Trojan.DownLoader29.46844

Technical Information

Modifies file system

Creates the following files

<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\caasbycl\1[1].jpg
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\seller[1].css
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\topnew2[1].css
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\common[1].js
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\tj[1].js
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\caasbycl\mystat[1].jsp
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\caasbycl\45[1].jpg
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\push[1].js
%APPDATA%\microsoft\windows\cookies\user@baidu[1].txt
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\caasbycl\end_n_input_bg2[1].gif
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\39[1].jpg
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\5[1].jpg
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\caasbycl\jquery.fancybox-1.3.4[1].css
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\3386f9569324b24d60f0760d5c[1].jpg
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\59a8b07f85536cebc5adba5e72[1].jpg
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\32[1].jpg
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\css[1].css
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\9[1].jpg
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\1563419211413713[1].jpg
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\cb57c7a0a935b537ac046d9c14[1].jpg
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\35[1].jpg
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\0fdc696edec39fe3c168d4d66c[1].jpg
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\22708fbce0e211090133da0ba8[1].jpg
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\caasbycl\2[1].jpg
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\jquery-ui-1.8.5.custom[1].css
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\caasbycl\f[1].txt

Network activity

TCP

HTTP GET requests

http://www.hd##ly.cn/ueditor/php/upload/image/20190718/1563419211413713.jpg
http://cs###.#####ai.com.litedownloadseek.cn/css/seller.css?v=########
http://bi##.###edownloadseek.cn/common.js
http://bi##.###edownloadseek.cn/tj.js
http://pu##.###nzhang.baidu.com/push.js
http://bi##.huaxia.com/images/commentImages/end_n_input_bg2.gif
http://bi##.huaxia.com/huaxiaimages/lb/45.jpg
http://bi##.###edownloadseek.cn/gate/big5/stat.huaxia.com/count/MyStat.jsp?ai###########################
http://bi##.huaxia.com/huaxiaimages/zz/39.jpg
http://bi##.huaxia.com/huaxiaimages/zz/5.jpg
http://bi##.huaxia.com/huaxiaimages/zz/32.jpg
http://bi##.huaxia.com/huaxiaimages/zz/9.jpg
http://bi##.huaxia.com/huaxiaimages/zz/35.jpg
http://im#.##eshi-img.com/center/680/42/cf/84/59a8b07f85536cebc5adba5e72.jpeg
http://im#.##eshi-img.com/center/680/bb/5d/e6/0fdc696edec39fe3c168d4d66c.jpeg
http://kq##.##.litedownloadseek.cn/static/skin/css.css
http://kq##.##.litedownloadseek.cn/static/yem/chajian/fancybox/jquery.fancybox-1.3.4.css
http://im##.#heshi-img.com/center/680/ba/d4/cb/3386f9569324b24d60f0760d5c.jpeg
http://im##.#heshi-img.com/center/680/0b/3a/38/cb57c7a0a935b537ac046d9c14.jpeg
http://im##.#heshi-img.com/center/680/41/75/0a/22708fbce0e211090133da0ba8.jpeg
http://bi##.huaxia.com/huaxiaimages/zz/2.jpg
http://bi##.huaxia.com/huaxiaimages/zz/1.jpg
http://cs###.#####ai.com.litedownloadseek.cn/css/topnew2.css?v=########
http://cs###.#####ai.com.litedownloadseek.cn/css/start/jquery-ui-1.8.5.custom.css