Trojan.DownLoader33.26584

Technical Information

Modifies file system

Creates the following files

%TEMP%\0011f809.log
%TEMP%\inh117~1\locale\id.locale
%TEMP%\inh117~1\locale\ja.locale
%TEMP%\inh117~1\locale\nl.locale
%TEMP%\0011fa0d.log
%TEMP%\0011fa4b.log
%TEMP%\inh117762547794\bootstrap_49784.html
%TEMP%\in364b~1\1d840d~1.par
%TEMP%\in364b~1\1d840d~1.cis
%TEMP%\in364bb553\1d840d06_stp\yt13.html
%TEMP%\in364bb553\1d840d06_stp\yt17.html
%TEMP%\in364b~1\6d37a3~1.cis
%TEMP%\inh117~1\images\close.png
%TEMP%\in364b~1\1c9ec5~1.par
%TEMP%\001278c2.log
%TEMP%\in364b~1\019d86~1.par
%TEMP%\in364b~1\019d86~1.cis
%TEMP%\in364b~1\58855a~1.cis
%TEMP%\in364bb553\1c9ec531_stp\osutils.vbs
%TEMP%\in364bb553\1c9ec531_stp\run.vbs
%TEMP%\in364b~1\58855a~1.par
%TEMP%\in364b~1\6d37a3~1.par
%TEMP%\in364bb553\019d86ed_stp\we23.html
%TEMP%\in364bb553\019d86ed_stp\wp24.html
%TEMP%\00127e60.log
%TEMP%\inh117~1\locale\el.locale
%TEMP%\inh117~1\locale\en.locale
%TEMP%\inh117~1\locale\cs.locale
%TEMP%\inh117~1\images\welcome_bg.jpg
%TEMP%\inh117~1\images\text-bg.png
%TEMP%\inh117~1\css\main.css
%TEMP%\inh117~1\css\sdk-ui\browse.css
%TEMP%\inh117~1\css\sdk-ui\button.css
%TEMP%\inh117~1\css\sdk-ui\checkbox.css
%TEMP%\inh117~1\css\sdk-ui\images\button-bg.png
%TEMP%\inh117~1\css\sdk-ui\images\progress-bg-corner.png
%TEMP%\inh117~1\css\sdk-ui\images\progress-bg.png
%TEMP%\inh117~1\css\sdk-ui\images\progress-bg2.png
%TEMP%\inh117~1\css\sdk-ui\progress-bar.css
%TEMP%\inh117~1\csshover3.htc
%TEMP%\inh117~1\form.bmp.mask
%TEMP%\in364bb553\6d37a3c8_stp\icut.dat
%TEMP%\in364b~1\1c9ec5~1.cis
%TEMP%\inh117~1\images\bg.jpg
%TEMP%\inh117~1\images\color_button.png
%TEMP%\inh117~1\images\color_button_hover.png
%TEMP%\inh117~1\images\grey_button.png
%TEMP%\inh117~1\images\grey_button_hover.png
%TEMP%\inh117~1\images\icon_generic.png
%TEMP%\inh117~1\images\loader.gif
%TEMP%\inh117~1\images\pause_button.png
%TEMP%\inh117~1\images\quick_specs.png
%TEMP%\inh117~1\images\resume_button.png
%TEMP%\inh117~1\images\specseperator.png
%TEMP%\inh117~1\images\sponsored.png
%TEMP%\inh117~1\css\ie6_main.css
%TEMP%\inh117~1\images\close_hover.png
%TEMP%\in364bb553\58855a8f_stp\asgnd.json

Deletes the following files

%TEMP%\0011f809.log
%TEMP%\0011fa0d.log
%TEMP%\0011fa4b.log
%TEMP%\inh117762547794\bootstrap_49784.html
%TEMP%\001278c2.log
%TEMP%\00127e60.log

Moves the following files

from %TEMP%\in364bb553\1d840d06_stp\yt13.html to %TEMP%\bl\yt13.html
from %TEMP%\in364bb553\1d840d06_stp\yt17.html to %TEMP%\bl\yt17.html
from %TEMP%\in364bb553\019d86ed_stp\we23.html to %TEMP%\bf_yl\we23.html
from %TEMP%\in364bb553\019d86ed_stp\wp24.html to %TEMP%\bf_yl\wp24.html

Network activity

TCP

HTTP GET requests

http://im####.#ownloadastro.com/downloader/id/spss.jpeg
http://cd###.dodonas.com/img/Tavasat/15Feb17/v2/EN.png
http://cd###.dodonas.com/img/Sibarasawi/bg_comp.png
http://cd###.dodonas.com/ofr/Webinebinec/Webinebinec_Links_13Oct15
http://cd###.dodonas.com/ofr/Solululadul/osutils
http://cd###.dodonas.com/ofr/Solululadul/icut_v2_2
http://cd###.dodonas.com/ofr/Solululadul/asgnd
http://cd###.dodonas.com/ofr/Niniwic/YL/Niniwic_Tefenece_12Apr16
http://cd###.dodonas.com/img/Sibarasawi/logo_comp.png
http://cd###.dodonas.com/img/Sibarasawi/TPC_win_bg.png
http://cd###.dodonas.com/img/Sibarasawi/TPC_img_bg.png
http://cd###.dodonas.com/img/Jimomoromoj/Jimomoromoj_logo_080320.png
http://cd###.dodonas.com/img/Tefenece/Tefenece_logo_black.png
http://cd###.dodonas.com/img/Webinebinec/teal_logo.png
http://cd###.dodonas.com/img/Webinebinec/teal_logo_white.png
http://sp##.##.downloadastro.com/thank_you/?ut###############################################