Trojan.DownLoader47.60456

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%TEMP%\is-8hftm.tmp\is-4sh8q.tmp
%LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\is-smg9b.tmp
%LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\is-9nq6h.tmp
%LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\is-tu0cq.tmp
%LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\is-f24n4.tmp
%LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\is-v0qbk.tmp
%LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\is-n4um0.tmp
%LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\is-88kvn.tmp
%LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\is-jde1t.tmp
%LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\is-kvgf6.tmp
%LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\is-7nc8t.tmp
%LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\is-3ilmg.tmp
%LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\is-sjpa8.tmp
%LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\is-6eq28.tmp
%LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\is-fh98g.tmp
%LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\is-virpd.tmp
%LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\is-rvgbe.tmp
%LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\is-1oan3.tmp
%LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\is-rjhi3.tmp
%LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\is-cohkn.tmp
%LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\is-78jkn.tmp
%LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\is-f7k3v.tmp
%LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\is-0l0mr.tmp
%LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\uninstall\is-bmkom.tmp
%TEMP%\is-mgk9a.tmp\_isetup\_iscrypt.dll
%TEMP%\is-mgk9a.tmp\_isetup\_shfoldr.dll
%TEMP%\is-mgk9a.tmp\_isetup\_setup64.tmp
%TEMP%\is-mgk9a.tmp\_isetup\_regdll.tmp
%LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\uninstall\unins000.dat
%LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\videoconverterpro32.exe

Перемещает следующие файлы

%LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\uninstall\is-bmkom.tmp в %LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\uninstall\unins000.exe
%LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\is-tu0cq.tmp в %LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\vcruntime140_1.dll
%LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\is-f24n4.tmp в %LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\vcruntime140.dll
%LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\is-v0qbk.tmp в %LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\vccorlib140.dll
%LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\is-n4um0.tmp в %LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\valuetransformers.dll
%LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\is-88kvn.tmp в %LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\ucrtbase.dll
%LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\is-jde1t.tmp в %LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\netstandard.dll
%LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\is-kvgf6.tmp в %LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\netsparkle.dll
%LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\is-7nc8t.tmp в %LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\msvcp140_2.dll
%LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\is-3ilmg.tmp в %LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\msvcp140_1.dll
%LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\is-9nq6h.tmp в %LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\sqlite3.dll
%LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\is-sjpa8.tmp в %LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\msvcp140.dll
%LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\is-fh98g.tmp в %LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\microsoft.appcenter.crashes.dll
%LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\is-virpd.tmp в %LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\microsoft.appcenter.analytics.dll
%LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\is-rvgbe.tmp в %LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\devkit.dll
%LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\is-1oan3.tmp в %LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\concrt140.dll
%LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\is-rjhi3.tmp в %LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\colorsetkit.dll
%LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\is-cohkn.tmp в %LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\avutil-57.dll
%LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\is-78jkn.tmp в %LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\avformat-59.dll
%LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\is-f7k3v.tmp в %LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\avfilter-8.dll
%LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\is-0l0mr.tmp в %LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\avdevice-59.dll
%LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\is-6eq28.tmp в %LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\microsoft.appcenter.dll
%LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\is-smg9b.tmp в %LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\videoconverterpro32.exe

Сетевая активность

Подключается к

'st###7345724.ru':80

TCP

Запросы HTTP POST

http://st###7345724.ru/new/net_api

UDP

DNS ASK st###7345724.ru

Другое

Ищет следующие окна

ClassName: 'n3ac8d_DVDRipper_12233_n3ac8d' WindowName: ''

Создает и запускает на исполнение

'%TEMP%\is-8hftm.tmp\is-4sh8q.tmp' /SL4 $70164 "<Полный путь к файлу>" 5256534 52224
'%LOCALAPPDATA%\cheetah video converter pro 3.0.0.111\videoconverterpro32.exe' 5797b9f38a4de7197e9ef03dbec4341e

Запускает на исполнение