home

files.downlogram.com

A HAPPY DREAMHOST CUSTOMER

Domain Information

The domain files.downlogram.com registered by A HAPPY DREAMHOST CUSTOMER was initially registered in May of 2012 through NEW DREAM NETWORK, LLC. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in New York City, New York within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Cloudfront CDN service which utilizes a number of proxy IP Addresses (see below).
Registrar:
DREAMHOST, LLC

Server location:
New York, United States (US)

Create date:
Sunday, May 6, 2012

Expires date:
Friday, May 6, 2016

Updated date:
Thursday, May 7, 2015

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US

Root domain:
downlogram.com

Whois:
3 downlogram.com records

Scanner detections:
Detections  (93% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.Installer.W3i.H, PUP.Installer.W3i.N, PUP.Installer.InstallX.Z, PUP.Installer.W3i.K, PUP.Installer.W3i.T, PUP.Installer.W3i.E, PUP.InstallX.W3i.Installer (M), PUP.InstallX.Installer (M)
92.86%

Malwarebytes
PUP.Optional.InstallIQ.A, PUP.Optional.SafeInstall.A
78.57%

Dr.Web
Adware.W3i.9, Trojan.DownLoader9.14179
78.57%

VIPRE Antivirus
InstallIQ Installer
78.57%

Sophos
InstallQ
78.57%

ESET NOD32
Win32/InstallIQ (variant)
78.57%

AVG
AdInstaller.InstallQ, MalSign.InstallX, Adware AdInstaller.InstallQ
57.14%

K7 AntiVirus
Unwanted-Program
50.00%

Trend Micro House Call
HV_INSTALLIQ_CA0836BD.TOMC, ADW_INSTALLIQ, TROJ_GEN.R0CBH0AI813, TROJ_GEN.F47V0303, TROJ_FAKEAV.BMC
42.86%

Fortinet FortiGate
Adware/InstallIQ, Riskware/InstallIQ
42.86%

Comodo Security
UnclassifiedMalware, Application.Win32.InstallIQ.B
35.71%

Avira AntiVirus
APPL/InstallQ.L, APPL/InstallIQ.C, Adware/InstaliIQ.E
35.71%

Baidu Antivirus
Trojan.Win32.InstallIQ, Trojan.Win32.Agent
35.71%

Trend Micro
ADW_INSTALLIQ, TROJ_FAKEAV.BMC
35.71%

IKARUS anti.virus
Win32.SuspectCrc, APPL
28.57%

The domain files.downlogram.com has been seen to resolve to the following 94 IP addresses.

52.85.131.238
server-52-85-131-238.iad53.r.cloudfront.net
May 18, 2016

52.85.131.230
server-52-85-131-230.iad53.r.cloudfront.net
May 18, 2016

52.85.131.155
server-52-85-131-155.iad53.r.cloudfront.net
May 18, 2016

52.85.131.143
server-52-85-131-143.iad53.r.cloudfront.net
May 18, 2016

52.85.131.136
server-52-85-131-136.iad53.r.cloudfront.net
May 18, 2016

52.85.131.75
server-52-85-131-75.iad53.r.cloudfront.net
May 18, 2016

52.85.131.34
server-52-85-131-34.iad53.r.cloudfront.net
May 18, 2016

52.85.131.251
server-52-85-131-251.iad53.r.cloudfront.net
May 18, 2016

54.192.195.136
server-54-192-195-136.iad53.r.cloudfront.net
February 19, 2016

54.192.195.125
server-54-192-195-125.iad53.r.cloudfront.net
February 19, 2016

54.192.195.110
server-54-192-195-110.iad53.r.cloudfront.net
February 19, 2016

54.192.195.57
server-54-192-195-57.iad53.r.cloudfront.net
February 19, 2016

54.192.195.8
server-54-192-195-8.iad53.r.cloudfront.net
February 19, 2016

54.192.195.4
server-54-192-195-4.iad53.r.cloudfront.net
February 19, 2016

54.192.195.230
server-54-192-195-230.iad53.r.cloudfront.net
February 19, 2016

54.192.195.199
server-54-192-195-199.iad53.r.cloudfront.net
February 19, 2016

54.192.195.250
server-54-192-195-250.iad53.r.cloudfront.net
January 27, 2016

54.192.195.202
server-54-192-195-202.iad53.r.cloudfront.net
January 27, 2016

54.192.195.193
server-54-192-195-193.iad53.r.cloudfront.net
January 27, 2016

54.192.195.170
server-54-192-195-170.iad53.r.cloudfront.net
January 27, 2016

54.192.195.103
server-54-192-195-103.iad53.r.cloudfront.net
January 27, 2016

54.192.195.55
server-54-192-195-55.iad53.r.cloudfront.net
January 27, 2016

54.192.195.5
server-54-192-195-5.iad53.r.cloudfront.net
January 27, 2016

54.192.195.251
server-54-192-195-251.iad53.r.cloudfront.net
January 27, 2016

54.230.103.94
server-54-230-103-94.iad2.r.cloudfront.net
December 17, 2015

54.230.103.240
server-54-230-103-240.iad2.r.cloudfront.net
December 17, 2015

54.230.103.227
server-54-230-103-227.iad2.r.cloudfront.net
December 17, 2015

54.230.103.212
server-54-230-103-212.iad2.r.cloudfront.net
December 17, 2015

54.230.103.164
server-54-230-103-164.iad2.r.cloudfront.net
December 17, 2015

54.230.103.162
server-54-230-103-162.iad2.r.cloudfront.net
December 17, 2015

 
Showing 30 of 94 IP Addresses

File downloads found at URLs served by files.downlogram.com.

1 / 68      (Adware)
http://files.downlogram.com/7zip_13978_7zip.exe  (3738a2022dd6f38e87fdb26cdcecb95e)

9 / 68      (Adware)
http://files.downlogram.com/dvdburner.exe  (74dbd8a183cebf90de082f56cd49d38e)

2 / 68      (inconclusive)
http://files.downlogram.com/codecs.exe  (94f8a2f23ac9c624a4864e4e3d09add4)

1 / 68      (Adware)
http://files.downlogram.com/ac3filter.exe  (45cc6c57c8aef4d1e7458e95bdf2537c)

8 / 68      (Adware)
http://files.downlogram.com/audioconverter.exe  (667aae184791bc8c6f21478f5534ccc8)

11 / 68    (Adware)
http://files.downlogram.com/finalmediaplayer.exe  (79f65310609a42079e32e7a2f58f2a54)

9 / 68      (Adware)
http://files.downlogram.com/7zip.exe  (77e2b804373cd0490d9a11f9aa54a296)

9 / 68      (Adware)
http://files.downlogram.com/exppdf7_b0.exe  (7e1ed05260f5db0c5359f80b880c624a)

7 / 68      (Adware)
http://files.downlogram.com/expertpdf7.exe  (01b34c400a71d7b335f6bba38d8eb9df)

16 / 68    (Adware)
http://files.downlogram.com/manual_download_14371_STN.exe  (5139d033bc3af2eabca4f5d2789c65ff)

18 / 68    (Adware)
http://files.downlogram.com/clipart_b0.exe  (InstallIQStub.exe)

10 / 68    (Adware)
http://files.downlogram.com/7zip_b0.exe  (dcf1b0e971984058371f0207aca15257)

18 / 68    (Adware)
http://files.downlogram.com/freefileviewer.exe  (InstallIQStub.exe)

18 / 68    (Adware)
http://files.downlogram.com/clipartcollection.exe  (InstallIQStub.exe)

The following 112 files have been seen to comunicate with files.downlogram.com in live environments.

TCP » 54.192.195.110:443
online-guardian-v2.0.9.exe

TCP » 54.192.55.199:80
ayiqhybsu.exe

TCP » 54.192.55.37:80
britches.exe (Britches)

TCP » 54.230.37.244:443
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 54.230.37.244:80
citrio.exe (Citrio by CatalinaGroup)

TCP » 54.192.55.199:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 54.230.51.186:80
uncheckitupdate.exe (Uncheckit Module by EVANGEL TECHNOLOGY (HK) LIMITED)

TCP » 54.192.55.39:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 54.230.51.187:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 54.192.55.154:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 54.192.55.199:80
ned5lrurm.exe

TCP » 54.192.55.199:80
qkseeSvc.exe (qksee by Qksee Pvt)

TCP » 54.192.55.37:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 54.230.37.181:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 54.230.37.181:80
bbqleadsapplication.exe (NpApplication by Microsoft)

TCP » 54.192.55.154:80
yacqq.exe

TCP » 54.192.55.154:443
browserairexec.exe (BrowserAir by Goobzo)

TCP » 54.192.55.39:80
emuletorrent.exe

TCP » 54.192.55.130:80
xshawtain.exe (Glary Utilities by Glarysoft)

TCP » 54.192.55.39:80
ipcdl.exe (YAC Security Protection by Elex do Brasil Participaçõesa)

 
Latest 20 of 144 files

URL:
http://files.downlogram.com/

Network:
Amazon Cloudfront

Web server:
AmazonS3

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.