popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

nd.xlsx

MSOffice File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 May 25, 2021, 9:29 a.m. May 25, 2021, 9:35 a.m.
Size 1.4MB
Type CDFV2 Encrypted
MD5 f886a27269a2648e3cb5cf4ce85d579b
SHA256 d40de7ba15f0ec97bd08e16c2c8ea5c73f224e35c0ddf4d0599d0e7ea0640ae0
CRC32 D7916BA7
ssdeep 24576:TFAwzrILvEMuHtl4wKuk+fkbR3mjntkPaeggkr9oyTCEo:RAwzmZC00pwmjKP+VZoCw
Yara
  • Microsoft_Office_File_Zero - Microsoft Office File

Name Response Post-Analysis Lookup
wespeaktruthtoman12.sytes.net
firstdigitalscope.gotdns.ch
A 192.3.13.56
192.3.13.56
wespeaktruthtoman.sytes.net
A 79.134.225.47
79.134.225.47
IP Address Status Action
164.124.101.2 Active Moloch
172.217.25.14 Active Moloch
192.3.13.56 Active Moloch
79.134.225.47 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.102:49806 -> 192.3.13.56:80 2019714 ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile Potentially Bad Traffic
TCP 192.3.13.56:80 -> 192.168.56.102:49806 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x74d5374b
DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x74bff725
NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x74d6414b
WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x74bfc8e2
CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x74af98ad
OleCreateEmbeddingHelper+0x2a1 CreateFileMoniker-0x17de ole32+0x81414 @ 0x74b41414
ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x74b57b68
MdCallBack-0x620fb3 excel+0x3f4bb1 @ 0x2f494bb1
MdCallBack-0x842308 excel+0x1d385c @ 0x2f27385c
MdCallBack-0x86a796 excel+0x1ab3ce @ 0x2f24b3ce
MdCallBack-0x86e0e8 excel+0x1a7a7c @ 0x2f247a7c
MdCallBack-0x4e034f excel+0x535815 @ 0x2f5d5815
MdCallBack-0x4e041d excel+0x535747 @ 0x2f5d5747
MdCallBack-0x67d17e excel+0x3989e6 @ 0x2f4389e6
MdCallBack-0xa0d6e1 excel+0x8483 @ 0x2f0a8483
MdCallBack-0xa0fd82 excel+0x5de2 @ 0x2f0a5de2
MdCallBack-0xa120c2 excel+0x3aa2 @ 0x2f0a3aa2
MdCallBack-0xa12378 excel+0x37ec @ 0x2f0a37ec
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0x800706be
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 3443400
registers.edi: 1957755408
registers.eax: 3443400
registers.ebp: 3443480
registers.edx: 0
registers.ebx: 4436412
registers.esi: 2147944126
registers.ecx: 4261324004
1 0 0

__exception__

 stacktrace: 
RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x74d5374b
DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x74bff725
NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x74d6414b
WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x74bfc8e2
CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x74af98ad
CoRegisterMessageFilter+0x5048 ObjectStublessClient5-0x21 ole32+0x3b641 @ 0x74afb641
CoRegisterMessageFilter+0x4ff4 ObjectStublessClient5-0x75 ole32+0x3b5ed @ 0x74afb5ed
CoRegisterMessageFilter+0x4b79 ObjectStublessClient5-0x4f0 ole32+0x3b172 @ 0x74afb172
CoRegisterMessageFilter+0x4075 ObjectStublessClient5-0xff4 ole32+0x3a66e @ 0x74afa66e
ObjectStublessClient31+0x2961c STGMEDIUM_UserUnmarshal-0x92 ole32+0xba68c @ 0x74b7a68c
ObjectStublessClient31+0x6776 STGMEDIUM_UserUnmarshal-0x22f38 ole32+0x977e6 @ 0x74b577e6
OleCreateEmbeddingHelper+0x344 CreateFileMoniker-0x173b ole32+0x814b7 @ 0x74b414b7
ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x74b57b68
MdCallBack-0x620fb3 excel+0x3f4bb1 @ 0x2f494bb1
MdCallBack-0x842308 excel+0x1d385c @ 0x2f27385c
MdCallBack-0x86a796 excel+0x1ab3ce @ 0x2f24b3ce
MdCallBack-0x86e0e8 excel+0x1a7a7c @ 0x2f247a7c
MdCallBack-0x4e034f excel+0x535815 @ 0x2f5d5815
MdCallBack-0x4e041d excel+0x535747 @ 0x2f5d5747
MdCallBack-0x67d17e excel+0x3989e6 @ 0x2f4389e6
MdCallBack-0xa0d6e1 excel+0x8483 @ 0x2f0a8483
MdCallBack-0xa0fd82 excel+0x5de2 @ 0x2f0a5de2
MdCallBack-0xa120c2 excel+0x3aa2 @ 0x2f0a3aa2
MdCallBack-0xa12378 excel+0x37ec @ 0x2f0a37ec
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0x800706ba
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 3443092
registers.edi: 1957755408
registers.eax: 3443092
registers.ebp: 3443172
registers.edx: 0
registers.ebx: 4436628
registers.esi: 2147944122
registers.ecx: 4261324004
1 0 0
domain wespeaktruthtoman12.sytes.net
domain wespeaktruthtoman.sytes.net
request GET http://firstdigitalscope.gotdns.ch/img/nd.exe
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 4656
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x70af1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 4656
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x70b4f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 4656
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x70b4f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 4656
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x70731000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 4656
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x70731000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 4656
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x743c1000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x06c40000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x06c40000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x06c50000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x06c60000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 4656
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73711000
process_handle: 0xffffffff
1 0 0
Application Crash Process EXCEL.EXE with pid 4656 crashed
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x74d5374b
DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x74bff725
NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x74d6414b
WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x74bfc8e2
CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x74af98ad
OleCreateEmbeddingHelper+0x2a1 CreateFileMoniker-0x17de ole32+0x81414 @ 0x74b41414
ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x74b57b68
MdCallBack-0x620fb3 excel+0x3f4bb1 @ 0x2f494bb1
MdCallBack-0x842308 excel+0x1d385c @ 0x2f27385c
MdCallBack-0x86a796 excel+0x1ab3ce @ 0x2f24b3ce
MdCallBack-0x86e0e8 excel+0x1a7a7c @ 0x2f247a7c
MdCallBack-0x4e034f excel+0x535815 @ 0x2f5d5815
MdCallBack-0x4e041d excel+0x535747 @ 0x2f5d5747
MdCallBack-0x67d17e excel+0x3989e6 @ 0x2f4389e6
MdCallBack-0xa0d6e1 excel+0x8483 @ 0x2f0a8483
MdCallBack-0xa0fd82 excel+0x5de2 @ 0x2f0a5de2
MdCallBack-0xa120c2 excel+0x3aa2 @ 0x2f0a3aa2
MdCallBack-0xa12378 excel+0x37ec @ 0x2f0a37ec
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0x800706be
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 3443400
registers.edi: 1957755408
registers.eax: 3443400
registers.ebp: 3443480
registers.edx: 0
registers.ebx: 4436412
registers.esi: 2147944126
registers.ecx: 4261324004
1 0 0

__exception__

 stacktrace: 
RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x74d5374b
DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x74bff725
NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x74d6414b
WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x74bfc8e2
CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x74af98ad
CoRegisterMessageFilter+0x5048 ObjectStublessClient5-0x21 ole32+0x3b641 @ 0x74afb641
CoRegisterMessageFilter+0x4ff4 ObjectStublessClient5-0x75 ole32+0x3b5ed @ 0x74afb5ed
CoRegisterMessageFilter+0x4b79 ObjectStublessClient5-0x4f0 ole32+0x3b172 @ 0x74afb172
CoRegisterMessageFilter+0x4075 ObjectStublessClient5-0xff4 ole32+0x3a66e @ 0x74afa66e
ObjectStublessClient31+0x2961c STGMEDIUM_UserUnmarshal-0x92 ole32+0xba68c @ 0x74b7a68c
ObjectStublessClient31+0x6776 STGMEDIUM_UserUnmarshal-0x22f38 ole32+0x977e6 @ 0x74b577e6
OleCreateEmbeddingHelper+0x344 CreateFileMoniker-0x173b ole32+0x814b7 @ 0x74b414b7
ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x74b57b68
MdCallBack-0x620fb3 excel+0x3f4bb1 @ 0x2f494bb1
MdCallBack-0x842308 excel+0x1d385c @ 0x2f27385c
MdCallBack-0x86a796 excel+0x1ab3ce @ 0x2f24b3ce
MdCallBack-0x86e0e8 excel+0x1a7a7c @ 0x2f247a7c
MdCallBack-0x4e034f excel+0x535815 @ 0x2f5d5815
MdCallBack-0x4e041d excel+0x535747 @ 0x2f5d5747
MdCallBack-0x67d17e excel+0x3989e6 @ 0x2f4389e6
MdCallBack-0xa0d6e1 excel+0x8483 @ 0x2f0a8483
MdCallBack-0xa0fd82 excel+0x5de2 @ 0x2f0a5de2
MdCallBack-0xa120c2 excel+0x3aa2 @ 0x2f0a3aa2
MdCallBack-0xa12378 excel+0x37ec @ 0x2f0a37ec
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0x800706ba
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 3443092
registers.edi: 1957755408
registers.eax: 3443092
registers.ebp: 3443172
registers.edx: 0
registers.ebx: 4436628
registers.esi: 2147944122
registers.ecx: 4261324004
1 0 0
file C:\Users\test22\AppData\Local\Temp\~$nd.xlsx
Time & API Arguments Status Return Repeated

NtCreateFile

 create_disposition: 2 (FILE_CREATE)
file_handle: 0x000003a8
filepath: C:\Users\test22\AppData\Local\Temp\~$nd.xlsx
desired_access: 0xc0110080 (FILE_READ_ATTRIBUTES|DELETE|SYNCHRONIZE|GENERIC_WRITE)
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath_r: \??\C:\Users\test22\AppData\Local\Temp\~$nd.xlsx
create_options: 4198496 (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT|FILE_DELETE_ON_CLOSE)
status_info: 2 (FILE_CREATED)
share_access: 1 (FILE_SHARE_READ)
1 0 0

NtCreateFile

 create_disposition: 2 (FILE_CREATE)
file_handle: 0x00000000
filepath: C:\Users\test22\AppData\Roaming\Microsoft
desired_access: 0x00100001 (FILE_READ_DATA|FILE_LIST_DIRECTORY|SYNCHRONIZE)
file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM)
filepath_r: \??\C:\Users\test22\AppData\Roaming\Microsoft
create_options: 16417 (FILE_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT|FILE_OPEN_FOR_BACKUP_INTENT)
status_info: 4294967295 ()
share_access: 3 (FILE_SHARE_READ|FILE_SHARE_WRITE)
3221225525 0

NtCreateFile

 create_disposition: 2 (FILE_CREATE)
file_handle: 0x00000000
filepath: C:\Users\test22\AppData\Roaming\Microsoft\Crypto
desired_access: 0x00100001 (FILE_READ_DATA|FILE_LIST_DIRECTORY|SYNCHRONIZE)
file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM)
filepath_r: \??\C:\Users\test22\AppData\Roaming\Microsoft\Crypto
create_options: 16417 (FILE_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT|FILE_OPEN_FOR_BACKUP_INTENT)
status_info: 4294967295 ()
share_access: 3 (FILE_SHARE_READ|FILE_SHARE_WRITE)
3221225525 0

NtCreateFile

 create_disposition: 2 (FILE_CREATE)
file_handle: 0x00000000
filepath: C:\Users\test22\AppData\Roaming\Microsoft\Crypto\RSA
desired_access: 0x00100001 (FILE_READ_DATA|FILE_LIST_DIRECTORY|SYNCHRONIZE)
file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM)
filepath_r: \??\C:\Users\test22\AppData\Roaming\Microsoft\Crypto\RSA
create_options: 16417 (FILE_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT|FILE_OPEN_FOR_BACKUP_INTENT)
status_info: 4294967295 ()
share_access: 3 (FILE_SHARE_READ|FILE_SHARE_WRITE)
3221225525 0

NtCreateFile

 create_disposition: 2 (FILE_CREATE)
file_handle: 0x00000000
filepath: C:\Users\test22\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3832866432-4053218753-3017428901-1001
desired_access: 0x00100001 (FILE_READ_DATA|FILE_LIST_DIRECTORY|SYNCHRONIZE)
file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM)
filepath_r: \??\C:\Users\test22\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3832866432-4053218753-3017428901-1001
create_options: 16417 (FILE_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT|FILE_OPEN_FOR_BACKUP_INTENT)
status_info: 4294967295 ()
share_access: 3 (FILE_SHARE_READ|FILE_SHARE_WRITE)
3221225525 0
host 172.217.25.14
MicroWorld-eScan Exploit.CVE-2018-0802.Gen
McAfee Exploit-GBT!44683ACB1E2A
Arcabit Exploit.CVE-2018-0802.Gen
Symantec Trojan.Gen.2
Avast OLE:CVE-2017-11882-B [Expl]
BitDefender Exploit.CVE-2018-0802.Gen
Ad-Aware Exploit.CVE-2018-0802.Gen
TACHYON Suspicious/W97.CVE-2018-0798
McAfee-GW-Edition Exploit-GBT!44683ACB1E2A
FireEye Exploit.CVE-2018-0802.Gen
Emsisoft Exploit.CVE-2018-0802.Gen (B)
GData Exploit.CVE-2018-0802.Gen
ALYac Exploit.CVE-2018-0802.Gen
MAX malware (ai score=87)
Fortinet MSExcel/CVE_2017_11882!exploit
AVG OLE:CVE-2017-11882-B [Expl]
dead_host 192.168.56.102:49813
dead_host 79.134.225.47:5600
dead_host 192.168.56.102:49824
dead_host 192.168.56.102:49818
dead_host 192.168.56.102:49819
dead_host 192.168.56.102:49816
dead_host 192.168.56.102:49810
dead_host 192.168.56.102:49817
dead_host 192.168.56.102:49822
dead_host 192.168.56.102:49823
dead_host 192.168.56.102:49820
dead_host 192.168.56.102:49821
dead_host 192.168.56.102:49815