Technical Information
Network activity
Connects to
- 's-######ayni.rozblog.com':443
- 'x1.#.lencr.org':80
- 'po###usic.ir':443
- 'up####.afsarejavan.com':80
- 'ap##at.com':443
- 's6.#plod.ir':80
- 'po###usic.ir':80
- 'oh###um.info':443
- 'ap##at.com':80
- 'cl#.##rsiangig.com':80
- 'fp######ad2.macromedia.com':80
- 'it###site.ir':80
- 'pi##ak.net':80
- 'r3.#.lencr.org':80
- 'up###der.net':443
- 'up###der.net':80
- 'as##ora.ir':80
- 'microsoft.com':80
- 'cd#.#araru.com':443
- 'cd#.#opcash.net':445
- 'mo##var.net':80
- 'cd#.#araru.com':80
- 'gt#8.ir':80
- 'ba##nbox.ir':80
- 'ro##p.ir':443
- 'ro##log.com':80
- '1a##ar.ir':80
- 'co####r.toolsir.com':80
- 'oc##.#ectigo.com':80
TCP
HTTP GET requests
- http://1a##ar.ir/abzar/tools/slider2/?no####################################################################
- http://pi##ak.net/random-text/hadis/4.png
- http://www.as##ora.biz/mazhabi-projects/live/8/8_11.png
- http://www.as##ora.biz/mazhabi-projects/live/8/8_12.png
- http://1a##ar.ir/abzar/tools/slider2/1/lock.js
- http://pi##ak.net/random-text/hadis/2.png
- http://pi##ak.net/random-text/hadis/asl.htm
- http://pi##ak.net/random-text/hadis/3.png
- http://www.as##ora.biz/mazhabi-projects/clock/saat.php?mo##############
- http://1a##ar.ir/abzar/tools/slider/1/logo.png
- http://www.as##ora.biz/mazhabi-projects/live/8/8_9.png
- http://www.as##ora.biz/mazhabi-projects/live/8/8_10.png
- http://www.as##ora.biz/mazhabi-projects/clock/c/3Rahbar/5.swf
- http://www.as##ora.biz/mazhabi-projects/oghat/date.php?co##############################################################################################################
- http://fp######ad2.macromedia.com/get/flashplayer/update/current/install/version.xml19.0.0.207~installVector=2&lang=en&cpuWordLength=64&playerType=ax&os=win&osVer=13
- http://cl#.##rsiangig.com/dl/h1fd3T/vvvvvvvvvvvvvvvvvv.png
- http://www.ap##at.com/public/public/images/logo/aparatlogo_fa_color_black_275_100.png
- http://po###usic.ir/wp-content/themes/PMWP/inc/player_mp3_maxi.swf
- http://s6.#plod.ir/i/00782/macbag1peumn.gif
- http://up####.afsarejavan.com/uploads/14308962681.jpg
- http://x1.#.lencr.org/
- http://r3.#.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgRZ4JiOC1VR7b%2BkmQWPF8QE9Q%3D%3D
- http://pi##ak.net/random-text/hadis/asl_data/1.png
- http://www.as##ora.biz/mazhabi-projects/oghat/javas-change-shahr.js
- http://1a##ar.ir/abzar/tools/slider2/1/slider.js
- http://www.as##ora.biz/mazhabi-projects/live/8/8_7.png
- http://www.as##ora.biz/mazhabi-projects/live/8/8_8.png
- http://1a##ar.ir/abzar/tools/slider2/slider1.php?pl##############################################
- http://ro##log.com/temp/rang/like.png
- http://ba##nbox.ir/id/3895262608346988311?pr#####
- http://www.gt#8.ir/pics/news/911003/NamarFa.jpg
- http://cd#.#araru.com/files/fa/news/1393/11/3/185511_987.jpg
- http://mo##var.net/wp-content/uploads/2015/05/resized_87535_823.jpg
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- http://1a##ar.ir/abzar/tools/stat/amar-v3-ramz.php?mo##########################################################################
- http://www.up###der.net/img/image/62/7d869a770d551c1ac2af2171cc1b22a3/ads-2-120.png
- http://www.as##ora.ir/images/logos/logo2.gif
- http://ro##log.com/temp/pro/ads_468.jpg
- http://co####r.toolsir.com/images/chart.gif
- http://1a##ar.ir/abzar/tools/slider2/1/jquery.js
- http://www.as##ora.biz/mazhabi-projects/live/8/8_3.png
- http://www.as##ora.biz/mazhabi-projects/live/8/8_1.png
- http://1a##ar.ir/abzar/tools/slider2/1/style.css
- http://www.as##ora.biz/mazhabi-projects/live/8/8_2.png
- http://www.as##ora.biz/mazhabi-projects/live/8/8_4.png
- http://pi##ak.net/random-text/hadis/asl1.html
- http://www.as##ora.biz/mazhabi-projects/live/8/8_6.png
- http://it###site.ir/cleander/cleander1/tarh13/3taii.js
- http://www.as##ora.biz/mazhabi-projects/live/8/8_5.png
- http://1a##ar.ir/abzar/tools/stat/pic/stat-1.png
- http://oc##.#ectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECECqs2imCrPIHb9EfUSQQxQQ%3D
- http://r3.#.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgPWO8G3p%2BC7P8WyzxCG4K7xtw%3D%3D
Other
- 's-######ayni.rozblog.com':443
- 'ro##p.ir':443
- 'cd#.#araru.com':443
- 'up###der.net':443
- 'ap##at.com':443
- 'po###usic.ir':443
- 'oh###um.info':443
UDP
- DNS ASK s-######ayni.rozblog.com
- DNS ASK x1.#.lencr.org
- DNS ASK po###usic.ir
- DNS ASK oh###um.info
- DNS ASK s6.#plod.ir
- DNS ASK ap##at.com
- DNS ASK up####.afsarejavan.com
- DNS ASK cl#.##rsiangig.com
- DNS ASK up.###stqurani.ir
- DNS ASK fp######ad2.macromedia.com
- DNS ASK it###site.ir
- DNS ASK pi##ak.net
- DNS ASK co####r.toolsir.com
- DNS ASK r3.#.lencr.org
- DNS ASK up###der.net
- DNS ASK as##ora.ir
- DNS ASK microsoft.com
- DNS ASK cd#.#opcash.net
- DNS ASK cd#.#araru.com
- DNS ASK up###d-iran.tk
- DNS ASK mo##var.net
- DNS ASK ba##nbox.ir
- DNS ASK gt#8.ir
- DNS ASK ro##p.ir
- DNS ASK ja##aab.ir
- DNS ASK 1a##ar.ir
- DNS ASK ro##log.com
- DNS ASK as##ora.biz
- DNS ASK oc##.#ectigo.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
