutemp\s_m_tc_goldragon_stick.zip
<Current directory>\$$iutemp\s_m_tc_goldragon_whip.zip
<Current directory>\$$iutemp\s_sc_goldragon_dualgun.zip
<Current directory>\$$iutemp\s_sc_goldragon_rifle.zip
<Current directory>\$$iutemp\s_w_as_goldragon_bow.zip
<Current directory>\$$iutemp\s_w_cos_as_goldragon.zip
<Current directory>\$$iutemp\s_w_cos_dw_goldragon.zip
<Current directory>\$$iutemp\s_w_cos_fs_goldragon.zip
<Current directory>\$$iutemp\s_m_dw_goldragon_circleknife.zip
<Current directory>\$$iutemp\s_w_cos_ks_goldragon.zip
<Current directory>\$$iutemp\s_m_cos_tc_goldragon.zip
<Current directory>\$$iutemp\s_m_cos_sc_goldragon.zip
<Current directory>\$$iutemp\uiinnercfg01.zip
<Current directory>\$$iutemp\uiinnercfg02 - copy.zip
<Current directory>\$$iutemp\uiinnercfg02.zip
<Current directory>\$$iutemp\uiinnercfg03 - copy.zip
<Current directory>\$$iutemp\uiinnercfg03.zip
<Current directory>\$$iutemp\uioutercfg.zip
<Current directory>\$$iutemp\map.zip
<Current directory>\$$iutemp\b_sc_goldragon_dualgun.zip
<Current directory>\$$iutemp\b_sc_goldragon_rifle.zip
<Current directory>\$$iutemp\s_m_as_goldragon_bow.zip
<Current directory>\$$iutemp\s_m_cos_as_goldragon.zip
<Current directory>\$$iutemp\s_m_cos_dw_goldragon.zip
<Current directory>\$$iutemp\s_m_cos_fs_goldragon.zip
<Current directory>\$$iutemp\s_m_cos_kk_goldragon.zip
<Current directory>\$$iutemp\s_m_cos_ks_goldragon.zip
<Current directory>\$$iutemp\uiextcfg.zip
<Current directory>\$$iutemp\m_cos_sc_goldragon_helmet.zip

Deletes the following files

%TEMP%\{22ce17f4-08b6-4b24-a063-9ebf4a60fc14}
%TEMP%\{2215dc34-29ce-4050-a85a-47fd9a08c868}
%TEMP%\update.exe
<Current directory>\$$iutemp\update.urs
%TEMP%\incupdate_tempimg4.jpg
%TEMP%\incupdate_tempimg3.jpg
%TEMP%\incupdate_tempimg2.jpg
%TEMP%\incupdate_tempimg1.jpg
%TEMP%\{31d23f42-30ab-4b40-b8b1-f412eed205fc}
%TEMP%\update.urs.$$$
%TEMP%\updateidx.ini
%TEMP%\updateidx.$$$
%TEMP%\incupdate.idx
%TEMP%\{68a03243-8e7f-400b-bcfa-db0c31033526}
%TEMP%\{ff6c4d14-4f35-4e7c-a18d-4d1dd7b860fe}
%TEMP%\update.ini
%TEMP%\update.urs.$$$.$$$
%TEMP%\update.zip
%TEMP%\{691dbe2b-fe95-4d40-88f1-e43117d240c0}

Substitutes the following files

<Current directory>\$$iutemp\update.urs
%TEMP%\update.urs.$$$
%TEMP%\update.ini
%TEMP%\incupdate_tempimg1.jpg
%TEMP%\incupdate_tempimg2.jpg
%TEMP%\incupdate_tempimg3.jpg
%TEMP%\incupdate_tempimg4.jpg
%TEMP%\incupdate.idx
%TEMP%\updateidx.ini

Network activity

TCP

HTTP GET requests

http://13#.#9.112.97/updates/incupdate.idx
http://13#.#9.112.97/updates/m_cos_dw_goldragon_acc.zip
http://13#.#9.112.97/updates/m_cos_as_goldragon_leg_mask2.zip
http://13#.#9.112.97/updates/m_cos_as_goldragon_leg_e.zip
http://13#.#9.112.97/updates/m_cos_as_goldragon_leg.zip
http://13#.#9.112.97/updates/m_cos_as_goldragon_body_mask2.zip
http://13#.#9.112.97/updates/m_cos_as_goldragon_body_e.zip
http://13#.#9.112.97/updates/m_cos_as_goldragon_body.zip
http://13#.#9.112.97/updates/m_cos_as_goldragon_acc_mask2.zip
http://13#.#9.112.97/updates/m_cos_as_goldragon_acc_e.zip
http://13#.#9.112.97/updates/m_cos_as_goldragon_acc.zip
http://13#.#9.112.97/updates/ks_goldragon_sword_mask2.zip
http://13#.#9.112.97/updates/ks_goldragon_sword_e.zip
http://13#.#9.112.97/updates/ks_goldragon_sword.zip
http://13#.#9.112.97/updates/fsdw_goldragon_knife_mask2.zip
http://13#.#9.112.97/updates/fsdw_goldragon_knife_e.zip
http://13#.#9.112.97/updates/fsdw_goldragon_knife.zip
http://13#.#9.112.97/updates/dw_goldragon_dualsickle_mask2.zip
http://13#.#9.112.97/updates/dw_goldragon_dualsickle_e.zip
http://13#.#9.112.97/updates/dw_goldragon_dualsickle.zip
http://13#.#9.112.97/updates/drm_goldragon_umbrella_mask2.zip
http://13#.#9.112.97/updates/cos_goldragon_glass.zip
http://13#.#9.112.97/updates/as_goldragon_bow_mask2.zip
http://13#.#9.112.97/updates/as_goldragon_bow_e.zip
http://13#.#9.112.97/updates/as_goldragon_bow.zip
http://13#.#9.112.97/updates/param.zip
http://13#.#9.112.97/updates/minia.zip
http://13#.#9.112.97/updates/launcher1.zip
http://13#.#9.112.97/updates/skinobject.zip
http://13#.#9.112.97/updates/s_w_tc_goldragon_whip.zip
http://13#.#9.112.97/updates/m_cos_dw_goldragon_acc_e.zip
http://13#.#9.112.97/updates/m_cos_dw_goldragon_acc_mask2.zip
http://13#.#9.112.97/updates/m_cos_dw_goldragon_body.zip
http://13#.#9.112.97/updates/m_cos_dw_goldragon_body_e.zip
http://13#.#9.112.97/updates/m_cos_sc_goldragon_body_mask2.zip
http://13#.#9.112.97/updates/m_cos_sc_goldragon_body_e.zip
http://13#.#9.112.97/updates/m_cos_sc_goldragon_body.zip
http://13#.#9.112.97/updates/m_cos_ks_goldragon_all_mask2.zip
http://13#.#9.112.97/updates/m_cos_ks_goldragon_all_mask1.zip
http://13#.#9.112.97/updates/m_cos_ks_goldragon_all_e.zip
http://13#.#9.112.97/updates/m_cos_ks_goldragon_all.zip
http://13#.#9.112.97/updates/m_cos_ks_goldragon_acc_mask2.zip
http://13#.#9.112.97/updates/m_cos_ks_goldragon_acc_e.zip
http://13#.#9.112.97/updates/m_cos_ks_goldragon_acc.zip
http://13#.#9.112.97/updates/m_cos_kk_goldragon_all_mask2.zip
http://13#.#9.112.97/updates/m_cos_kk_goldragon_all_mask1.zip
http://13#.#9.112.97/updates/m_cos_kk_goldragon_all_e.zip
http://13#.#9.112.97/updates/m_cos_kk_goldragon_all.zip
http://13#.#9.112.97/updates/m_cos_kk_goldragon_acc_e.zip
http://13#.#9.112.97/updates/m_cos_kk_goldragon_acc_mask2.zip
http://13#.#9.112.97/updates/m_cos_kk_goldragon_acc.zip
http://13#.#9.112.97/updates/m_cos_fs_goldragon_leg_mask2.zip
http://13#.#9.112.97/updates/m_cos_fs_goldragon_leg_e.zip
http://13#.#9.112.97/updates/m_cos_fs_goldragon_leg.zip
http://13#.#9.112.97/updates/m_cos_fs_goldragon_body_mask2.zip
http://13#.#9.112.97/updates/m_cos_fs_goldragon_body_e.zip
http://13#.#9.112.97/updates/m_cos_fs_goldragon_body.zip
http://13#.#9.112.97/updates/m_cos_fs_goldragon_acc_mask2.zip
http://13#.#9.112.97/updates/m_cos_fs_goldragon_acc_e.zip
http://13#.#9.112.97/updates/m_cos_fs_goldragon_acc.zip
http://13#.#9.112.97/updates/m_cos_dw_goldragon_leg_mask2.zip
http://13#.#9.112.97/updates/m_cos_dw_goldragon_leg_e.zip
http://13#.#9.112.97/updates/m_cos_dw_goldragon_leg.zip
http://13#.#9.112.97/updates/m_cos_dw_goldragon_body_mask2.zip
http://13#.#9.112.97/updates/m_cos_sc_goldragon_helmet.zip
http://13#.#9.112.97/updates/s_w_tc_goldragon_stick.zip
http://13#.#9.112.97/updates/s_w_tc_goldragon_box.zip
http://13#.#9.112.97/updates/s_w_ss_goldragon_staff.zip
http://13#.#9.112.97/updates/s_m_as_goldragon_bow.zip
http://13#.#9.112.97/updates/b_sc_goldragon_rifle.zip
http://13#.#9.112.97/updates/b_sc_goldragon_dualgun.zip
http://13#.#9.112.97/updates/map.zip
http://13#.#9.112.97/updates/uioutercfg.zip
http://13#.#9.112.97/updates/uiinnercfg03.zip
http://13#.#9.112.97/updates/uiinnercfg03%20-%20copy.zip
http://13#.#9.112.97/updates/uiinnercfg02.zip
http://13#.#9.112.97/updates/uiinnercfg02%20-%20copy.zip
http://13#.#9.112.97/updates/uiinnercfg01.zip
http://13#.#9.112.97/updates/uiinnercfg.zip
http://13#.#9.112.97/updates/uiextcfg1.zip
http://13#.#9.112.97/updates/uiextcfg.zip
http://13#.#9.112.97/updates/servertext.zip
http://13#.#9.112.97/updates/launcher.zip
http://13#.#9.112.97/updates/interface_cfg.zip
http://13#.#9.112.97/updates/gameword.zip
http://13#.#9.112.97/updates/gameintext.zip
http://13#.#9.112.97/updates/gameextext.zip
http://13#.#9.112.97/updates/quest.zip
http://13#.#9.112.97/updates/npctalk.zip
http://13#.#9.112.97/updates/level.zip
http://13#.#9.112.97/updates/glogic.zip
http://13#.#9.112.97/updates/activity.zip
http://13#.#9.112.97/updates/effect.zip
http://13#.#9.112.97/updates/effectchar.zip
http://13#.#9.112.97/updates/animation.zip
http://13#.#9.112.97/updates/bugtrap.zip
http://13#.#9.112.97/updates/update.zip
http://13#.#9.112.97/updates/s_m_cos_as_goldragon.zip
http://13#.#9.112.97/updates/s_m_cos_dw_goldragon.zip
http://13#.#9.112.97/updates/s_m_cos_fs_goldragon.zip
http://13#.#9.112.97/updates/s_m_cos_kk_goldragon.zip
http://13#.#9.112.97/updates/s_w_kk_goldragon_gauntlet.zip
http://13#.#9.112.97/updates/s_w_fs_goldragon_gauntlet.zip
http://13#.#9.112.97/updates/s_w_dw_goldragon_scythe.zip
http://13#.#9.112.97/updates/s_w_dw_goldragon_dualspear.zip
http://13#.#9.112.97/updates/s_w_dw_goldragon_circleknife.zip
http://13#.#9.112.97/updates/s_w_cos_tc_goldragon.zip
http://13#.#9.112.97/updates/s_w_cos_ss_goldragon.zip
http://13#.#9.112.97/updates/s_w_cos_sc_goldragon.zip
http://13#.#9.112.97/updates/s_w_cos_ks_goldragon.zip
http://13#.#9.112.97/updates/s_w_cos_kk_goldragon.zip
http://13#.#9.112.97/updates/s_w_cos_fs_goldragon.zip
http://13#.#9.112.97/updates/s_w_cos_dw_goldragon.zip
http://13#.#9.112.97/updates/s_w_cos_as_goldragon.zip
http://13#.#9.112.97/updates/s_w_as_goldragon_bow.zip
http://13#.#9.112.97/updates/s_sc_goldragon_dualgun.zip
http://13#.#9.112.97/updates/s_sc_goldragon_rifle.zip
http://13#.#9.112.97/updates/s_m_tc_goldragon_whip.zip
http://13#.#9.112.97/updates/s_m_tc_goldragon_stick.zip
http://13#.#9.112.97/updates/s_m_tc_goldragon_box.zip
http://13#.#9.112.97/updates/s_m_ss_goldragon_staff.zip
http://13#.#9.112.97/updates/s_m_ks_goldragon_sword.zip
http://13#.#9.112.97/updates/s_m_kk_goldragon_gauntlet.zip
http://13#.#9.112.97/updates/s_m_fs_goldragon_gauntlet.zip
http://13#.#9.112.97/updates/s_m_dw_goldragon_scythe.zip
http://13#.#9.112.97/updates/s_m_dw_goldragon_dualspear.zip
http://13#.#9.112.97/updates/s_m_dw_goldragon_circleknife.zip
http://13#.#9.112.97/updates/s_m_cos_tc_goldragon.zip
http://13#.#9.112.97/updates/s_m_cos_ss_goldragon.zip
http://13#.#9.112.97/updates/s_m_cos_sc_goldragon.zip
http://13#.#9.112.97/updates/s_m_cos_ks_goldragon.zip
http://13#.#9.112.97/updates/s_w_ks_goldragon_sword.zip
http://13#.#9.112.97/updates/m_cos_sc_goldragon_helmet_e.zip

Miscellaneous

Creates and executes the following

'%TEMP%\sblcopyf.exe'

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней