Trojan.DownLoader34.35136

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
%WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357

Сетевая активность

TCP

Запросы HTTP GET

http://ge####ire.rzb.ir/js/site.js
http://ro##p.ir/up/rozex/bloob/images/backgrounds/6.png
http://www.dl##x.com/wp-content/uploads/2017/09/Need-For-Speed-Payback.jpg
http://www.dl##x.com/wp-content/uploads/2018/02/Fortnite.jpg
http://www.ga#####easedates.net/images/covers/pc/cover-pc-destiny-2.jpg
http://ga##x10.com/wp-content/uploads/2017/08/aco-packshot-pcdvdrom-standard-2d-pol.jpg
http://re#o.st/self/f97f4d021904c1b49ba65bd268658c31a8c1d01e.jpg
http://ga###lay.net/wp-content/uploads/2017/03/Tom-Clancys-Rainbow-Six-Siege-Free-Download.jpg
http://ro##p.ir/view/2371408/IMG_20171120_200255.jpg
http://ro##p.ir/up/rozex/rozex3.gif
http://www.dl##x.com/wp-content/uploads/2018/02/Age-of-Empires-Definitive-Edition.jpg
http://www.dl##x.com/wp-content/uploads/2017/11/amdup.jpg
http://ro##p.ir/up/rozex/bloob/images/logo1.png
http://ro##log.com/temp/rozex/bloob/jquery.form.min.js
http://ro##log.com/temp/rozex/bloob/scripts.js
http://www.dl##x.com/wp-content/uploads/2017/09/Assassins-Creed-Origins.jpg
http://www.dl##x.com/wp-content/uploads/2017/12/The-Legend-of-Zelda-Breath-of-The-Wild.jpg
http://www.dl##x.com/wp-content/uploads/2017/10/Real-Farm.jpg
http://www.dl##x.com/wp-content/uploads/2016/03/tom_clancy.jpg
http://www.dl##x.com/wp-content/uploads/2017/10/WWE-2K18.jpg
http://www.dl##x.com/wp-content/uploads/2015/12/Dying-Light-Co.jpg
http://www.dl##x.com/wp-content/uploads/2017/11/Life-is-Strange-Before-the-Storm.jpg
http://www.dl##x.com/wp-content/uploads/2017/09/Call-of-Duty%C2%AE-WWII-.jpg
http://x.##2.us/x.cer
http://cr#.#odaddy.com/gdroot.crl
http://cr#.#odaddy.com/gdroot-g2.crl
http://ro##log.com/temp/rozex/bloob/polls-js.js
http://www.dl##x.com/wp-content/uploads/2017/07/Dying-Light-The-Fo.jpg
http://ro##log.com/temp/rozex/bloob/html5.js
http://ro##log.com/temp/rozex/bloob/zilla-likes.js
http://ro##log.com/temp/rozex/bloob/jquery.blockUI.js
http://ro##log.com/temp/rozex/bloob/recaptcha_ajax.js
http://ro##p.ir/up/rozex/bloob/style.css
http://ro##p.ir/up/rozex/bloob/prettyPhoto.css
http://ro##p.ir/up/rozex/bloob/symple_styles.css
http://ro##p.ir/up/rozex/bloob/styles.css
http://ro##p.ir/up/rozex/bloob/icons.css
http://ro##p.ir/up/rozex/bloob/animate.css
http://ro##p.ir/up/rozex/bloob/responsive.css
http://ro##p.ir/up/rozex/bloob/js_composer.css
http://ro##p.ir/up/rozex/bloob/masterslider.main.css
http://ro##p.ir/up/rozex/bloob/rtl.css
http://ro##p.ir/up/rozex/Documents/tool-contact/v2/style.css
http://ro##p.ir/up/rozex/bloob/allStyle.css
http://ro##p.ir/up/rozex/Documents/tool-contact/v2/black.css
http://ro##p.ir/up/rozex/bloob/fonts/fontawesome-webfont.eot?
http://ro##p.ir/up/rozex/bloob/font/dripicons.eot?
http://ro##p.ir/up/rozex/bloob/fonts/MjCasablanca.eot?
http://ro##p.ir/up/rozex/bloob/fonts/BYekan.eot?
http://ro##p.ir/up/rozex/Documents/tool-contact/v2/fonticon.css
http://ro##p.ir/up/rozex/them-shop/barnar/fonts.css
http://ro##p.ir/up/rozex/them-shop/barnar/fonts/BYekan.eot?
http://ro##log.com/temp/rozex/bloob/jquery.js
http://we####iconfonts.com/api/fonts/entypo/entypo.eot?
http://ro##p.ir/up/rozex/them-shop/barnar/fonts/dinar.eot?
http://ro##p.ir/up/rozex/them-shop/barnar/fonts/dinarm.eot?
http://ro##log.com/temp/rozex/bloob/jquery-migrate.min.js?ve#######
http://ro##p.ir/up/rozex/bloob/font-awesome.min.css
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
http://o.##2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D