Technical Information
Modifies file system
Creates the following files
- %TEMP%\rarsfx0\install jdownloader.exe
- %TEMP%\inh10249261015\css\helpers\_z-index.scss
- %TEMP%\inh10249261015\css\sdk-ui\_browse.scss
- %TEMP%\inh10249261015\css\sdk-ui\_button.scss
- %TEMP%\inh10249261015\css\sdk-ui\_checkbox.scss
- %TEMP%\inh10249261015\css\sdk-ui\_progress-bar.scss
- %TEMP%\inh10249261015\css\sdk-ui\images\button-bg.png
- %TEMP%\inh10249261015\css\sdk-ui\images\progress-bg-corner.png
- %TEMP%\inh10249261015\css\sdk-ui\images\progress-bg.png
- %TEMP%\inh10249261015\css\sdk-ui\images\progress-bg2.png
- %TEMP%\inh10249261015\images\bg.jpg
- %TEMP%\inh10249261015\images\bg.png
- %TEMP%\inh10249261015\images\close.png
- %TEMP%\inh10249261015\images\close_hover.png
- %TEMP%\inh10249261015\images\color_button.png
- %TEMP%\inh10249261015\images\grey_button.png
- %TEMP%\inh10249261015\bootstrap_26581.html
- %TEMP%\inh10249261015\images\grey_button_hover.png
- %TEMP%\inh10249261015\images\icon_generic.png
- %TEMP%\inh10249261015\images\loader.gif
- %TEMP%\inh10249261015\images\pause_button.png
- %TEMP%\inh10249261015\images\progress.png
- %TEMP%\inh10249261015\images\progressad.png
- %TEMP%\inh10249261015\images\progressbar.png
- %TEMP%\inh10249261015\images\quick_specs.png
- %TEMP%\inh10249261015\images\resume_button.png
- %TEMP%\inh10249261015\images\sponsored.png
- %TEMP%\inh10249261015\libs\localassests\icc\icc_v5_8.cis
- %TEMP%\inh10249261015\libs\localassests\icut\icut_v2_2.cis
- %TEMP%\inh10249261015\locale\en.locale
- %TEMP%\000fa4f5.log
- %TEMP%\inh10249261015\css\helpers\_width-height.scss
- %TEMP%\inh10249261015\images\color_button_hover.png
- %TEMP%\inh10249261015\css\helpers\_visibility.scss
- %TEMP%\inh10249261015\css\main.scss
- %TEMP%\nsw8843.tmp\system.dll
- %TEMP%\nsw8843.tmp\inetc.dll
- %TEMP%\132730230093092000.exe
- %TEMP%\nsl8c96.tmp
- %TEMP%\nsg8d14.tmp\nsexec.dll
- %TEMP%\nsg8d14.tmp\system.dll
- %TEMP%\nsg8d14.tmp\inetc.dll
- %TEMP%\13273023013271600082.exe
- %TEMP%\000fa38e.log
- %TEMP%\inh10249261015\csshover3.htc
- %TEMP%\inh10249261015\form.bmp.mask
- %TEMP%\inh10249261015\css\ie6_main.css
- %TEMP%\inh10249261015\css\ie6_main.scss
- %TEMP%\inh10249261015\css\main.css
- %TEMP%\inh10249261015\css\swagent.css
- %TEMP%\inh10249261015\css\helpers\_positions.scss
- %TEMP%\inh10249261015\css\_functions.scss
- %TEMP%\inh10249261015\css\_helpers.scss
- %TEMP%\inh10249261015\css\_variables.scss
- %TEMP%\inh10249261015\css\helpers\_align.scss
- %TEMP%\inh10249261015\css\helpers\_backgrounds.scss
- %TEMP%\inh10249261015\css\helpers\_border-radius.scss
- %TEMP%\inh10249261015\css\helpers\_border.scss
- %TEMP%\inh10249261015\css\helpers\_clearfix.scss
- %TEMP%\inh10249261015\css\helpers\_colors.scss
- %TEMP%\inh10249261015\css\helpers\_display.scss
- %TEMP%\inh10249261015\css\helpers\_float.scss
- %TEMP%\inh10249261015\css\helpers\_lists.scss
- %TEMP%\inh10249261015\css\helpers\_margin.scss
- %TEMP%\inh10249261015\css\helpers\_padding.scss
- %TEMP%\inh10249261015\css\helpers\_typography.scss
- %ProgramFiles(x86)%\000fab0d.log
Deletes the following files
- %TEMP%\nsw8843.tmp\inetc.dll
- %TEMP%\nsw8843.tmp\system.dll
- %TEMP%\000fa38e.log
- %TEMP%\000fa4f5.log
- %ProgramFiles(x86)%\000fab0d.log
- %TEMP%\inh10249261015\bootstrap_26581.html
Modifies the following files
Substitutes the following files
- %TEMP%\000fa4f5.log
Network activity
Connects to
- 'in######r.jdownloader.org':80
- 'fe###.jdcdn.org':80
UDP
- DNS ASK in######r.jdownloader.org
- DNS ASK fe###.jdcdn.org
- DNS ASK de#.###omi-tonoc.com
- DNS ASK vp#.###omi-tonoc.com
- DNS ASK bb#.###omi-tonoc.com
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
- ClassName: '#32770' WindowName: ''
- ClassName: 'SysListView32' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '%TEMP%\rarsfx0\install jdownloader.exe'
- '%TEMP%\132730230093092000.exe'
- '%TEMP%\13273023013271600082.exe'
- '%WINDIR%\syswow64\wbem\wmic.exe' /NAMESPACE:\\root\SecurityCenter path AntiVirusProduct get displayName' (with hidden window)
- '%WINDIR%\syswow64\wbem\wmic.exe' /NAMESPACE:\\root\SecurityCenter2 path AntiVirusProduct get displayName' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\wbem\wmic.exe' /NAMESPACE:\\root\SecurityCenter path AntiVirusProduct get displayName
- '%WINDIR%\syswow64\wbem\wmic.exe' /NAMESPACE:\\root\SecurityCenter2 path AntiVirusProduct get displayName
