Trojan.DownLoader41.5875

Technical Information

Modifies file system

Creates the following files

%APPDATA%\nemoinfo\<File name>\fb3\20210808.mbin
%APPDATA%\nemoinfo\n8client\91848b2a6ed7\858\skin\windowslive\mainwnd\icon-undo.psd
%APPDATA%\nemoinfo\n8client\91848b2a6ed7\858\skin\windowslive\mainwnd\left.bmp
%APPDATA%\nemoinfo\n8client\91848b2a6ed7\858\skin\windowslive\mainwnd\max.psd
%APPDATA%\nemoinfo\n8client\91848b2a6ed7\858\skin\windowslive\mainwnd\min.psd
%APPDATA%\nemoinfo\n8client\91848b2a6ed7\858\skin\windowslive\mainwnd\more.psd
%APPDATA%\nemoinfo\n8client\91848b2a6ed7\858\skin\windowslive\mainwnd\new.psd
%APPDATA%\nemoinfo\n8client\91848b2a6ed7\858\skin\windowslive\mainwnd\open.psd
%APPDATA%\nemoinfo\n8client\91848b2a6ed7\858\skin\windowslive\mainwnd\progress.bmp
%APPDATA%\nemoinfo\n8client\91848b2a6ed7\858\skin\windowslive\mainwnd\icon-redo.psd
%APPDATA%\nemoinfo\n8client\91848b2a6ed7\858\skin\windowslive\mainwnd\icon-setting.psd
%APPDATA%\nemoinfo\n8client\91848b2a6ed7\858\skin\windowslive\mainwnd\replacecolor.psd
%APPDATA%\nemoinfo\n8client\91848b2a6ed7\858\skin\windowslive\mainwnd\save.psd
%APPDATA%\nemoinfo\n8client\91848b2a6ed7\858\skin\windowslive\mainwnd\theme.xml
%APPDATA%\nemoinfo\n8client\91848b2a6ed7\858\skin\windowslive\mainwnd\thumbs.db
%APPDATA%\nemoinfo\n8client\91848b2a6ed7\858\skin\windowslive\mainwnd\top.bmp
%APPDATA%\nemoinfo\n8client\template\40cc9b6b-9560-4eb2-b6b4-030ddbc942e3\image.nptl
%APPDATA%\nemoinfo\studiopublisher\user.ini
C:\:likuei
%APPDATA%\nemoinfo\n8client\template\9b774fb4-f197-4fa3-97ac-b5e2832d6b6a\template.pntl
%APPDATA%\nemoinfo\n8client\91848b2a6ed7\858\skin\windowslive\mainwnd\restore.psd
%APPDATA%\nemoinfo\n8client\91848b2a6ed7\858\skin\windowslive\mainwnd\right.bmp
%APPDATA%\nemoinfo\n8client\91848b2a6ed7\858\skin\windowslive\mainwnd\icon-ps.psd
%APPDATA%\nemoinfo\n8client\91848b2a6ed7\858\skin\windowslive\mainwnd\icon-mask.psd
%APPDATA%\nemoinfo\n8client\91848b2a6ed7\858\skin\windowslive\mainwnd\icon-line.psd
%TEMP%\n498e.tmp
%TEMP%\n4b15.tmp
%APPDATA%\nemoinfo\n8client\91848b2a6ed7\858\skin\windowslive\dialog\bottom.bmp
%APPDATA%\nemoinfo\n8client\91848b2a6ed7\858\skin\windowslive\dialog\close.psd
%APPDATA%\nemoinfo\n8client\91848b2a6ed7\858\skin\windowslive\dialog\dialog.bmp
%APPDATA%\nemoinfo\n8client\91848b2a6ed7\858\skin\windowslive\dialog\left.bmp
%APPDATA%\nemoinfo\n8client\91848b2a6ed7\858\skin\windowslive\dialog\max.psd
%APPDATA%\nemoinfo\n8client\91848b2a6ed7\858\skin\windowslive\dialog\min.psd
%APPDATA%\nemoinfo\n8client\91848b2a6ed7\858\skin\windowslive\dialog\restore.psd
%TEMP%\n496e.tmp
%APPDATA%\nemoinfo\n8client\91848b2a6ed7\858\skin\windowslive\dialog\right.bmp
%APPDATA%\nemoinfo\n8client\91848b2a6ed7\858\skin\windowslive\dialog\thumbs.db
%APPDATA%\nemoinfo\n8client\91848b2a6ed7\858\skin\windowslive\dialog\top.bmp
%APPDATA%\nemoinfo\n8client\91848b2a6ed7\858\skin\windowslive\mainwnd\bottom.bmp
%APPDATA%\nemoinfo\n8client\91848b2a6ed7\858\skin\windowslive\mainwnd\button-menu.psd
%APPDATA%\nemoinfo\n8client\91848b2a6ed7\858\skin\windowslive\mainwnd\close.psd
%APPDATA%\nemoinfo\n8client\91848b2a6ed7\858\skin\windowslive\mainwnd\dialog.bmp
%APPDATA%\nemoinfo\n8client\91848b2a6ed7\858\skin\windowslive\mainwnd\icon-addtext.psd
%APPDATA%\nemoinfo\n8client\91848b2a6ed7\858\skin\windowslive\mainwnd\icon-edit.psd
%APPDATA%\nemoinfo\n8client\91848b2a6ed7\858\skin\windowslive\mainwnd\icon-export.psd
%APPDATA%\nemoinfo\n8client\91848b2a6ed7\858\skin\windowslive\dialog\theme.xml
C:\:nspt
D:\:nspt

Deletes the following files

%TEMP%\n4b15.tmp
%TEMP%\n496e.tmp
%TEMP%\n498e.tmp

Network activity

TCP

HTTP GET requests

http://www.ne###nfo.com/product/checkupdate.asp?pr#####################################################
http://www.ne###nfo.com/uifkei299/nmfb3.asp?md#################################################################################

HTTP POST requests