Trojan.DownLoader36.46164

Technical Information

Network activity

Connects to

'ab##rfa.com':80
'oc##.#ectigo.com':80
'microsoft.com':80
'r3.#.lencr.org':80
's4.##stats.com':443
's1#.#istats.com':443
's1#.#istats.com':80
'te##.com':443
's3.##cofile.com':443
'oc##.#etsolssl.com':80
'sa###blog.com':80
'go#####agmanager.com':443
'ha######zi.persiangig.com':80
'bs###etal.com':80
's3.##cofile.com':80
'te##.com':80
'cd#.###ine.4dsply.com':443
'p3##p.ir':80
'de######load.rozblog.com':80
'sc###t2ni.ir':80
'cr#.##tsolssl.com':80

TCP

HTTP GET requests

http://ab##rfa.com/Template/yekmovie/AF_Powerful.js
http://www.sa###blog.com/uploads/t/temsara/124355.png
http://www.sa###blog.com/uploads/t/temsara/126078.png
http://www.sa###blog.com/uploads/t/temsara/126095.png
http://ro##p.ir/up/centertarh/themedl/postfoto/mehrgafblue.jpg
http://www.sa###blog.com/uploads/t/temsara/124711.png
http://te#####021.rozblog.com/images/no_image.png
http://te#####021.rozblog.com/temp/news_v3/responsiv/2.png
http://te#####021.rozblog.com/code/popup
http://ro##p.ir/up/centertarh/themedl/postfoto/%D9%85%D9%87%D8%B1%DA%AF%D8%A7%D9%81_%D9%87%D8%AF%D8%B1.jpg
http://te#####021.rozblog.com/temp/news_v3/responsiv/3.png
http://ro##p.ir/up/centertarh/themedl/postfoto/%D9%85%DB%8C%D9%87%D9%86_%D8%A7%D8%B3%DA%A9%D8%B1%DB%8C%D9%BE%D8%AA.jpg
http://te#####021.rozblog.com/temp/news_v3/responsiv/line.png
http://ro##p.ir/up/centertarh/themedl/postfoto/%D9%BE%DB%8C_%D8%B3%DB%8C_2.jpg
http://ro##p.ir/up/centertarh/themedl/postfoto/p30new1.jpg
http://ro##p.ir/up/centertarh/themedl/postfoto/broozdll.jpg
http://ro##p.ir/up/centertarh/themedl/postfoto/music98ia.jpg
http://te#####021.rozblog.com/weblog/file/loading/88.gif
http://ro##log.com/temp/rang/like.png
http://ro##log.com/temp/music3/MTForumBlock_row.png
http://www.sa###blog.com/uploads/t/temsara/141912.jpg
http://ro##p.ir/up/centertarh/themedl/postfoto/p30new2.jpg
http://ab##rfa.com/Template/yekmovie/style_002.css
http://ab##rfa.com/Template/yekmovie/jquery_002.js
http://ab##rfa.com/Template/yekmovie/jquery_005.js
http://te#####021.rozblog.com/js/site.js
http://ab##rfa.com/Template/yekmovie/jquery.js
http://te#####021.rozblog.com/temp/news_v3/responsiv/font.css
http://te#####021.rozblog.com/temp/default/script.js
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
http://ro##p.ir/up/centertarh/themedl/postfoto/dezla.jpg
http://p3##p.ir/up/n9yxmqeyqgsfpe3yh8f5.js
http://ab##rfa.com/Template/yekmovie/wp-page-numbers.css
http://te#####021.rozblog.com/temp/news_v3/responsiv/fonts/fontawesome-webfont.eot?
http://ro##log.com/temp/news_v3/responsiv/1.png
http://ro##log.com/temp/nuke/FBarrow.gif
http://ro##log.com/temp/music3/MTForumBlock_row_over.png
http://s4.##cofile.com/file/7849234836/Rozblog_01_WwW_themsaz_ir_1_.jpg
http://s3.##cofile.com/file/7849221612/TakVarz_WwW_themsaz_ir.jpg
http://ro##log.com/include/rozblog_ads_js.php
http://te#####021.rozblog.com/temp/news_v3/responsiv/fonts/yekanregular.woff)%20format(%22woff%22
http://oc##.#ectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEA4XQ00je0h9hnmjUyA%2F95g%3D