Trojan.DownLoader39.42773

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012021060820210609\index.dat

Сетевая активность

Подключается к

'sw###mining.win':443
'oa###ocks.org':80
'ir###pic.com':80
'i.###img.com':443
'kr###na24.ru':80
'ce####itymixer.com':80
'i.####ymail.co.uk':443
'pj####.wordpress.com':443
'im#####c.timeincapp.com':443
'cr###ick.com':80
'i.###m.co.uk':443
'pe########om.files.wordpress.com':443
'th#####-cl.xhcdn.com':443
'th####peningnew.com':80
'me###mass.net':443
'cl#####sion-gion.com':80
'lo##dat.ru':80
'pr###it2016.ru':443
'ji###osek.eu':443
'cd#.##quisitr.com':443
'st####.hugedomains.com':80
'th#####eningblog.com':80
'fa#.###fappeningnew.com':443
'th#####eningblog.com':443
'pj####.#iles.wordpress.com':80
'pj####.#iles.wordpress.com':443
'x.##2.us':80
'oc##.thawte.com':80
'ji###osek.eu':80
'o.##2.us':80
'pr###it2016.ru':80
'di.##ncdn.com':443
'st###ounter.com':443
'il###4ulih.com':445
'aj##.#oogleapis.com':80
'ht######v.googlecode.com':445
'ht######v.googlecode.com':139
'microsoft.com':80
'm.####access.mobi':443
'sw###mining.win':80
'google.com':80
'im####.###ebritymoviearchive.com':80
'im#####.xvideos-cdn.com':443
'im####c.xvideos.com':443
'ne###emovie.com':443
'ga####.uludagsozluk.com':80
'cd##.aznude.com':443
'cf##e.com':80
'nu###raphy.com':80
'an###sored.com':80
'th###ppening.so':80
'i.####ymail.co.uk':80
'pj####.wordpress.com':80
'nu####lebsworld.com':80
'st####.cinemagia.ro':80
'ne######.files.wordpress.com':443
'ci.##ncdn.com':443
'cd#.##quisitr.com':80
'im###.#eviantart.net':443
'up####.wikimedia.org':443
'oc##.###tg2.amazontrust.com':80

TCP

Запросы HTTP GET

http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
http://x.##2.us/x.cer
http://an###sored.com/files/images/vthumbs/m/a85b07fcc45a8c93bb00e5b7fd079dbc_full.jpg
http://an###sored.com/files/images/vthumbs/m/4a82bd3579491a9caceb2d57b6130aab_full.jpg
http://an###sored.com/sites/default/files/images/galleries/_ver2/data/pic/00/22/15/Lynskey-Park-n-01.jpg
http://st####.hugedomains.com/images/logo_huge_domains.gif
http://an###sored.com/sites/default/files/images/galleries/_ver2/data/pic/00/22/15/Lynskey-Heavenly-dai-n-4.jpg
http://an###sored.com/files/images/vthumbs/m/2e28d7502c3bb6eddf55e9d722c4d325_full.jpg
http://cf##e.com/medias/thumbs/1450830848f072d192_cfake.jpg
http://www.ir###pic.com/wp-content/uploads/2015/12/Melanie-Lynskey-18.jpg
http://www.ir###pic.com/wp-content/uploads/2015/12/Melanie-Lynskey-1.jpg
http://an###sored.com/files/images/vthumbs/m/af9403dcfa76b25bf429ea803e7d6c5e_full.jpg
http://an###sored.com/sites/default/files/images/celebrities/m/melanie_lynskey_naked.jpg
http://cf##e.com/medias/thumbs/1436185110029fb230_cfake.jpg
http://cf##e.com/medias/thumbs/14115158722b251e76_cfake.jpg
http://www.ir###pic.com/wp-content/uploads/2015/12/Melanie-Lynskey-17.jpg
http://ce####itymixer.com/wp-content/uploads/2016/01/MelanieLynskey02.jpg
http://i.####ymail.co.uk/i/pix/2017/02/16/18/3D4D92A200000578-4232212-Soon_to_wed_Melanie_Lynskey_delivered_some_news_on_Thursday_Whil-m-70_1487270810122.jpg
http://www.nu####lebsworld.com/nudeceleb/camsanon.jpg
http://an###sored.com/files/images/vthumbs/m/962abf2681771fef56f51845e98e7a0b_full.jpg
http://cf##e.com/medias/thumbs/1517227420d0e8a1d8_cfake.jpg
http://sw###mining.win/px.gif?ch######################
http://o.##2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D
http://oc##.###tg2.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D