Trojan.DownLoader46.45364

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%APPDATA%\microsoft\windows\privacie\index.dat
%LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012024010220240103\index.dat

Сетевая активность

Подключается к

'go#####k.rozblog.com':443
'qw###698.com':80
'fo##sh.biz':80
'be##.#aprila.com':443
'ho##ozdl.ir':80
'ho######.ir.domains.blog.ir':80
'go#####agmanager.com':443
'go#####a###ytics.com':443
'pk#.goog':80
'dl.###nloadyha.com':80
'ra###.bayan.ir':80
'we##ozar.ir':80
'dl###zane.net':443
'cd#.#ayan.ir':80

TCP

Запросы HTTP GET

http://qw###698.com/nabimages/HB/1393092411084baner1.gif
http://cd#.#ayan.ir/blog/templates/907/nav-bg.png
http://cd#.#ayan.ir/blog/templates/907/header_bg.jpg
http://cd#.#ayan.ir/blog/templates/907/line2.png
http://cd#.#ayan.ir/blog/templates/907/footer-bg.jpg
http://cd#.#ayan.ir/blog/templates/907/box-title.png
http://cd#.#ayan.ir/blog/templates/907/box-shadow.png
http://cd#.#ayan.ir/blog/templates/907/box-bg.png
http://cd#.#ayan.ir/blog/templates/907/shadow.png
http://cd#.#ayan.ir/blog/templates/907/home.png
http://cd#.#ayan.ir/blog/templates/907/nav-hover.png
http://cd#.#ayan.ir/blog/templates/907/sidebar-bullet.png
http://cd#.#ayan.ir/blog/templates/907/details_ico.png
http://cd#.#ayan.ir/blog/templates/907/big-btn-bg.png
http://cd#.#ayan.ir/blog/templates/907/footer-bg_shadow.jpg
http://cd#.#ayan.ir/blog/templates/907/bg_footer.png
http://cd#.#ayan.ir/blog/templates/shared/icon/rss-icon-dark.png
http://cd#.#ayan.ir/blog/templates/shared/icon/bayan-icon-dark.png
http://cd#.#ayan.ir/blog/templates/shared/icon/bayanbox-icon-dark.png
http://cd#.#ayan.ir/blog/templates/shared/icon/blog-icon-dark.png
http://cd#.#ayan.ir/blog/templates/shared/icon/templates-icon-dark.png
http://www.we###zar.com/counter/pic/stat4.gif
http://www.do###oadyha.com/wp-content/uploads/Dungeon-Maker.jpg
http://en####.webgozar.ir/counter/xstat.aspx?t=######################################################################################################################
http://www.do###oadyha.com/wp-content/uploads/a606938cfdbd1fbcd16f9b75385ef09e.jpg
http://www.we##ozar.ir/c.aspx?Co####################
http://qw###698.com/nabimages/nGoodImages/13930924110919gloves1.jpg
http://fo##sh.biz/template/1/img/detailshop.gif
http://qw###698.com/nabimages/nGoodImages/13930924111015gloves4.jpg
http://qw###698.com/nabimages/nGoodImages/13930924111028gloves2.jpg
http://qw###698.com/nabimages/nGoodImages/13930924111559gloves3.jpg
http://qw###698.com/nabimages/VB/1393092411099baner2.gif
http://qw###698.com/nabimages/nGoodImages/13930924111126gloves7.jpg
http://ho##ozdl.ir/
http://ho######.ir.domains.blog.ir/
http://ho######.ir.domains.blog.ir/static/CIqVapCieMo/2279571377/style.css
http://bl#g.ir/media/script/blog.min.js?FY####
http://bl#g.ir/media/css/sharedrtl-blogs.css?fv####
http://pk#.goog/gsr1/gsr1.crt
http://bl#g.ir/media/images/cleardot.gif
http://dl.###nloadyha.com/image/WhatsApp.Messenger.jpg
http://dl.###nloadyha.com/image/PicsArt.Photo.Studio.jpg
http://www.do###oadyha.com/wp-content/uploads/NLL-Screen-Recorder-PRO-Cover.jpg
http://ra###.bayan.ir/rb.js?v=##
http://www.do###oadyha.com/wp-content/uploads/Instagram-android.jpg
http://www.do###oadyha.com/wp-content/uploads/Football-Fred-Cover.jpg
http://www.do###oadyha.com/wp-content/uploads/Super-Backup-Restore-Full-Cover.jpg
http://www.do###oadyha.com/wp-content/uploads/Brain-Marmelade-Cover.jpg
http://ho######.ir.domains.blog.ir/favicon.ico