Trojan.DownLoader47.56465

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%TEMP%\is-n9an3.tmp\is-acck4.tmp
%LOCALAPPDATA%\dober after effects 14.2.0.46\is-8j8fn.tmp
%LOCALAPPDATA%\dober after effects 14.2.0.46\is-lt52v.tmp
%LOCALAPPDATA%\dober after effects 14.2.0.46\is-38n9r.tmp
%LOCALAPPDATA%\dober after effects 14.2.0.46\is-iscfm.tmp
%LOCALAPPDATA%\dober after effects 14.2.0.46\is-cfika.tmp
%LOCALAPPDATA%\dober after effects 14.2.0.46\is-s64i2.tmp
%LOCALAPPDATA%\dober after effects 14.2.0.46\is-hqnv2.tmp
%LOCALAPPDATA%\dober after effects 14.2.0.46\is-00n0h.tmp
%LOCALAPPDATA%\dober after effects 14.2.0.46\is-d9drf.tmp
%LOCALAPPDATA%\dober after effects 14.2.0.46\is-ocqhn.tmp
%LOCALAPPDATA%\dober after effects 14.2.0.46\is-qqle0.tmp
%LOCALAPPDATA%\dober after effects 14.2.0.46\is-n136g.tmp
%LOCALAPPDATA%\dober after effects 14.2.0.46\is-goqgf.tmp
%LOCALAPPDATA%\dober after effects 14.2.0.46\is-5jv43.tmp
%LOCALAPPDATA%\dober after effects 14.2.0.46\is-5b63s.tmp
%LOCALAPPDATA%\dober after effects 14.2.0.46\is-v3jts.tmp
%LOCALAPPDATA%\dober after effects 14.2.0.46\is-1gnih.tmp
%LOCALAPPDATA%\dober after effects 14.2.0.46\is-tsgfh.tmp
%LOCALAPPDATA%\dober after effects 14.2.0.46\is-p481v.tmp
%LOCALAPPDATA%\dober after effects 14.2.0.46\is-vo76t.tmp
%LOCALAPPDATA%\dober after effects 14.2.0.46\is-kesku.tmp
%LOCALAPPDATA%\dober after effects 14.2.0.46\is-4f4u6.tmp
%LOCALAPPDATA%\dober after effects 14.2.0.46\uninstall\is-hratg.tmp
%TEMP%\is-h0o5q.tmp\_isetup\_iscrypt.dll
%TEMP%\is-h0o5q.tmp\_isetup\_shfoldr.dll
%TEMP%\is-h0o5q.tmp\_isetup\_setup64.tmp
%TEMP%\is-h0o5q.tmp\_isetup\_regdll.tmp
%LOCALAPPDATA%\dober after effects 14.2.0.46\uninstall\unins000.dat
%LOCALAPPDATA%\dober after effects 14.2.0.46\doberaftereffects.exe

Перемещает следующие файлы

%LOCALAPPDATA%\dober after effects 14.2.0.46\uninstall\is-hratg.tmp в %LOCALAPPDATA%\dober after effects 14.2.0.46\uninstall\unins000.exe
%LOCALAPPDATA%\dober after effects 14.2.0.46\is-38n9r.tmp в %LOCALAPPDATA%\dober after effects 14.2.0.46\vcruntime140_1.dll
%LOCALAPPDATA%\dober after effects 14.2.0.46\is-iscfm.tmp в %LOCALAPPDATA%\dober after effects 14.2.0.46\vcruntime140.dll
%LOCALAPPDATA%\dober after effects 14.2.0.46\is-cfika.tmp в %LOCALAPPDATA%\dober after effects 14.2.0.46\vccorlib140.dll
%LOCALAPPDATA%\dober after effects 14.2.0.46\is-s64i2.tmp в %LOCALAPPDATA%\dober after effects 14.2.0.46\valuetransformers.dll
%LOCALAPPDATA%\dober after effects 14.2.0.46\is-hqnv2.tmp в %LOCALAPPDATA%\dober after effects 14.2.0.46\ucrtbase.dll
%LOCALAPPDATA%\dober after effects 14.2.0.46\is-00n0h.tmp в %LOCALAPPDATA%\dober after effects 14.2.0.46\netstandard.dll
%LOCALAPPDATA%\dober after effects 14.2.0.46\is-d9drf.tmp в %LOCALAPPDATA%\dober after effects 14.2.0.46\netsparkle.dll
%LOCALAPPDATA%\dober after effects 14.2.0.46\is-ocqhn.tmp в %LOCALAPPDATA%\dober after effects 14.2.0.46\msvcp140_2.dll
%LOCALAPPDATA%\dober after effects 14.2.0.46\is-qqle0.tmp в %LOCALAPPDATA%\dober after effects 14.2.0.46\msvcp140_1.dll
%LOCALAPPDATA%\dober after effects 14.2.0.46\is-lt52v.tmp в %LOCALAPPDATA%\dober after effects 14.2.0.46\sqlite3.dll
%LOCALAPPDATA%\dober after effects 14.2.0.46\is-n136g.tmp в %LOCALAPPDATA%\dober after effects 14.2.0.46\msvcp140.dll
%LOCALAPPDATA%\dober after effects 14.2.0.46\is-5jv43.tmp в %LOCALAPPDATA%\dober after effects 14.2.0.46\microsoft.appcenter.crashes.dll
%LOCALAPPDATA%\dober after effects 14.2.0.46\is-5b63s.tmp в %LOCALAPPDATA%\dober after effects 14.2.0.46\microsoft.appcenter.analytics.dll
%LOCALAPPDATA%\dober after effects 14.2.0.46\is-v3jts.tmp в %LOCALAPPDATA%\dober after effects 14.2.0.46\devkit.dll
%LOCALAPPDATA%\dober after effects 14.2.0.46\is-1gnih.tmp в %LOCALAPPDATA%\dober after effects 14.2.0.46\concrt140.dll
%LOCALAPPDATA%\dober after effects 14.2.0.46\is-tsgfh.tmp в %LOCALAPPDATA%\dober after effects 14.2.0.46\colorsetkit.dll
%LOCALAPPDATA%\dober after effects 14.2.0.46\is-p481v.tmp в %LOCALAPPDATA%\dober after effects 14.2.0.46\avutil-57.dll
%LOCALAPPDATA%\dober after effects 14.2.0.46\is-vo76t.tmp в %LOCALAPPDATA%\dober after effects 14.2.0.46\avformat-59.dll
%LOCALAPPDATA%\dober after effects 14.2.0.46\is-kesku.tmp в %LOCALAPPDATA%\dober after effects 14.2.0.46\avfilter-8.dll
%LOCALAPPDATA%\dober after effects 14.2.0.46\is-4f4u6.tmp в %LOCALAPPDATA%\dober after effects 14.2.0.46\avdevice-59.dll
%LOCALAPPDATA%\dober after effects 14.2.0.46\is-goqgf.tmp в %LOCALAPPDATA%\dober after effects 14.2.0.46\microsoft.appcenter.dll
%LOCALAPPDATA%\dober after effects 14.2.0.46\is-8j8fn.tmp в %LOCALAPPDATA%\dober after effects 14.2.0.46\doberaftereffects.exe

Сетевая активность

Подключается к

'st###7345724.ru':80

TCP

Запросы HTTP POST

http://st###7345724.ru/new/net_api

UDP

DNS ASK st###7345724.ru

Другое

Ищет следующие окна

ClassName: 'v%x_DAE_1253caae95' WindowName: ''

Создает и запускает на исполнение

'%TEMP%\is-n9an3.tmp\is-acck4.tmp' /SL4 $5024E "<Полный путь к файлу>" 5601528 52224
'%LOCALAPPDATA%\dober after effects 14.2.0.46\doberaftereffects.exe' da0152e7df34fee90f28a9dcaa853d5c

Запускает на исполнение