Trojan.DownLoader34.31376

Technical Information

Modifies file system

Creates the following files

%WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
%WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357
%LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012020090220200903\index.dat

Network activity

TCP

HTTP GET requests

http://za##op.com/website/js
http://up.#ozup.ir/up/kamyab4u/codes/rightheme-sans/fa_num/fonts/IRANSansWeb(FaNum)_UltraLight.eot?
http://up.##pertemp.ir/view/3081242/lazy.gif
http://up.##madl.ir/view/3194249/%D9%85%D9%88%DA%86%DB%8C%D9%86%20%D9%82%D8%B3%D9%85%D8%AA%20%D9%86%D9%87%D9%85.jpg
http://up.##madl.ir/view/3187383/%D8%B3%D8%B1%DB%8C%D8%A7%D9%84+%D8%AF%D9%84.jpg
http://up.##madl.ir/view/3188090/%D8%A2%D9%82%D8%A7%D8%B2%D8%A7%D8%AF%D9%87%209.jpg
http://up.##madl.ir/view/3193660/%D8%AF%D8%A7%D9%86%D9%84%D9%88%D8%AF%20%D8%B3%D8%B1%DB%8C%D8%A7%D9%84%20%D8%AF%D9%84%20%D9%82%D8%B3%D9%85%D8%AA%2037.jpg
http://up.##madl.ir/view/3187067/139210131656479201848444.jpg
http://up.##madl.ir/view/3188941/image_91e3b286d11fe86e3f5f1b2d742d1ac508d56435.jpg
http://up.##pertemp.ir/view/2219434/enscroll.min.js
http://up.##madl.ir/view/3193490/%D9%81%DB%8C%D9%84%D9%85.png
http://up.##madl.ir/view/3189183/%D8%AF%D8%A7%D9%86%D9%84%D9%88%D8%AF%20%D9%81%DB%8C%D9%84%D9%85%20%D8%AD%DA%A9%D8%A7%DB%8C%D8%AA%20%D8%AF%D8%B1%DB%8C%D8%A7_404973.jpg
http://up.##madl.ir/view/3188341/%D8%A2%D9%82%D8%A7%D8%B2%D8%A7%D8%AF%D9%87%20%D9%82%D8%B3%D9%85%D8%AA%2010.jpg
http://up.##madl.ir/view/3187864/%D9%81%DB%8C%D9%84%D9%85%20%D8%A2%D9%BE%D8%A7%D8%B1%D8%AA%D9%85%D8%A7%D9%86%20%D8%A2%D9%82%D8%A7%DB%8C%20%D9%87%D9%86%D8%B1%D9%BE%DB%8C%D8%B4%D9%87.jpg
http://up.##pertemp.ir/view/3081048/owl.carousel.js
http://up.##pertemp.ir/view/3081049/fixto.js
http://up.#ozup.ir/view/3081256/java.js
http://mi####acklink.ir/ads/css/style-1.css
http://up.##pertemp.ir/view/3081260/like-dislake.png
http://up.##pertemp.ir/view/3081055/logo.png
http://up.##pertemp.ir/view/3081058/namasha-logo-128x128.png
http://up.#ozup.ir/up/kamyab4u/codes/rightheme-sans/fa_num/fonts/IRANSansWeb(FaNum)_Medium.eot?
http://up.#ozup.ir/up/kamyab4u/codes/rightheme-sans/fa_num/fonts/IRANSansWeb(FaNum).eot?
http://up.#ozup.ir/up/kamyab4u/codes/rightheme-sans/fa_num/fonts/IRANSansWeb(FaNum)_Light.eot?
http://www.he##love.ir/js/site.js
http://up.##pertemp.ir/view/2219435/html5.js
http://up.##pertemp.ir/view/2219814/modernizr.js
http://up.##pertemp.ir/view/2219812/jquery.js
http://up.##pertemp.ir/view/2219436/jquery-migrate.min.js
http://up.##pertemp.ir/view/2219437/StyleForumFlat.css
http://up.##pertemp.ir/view/2219813/jquery.min.js
http://up.##pertemp.ir/view/2219815/plugins.min.js
http://am##fa.ir/stats/7477.js
http://up.##madl.ir/view/3170522/%D9%81%DB%8C%D9%84%D9%85-%D8%B3%DB%8C%D9%86%D9%85%D8%A7%DB%8C%DB%8C-%D9%85%D9%87%D9%85%D8%A7%D9%86%D8%AE%D8%A7%D9%86%D9%87-%D9%85%D8%A7%D9%87-%D9%86%D9%88.jpg
http://up.##pertemp.ir/view/2219811/jquery.jplayer.min.js
http://www.si##dl.ir/tag/%D8%AF%D8%A7%D9%86%D9%84%D9%88%D8%AF-%D9%81%DB%8C%D9%84%D9%85-%D8%A7%DB%8C%D8%B1%D8%A7%D9%86%DB%8C-%D8%AC%D8%AF%DB%8C%D8%AF
http://up.##pertemp.ir/view/3081257/style.css
http://www.si##dl.ir/js/site.js
http://up.##pertemp.ir/view/2519956/jquery.js
http://up.#ozup.ir/up/kamyab4u/codes/rightheme-sans/fa_num/fonts.css
http://up.#ozup.ir/up/kamyab4u/codes/rightheme-sans/fa_num/fonts/IRANSansWeb(FaNum)_Black.eot?
http://up.#ozup.ir/up/kamyab4u/codes/rightheme-sans/fa_num/fonts/IRANSansWeb(FaNum)_Bold.eot?
http://up.#ozup.ir/up/kamyab4u/codes/rightheme-sans/fonts/fontawesome-webfont.eot?
http://up.##pertemp.ir/view/2219438/style.css
http://za##op.com/website/pp/null/393//?69####
http://up.##pertemp.ir/view/3081057/mini.png