Trojan.DownLoader47.59269

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%TEMP%\is-mi63j.tmp\is-9je7b.tmp
%LOCALAPPDATA%\dober after effects 13.1.0.33\is-qtjai.tmp
%LOCALAPPDATA%\dober after effects 13.1.0.33\is-4d22f.tmp
%LOCALAPPDATA%\dober after effects 13.1.0.33\is-me6k3.tmp
%LOCALAPPDATA%\dober after effects 13.1.0.33\is-hn689.tmp
%LOCALAPPDATA%\dober after effects 13.1.0.33\is-a1m7v.tmp
%LOCALAPPDATA%\dober after effects 13.1.0.33\is-v1pov.tmp
%LOCALAPPDATA%\dober after effects 13.1.0.33\is-3cemq.tmp
%LOCALAPPDATA%\dober after effects 13.1.0.33\is-tilb1.tmp
%LOCALAPPDATA%\dober after effects 13.1.0.33\is-9u2bh.tmp
%LOCALAPPDATA%\dober after effects 13.1.0.33\is-piaq9.tmp
%LOCALAPPDATA%\dober after effects 13.1.0.33\is-kdq59.tmp
%LOCALAPPDATA%\dober after effects 13.1.0.33\is-9nrpn.tmp
%LOCALAPPDATA%\dober after effects 13.1.0.33\is-6e71f.tmp
%LOCALAPPDATA%\dober after effects 13.1.0.33\is-8imll.tmp
%LOCALAPPDATA%\dober after effects 13.1.0.33\is-lg7lo.tmp
%LOCALAPPDATA%\dober after effects 13.1.0.33\is-9qu5k.tmp
%LOCALAPPDATA%\dober after effects 13.1.0.33\is-rnmq1.tmp
%LOCALAPPDATA%\dober after effects 13.1.0.33\is-ckvec.tmp
%LOCALAPPDATA%\dober after effects 13.1.0.33\is-k3m2g.tmp
%LOCALAPPDATA%\dober after effects 13.1.0.33\is-f2qjv.tmp
%LOCALAPPDATA%\dober after effects 13.1.0.33\is-3m99g.tmp
%LOCALAPPDATA%\dober after effects 13.1.0.33\is-si1rl.tmp
%LOCALAPPDATA%\dober after effects 13.1.0.33\uninstall\is-tom9o.tmp
%TEMP%\is-viiu0.tmp\_isetup\_iscrypt.dll
%TEMP%\is-viiu0.tmp\_isetup\_shfoldr.dll
%TEMP%\is-viiu0.tmp\_isetup\_setup64.tmp
%TEMP%\is-viiu0.tmp\_isetup\_regdll.tmp
%LOCALAPPDATA%\dober after effects 13.1.0.33\uninstall\unins000.dat
%LOCALAPPDATA%\dober after effects 13.1.0.33\doberaftereffects3.exe

Перемещает следующие файлы

%LOCALAPPDATA%\dober after effects 13.1.0.33\uninstall\is-tom9o.tmp в %LOCALAPPDATA%\dober after effects 13.1.0.33\uninstall\unins000.exe
%LOCALAPPDATA%\dober after effects 13.1.0.33\is-me6k3.tmp в %LOCALAPPDATA%\dober after effects 13.1.0.33\vcruntime140_1.dll
%LOCALAPPDATA%\dober after effects 13.1.0.33\is-hn689.tmp в %LOCALAPPDATA%\dober after effects 13.1.0.33\vcruntime140.dll
%LOCALAPPDATA%\dober after effects 13.1.0.33\is-a1m7v.tmp в %LOCALAPPDATA%\dober after effects 13.1.0.33\vccorlib140.dll
%LOCALAPPDATA%\dober after effects 13.1.0.33\is-v1pov.tmp в %LOCALAPPDATA%\dober after effects 13.1.0.33\valuetransformers.dll
%LOCALAPPDATA%\dober after effects 13.1.0.33\is-3cemq.tmp в %LOCALAPPDATA%\dober after effects 13.1.0.33\ucrtbase.dll
%LOCALAPPDATA%\dober after effects 13.1.0.33\is-tilb1.tmp в %LOCALAPPDATA%\dober after effects 13.1.0.33\netstandard.dll
%LOCALAPPDATA%\dober after effects 13.1.0.33\is-9u2bh.tmp в %LOCALAPPDATA%\dober after effects 13.1.0.33\netsparkle.dll
%LOCALAPPDATA%\dober after effects 13.1.0.33\is-piaq9.tmp в %LOCALAPPDATA%\dober after effects 13.1.0.33\msvcp140_2.dll
%LOCALAPPDATA%\dober after effects 13.1.0.33\is-kdq59.tmp в %LOCALAPPDATA%\dober after effects 13.1.0.33\msvcp140_1.dll
%LOCALAPPDATA%\dober after effects 13.1.0.33\is-4d22f.tmp в %LOCALAPPDATA%\dober after effects 13.1.0.33\sqlite3.dll
%LOCALAPPDATA%\dober after effects 13.1.0.33\is-9nrpn.tmp в %LOCALAPPDATA%\dober after effects 13.1.0.33\msvcp140.dll
%LOCALAPPDATA%\dober after effects 13.1.0.33\is-8imll.tmp в %LOCALAPPDATA%\dober after effects 13.1.0.33\microsoft.appcenter.crashes.dll
%LOCALAPPDATA%\dober after effects 13.1.0.33\is-lg7lo.tmp в %LOCALAPPDATA%\dober after effects 13.1.0.33\microsoft.appcenter.analytics.dll
%LOCALAPPDATA%\dober after effects 13.1.0.33\is-9qu5k.tmp в %LOCALAPPDATA%\dober after effects 13.1.0.33\devkit.dll
%LOCALAPPDATA%\dober after effects 13.1.0.33\is-rnmq1.tmp в %LOCALAPPDATA%\dober after effects 13.1.0.33\concrt140.dll
%LOCALAPPDATA%\dober after effects 13.1.0.33\is-ckvec.tmp в %LOCALAPPDATA%\dober after effects 13.1.0.33\colorsetkit.dll
%LOCALAPPDATA%\dober after effects 13.1.0.33\is-k3m2g.tmp в %LOCALAPPDATA%\dober after effects 13.1.0.33\avutil-57.dll
%LOCALAPPDATA%\dober after effects 13.1.0.33\is-f2qjv.tmp в %LOCALAPPDATA%\dober after effects 13.1.0.33\avformat-59.dll
%LOCALAPPDATA%\dober after effects 13.1.0.33\is-3m99g.tmp в %LOCALAPPDATA%\dober after effects 13.1.0.33\avfilter-8.dll
%LOCALAPPDATA%\dober after effects 13.1.0.33\is-si1rl.tmp в %LOCALAPPDATA%\dober after effects 13.1.0.33\avdevice-59.dll
%LOCALAPPDATA%\dober after effects 13.1.0.33\is-6e71f.tmp в %LOCALAPPDATA%\dober after effects 13.1.0.33\microsoft.appcenter.dll
%LOCALAPPDATA%\dober after effects 13.1.0.33\is-qtjai.tmp в %LOCALAPPDATA%\dober after effects 13.1.0.33\doberaftereffects3.exe

Сетевая активность

Подключается к

'st###7345724.ru':80

TCP

Запросы HTTP POST

http://st###7345724.ru/new/net_api

UDP

DNS ASK st###7345724.ru

Другое

Ищет следующие окна

ClassName: 'f%x_DAE_1254c5dfb9' WindowName: ''

Создает и запускает на исполнение

'%TEMP%\is-mi63j.tmp\is-9je7b.tmp' /SL4 $50240 "<Полный путь к файлу>" 5803957 52224
'%LOCALAPPDATA%\dober after effects 13.1.0.33\doberaftereffects3.exe' a1c257747bdcd1030071fec9846e7663

Запускает на исполнение