Trojan.DownLoader34.7013

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
%WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357

Сетевая активность

TCP

Запросы HTTP GET

http://ax##.r98.ir/js/site.js
http://ro##p.ir/view/1898698/%D8%B1%D8%B6%D8%A7-%D8%B1%D9%88%DB%8C%DA%AF%D8%B1%DB%8C-2.jpg
http://ro##p.ir/view/1900664/mahnaz-afshar-poster.jpg
http://ro##p.ir/view/1900683/nioosha_zeighami_zemestan_94_731167.jpg
http://ro##p.ir/view/1900691/golikhani-black-white.jpg
http://ro##p.ir/view/1900696/shabnam_golikhani.jpg
http://ro##p.ir/view/1900702/man_madar_hastam.jpg
http://ro##p.ir/view/1900713/baran-kosari_0.jpg
http://ro##p.ir/view/1898978/5528746_01.jpg
http://ro##p.ir/view/1900723/512039.4x2v5v8.jpg
http://ro##p.ir/view/1901887/fariborz.jpg
http://ro##p.ir/view/1901892/porsorkh-arman.jpg
http://ro##p.ir/view/1901897/parsapirouzfar_03.jpg
http://ro##p.ir/view/1901902/sham%20ghariban95_01.jpg
http://ro##log.com/temp/rozex/bloob/polls-js.js
http://ro##p.ir/view/1901910/www_Campec_Ir_film_salam_bambaei_2.jpg
http://ro##log.com/temp/rozex/bloob/scripts.js
http://ro##p.ir/view/1901885/ali-ziya.jpg
http://ro##p.ir/view/1898898/golzar-indian.jpg
http://ro##p.ir/view/1898779/%DA%A9%D8%A7%D9%85%D8%A8%DB%8C%D8%B2-%D8%AF%DB%8C%D8%B1%D8%A8%D8%A7%D8%B2-3.jpg
http://ro##p.ir/view/1898654/-%D8%B5%D8%A7%D9%84%D8%AD%DB%8C-1-e1475014889656.jpg
http://ro##p.ir/view/1898578/%D8%B1%D8%B6%D8%A7-%D8%B9%D8%B7%D8%A7%D8%B1%D8%A7%D9%86-2.jpg
http://ro##p.ir/view/1898984/selfi-shahab.jpg
http://ro##p.ir/view/1900674/niusha-zeighami-model-manto.jpg
http://ro##p.ir/up/rozex/bloob/images/heart.png
http://ro##p.ir/up/rozex/rozex3.gif
http://ro##p.ir/view/1898594/%DA%AF%D9%84%D8%B4%DB%8C%D9%81%D8%AA%D9%87-%D9%81%D8%B1%D8%A7%D9%87%D8%A7%D9%86%DB%8C.jpg
http://ro##p.ir/view/1898765/%D8%AA%D8%B1%D9%84%D8%A7%D9%86-%D9%BE%D8%B1%D9%88%D8%A7%D9%86%D9%87.jpg
http://ro##p.ir/view/1898812/%D9%84%DB%8C%D9%86%D8%AF%D8%A7-%DA%A9%DB%8C%D8%A7%D9%86%DB%8C-1.jpg
http://ro##p.ir/view/1898714/%DB%8C%DA%A9%D8%AA%D8%A7-%D9%86%D8%A7%D8%B5%D8%B1-1.jpg
http://ro##p.ir/view/1898591/%D8%A8%D9%87%D9%86%D9%88%D8%B4-%D8%B7%D8%A8%D8%A7%D8%B7%D8%A8%D8%A7%DB%8C%DB%8C-1.jpg
http://ro##p.ir/view/1898572/%D9%88%DB%8C%D8%AF%D8%A7-%D8%AC%D9%88%D8%A7%D9%86-1.jpg
http://ro##p.ir/view/1898633/%D9%86%D8%B3%D8%B1%DB%8C%D9%86-%D9%86%D8%B5%D8%B1%D8%AA%DB%8C-5.jpg
http://ro##p.ir/view/1898803/%D8%A7%D9%84%D9%86%D8%A7%D8%B2-%D8%B4%D8%A7%DA%A9%D8%B1%D8%AF%D9%88%D8%B3%D8%AA-3.jpg
http://ro##p.ir/view/1898789/%D9%85%D8%A7%D8%AF%D8%B1-%D8%A7%D9%84%D9%87%D9%87-%D8%AD%D8%B5%D8%A7%D8%B1%DB%8C-3.jpg
http://ro##p.ir/view/1898596/-%D8%AC%D9%88%D8%A7%D9%87%D8%B1%DB%8C%D8%A7%D9%86-e1475103198389.jpg
http://ro##p.ir/view/1898750/%D9%86%D8%B1%DA%AF%D8%B3-%D9%85%D8%AD%D9%85%D8%AF%DB%8C-1.jpg
http://ro##p.ir/view/1898723/-%D8%B4%D8%A7%D8%AF%D9%88%D9%86%D9%87-%D9%88-%D8%AF%D8%AE%D8%AA%D8%B1%D8%B4-e1474797997527.jpg
http://ro###.rozblog.com/user/Avatar/rozex/rozex.jpg
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
http://fa###ama.com/images/like1.png
http://ro##log.com/temp/rozex/bloob/jquery.form.min.js
http://ro##p.ir/up/rozex/bloob/fonts/fontawesome-webfont.eot?
http://ro##p.ir/up/rozex/bloob/font-awesome.min.css
http://ro##p.ir/up/rozex/Documents/tool-contact/v2/black.css
http://ro##p.ir/up/rozex/Documents/tool-contact/v2/style.css
http://ro##p.ir/up/rozex/bloob/rtl.css
http://ro##p.ir/up/rozex/bloob/masterslider.main.css
http://ro##p.ir/up/rozex/bloob/js_composer.css
http://ro##p.ir/up/rozex/bloob/font/dripicons.eot?
http://ro##p.ir/up/rozex/bloob/responsive.css
http://ro##p.ir/up/rozex/bloob/icons.css
http://ro##p.ir/up/rozex/bloob/styles.css
http://ro##p.ir/up/rozex/bloob/prettyPhoto.css
http://ro##p.ir/up/rozex/bloob/symple_styles.css
http://ro##p.ir/up/rozex/bloob/style.css
http://ro##p.ir/up/rozex/bloob/allStyle.css
http://ro##log.com/temp/rozex/bloob/recaptcha_ajax.js
http://ro##p.ir/up/rozex/bloob/animate.css
http://ro##p.ir/up/rozex/bloob/fonts/MjCasablanca.eot?
http://ro##p.ir/up/rozex/bloob/fonts/BYekan.eot?
http://ro##p.ir/up/rozex/Documents/tool-contact/v2/fonticon.css
http://ro##log.com/temp/ng/sharethis.png
http://dl.##pnaz.com/2016/09/%D8%B1%D8%B6%D8%A7-%D8%B1%D9%88%DB%8C%DA%AF%D8%B1%DB%8C-3.jpg
http://dl.##pnaz.com/2016/09/%D8%B1%D8%B6%D8%A7-%D8%B1%D9%88%DB%8C%DA%AF%D8%B1%DB%8C-2.jpg
http://ro##log.com/temp/ng/cloob.png
http://ro##p.ir/view/1901918/www_Campec_Ir_bita_beigi_1.jpg
http://ro##log.com/images/ads/logo_ads.png
http://ro##p.ir/up/rozex/bloob/images/backgrounds/6.png
http://ro##log.com/temp/rozex/bloob/html5.js
http://ro##log.com/temp/rozex/bloob/zilla-likes.js
http://ro##log.com/temp/rozex/bloob/jquery.blockUI.js
http://ro##log.com/temp/rozex/bloob/jquery-migrate.min.js?ve#######
http://ro##p.ir/up/rozex/them-shop/barnar/fonts/dinarm.eot?
http://ro##p.ir/up/rozex/them-shop/barnar/fonts/dinar.eot?
http://ro##log.com/temp/rozex/bloob/jquery.js
http://ro##p.ir/up/rozex/them-shop/barnar/fonts/BYekan.eot?
http://we####iconfonts.com/api/fonts/entypo/entypo.eot?
http://ro##p.ir/up/rozex/them-shop/barnar/fonts.css
http://8p#c.ir/images/o6w65a6gvjaj892ffle2.png
http://oc##.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D