Trojan.DownLoader47.59756

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-0qbbs.tmp\is-g1u12.tmp
%LOCALAPPDATA%\edvard video maker 2.0.0.13\is-r0ibe.tmp
%LOCALAPPDATA%\edvard video maker 2.0.0.13\is-er1a3.tmp
%LOCALAPPDATA%\edvard video maker 2.0.0.13\is-hh8j9.tmp
%LOCALAPPDATA%\edvard video maker 2.0.0.13\is-3rncp.tmp
%LOCALAPPDATA%\edvard video maker 2.0.0.13\is-f0iet.tmp
%LOCALAPPDATA%\edvard video maker 2.0.0.13\is-5gfij.tmp
%LOCALAPPDATA%\edvard video maker 2.0.0.13\is-mfpqc.tmp
%LOCALAPPDATA%\edvard video maker 2.0.0.13\is-usse0.tmp
%LOCALAPPDATA%\edvard video maker 2.0.0.13\is-680iv.tmp
%LOCALAPPDATA%\edvard video maker 2.0.0.13\is-2u0hj.tmp
%LOCALAPPDATA%\edvard video maker 2.0.0.13\is-2oa96.tmp
%LOCALAPPDATA%\edvard video maker 2.0.0.13\is-u1mqb.tmp
%LOCALAPPDATA%\edvard video maker 2.0.0.13\is-hq42r.tmp
%LOCALAPPDATA%\edvard video maker 2.0.0.13\is-v279c.tmp
%LOCALAPPDATA%\edvard video maker 2.0.0.13\is-9pfcu.tmp
%LOCALAPPDATA%\edvard video maker 2.0.0.13\is-75se3.tmp
%LOCALAPPDATA%\edvard video maker 2.0.0.13\is-akitp.tmp
%LOCALAPPDATA%\edvard video maker 2.0.0.13\is-kjd05.tmp
%LOCALAPPDATA%\edvard video maker 2.0.0.13\is-a2m6t.tmp
%LOCALAPPDATA%\edvard video maker 2.0.0.13\is-c4e9g.tmp
%LOCALAPPDATA%\edvard video maker 2.0.0.13\is-cnbn2.tmp
%LOCALAPPDATA%\edvard video maker 2.0.0.13\is-m1307.tmp
%LOCALAPPDATA%\edvard video maker 2.0.0.13\uninstall\is-s4dca.tmp
%TEMP%\is-jnqgp.tmp\_isetup\_iscrypt.dll
%TEMP%\is-jnqgp.tmp\_isetup\_shfoldr.dll
%TEMP%\is-jnqgp.tmp\_isetup\_setup64.tmp
%TEMP%\is-jnqgp.tmp\_isetup\_regdll.tmp
%LOCALAPPDATA%\edvard video maker 2.0.0.13\uninstall\unins000.dat
%LOCALAPPDATA%\edvard video maker 2.0.0.13\edvardvideomaker32.exe

Moves the following files

from %LOCALAPPDATA%\edvard video maker 2.0.0.13\uninstall\is-s4dca.tmp to %LOCALAPPDATA%\edvard video maker 2.0.0.13\uninstall\unins000.exe
from %LOCALAPPDATA%\edvard video maker 2.0.0.13\is-hh8j9.tmp to %LOCALAPPDATA%\edvard video maker 2.0.0.13\vcruntime140_1.dll
from %LOCALAPPDATA%\edvard video maker 2.0.0.13\is-3rncp.tmp to %LOCALAPPDATA%\edvard video maker 2.0.0.13\vcruntime140.dll
from %LOCALAPPDATA%\edvard video maker 2.0.0.13\is-f0iet.tmp to %LOCALAPPDATA%\edvard video maker 2.0.0.13\vccorlib140.dll
from %LOCALAPPDATA%\edvard video maker 2.0.0.13\is-5gfij.tmp to %LOCALAPPDATA%\edvard video maker 2.0.0.13\valuetransformers.dll
from %LOCALAPPDATA%\edvard video maker 2.0.0.13\is-mfpqc.tmp to %LOCALAPPDATA%\edvard video maker 2.0.0.13\ucrtbase.dll
from %LOCALAPPDATA%\edvard video maker 2.0.0.13\is-usse0.tmp to %LOCALAPPDATA%\edvard video maker 2.0.0.13\netstandard.dll
from %LOCALAPPDATA%\edvard video maker 2.0.0.13\is-680iv.tmp to %LOCALAPPDATA%\edvard video maker 2.0.0.13\netsparkle.dll
from %LOCALAPPDATA%\edvard video maker 2.0.0.13\is-2u0hj.tmp to %LOCALAPPDATA%\edvard video maker 2.0.0.13\msvcp140_2.dll
from %LOCALAPPDATA%\edvard video maker 2.0.0.13\is-2oa96.tmp to %LOCALAPPDATA%\edvard video maker 2.0.0.13\msvcp140_1.dll
from %LOCALAPPDATA%\edvard video maker 2.0.0.13\is-er1a3.tmp to %LOCALAPPDATA%\edvard video maker 2.0.0.13\sqlite3.dll
from %LOCALAPPDATA%\edvard video maker 2.0.0.13\is-u1mqb.tmp to %LOCALAPPDATA%\edvard video maker 2.0.0.13\msvcp140.dll
from %LOCALAPPDATA%\edvard video maker 2.0.0.13\is-v279c.tmp to %LOCALAPPDATA%\edvard video maker 2.0.0.13\microsoft.appcenter.crashes.dll
from %LOCALAPPDATA%\edvard video maker 2.0.0.13\is-9pfcu.tmp to %LOCALAPPDATA%\edvard video maker 2.0.0.13\microsoft.appcenter.analytics.dll
from %LOCALAPPDATA%\edvard video maker 2.0.0.13\is-75se3.tmp to %LOCALAPPDATA%\edvard video maker 2.0.0.13\devkit.dll
from %LOCALAPPDATA%\edvard video maker 2.0.0.13\is-akitp.tmp to %LOCALAPPDATA%\edvard video maker 2.0.0.13\concrt140.dll
from %LOCALAPPDATA%\edvard video maker 2.0.0.13\is-kjd05.tmp to %LOCALAPPDATA%\edvard video maker 2.0.0.13\colorsetkit.dll
from %LOCALAPPDATA%\edvard video maker 2.0.0.13\is-a2m6t.tmp to %LOCALAPPDATA%\edvard video maker 2.0.0.13\avutil-57.dll
from %LOCALAPPDATA%\edvard video maker 2.0.0.13\is-c4e9g.tmp to %LOCALAPPDATA%\edvard video maker 2.0.0.13\avformat-59.dll
from %LOCALAPPDATA%\edvard video maker 2.0.0.13\is-cnbn2.tmp to %LOCALAPPDATA%\edvard video maker 2.0.0.13\avfilter-8.dll
from %LOCALAPPDATA%\edvard video maker 2.0.0.13\is-m1307.tmp to %LOCALAPPDATA%\edvard video maker 2.0.0.13\avdevice-59.dll
from %LOCALAPPDATA%\edvard video maker 2.0.0.13\is-hq42r.tmp to %LOCALAPPDATA%\edvard video maker 2.0.0.13\microsoft.appcenter.dll
from %LOCALAPPDATA%\edvard video maker 2.0.0.13\is-r0ibe.tmp to %LOCALAPPDATA%\edvard video maker 2.0.0.13\edvardvideomaker32.exe

Network activity

Connects to

'st###7345724.ru':80

TCP

HTTP POST requests

http://st###7345724.ru/new/net_api

UDP

DNS ASK st###7345724.ru

Miscellaneous

Searches for the following windows

ClassName: 'D7efdd_EdvardVideoMaker_12204_D7efdd' WindowName: ''

Creates and executes the following

'%TEMP%\is-0qbbs.tmp\is-g1u12.tmp' /SL4 $5024A "<Full path to file>" 5852561 52224
'%LOCALAPPDATA%\edvard video maker 2.0.0.13\edvardvideomaker32.exe' 516e47437064892759cf88726eba8881

Executes the following