Trojan.DownLoader29.61023

Technical Information

Modifies file system

Creates the following files

%HOMEPATH%\cookies\user@baidu[1].txt

Network activity

Connects to

'pu##.###nzhang.baidu.com':445
'pu##.###nzhang.baidu.com':139
'pu##.###nzhang.baidu.com':80

TCP

HTTP GET requests

http://y0.#######g.com.litedownloadseek.cn/a/2016/0122/basic_new_v2.css
http://bi##.huaxia.com/huaxiaimages/zz/5.jpg
http://bi##.huaxia.com/huaxiaimages/zz/2.jpg
http://bi##.huaxia.com/huaxiaimages/zz/32.jpg
http://d.###ngimg.com/w90_h90/p2.ifengimg.com/fck/2017_16/28b7513fe4c6047_w500_h398.jpg
http://d.###ngimg.com/w90_h90/p0.ifengimg.com/a/2017_16/8be6d6de370b534_size30_w307_h472.jpg
http://d.###ngimg.com/w90_h90/p2.ifengimg.com/a/2017_16/8487e738d4f54a3_size90_w400_h228.jpg
http://d.###ngimg.com/w90_h90/p0.ifengimg.com/a/2017_14/ee45969760d13aa_size56_w500_h281.jpg
http://d.###ngimg.com/w90_h90/p1.ifengimg.com/a/2017_18/bb6327462918e0b_size108_w400_h300.jpg
http://d.###ngimg.com/w90_h90/p3.ifengimg.com/a/2017_18/ee38c1f06763f74_size118_w400_h300.jpg
http://d.###ngimg.com/w90_h90/p1.ifengimg.com/cmpp/2017/04/24/ab389c6e8cbcd99c0ebb11eca05a7c17_size50_w188_h118.jpg
http://d.###ngimg.com/w90_h90/p1.ifengimg.com/cmpp/2017/05/03/95267448c453aaa15eab26a386f690c7_size58_w188_h118.jpg
http://bi##.huaxia.com/huaxiaimages/zz/9.jpg
http://d.###ngimg.com/w90_h90/p3.ifengimg.com/cmpp/2017/05/04/92996c3cb17627b24efc026ee8a5af62_size41_w188_h118.jpg
http://d.###ngimg.com/w90_h90/p1.ifengimg.com/a/2017_17/ed5acea4a6f1e91_size146_w980_h570.jpg
http://d.###ngimg.com/w90_h90/p3.ifengimg.com/a/2017_18/c211e87b13bae49_size356_w1174_h647.jpg
http://bi##.huaxia.com/huaxiaimages/zz/39.jpg
http://y2.##engimg.com/9949a678442334cc/2013/1118/line.gif
http://y3.##engimg.com/e01ed39fc2da5d4a/2013/0617/more03.gif
http://y2.##engimg.com/e01ed39fc2da5d4a/2013/1023/s_bg02_1.gif
http://bi##.huaxia.com/images/commentImages/end_n_input_bg2.gif
http://y2.##engimg.com/l/2015/20/87f7e4c8d571484/ship01.jpg
http://y1.##engimg.com/a/2015/0715/line06.jpg
http://y0.##engimg.com/fe/zx1/images/dian2_5eaa3ce6.jpg
http://y0.##engimg.com/fe/zx1/images/dian1_14fd99e2.jpg
http://y0.##engimg.com/fe/zx1/images/xbj_a2f363cf.jpg
http://y2.##engimg.com/e01ed39fc2da5d4a/2013/1023/s_bg01_1.gif
http://bi##.huaxia.com/huaxiaimages/lb/45.jpg
http://p0.##engimg.com/fe/zx2/images/head_bj_53002fb7.jpg
http://y3.##engimg.com/l/2015/20/87f7e4c8d571484/line04.jpg
http://bi##.###edownloadseek.cn/gate/big5/stat.huaxia.com/count/MyStat.jsp?ai###########################
http://y2.##engimg.com/e01ed39fc2da5d4a/2014/0318/newsn_02.jpg
http://y2.##engimg.com/e01ed39fc2da5d4a/2013/1023/nav_bg03.gif
http://y2.##engimg.com/e01ed39fc2da5d4a/2013/1023/nav_bg02.gif
http://y2.##engimg.com/e01ed39fc2da5d4a/2013/1023/nav_bg01.gif
http://y0.##engimg.com/fe/zx1/images/xian_df30d870.jpg
http://bi##.###edownloadseek.cn/tj.js
http://d.###ngimg.com/w90_h90/p0.ifengimg.com/a/2017_18/75ab9859d1dff8d_size103_w1021_h586.jpg
http://d.###ngimg.com/w90_h90/p2.ifengimg.com/a/2017_18/5df74b4ad7aabc9_size94_w947_h664.jpg
http://d.###ngimg.com/w90_h90/p0.ifengimg.com/a/2017_18/fdf98a28941fc6b_size97_w697_h497.jpg
http://p1.##engimg.com/a/2017_16/3ea4e7427ad43cd.jpg
http://y3.##engimg.com/l/2015/20/87f7e4c8d571484/feng01.jpg
http://ne########-com.litedownloadseek.cn/
http://p2.##engimg.com/a/2017_16/5577ab2a2a0291e.jpg
http://y0.##engimg.com/fe/zx1/images/live_01_c503899c.jpg
http://y2.##engimg.com/l/2015/20/87f7e4c8d571484/feng.jpg
http://y1.##engimg.com/fe/zx1/images/right_827e4210.gif
http://y1.##engimg.com/fe/zx1/images/left_40e02304.gif
http://d.###ngimg.com/w650_h400/p3.ifengimg.com/cmpp/2017/05/04/21/9f254652-3782-4651-9770-596130df016d_size270_w1024_h683.jpg
http://d.###ngimg.com/w650_h400/p2.ifengimg.com/web/2017_18/bd4dafd671fdbcc_w930_h584.jpg
http://p0.#######g.com.litedownloadseek.cn/fe/zx2/styles/header_90cc09ce.css
http://y2.##engimg.com/a/2015/0715/logo_news_z.gif
http://p2.##engimg.com/a/2017/0104/fb96dfa4d829fd1size22_w120_h164.png
http://bi##.huaxia.com/huaxiaimages/zz/1.jpg
http://p1.#######g.com.litedownloadseek.cn/a/2017/0321/6196a1fb8c348a0.css
http://y0.##engimg.com/l/2015/20/87f7e4c8d571484/weix.jpg
http://p2.##engimg.com/a/2017_16/3c496e1c717e89e.jpg
http://y2.##engimg.com/e01ed39fc2da5d4a/2014/0318/newsn_15.gif
http://p3.##engimg.com/a/2017_16/77f9ebf08491c5e.jpg
http://d.###ngimg.com/w90_h90/p2.ifengimg.com/a/2017_02/828d2f1c6ca99cf_size42_w690_h540.jpg
http://d.###ngimg.com/w90_h90/p3.ifengimg.com/a/2017_03/aadc0d44da4c7a3_size15_w565_h365.jpg
http://d.###ngimg.com/w90_h90/p2.ifengimg.com/a/2017_15/1b1f8a4622c4d9c_size46_w900_h500.jpg
http://d.###ngimg.com/w90_h90/p1.ifengimg.com/a/2017_16/acf7b6bfce79a9e_size56_w900_h500.jpg
http://d.###ngimg.com/w90_h90/p1.ifengimg.com/a/2017_17/14031982affa8ef_size56_w900_h500.jpg
http://d.###ngimg.com/w90_h90/p0.ifengimg.com/a/2017/0504/e5f3b6404dfcde1size68_w440_h398.jpg
http://d.###ngimg.com/w90_h90/p1.ifengimg.com/a/2017/0504/26e96c63f1a6a58size14_w500_h276.jpg
http://d.###ngimg.com/w90_h90/p2.ifengimg.com/a/2017/0504/76cf975f4b0be8csize184_w540_h340.jpg
http://bi##.huaxia.com/huaxiaimages/zz/35.jpg
http://d.###ngimg.com/w90_h90/p1.ifengimg.com/haina/2016_46/14aa8d593e3a40f_w557_h484.jpg
http://d.###ngimg.com/w90_h90/p0.ifengimg.com/a/2016_46/dc7cfe932690b08_size30_w500_h389.jpg
http://d.###ngimg.com/w90_h90/p3.ifengimg.com/a/2016_46/9e89f02bff7c258_size27_w604_h414.jpg
http://y2.##engimg.com/e01ed39fc2da5d4a/2014/0318/newsn_14.gif
http://d.###ngimg.com/w650_h400/p1.ifengimg.com/a/2017_18/738ffd24e237542_size496_w1000_h666.jpg
http://d.###ngimg.com/w650_h400/p2.ifengimg.com/a/2017_18/97bf809ae968cc1_size106_w791_h800.jpg
http://p3.##engimg.com/a/2017_15/96197020db7a490.jpg
http://d.###ngimg.com/w90_h90/p3.ifengimg.com/a/2017_01/b927f9748ba7e86_size12_w317_h220.jpg
http://pu##.###nzhang.baidu.com/push.js