Trojan.DownLoader27.37367

Техническая информация

Изменения в файловой системе

Создает следующие файлы

<Текущая директория>\tray6.ico
<Текущая директория>\fmt_moyu.ico
<Текущая директория>\gameyxdown.dat
%APPDATA%\localdb.db
%HOMEPATH%\cookies\user@707891[1].txt
%HOMEPATH%\cookies\user@mdsu.707891[1].txt

Сетевая активность

TCP

Запросы HTTP GET

http://bo###.9chapu.com/gamestart/yxgamestart.json
http://st####.yxdown.com/cjimages/swf/qdq_left_2.swf
http://i-#.#xdown.com/2019/7/16/8f1be297-d6a5-469e-a4bb-47b3a74a3b13.jpg
http://st####.yxdown.com/cjimages/swf/qdq_right_2.swf
http://i-#.#xdown.com/2019/7/17/4d66637c-b77c-484a-abce-22b937b09527.jpg
http://i-#.#xdown.com/2019/7/17/405de35e-6539-4aa3-8a39-fb3f4ceaddc6.png
http://i-#.#xdown.com/2019/7/16/04b20c39-3794-4d90-b782-6a412a1a6c38.png
http://i-#.#xdown.com/2019/7/17/b67c4b48-968f-447e-8b62-4871bfdac557.jpg
http://i-#.#xdown.com/2019/7/17/d5da0fd3-6270-44ea-8f5d-e87fda319693.jpg
http://i-#.#xdown.com/2019/7/17/2d4621d4-ff5d-4848-ad7f-a80babbc2ed9.jpg
http://i-#.#xdown.com/2019/7/17/2aee86b4-66f7-48a2-b4ca-1c469c1b3fca.jpg
http://i-#.#xdown.com/2019/7/16/d2e8a242-048b-4f7c-a6d8-638b5a2f25f4.jpg
http://i-#.#xdown.com/2019/7/16/cd81b420-1dd6-41dc-a0a6-2f7971bc8f8e.jpg
http://i-#.#xdown.com/2019/7/16/49c13e61-583e-4a2b-9961-f9b9205537a0.jpg
http://i-#.#xdown.com/2019/7/16/89c4cbe6-04d0-423d-b734-005923c6ee99.jpg
http://i-#.#xdown.com/2019/7/16/1b233852-fca6-40c1-815b-7094927b1282.jpg
http://i-#.#xdown.com/2019/7/16/595d255e-66ed-4f3a-ac02-0b6b18ddf3f3.jpg
http://i-#.#xdown.com/2019/7/16/b9b9ce04-6c8b-44c2-b873-344f35d24987.jpg
http://i-#.#xdown.com/2019/7/16/27a2c46a-7268-400c-b1c6-5def52b5a78e.jpg
http://i-#####own.715083.com/2019/7/16/9fd0bbdf-0c7a-467b-9dd9-b0bfe80ef224.jpg?im###############
http://i-#####own.715083.com/2019/7/16/2a8e64c7-3899-4fa8-8778-362b8b0833e3.jpg?im###############
http://i-#####own.715083.com/2019/7/16/5143472c-b520-4990-8714-ff46e436b61b.jpg?im###############
http://md##.707891.com/pop-up/yxbao_xb_0313.html
http://md##.707891.com/pop-up/icon/close.png
http://i-#####own.715083.com/2019/7/16/8f1be297-d6a5-469e-a4bb-47b3a74a3b13.jpg?im###############
http://i-#####own.715083.com/2019/7/16/2fb0f100-b2bc-4e78-b916-308abca9f2df.jpg?im###############
http://i-#.#xdown.com/2019/7/16/5143472c-b520-4990-8714-ff46e436b61b.jpg
http://i-#####own.715083.com/2019/7/17/4d66637c-b77c-484a-abce-22b937b09527.jpg?im###############
http://st####.yxdown.com/cjimages/swf/qdq_mid_1.swf
http://st####.yxdown.com/cj/qdq_right.js
http://ap#.##li.730891.com/open/rili/ip.json
http://gg#.#ql0468.com/redirect/box/ini/tc.url?ch###############################################
http://wc##.#mgouwu.com/yxh/img/tray6.ico
http://wc##.#mgouwu.com/yxh/img/fmt_moyu.ico
http://x1######n-qdq.srudw.cn:8090/gameStart/boxQDQ.html
http://st####.yxdown.com/h5/css/common.css
http://st####.yxdown.com/h5/js/jquery-1.9.1.min.js
http://st####.yxdown.com/h5/js/swfobject.2.2.js
http://st####.yxdown.com/h5/js/jstart161104.js
http://x1######n-qdq.srudw.cn:8090/gameStart/guang111.html
http://x1######n-qdq.srudw.cn:8090/gameStart/guang222.html
http://x1######n-qdq.srudw.cn:8090/gameStart/style/normalize.css
http://m.###own.com/yb/box/item.cshtml
http://www.yx##wn.com/js/swfobject.2.2.js
http://st####.yxdown.com/h5/css/qdq_v3.css
http://x1######n-qdq.srudw.cn:8090/gameStart/js/jquery-1.9.1.min.js
http://st####.yxdown.com/h5/images/q_bg.jpg
http://st####.yxdown.com/h5/js/qdq_a.js
http://st####.yxdown.com/h5/images/q_title.png
http://i-#.#xdown.com/2019/7/16/9fd0bbdf-0c7a-467b-9dd9-b0bfe80ef224.jpg
http://i-#.#xdown.com/2019/7/16/2fb0f100-b2bc-4e78-b916-308abca9f2df.jpg
http://st####.yxdown.com/h5/images/q_title3.png
http://st####.yxdown.com/h5/js/qdq_v3.js
http://i-#.#xdown.com/2019/7/16/2a8e64c7-3899-4fa8-8778-362b8b0833e3.jpg
http://st####.yxdown.com/cj/qdq_left.js
http://st####.yxdown.com/cjimages/tg-ico-expand.png
http://i-#####own.715083.com/2019/7/17/405de35e-6539-4aa3-8a39-fb3f4ceaddc6.png?im###############