Trojan.DownLoader36.52426

Technical Information

Modifies file system

Creates the following files

%LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012021022620210227\index.dat

Modifies the following files

Network activity

Connects to

'se####.rozblog.com':80
'ra###hoon.net':443
'ra###hoon.net':80
'go#####agmanager.com':443
'ch#####i.sakura.ne.jp':80
'ir###iadl.ir':80
'dl.##moviedl.ir':80
'cd#.#ayan.ir':80
'we##ozar.ir':80
'microsoft.com':80
'do###oadyha.com':80
'ra###.bayan.ir':80
'bl#g.ir':80
'go#####analytics.com':443
'up.##ltijob.ir':80
'gr###tar.com':80
'ho##ozdl.ir':80
'ho###zmusic.ir':80
'cd#.###ine.4dsply.com':443
'dl###zane.net':443
'r3.#.lencr.org':80

TCP

HTTP GET requests

http://se####.rozblog.com/js/site.js
http://cd#.#ayan.ir/blog/templates/907/box-shadow.png
http://cd#.#ayan.ir/blog/templates/907/box-title.png
http://cd#.#ayan.ir/blog/templates/907/sidebar-bullet.png
http://cd#.#ayan.ir/blog/templates/907/details_ico.png
http://cd#.#ayan.ir/blog/templates/907/big-btn-bg.png
http://cd#.#ayan.ir/blog/templates/907/footer-bg_shadow.jpg
http://www.mu##ijob.ir/page/test-user32script-key-36985698-user-multijob-pid-596525365
http://cd#.#ayan.ir/blog/templates/shared/icon/blog-icon-dark.png
http://cd#.#ayan.ir/blog/templates/shared/icon/templates-icon-dark.png
http://cd#.#ayan.ir/blog/templates/907/home.png
http://cd#.#ayan.ir/blog/templates/907/shadow.png
http://cd#.#ayan.ir/blog/templates/907/nav-hover.png
http://cd#.#ayan.ir/blog/templates/907/footer-bg.jpg
http://mu##ijob.ir/page/test-user32script-key-36985698-user-multijob-pid-596525365
http://cd#.#ayan.ir/blog/templates/907/bg_footer.png
http://cd#.#ayan.ir/blog/templates/shared/icon/rss-icon-dark.png
http://dl.##moviedl.ir/up/multimovie/rozipearning/roz-ip-earning.js
http://www.we###zar.com/counter/pic/stat4.gif
http://www.mu##ijob.ir/page/popsmusic-encodeplaner-soaliscript?/=###
http://mu##ijob.ir/page/popsmusic-encodeplaner-soaliscript?/=###
http://ro##p.ir/up/multimovie/javascripttools/irmoviedlantiroztelegram/irmoviedltelegrampowercodeorigin.js
http://cd#.#ayan.ir/blog/templates/shared/icon/bayan-icon-dark.png
http://cd#.#ayan.ir/blog/templates/shared/icon/bayanbox-icon-dark.png
http://cd#.#ayan.ir/blog/templates/907/box-bg.png
http://cd#.#ayan.ir/blog/templates/907/nav-bg.png
http://cd#.#ayan.ir/blog/templates/907/line2.png
http://ro##log.com/temp/news_v3/responsiv/1.png
http://ro##p.ir/view/2488323/pdf.jpg
http://www.gr###tar.com/avatar/605571270ae5093f2957731c353a244c?d=#####
http://www.gr###tar.com/avatar/05a50b0327f9635a3b45c625e89399fb?d=#####
http://ro##log.com/editor/Rb_editor/images/smileys/004.gif
http://ro##log.com/editor/Rb_editor01/plugins/emotions/smile/42.gif
http://www.gr###tar.com/avatar/62556d29612d3a09bc7d8378bb07a614?d=#####
http://bl#g.ir/media/css/sharedrtl.css?uM####
http://ro##log.com/images/ads/logo_ads.png
http://ro##log.com/images/refresh.gif
http://ro##log.com/include/rozblog_ads_js.php
http://www.gr###tar.com/avatar/ad1b4179a69bdaf3396a393acf0d2a74?d=#####
http://ro##log.com/editor/Rb_editor01/plugins/emotions/smile/4.gif
http://ro##log.com/temp/rang/like.png
http://www.do###oadyha.com/wp-content/uploads/Instagram-android.jpg
http://www.mu##ijob.ir/page/test-users-key-control-all-other-pid2235550
http://www.do###oadyha.com/wp-content/uploads/Football-Fred-Cover.jpg
http://www.do###oadyha.com/wp-content/uploads/Super-Backup-Restore-Full-Cover.jpg
http://www.do###oadyha.com/wp-content/uploads/a606938cfdbd1fbcd16f9b75385ef09e.jpg
http://www.do###oadyha.com/wp-content/uploads/Brain-Marmelade-Cover.jpg
http://ra###.bayan.ir/bl!x3HbfrTINCc/rb.gif?v=###################################################################################################################################################...
http://mu##ijob.ir/page/test-users-key-control-all-other-pid2235550
http://bl#g.ir/media/images/cleardot.gif
http://www.ir###iedl.ir/page/roz-mobile-ip-eaning
http://ir###iedl.ir/page/roz-mobile-ip-eaning