Trojan.DownLoader34.17227

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
%WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357

Сетевая активность

TCP

Запросы HTTP GET

http://ar#####iha.rozblog.com/js/site.js
http://ar#####iha.rozblog.com/images/no_image.png
http://ro##p.ir/up/rozex/rozex3.gif
http://ro##p.ir/up/panis/Pictures/shahshahani/1545810_680322465352880_195984709_n.jpg
http://s3.##cofile.com/file/8210872326/www_Campec_Ir_Behnoosh_Bakhtiari.jpg
http://ro##log.com/images/refresh.gif
http://www.mu##ijob.ir/page/random-viewlinks-introu-pid255655866
http://up.##ltijob.ir/abzar/tools/mypoping/interupopredirecttomysitelinks/autolinkstooursiterandom.js
http://up.##ltijob.ir/abzar/tools/popuponclickmod/operator/multijobpopputerpopads.js
http://te##gram.me/joinchat/AAAAADwUKoUfci_AqAPAxQ
http://up.##ltijob.ir/abzar/tools/popuponclickmod/operator/onclickpopup.js
http://s1#.#####sic.org.bir-music1.ir/shahrivar94/Ali-Abdolmaleki-Chera-Man.jpg
http://up.##ltijob.ir/abzar/tools/popuponclickmod/operator/onclickpopupoperator.js
http://s3.##cofile.com/file/8210872968/www_Campec_Ir_Yekta_Naser.jpg
http://s1#.#####sic.org.bir-music1.ir/cgi-sys/suspendedpage.cgi
http://s6.##cofile.com/file/8210867726/www_Campec_Ir_Consert_Omid_Hajili.jpg
http://ro##log.com/temp/rozex/bloob/scripts.js
http://ro##p.ir/up/rozex/bloob/images/heart.png
http://ro###.rozblog.com/user/Avatar/rozex/rozex.jpg
http://fu#.###verdownload.com/wp-content/uploads/2014/03/serial-roozhaye-bad-bedar.jpg
http://ro##log.com/temp/music3/MTForumBlock_row_over.png
http://ro##log.com/temp/rozex/bloob/js_composer_front.js
http://ro##log.com/temp/rozex/bloob/custom.js
http://st####.hugedomains.com/images/logo_huge_domains.gif
http://ro##log.com/temp/rozex/bloob/jquery.prettyPhoto.js
http://ro##log.com/temp/rozex/bloob/jquery.fitvids.js
http://ro##log.com/temp/rozex/bloob/jquery.li-scroller-rtl.1.0.js
http://ro##log.com/temp/rozex/bloob/seven.min.js
http://ro##log.com/temp/rozex/bloob/owl.carousel.min.js
http://hw##.##set.lenzor.com/lp/375210-759-m.jpg
http://www.be###sic254.com/wp-content/uploads/2014/05/Behnam-Safavi.jpg
http://ro##log.com/temp/rozex/bloob/polls-js.js
http://www.ta###ama.com/wp-content/uploads/2014/05/en613.jpg
http://www.ta###ama.com/wp-content/uploads/picture/Neisan/1.jpg
http://ro##log.com/temp/rozex/bloob/jquery.form.min.js
http://mi##nd.ir/wp-content/uploads/2014/05/download-serial-secret-army.jpg
http://se##.#ust.edu.cn/wp-content/uploads/2014/05/Behnam-Safavi.jpg
http://s6.##cofile.com/file/8210879150/www_Campec_Ir_Nioosha_Zeighami.jpg
http://s1#.#####sic.org.bir-music1.ir/shahrivar94/Mehdi%20Ahmadvand.JPG
http://s1#.#####sic.org.bir-music1.ir/shahrivar94/Behnam-Alamshahi-Birdaneh.jpg
http://ro##p.ir/up/rozex/bloob/font-awesome.min.css
http://ro##p.ir/up/rozex/Documents/tool-contact/v2/black.css
http://ro##p.ir/up/rozex/Documents/tool-contact/v2/style.css
http://ro##p.ir/up/rozex/bloob/rtl.css
http://ro##p.ir/up/rozex/bloob/masterslider.main.css
http://ro##p.ir/up/rozex/bloob/js_composer.css
http://ro##p.ir/up/rozex/bloob/responsive.css
http://ro##p.ir/up/rozex/bloob/animate.css
http://ro##p.ir/up/rozex/bloob/icons.css
http://ro##p.ir/up/rozex/bloob/styles.css
http://ro##p.ir/up/rozex/bloob/prettyPhoto.css
http://ro##p.ir/up/rozex/bloob/symple_styles.css
http://ro##p.ir/up/rozex/bloob/style.css
http://ro##log.com/temp/rozex/bloob/recaptcha_ajax.js
http://ro##p.ir/up/rozex/bloob/allStyle.css
http://ro##p.ir/up/rozex/bloob/fonts/fontawesome-webfont.eot?
http://ro##p.ir/up/rozex/bloob/font/dripicons.eot?
http://ro##p.ir/up/rozex/bloob/fonts/MjCasablanca.eot?
http://ro##p.ir/up/rozex/bloob/fonts/BYekan.eot?
http://s3.##cofile.com/file/8212809326/www_Campec_Ir_Nioosha_Zeighami_494.JPG
http://s1#.#####sic.org.bir-music1.ir/shahrivar94/majid%20kharatha%20-%20daram%20miram/144264116125465578untitled.jpeg
http://s1#.#####sic.org.bir-music1.ir/mehr94/tataloo-video.jpg
http://ro##p.ir/up/rozex/bloob/images/backgrounds/6.png
http://ro##p.ir/up/rozex/bloob/images/logo1.png
http://ro##log.com/temp/rozex/bloob/html5.js
http://ro##log.com/temp/rozex/bloob/zilla-likes.js
http://ro##log.com/temp/rozex/bloob/jquery-migrate.min.js?ve#######
http://ro##log.com/temp/rozex/bloob/jquery.blockUI.js
http://ro##p.ir/up/rozex/them-shop/barnar/fonts/dinarm.eot?
http://ro##p.ir/up/rozex/them-shop/barnar/fonts/dinar.eot?
http://ro##log.com/temp/rozex/bloob/jquery.js
http://ro##p.ir/up/rozex/them-shop/barnar/fonts/BYekan.eot?
http://we####iconfonts.com/api/fonts/entypo/entypo.eot?
http://ro##p.ir/up/rozex/them-shop/barnar/fonts.css
http://ro##p.ir/up/rozex/Documents/tool-contact/v2/fonticon.css
http://s3.##cofile.com/file/8212905684/www_Campec_Ir_Narges_Mohammadi_267.JPG
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt