popup
procMemory | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Process Memory

Process memory dump for Daemon.exe (PID 3576, dump 1)

Extracted/injected images (may contain unpacked executables)
Download #1

Yara signatures matches on process memory

Match: inject_thread

  • Q3JlYXRlUmVtb3RlVGhyZWFk (CreateRemoteThread)
  • Q3JlYXRlVGhyZWFk (CreateThread)
  • T3BlblByb2Nlc3M= (OpenProcess)
  • TnRXcml0ZVZpcnR1YWxNZW1vcnk= (NtWriteVirtualMemory)
  • V3JpdGVQcm9jZXNzTWVtb3J5 (WriteProcessMemory)
  • VmlydHVhbEFsbG9jRXg= (VirtualAllocEx)

Match: hijack_network

  • U09GVFdBUkVcQ2xhc3Nlc1xQUk9UT0NPTFNcSGFuZGxlcg== (SOFTWARE\Classes\PROTOCOLS\Handler)
  • ZHJpdmVyc1xldGNcaG9zdHM= (drivers\etc\hosts)

Match: create_service

  • Q29udHJvbFNlcnZpY2U= (ControlService)
  • Q3JlYXRlU2VydmljZQ== (CreateService)
  • QURWQVBJMzIuRExM (ADVAPI32.DLL)
  • QURWQVBJMzIuZGxs (ADVAPI32.dll)
  • U3RhcnRTZXJ2aWNl (StartService)
  • UXVlcnlTZXJ2aWNlU3RhdHVz (QueryServiceStatus)
  • YWR2YXBpMzIuZGxs (advapi32.dll)

Match: create_com_service

  • RGxsQ2FuVW5sb2FkTm93 (DllCanUnloadNow)
  • RGxsR2V0Q2xhc3NPYmplY3Q= (DllGetClassObject)
  • RGxsSW5zdGFsbA== (DllInstall)
  • RGxsUmVnaXN0ZXJTZXJ2ZXI= (DllRegisterServer)
  • RGxsVW5yZWdpc3RlclNlcnZlcg== (DllUnregisterServer)

Match: network_udp_sock

  • U3lzdGVtLk5ldA== (System.Net)
  • V1MyXzMyLkRMTA== (WS2_32.DLL)
  • V1MyXzMyLmRsbA== (WS2_32.dll)
  • V1NBU2VuZFRv (WSASendTo)
  • V1NBU3RhcnR1cA== (WSAStartup)
  • V1NBUmVjdkZyb20= (WSARecvFrom)
  • V1NPQ0szMi5kbGw= (WSOCK32.dll)
  • c2VuZHRv (sendto)
  • cmVjdmZyb20= (recvfrom)
  • d3MyXzMyLmRsbA== (ws2_32.dll)

Match: network_tcp_listen

  • QWNjZXB0RXg= (AcceptEx)
  • R2V0QWNjZXB0RXhTb2NrYWRkcnM= (GetAcceptExSockaddrs)
  • TVNXU09DSy5kbGw= (MSWSOCK.dll)
  • U3lzdGVtLk5ldA== (System.Net)
  • V1MyXzMyLkRMTA== (WS2_32.DLL)
  • V1MyXzMyLmRsbA== (WS2_32.dll)
  • V1NBQWNjZXB0 (WSAAccept)
  • V1NBU29ja2V0 (WSASocket)
  • V1NBU3RhcnR1cA== (WSAStartup)
  • V1NPQ0szMi5kbGw= (WSOCK32.dll)
  • YWNjZXB0 (accept)
  • YmluZA== (bind)
  • bGlzdGVu (listen)
  • bXN3c29jay5kbGw= (mswsock.dll)
  • d3MyXzMyLmRsbA== (ws2_32.dll)

Match: network_toredo

  • XEN1cnJlbnRDb250cm9sU2V0XFNlcnZpY2VzXFRjcGlwNlxQYXJhbWV0ZXJzXEludGVyZmFjZXNc (\CurrentControlSet\Services\Tcpip6\Parameters\Interfaces\)
  • ZmlyZXdhbGxhcGkuZGxs (firewallapi.dll)

Match: network_p2p_win

  • UGVlckNvbGxhYkV4cG9ydENvbnRhY3Q= (PeerCollabExportContact)
  • UGVlckNvbGxhYkdldEFwcGxpY2F0aW9uUmVnaXN0cmF0aW9uSW5mbw== (PeerCollabGetApplicationRegistrationInfo)
  • UGVlckNvbGxhYkdldEV2ZW50RGF0YQ== (PeerCollabGetEventData)
  • UGVlckNvbGxhYkdldEVuZHBvaW50TmFtZQ== (PeerCollabGetEndpointName)
  • UGVlckNvbGxhYkdldEludml0YXRpb25SZXNwb25zZQ== (PeerCollabGetInvitationResponse)
  • UGVlckNvbGxhYkdldFByZXNlbmNlSW5mbw== (PeerCollabGetPresenceInfo)
  • UGVlckNvbGxhYkdldFNpZ25pbk9wdGlvbnM= (PeerCollabGetSigninOptions)
  • UGVlckNvbGxhYkludml0ZUNvbnRhY3Q= (PeerCollabInviteContact)
  • UGVlckNvbGxhYkludml0ZUVuZHBvaW50 (PeerCollabInviteEndpoint)
  • UGVlckNvbGxhYlBhcnNlQ29udGFjdA== (PeerCollabParseContact)
  • UGVlckNvbGxhYlF1ZXJ5Q29udGFjdERhdGE= (PeerCollabQueryContactData)
  • UGVlckNvbGxhYlJlZ2lzdGVyQXBwbGljYXRpb24= (PeerCollabRegisterApplication)
  • UGVlckNvbGxhYlJlZ2lzdGVyRXZlbnQ= (PeerCollabRegisterEvent)
  • UGVlckNvbGxhYlJlZnJlc2hFbmRwb2ludERhdGE= (PeerCollabRefreshEndpointData)
  • UGVlckNvbGxhYlNldE9iamVjdA== (PeerCollabSetObject)
  • UGVlckNvbGxhYlNldEVuZHBvaW50TmFtZQ== (PeerCollabSetEndpointName)
  • UGVlckNvbGxhYlNldFByZXNlbmNlSW5mbw== (PeerCollabSetPresenceInfo)
  • UGVlckNvbGxhYlNpZ25vdXQ= (PeerCollabSignout)
  • UGVlckNvbGxhYlVucmVnaXN0ZXJBcHBsaWNhdGlvbg== (PeerCollabUnregisterApplication)
  • UGVlckNvbGxhYlVwZGF0ZUNvbnRhY3Q= (PeerCollabUpdateContact)

Match: network_http

  • SHR0cE9wZW5SZXF1ZXN0 (HttpOpenRequest)
  • SHR0cFNlbmRSZXF1ZXN0 (HttpSendRequest)
  • SW50ZXJuZXRDb25uZWN0 (InternetConnect)
  • SW50ZXJuZXRPcGVu (InternetOpen)
  • SW50ZXJuZXRPcGVuVXJs (InternetOpenUrl)
  • SW50ZXJuZXRSZWFkRmlsZQ== (InternetReadFile)
  • SW50ZXJuZXRXcml0ZUZpbGU= (InternetWriteFile)
  • V0lOSU5FVC5kbGw= (WININET.dll)
  • d2luaW5ldC5kbGw= (wininet.dll)

Match: network_dropper

  • VVJMRG93bmxvYWRUb0NhY2hlRmlsZQ== (URLDownloadToCacheFile)
  • VVJMRG93bmxvYWRUb0ZpbGU= (URLDownloadToFile)
  • VVJMT3BlblB1bGxTdHJlYW0= (URLOpenPullStream)
  • VVJMT3BlblN0cmVhbQ== (URLOpenStream)
  • VXJsbW9uLmRsbA== (Urlmon.dll)
  • dXJsbW9uLmRsbA== (urlmon.dll)

Match: network_ftp

  • RnRwQ3JlYXRlRGlyZWN0b3J5 (FtpCreateDirectory)
  • RnRwR2V0Q3VycmVudERpcmVjdG9yeQ== (FtpGetCurrentDirectory)
  • RnRwR2V0RmlsZQ== (FtpGetFile)
  • RnRwR2V0RmlsZVNpemU= (FtpGetFileSize)
  • RnRwRGVsZXRlRmlsZQ== (FtpDeleteFile)
  • RnRwT3BlbkZpbGU= (FtpOpenFile)
  • RnRwU2V0Q3VycmVudERpcmVjdG9yeQ== (FtpSetCurrentDirectory)
  • RnRwUHV0RmlsZQ== (FtpPutFile)
  • RnRwUmVtb3ZlRGlyZWN0b3J5 (FtpRemoveDirectory)
  • RnRwUmVuYW1lRmlsZQ== (FtpRenameFile)
  • V0lOSU5FVC5kbGw= (WININET.dll)
  • d2luaW5ldC5kbGw= (wininet.dll)

Match: network_tcp_socket

  • V1MyXzMyLkRMTA== (WS2_32.DLL)
  • V1MyXzMyLmRsbA== (WS2_32.dll)
  • V1NBQ29ubmVjdA== (WSAConnect)
  • V1NBQ2xlYW51cA== (WSACleanup)
  • V1NBU29ja2V0 (WSASocket)
  • V1NBU2VuZA== (WSASend)
  • V1NBU3RhcnR1cA== (WSAStartup)
  • V1NPQ0szMi5kbGw= (WSOCK32.dll)
  • Y29ubmVjdA== (connect)
  • Y2xvc2Vzb2NrZXQ= (closesocket)
  • c29ja2V0 (socket)
  • c2VuZA== (send)
  • d3MyXzMyLmRsbA== (ws2_32.dll)

Match: network_dns

  • RE5TQVBJLmRsbA== (DNSAPI.dll)
  • RG5zUXVlcnk= (DnsQuery)
  • U3lzdGVtLk5ldA== (System.Net)
  • V1MyXzMyLkRMTA== (WS2_32.DLL)
  • V1MyXzMyLmRsbA== (WS2_32.dll)
  • V1NBQXN5bmNHZXRIb3N0QnlOYW1l (WSAAsyncGetHostByName)
  • V1NPQ0szMi5kbGw= (WSOCK32.dll)
  • Z2V0YWRkcmluZm8= (getaddrinfo)
  • Z2V0aG9zdGJ5bmFtZQ== (gethostbyname)
  • ZG5zYXBpLmRsbA== (dnsapi.dll)
  • d3MyXzMyLmRsbA== (ws2_32.dll)

Match: network_dga

  • Q1JZUFQzMi5ETEw= (CRYPT32.DLL)
  • Q1JZUFQzMi5kbGw= (CRYPT32.dll)
  • Q3J5cHRBY3F1aXJlQ29udGV4dA== (CryptAcquireContext)
  • Q3J5cHRDcmVhdGVIYXNo (CryptCreateHash)
  • Q3J5cHRIYXNoRGF0YQ== (CryptHashData)
  • QURWQVBJMzIuRExM (ADVAPI32.DLL)
  • QURWQVBJMzIuZGxs (ADVAPI32.dll)
  • R2V0U3lzdGVtVGltZQ== (GetSystemTime)
  • R2V0U3lzdGVtVGltZUFzRmlsZVRpbWU= (GetSystemTimeAsFileTime)
  • SW50ZXJuZXRPcGVu (InternetOpen)
  • SW50ZXJuZXRPcGVuVXJs (InternetOpenUrl)
  • U3lzdGVtVGltZVRvRmlsZVRpbWU= (SystemTimeToFileTime)
  • V0lOSU5FVC5kbGw= (WININET.dll)
  • Y3J5cHQzMi5kbGw= (crypt32.dll)
  • YWR2YXBpMzIuZGxs (advapi32.dll)
  • Z2V0YWRkcmluZm8= (getaddrinfo)
  • Z2V0aG9zdGJ5bmFtZQ== (gethostbyname)
  • d2luaW5ldC5kbGw= (wininet.dll)

Match: escalate_priv

  • QURWQVBJMzIuRExM (ADVAPI32.DLL)
  • QURWQVBJMzIuZGxs (ADVAPI32.dll)
  • QWRqdXN0VG9rZW5Qcml2aWxlZ2Vz (AdjustTokenPrivileges)
  • YWR2YXBpMzIuZGxs (advapi32.dll)

Match: screenshot

  • Qml0Qmx0 (BitBlt)
  • R0RJMzIuZGxs (GDI32.dll)
  • R2V0REM= (GetDC)
  • VVNFUjMyLkRMTA== (USER32.DLL)
  • VVNFUjMyLmRsbA== (USER32.dll)
  • Z2RpMzIuZGxs (gdi32.dll)
  • dXNlcjMyLmRsbA== (user32.dll)

Match: keylogger

  • R2V0QXN5bmNLZXlTdGF0ZQ== (GetAsyncKeyState)
  • R2V0S2V5U3RhdGU= (GetKeyState)
  • R2V0S2V5Ym9hcmRUeXBl (GetKeyboardType)
  • TWFwVmlydHVhbEtleQ== (MapVirtualKey)
  • VVNFUjMyLkRMTA== (USER32.DLL)
  • VVNFUjMyLmRsbA== (USER32.dll)
  • dXNlcjMyLmRsbA== (user32.dll)

Match: cred_local

  • Q3JlZEVudW1lcmF0ZUE= (CredEnumerateA)
  • Q3JlZEVudW1lcmF0ZVc= (CredEnumerateW)
  • THNhRW51bWVyYXRlTG9nb25TZXNzaW9ucw== (LsaEnumerateLogonSessions)
  • U2FtSUNvbm5lY3Q= (SamIConnect)
  • U2FtUXVlcnlJbmZvcm1hdGlvblVzZQ== (SamQueryInformationUse)

Match: sniff_audio

  • V0lOTU0uZGxs (WINMM.dll)
  • d2F2ZUluQ2xvc2U= (waveInClose)
  • d2F2ZUluQWRkQnVmZmVy (waveInAddBuffer)
  • d2F2ZUluT3Blbg== (waveInOpen)
  • d2F2ZUluU3RhcnQ= (waveInStart)
  • d2F2ZUluUmVzZXQ= (waveInReset)
  • d2lubW0uZGxs (winmm.dll)

Match: migrate_apc

  • T3BlblRocmVhZA== (OpenThread)
  • UXVldWVVc2VyQVBD (QueueUserAPC)

Match: spreading_file

  • ZGVza3RvcC5pbmk= (desktop.ini)

Match: spreading_share

  • TmV0U2hhcmVFbnVt (NetShareEnum)
  • TmV0U2hhcmVHZXRJbmZv (NetShareGetInfo)
  • bmV0YXBpMzIuZGxs (netapi32.dll)

Match: win_mutex

  • Q3JlYXRlTXV0ZXg= (CreateMutex)

Match: win_registry

  • QURWQVBJMzIuRExM (ADVAPI32.DLL)
  • QURWQVBJMzIuZGxs (ADVAPI32.dll)
  • UmVnQ2xvc2VLZXk= (RegCloseKey)
  • UmVnQ3JlYXRlS2V5QQ== (RegCreateKeyA)
  • UmVnT3BlbktleUV4QQ== (RegOpenKeyExA)
  • UmVnU2V0VmFsdWVFeEE= (RegSetValueExA)
  • UmVnUXVlcnlWYWx1ZUV4QQ== (RegQueryValueExA)
  • YWR2YXBpMzIuZGxs (advapi32.dll)

Match: win_token

  • QURWQVBJMzIuRExM (ADVAPI32.DLL)
  • QURWQVBJMzIuZGxs (ADVAPI32.dll)
  • QWRqdXN0VG9rZW5Qcml2aWxlZ2Vz (AdjustTokenPrivileges)
  • RHVwbGljYXRlVG9rZW5FeA== (DuplicateTokenEx)
  • T3BlblByb2Nlc3NUb2tlbg== (OpenProcessToken)
  • TG9va3VwUHJpdmlsZWdlVmFsdWVB (LookupPrivilegeValueA)
  • YWR2YXBpMzIuZGxs (advapi32.dll)

Match: win_private_profile

  • R2V0UHJpdmF0ZVByb2ZpbGVJbnRB (GetPrivateProfileIntA)
  • R2V0UHJpdmF0ZVByb2ZpbGVTdHJpbmdB (GetPrivateProfileStringA)
  • S0VSTkVMMzIuRExM (KERNEL32.DLL)
  • S0VSTkVMMzIuZGxs (KERNEL32.dll)
  • V3JpdGVQcml2YXRlUHJvZmlsZVN0cmluZ0E= (WritePrivateProfileStringA)
  • a2VybmVsMzIuZGxs (kernel32.dll)

Match: win_files_operation

  • Q29weUZpbGU= (CopyFile)
  • Q3JlYXRlRmlsZUE= (CreateFileA)
  • RGVsZXRlRmlsZUE= (DeleteFileA)
  • RmluZENsb3Nl (FindClose)
  • RmluZEZpcnN0RmlsZUE= (FindFirstFileA)
  • S0VSTkVMMzIuRExM (KERNEL32.DLL)
  • S0VSTkVMMzIuZGxs (KERNEL32.dll)
  • TW92ZUZpbGVFeEE= (MoveFileExA)
  • U2V0RmlsZUF0dHJpYnV0ZXNB (SetFileAttributesA)
  • U2V0RmlsZVBvaW50ZXI= (SetFilePointer)
  • UmVhZEZpbGU= (ReadFile)
  • V3JpdGVGaWxl (WriteFile)
  • a2VybmVsMzIuZGxs (kernel32.dll)

Match: Str_Win32_Winsock2_Library

  • V1MyXzMyLkRMTA== (WS2_32.DLL)
  • V1MyXzMyLmRsbA== (WS2_32.dll)
  • V1NPQ0szMi5kbGw= (WSOCK32.dll)
  • d3MyXzMyLmRsbA== (ws2_32.dll)

Match: Str_Win32_Wininet_Library

  • V0lOSU5FVC5kbGw= (WININET.dll)
  • d2luaW5ldC5kbGw= (wininet.dll)

Match: Str_Win32_Internet_API

  • SW50ZXJuZXRDb25uZWN0 (InternetConnect)
  • SW50ZXJuZXRDbG9zZUhhbmRsZQ== (InternetCloseHandle)
  • SW50ZXJuZXRPcGVu (InternetOpen)
  • SW50ZXJuZXRSZWFkRmlsZQ== (InternetReadFile)

Match: Str_Win32_Http_API

  • SHR0cE9wZW5SZXF1ZXN0 (HttpOpenRequest)
  • SHR0cFF1ZXJ5SW5mbw== (HttpQueryInfo)
  • SHR0cFNlbmRSZXF1ZXN0 (HttpSendRequest)

Match: DebuggerCheck__GlobalFlags

  • TnRHbG9iYWxGbGFncw== (NtGlobalFlags)

Match: DebuggerCheck__QueryInfo

  • UXVlcnlJbmZvcm1hdGlvblByb2Nlc3M= (QueryInformationProcess)

Match: DebuggerCheck__RemoteAPI

  • Q2hlY2tSZW1vdGVEZWJ1Z2dlclByZXNlbnQ= (CheckRemoteDebuggerPresent)

Match: DebuggerHiding__Thread

  • U2V0SW5mb3JtYXRpb25UaHJlYWQ= (SetInformationThread)

Match: DebuggerHiding__Active

  • RGVidWdBY3RpdmVQcm9jZXNz (DebugActiveProcess)

Match: DebuggerException__ConsoleCtrl

  • R2VuZXJhdGVDb25zb2xlQ3RybEV2ZW50 (GenerateConsoleCtrlEvent)

Match: DebuggerException__SetConsoleCtrl

  • U2V0Q29uc29sZUN0cmxIYW5kbGVy (SetConsoleCtrlHandler)

Match: ThreadControl__Context

  • U2V0VGhyZWFkQ29udGV4dA== (SetThreadContext)

Match: SEH__vectored

  • QWRkVmVjdG9yZWRFeGNlcHRpb25IYW5kbGVy (AddVectoredExceptionHandler)
  • UmVtb3ZlVmVjdG9yZWRFeGNlcHRpb25IYW5kbGVy (RemoveVectoredExceptionHandler)

Match: Check_Dlls

  • ZABiAGcAaABlAGwAcAAuAGQAbABsAA== (dbghelp.dll)
  • ZGJnaGVscC5kbGw= (dbghelp.dll)
  • cABzAHQAbwByAGUAYwAuAGQAbABsAA== (pstorec.dll)
  • cHN0b3JlYy5kbGw= (pstorec.dll)

Match: anti_dbg

  • Q29udGludWVEZWJ1Z0V2ZW50 (ContinueDebugEvent)
  • Q2hlY2tSZW1vdGVEZWJ1Z2dlclByZXNlbnQ= (CheckRemoteDebuggerPresent)
  • RGVidWdBY3RpdmVQcm9jZXNz (DebugActiveProcess)
  • S0VSTkVMMzIuRExM (KERNEL32.DLL)
  • S0VSTkVMMzIuZGxs (KERNEL32.dll)
  • SXNEZWJ1Z2dlclByZXNlbnQ= (IsDebuggerPresent)
  • T3V0cHV0RGVidWdTdHJpbmc= (OutputDebugString)
  • a2VybmVsMzIuZGxs (kernel32.dll)

Match: antisb_threatExpert

  • ZGJnaGVscC5kbGw= (dbghelp.dll)

Match: disable_dep

  • TnRTZXRJbmZvcm1hdGlvblByb2Nlc3M= (NtSetInformationProcess)
  • U2V0UHJvY2Vzc0RFUFBvbGljeQ== (SetProcessDEPPolicy)
  • WndQcm90ZWN0VmlydHVhbE1lbW9yeQ== (ZwProtectVirtualMemory)

Match: win_hook

  • Q2FsbE5leHRIb29rRXg= (CallNextHookEx)
  • U2V0V2luZG93c0hvb2tFeEE= (SetWindowsHookExA)
  • VVNFUjMyLkRMTA== (USER32.DLL)
  • VVNFUjMyLmRsbA== (USER32.dll)
  • VW5ob29rV2luZG93c0hvb2tFeA== (UnhookWindowsHookEx)
  • dXNlcjMyLmRsbA== (user32.dll)

URLs found in process memory 
    https://ssl.pstatic.net/static/pwe/common/img_use_mobile_version.png
    http://wwwimages.adobe.com/www.adobe.com/swf/software/flash/about/flash_about_793x170.swf
    https://s.pstatic.net/static/www/mobile/edit/2018/0206/cropImg_166x108_118371466370743504.jpeg
    https://s.pstatic.net/dthumb.phinf/?src=%22https%3A%2F%2Fs.pstatic.net%2Fstatic%2Fwww%2Fmobile%2Fedit%2F2020%2F1031%2Fupload_20063893240744871RiJjV.jpg%22
    http://175.208.134.150:8282/test/test.eml
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/905.png
    https://s.pstatic.net/static/www/mobile/edit/2020/1103/mobile_142459883835.gif
    https://ssl.pstatic.net/tveta/libs/assets/js/common/min/probe.min.js
    http://blogimgs.naver.net/nblog/guestbook/btn_close2.gif
    https://ssl.pstatic.net/static/nid/login/rw_captcha01.png
    http://www.snee.com/xml/xslt/sample.doc
    http://www.yceml.net/0559/10408495-1499411010011
    https://t1.daumcdn.net/tistory_admin/blogs/plugins/tatterDesk/js/src/controls.js?_version_=9024c9023ed6ab26b00b4f2905e46ffa08aeb336
    https://s.pstatic.net/static/newsstand/up/2020/0615/nsd10319824.png
    http://t.static.blog.naver.net/mylog/versioning/nhn.keywordHighlighter-99428789.js
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0805%2FcropImg_339x222_38552809772500435.jpeg%22
    https://ssl.pstatic.net/static/pwe/nm/b.gif
    https://castbox.shopping.naver.com/js/lazyload.js
    https://s.pstatic.net/shopping.phinf/20200729_1/2931dd60-1842-4048-a39c-1e3389db4a0e.jpg
    https://ssl.pstatic.net/static/pwe/nm/spr_vertical_0d25bb77f8.png
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/042.png
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/955.png
    https://s.pstatic.net/dthumb.phinf/?src=%22https%3A%2F%2Fs.pstatic.net%2Fstatic%2Fwww%2Fmobile%2Fedit%2F2020%2F1021%2Fupload_19201541624342101mWI1T.jpg%22
    http://www.buzzadnetwork.com/jump/next.php?stamat=m%7CM-4iM-4jaQdHQBH0dEdHP3xP.0e7%2CboDB7XrVJDfRqYwVNhmAc8QRCrIuseXl_bWuTf_latOFYiGEzPpb7ikp5t8RPmTHyMRYDe1i9EJZLC6LSuccW1-YPggnMxkcwVirdNVGfgK3hFUbeKvFvqNv0-u8VxfrNUFB1gFhMN_8GLCn1znxf5_p0FJe0MYRI7nbfyajoqg_H3fvzrjsMsC0vAMYn2un8v5vcBfzwM-DewoZ7WId7geGlrySfAHx5KiJ5Hm90CU%2C
    https://s.pstatic.net/shopping.phinf/20200720_22/e2297359-375a-403a-86c5-44ff86c708fc.jpg
    https://t1.daumcdn.net/tistory_admin/blogs/plugins/PreventCopyContents/js/functions.js?_version_=9024c9023ed6ab26b00b4f2905e46ffa08aeb336
    https://s.pstatic.net/shopping.phinf/20201103_21/701f9083-a72b-4ef6-ac1c-0daf1907c51d.jpg?type=f214_292
    https://ssl.pstatic.net/tveta/libs/1298/1298853/743c01d46e807a376d99_20200730182507675.png
    https://tistory3.daumcdn.net/tistory/807805/skin/images/footerbg.jpg
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/820.png
    https://www.google.com/pagead/drt/ui
    https://s.pstatic.net/shopping.phinf/20201102_18/6131e135-0b61-4b61-86ca-480bf7612785.jpg
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/327.png
    http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    https://mail.naver.com/js_src/com/nhncorp/mail/write/se2_new/smart_editor2_inputarea_ie8.html?version=20190704
    https://static.nid.naver.com/loginv3/img/sp_login_20150113.gif
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/031.png
    https://tpc.googlesyndication.com/pagead/images/abg/icon.png
    https://search.pstatic.net/common/?src=http%3A%2F%2Fcafefiles.naver.net%2FMjAxNzExMDdfODcg%2FMDAxNTEwMDY0OTYzNTA5.y-bJj3BgRC8r80hM6EblWFHSqawqo5-vMJAzHBN6rEkg.vAPtUzoeY8mHPRaMuejD3HrMtW5xgv-cdeEaAc0q2Rog.PNG.flashcs7%2FScreenshot_2017-11-07-22-55-08.png%23600x1024
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0804%2FcropImg_336x206_38466352545626545.png%22
    https://www.naver.com
    https://t1.daumcdn.net/tistory_admin/blogs/style/menubar.css?_version_=9024c9023ed6ab26b00b4f2905e46ffa08aeb336
    https://ssl.pstatic.net/static/nid/login/pc_2step_396_110.png
    https://tpc.googlesyndication.com/pagead/js/r20180205/r20110914/abg.js
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/024.png
    https://c.microsoft.com/ms.js
    https://securepubads.g.doubleclick.net/tag/js/gpt.js
    http://blogimgs.naver.net/nblog/skins/happybean/btn-put.gif
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/957.png
    https://my.sendinblue.com/public/theme/version4/assets/images/loader_sblue.gif
    https://ssl.pstatic.net/static/pwe/nm/sp_mail_setup_140716.png
    https://s.pstatic.net/shopping.phinf/20180206_26/7e09abe6-c90b-4dc0-b6ef-e8ab8e8c4967.jpg
    https://mail.naver.com/js/uglified_jindo.js
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/932.png
    https://nid.naver.com/login/js/default/device.js
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0806%2Fmobile_152547536202c.jpg%22
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/410.png
    https://www.naver.com/favicon.ico?1
    http://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    https://castbox.shopping.naver.com/sb/main.nhn
    https://s.pstatic.net/dthumb.phinf/?src=%22https%3A%2F%2Fs.pstatic.net%2Fstatic%2Fwww%2Fmobile%2Fedit%2F2020%2F1027%2Fupload_1971247439269296006t9v.jpg%22
    https://mail.naver.com/css/mail2_le.min.200716.css
    https://www.google-analytics.com/analytics.js
    http://v3rjvtt.com/watch?shu=d5898a8543a73e06e149801003435598
    https://t1.daumcdn.net/tistory_admin/blogs/plugins/tatterDesk/js/src/builder.js?_version_=9024c9023ed6ab26b00b4f2905e46ffa08aeb336
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/934.png
    https://s.pstatic.net/static/www/font/NanumSquareR.eot?
    https://s.pstatic.net/shopping.phinf/20200803_13/9d1c5267-461b-45d3-a831-c37e49a65909.jpg
    https://fonts.googleapis.com/css?family=Open
    https://ssl.pstatic.net/tveta/libs/assets/js/pc/main/min/pc.veta.core.min.js
    https://mail.naver.com/favicon.ico?2
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/308.png
    http://blogimgs.naver.net/nblog/btn_urlcopy.gif
    https://s.pstatic.net/static/www/mobile/edit/2020/1104/cropImg_196x196_46387550610933987.jpeg
    https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct
    http://blogimgs.naver.net/imgs/btn_cancel.gif
    https://gamez1a.com/?track=aHR0cHM6Ly9wbGFyaXVtLmNvbS9wbGF5L2VuL3Rocm9uZS8wMDJfcGFzdG9yYWxfbXVzaWNfZz9wbGlkPTEwNzQxNCZweGw9cHJvcGVsbGVyLWFkcyZjbGlja0lkPTQxNzg1MzcxNzk0OCZwdWJsaXNoZXJJZD0zMjQzMjk
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/921.png
    http://blogimgs.naver.net/nblog/admin/layerpopup_shadow1.png
    https://wwwimages2.adobe.com/ubi/template/identity/adobe/Cookie.js
    http://blogimgs.naver.net/nblog/skins/happybean/btn-save-off.gif
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/809.png
    https://s.pstatic.net/shopping.phinf/20200715_0/edf4da6f-f1d6-4a76-a095-b0506598dc0f.jpg
    https://ssl.pstatic.net/static/pwe/address/deskhome/spr_cp_address_120618_cal.png
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0805%2Fmobile_162859571510c.jpg%22
    http://static.nid.naver.com/loginv3/commonLoginF_201505.swf
    https://s.pstatic.net/dthumb.phinf/?src=%22https%3A%2F%2Fs.pstatic.net%2Fstatic%2Fwww%2Fmobile%2Fedit%2F2020%2F1028%2Fupload_19808766573983548vV9dN.jpg%22
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0805%2Fmobile_17051541634c.jpg%22
    https://mail.naver.com/css/se2_new/ko_KR/smart_editor2.me.min.201022.css
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/355.png
    https://t1.daumcdn.net/tistory_admin/blogs/image/tree/folder_yellow/tab_closed.gif
    https://ssl.pstatic.net/tveta/libs/assets/js/pc/main/min/pc.veta.core.min.js?20181008
    https://s.pstatic.net/static/www/img/uit/2020/sp_shop.4e0461.png
    https://t1.daumcdn.net/tistory_admin/blogs/image/tree/folder_yellow/tab_treed_end.gif
    http://blogimgs.naver.com/blog20/blog/layout_photo/viewer2/btn_right.gif
    http://cfile7.uf.tistory.com/image/207B123D4E65769A140920
    https://s.pstatic.net/shopping.phinf/20201102_11/ab4f86db-b422-472d-bd20-e0cb84a680f2.jpg
    https://rcaptcha.nid.naver.com/rcaptCss?key=h0FDC5Ij4587qT
    https://s.pstatic.net/dthumb.phinf/?src=%22https%3A%2F%2Fs.pstatic.net%2Fstatic%2Fwww%2Fmobile%2Fedit%2F2020%2F1027%2Fupload_19697927713361615n0zU2.jpg%22
    https://s.pstatic.net/shopping.phinf/20201007_10/fc98c258-44e9-4580-ad2f-09c5f83eef07.jpg
    https://ssl.pstatic.net/static/pwe/nm/se2_new/bg_text_tool.gif
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/314.png
    http://blogimgs.naver.com/nblog/skins/infobox/0511_footer.gif
    http://t.static.blog.naver.net/mylog/versioning/JindoComponent-190469086.js
    https://ssl.pstatic.net/tveta/libs/external/js/TweenLite.min.js?20180423
    https://ssl.pstatic.net/static/pwe/address/deskhome/spr_cp_loading_bar.gif
    https://s.pstatic.net/static/newsstand/up/2017/0424/nsd144732945.png
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/005.png
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/020.png
    http://t.static.blog.naver.net/mylog/versioning/Hidden-426543577.js
    http://blogimgs.naver.net/blog20/blog/layout_photo/viewer2/btn_right.gif
    https://t1.daumcdn.net/tistory_admin/blogs/image/tree/folder_yellow/tab_opened.gif
    https://castbox.shopping.naver.com/shoppingboxnew/main.nhn
    https://s.pstatic.net/shopping.phinf/20201029_13/36876715-a066-44e8-a04d-105193b04e81.jpg
    https://s.pstatic.net/shopping.phinf/20200728_7/81547845-c636-45f3-9e17-9bc48e142627.jpg
    https://s.pstatic.net/shopping.phinf/20180206_3/a1ed9211-58e5-4b76-a630-fb98c98afd3a.jpg
    https://s.pstatic.net/shopping.phinf/20201030_9/809eb51e-5e87-4678-8894-dab24a45a7ef.jpg?type=f214_292
    https://ssl.pstatic.net/tveta/libs/assets/js/pc/main/min/rollingboard_imagerolling_332_flexunit.min.js?20180423
    https://pm.pstatic.net/dist/js/nelo_async.28f0e220.js?o=www
    https://file-examples.com/?p=47
    https://ssl.pstatic.net/tveta/libs/1302/1302658/788bd78eac6b4413585b_20201103164242177.jpg
    http://tveta.naver.net/libs/1187/1187983/0834f11dd0aa39a0703d_20180202155030063.jpg
    https://s.pstatic.net/static/www/mobile/edit/2018/0207/cropImg_166x108_118447400612544791.jpeg
    https://s.pstatic.net/shopping.phinf/20200730_22/d221948a-1151-457a-9c16-d1e733997523.jpg
    https://s.pstatic.net/shopping.phinf/20201013_20/69a37bb0-a35c-43bf-8411-40efd443805a.jpg
    https://googleads.g.doubleclick.net/pagead/drt/si
    https://s.pstatic.net/shopping.phinf/20201029_3/1bf6bde9-7a6d-4b4e-880a-bb11d64c645f.jpg
    https://s.pstatic.net/static/www/mobile/edit/2018/0206/cropImg_166x108_118370784378819479.jpeg
    http://static.naver.com/common/btn/btn_confirm2.gif
    https://www.google.com/recaptcha/api/fallback?k=6Lc8mHQUAAAAAP8U58My2TKKpLBWSL1Ecqe2NVMN
    https://s.pstatic.net/shopping.phinf/20201103_9/cc3b199c-fdeb-4235-9bf9-d4c164263515.jpg
    https://s.pstatic.net/static/www/mobile/edit/2020/0806/cropImg_196x196_38636265696584974.jpeg
    https://t1.daumcdn.net/tistory_admin/blogs/plugins/A_ShareEntryWithSNS/script/shareEntryWithSNS.js?_version_=9024c9023ed6ab26b00b4f2905e46ffa08aeb336
    https://cdn.datatables.net/1.10.15/css/jquery.dataTables.css
    https://s.pstatic.net/shopping.phinf/20200729_15/f1b08cd4-ffc2-42ba-977b-94098cd905ea.jpg
    http://blogimgs.naver.com/nblog/skins/rss/0114_image.gif
    https://search.pstatic.net/common/?src=http%3A%2F%2Fblogfiles5.naver.net%2F20150715_141%2Fadc0420_1436928108569hRsr9_JPEG%2F%25C4%25B8%25C3%25B3_01.JPG
    http://postfiles12.naver.net/20150723_251/itlovehj2_1437610835458HlgQM_GIF/PICF227.GIF?type=w1
    https://my.sendinblue.com/public/theme/version4/assets/js/src/subscribe-validate.js?v=1526904693
    https://s.pstatic.net/static/newsstand/up/2017/1209/nsd14224593.png
    https://s.pstatic.net/shopping.phinf/20200805_0/1b6a18b9-c0b2-4746-bcc3-ac5c4fd1ce01.jpg
    https://s.pstatic.net/static/www/mobile/edit/2018/0202/mobile_163100259813.png
    http://blogimgs.naver.net/nblog/mylog/post/btn_thin_close.gif
    https://search.pstatic.net/common/?src=http%3A%2F%2Fimgnews.naver.net%2Fimage%2Forigin%2F5016%2F2017%2F07%2F26%2F57173.jpg
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/028.png
    http://blogimgs.naver.net/imgs/btn_close8.gif
    https://search.pstatic.net/common/?src=http%3A%2F%2Fimage.nmv.naver.net%2Fblogucc28%2F2017%2F05%2F19%2F1052%2Fc09496170105db031e0c3c590a24708f69f3_ugcvideo_270P_01_16x9_s152.jpg
    https://ssl.pstatic.net/tveta/libs/1188/1188212/9cdbcc9ac7fa60c50050_20180131133417705.png
    http://img.naver.net/static/common/login/bg_login_id_main_6.gif
    https://s.pstatic.net/dthumb.phinf/?src=%22https%3A%2F%2Fs.pstatic.net%2Fstatic%2Fwww%2Fmobile%2Fedit%2F2020%2F1104%2Fupload_20410790965536696n1dQS.jpg%22
    https://www.google.com/url?q=https://fileinfo.com/extension/doc
    https://s.pstatic.net/shopping.phinf/20201021_28/863ded98-dad2-4864-963f-9b00e859b374.jpg
    https://search.pstatic.net/common/?src=http%3A%2F%2Fimgnews.naver.com%2Fimage%2F5048%2F2008%2F10%2F20%2F50480000001559_0.jpg
    http://t.static.blog.naver.net/mylog/versioning/LayoutTopCommon-895325723.js
    https://support.microsoft.com/api/content/GetCompassContentForPage/?iecbust=1518423990683
    https://static.nid.naver.com/images/ui/login/pc_sp_login_190522.png
    https://t1.daumcdn.net/tistory_admin/blogs/image/tree/folder_yellow/tab_treed.gif
    http://blogimgs.naver.com/blog20/blog/layout_photo/viewer2/btn_left.gif
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/076.png
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/984.png
    https://tpc.googlesyndication.com/pagead/js/r20180205/r20110914/client/ext/m_js_controller.js
    https://t1.daumcdn.net/tistory_admin/blogs/plugins/A_ShareEntryWithSNS/css/shareEntryWithSNS.css?_version_=9024c9023ed6ab26b00b4f2905e46ffa08aeb336
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0805%2FcropImg_339x222_38552865355140281.jpeg%22
    https://s.pstatic.net/static/www/mobile/edit/2018/0206/cropImg_166x108_118370877201946159.jpeg
    http://blogimgs.naver.com/nblog/skins/poststyle/0124_back3.gif
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/818.png
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0805%2Fmobile_161708319559c.jpg%22
    https://s.pstatic.net/imgshopping/static/sb/js/sb/nclkS02_v1.js?v=2020110217
    https://s.pstatic.net/shopping.phinf/20180209_10/34ec0d39-de3e-44be-adba-f6d9cb53297e.jpg
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/044.png
    https://s.pstatic.net/shopping.phinf/20200721_0/3c124f53-51b6-4d70-a7e1-a4dda7549626.jpg
    http://blogimgs.naver.com/nblog/skins/poststyle/0124_back1.gif
    https://s.pstatic.net/static/www/mobile/edit/2018/0208/cropImg_166x108_118548107741178090.jpeg
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/140.png
    https://ssl.pstatic.net/tveta/libs/external/js/jquery-1.8.0.min.js?20171121
    https://ssl.pstatic.net/static/pwe/nm/se2_new/icon_set.gif
    https://www.winamp.com/Assets/Images/wave-survey.png
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/968.png
    https://s.pstatic.net/static/www/font/NanumSquareEB.eot?
    https://assets.adobedtm.com/659ec8ada5450db95675e43beaaae92399591a11/satelliteLib-7123a14bc11ffd1ad43be190a593a8932494dcb0.js
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/973.png
    https://search.pstatic.net/common/?src=http%3A%2F%2Fimgnews.naver.net%2Fimage%2Forigin%2F5350%2F2018%2F02%2F08%2F19972.jpg
    https://www.google.com/url?q=https://www.winamp.com/
    https://www.google.com/images/branding/searchlogo/1x/googlelogo_desk_heirloom_color_150x55dp.gif
    https://www.winamp.com/
    http://blogimgs.naver.net/static/ws/btn_close.gif
    http://blogimgs.naver.com/nblog/skins/menu/0129_966.gif
    https://download.nullsoft.com/winamp/client/winamp58_3660_beta_full_en-us.exe
    https://nid.naver.com/login/css/global/desktop/w_20200707.css?20201006
    http://t.static.blog.naver.net/mylog/versioning/Frameset-584891086.js
    https://t1.daumcdn.net/tistory_admin/blogs/image/tree/folder_yellow/tab_isleaf.gif
    https://ff.linkggo.com/?flux_fts=tcapxxxlaciacpttozetltaqaatxzoxxttioxb0cdb
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/138.png
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/908.png
    https://ssl.pstatic.net/tveta/libs/1302/1302658/76d9aa14a0296671cd42_20201103164828327.jpg
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/014.png
    http://blogimgs.naver.net/nblog/guestbook/btn_ok.gif
    https://s.pstatic.net/static/www/mobile/edit/2020/1015/mobile_143527819777.jpg
    https://s.pstatic.net/dthumb.phinf/?src=%22https%3A%2F%2Fs.pstatic.net%2Fstatic%2Fwww%2Fmobile%2Fedit%2F2020%2F1103%2Fupload_20317055746134553LuqJN.jpg%22
    https://static.nid.naver.com/images/ui/login/t_sp_login_190522.png
    http://t.static.blog.naver.net/mylog/versioning//common/js/global/RemoveSubDomain-dea9950.js
    https://www.predictivadnetwork.com/script/preurl.php?stamat=m%7C%2Ck93djdiOqB1dQO0dEdHP3xP.afd%2CICsaLmdWejXEgAqyA-w26cYnRfPnHRNp3pTcFRmD1wLvV6S5pRnJYgp8ErXgAC3UKvHCPJFjWPSr5Ay1okP8ZA%2C%2C
    https://ssl.pstatic.net/static/pwe/address/deskhome/spr_cp_loading.png
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/923.png
    https://wwwimages2.adobe.com/downloadcenter/singlepage/live/images/progress_bar.gif
    https://fileinfo.com/extension/doc
    https://search.pstatic.net/common/?src=http%3A%2F%2Fimage.nmv.naver.net%2Fblogucc28%2F2017%2F07%2F02%2F1635%2Fe67054c4755f23d62d3d63685ad5d7d1dd9e_ugcvideo_270P_01_16x9_s152.jpg
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0729%2Fmobile_105310608744c.jpg%22
    http://t.static.blog.naver.net/mylog/versioning/PostBottomCommon-732655358.js
    https://s.pstatic.net/static/www/mobile/edit/2020/0806/cropImg_196x196_38636284969421088.jpeg
    https://ssl.pstatic.net/tveta/libs/1311/1311070/b43f49858e8cb6f69d23_20201028142220589.png
    https://www.winamp.com/Assets/Images/logo-winamp.svg
    https://static.nid.naver.com/images/web/user/sp_u_skip.png
    https://t1.daumcdn.net/tistory_admin/blogs/plugins/tatterDesk/image/TattertoolsSymbol.gif
    https://file-examples.com/wp-content/themes/file-examples/vendor/bootstrap/css/bootstrap.min.css
    http://blogimgs.naver.com/nblog/skins/happybean/bg-head.gif
    http://download.microsoft.com/download/2/5/7/257166C5-14B7-428B-8C1B-3E01E2330BA4/NeutralMSU/amd64fre/IE9-win7.msu
    http://blogimgs.naver.com/nblog/skins/infobox/0511_body.gif
    https://s.pstatic.net/dthumb.phinf/?src=%22https%3A%2F%2Fs.pstatic.net%2Fstatic%2Fwww%2Fmobile%2Fedit%2F2020%2F1104%2Fupload_20378923223507439f7IuJ.jpg%22
    http://t.static.blog.naver.net/mylog/versioning/PostView-760169613.css
    https://s.pstatic.net/shopping.phinf/20200826_26/5a541fdd-d243-470a-aa81-96028a1e38b1.jpg
    https://s.pstatic.net/dthumb.phinf/?src=%22https%3A%2F%2Fs.pstatic.net%2Fstatic%2Fwww%2Fmobile%2Fedit%2F2020%2F1103%2Fupload_20324648565761150utbrV.jpg%22
    https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
    https://nid.naver.com/login/js/default/common200417.js?v=20200714
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/813.png
    https://ssl.pstatic.net/tveta/libs/1287/1287125/9ca8986462f1a45f809f_20201103190938110.jpg
    http://blogimgs.naver.com/nblog/skins/wholebox/0126_f982.gif
    https://nid.naver.com/login/js/default/rcaptcha.js?v=20200728
    https://file-examples.com/index.php/sample-documents-download/sample-doc-download/
    http://blogimgs.naver.com/nblog/skins/poststyle/0124_input.gif
    http://blogimgs.naver.com/nblog/skins/poststyle/0124_back4.gif
    https://tpc.googlesyndication.com/daca_images/simgad/10995222030990580869
    https://www.google.com/url?q=http://www.winamp.com/
    https://s.pstatic.net/shopping.phinf/20201030_6/ddf87878-405a-4b85-85c8-d3839417b8e6.jpg
    https://ssl.pstatic.net/tveta/libs/external/js/EasePack.min.js?20180423
    https://tistory3.daumcdn.net/tistory/807805/skin/images/head_bg32.gif
    http://dol82net.tistory.com/api
    https://static.adobelogin.com/imslib/imslib.min.js
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/016.png
    https://www.google.com/url?q=https://file-examples.com/index.php/sample-documents-download/sample-doc-download/
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0806%2FcropImg_339x222_38634621104613184.jpeg%22
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/928.png
    https://s.pstatic.net/shopping.phinf/20180209_16/ff3f750c-6195-4f95-b940-4394ae6d66f1.jpg
    https://file-examples.com/index.php/wp-json/
    http://www.microsoft.com/schemas/ie8tldlistdescription/1.0
    https://mail.naver.com/js/uglified_ko_KR_200716.js
    https://nid.naver.com/login/js/default/captcha.js
    https://s.pstatic.net/dthumb.phinf/?src=%22https%3A%2F%2Fs.pstatic.net%2Fstatic%2Fwww%2Fmobile%2Fedit%2F2020%2F1103%2Fupload_203157123376733973w25J.jpg%22
    http://t.static.blog.naver.net/mylog/versioning//css/navercomment/naver_comment_blog_base-61fa3cc.css
    https://mail.naver.com/js/uglified_write_201027.js
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/447.png
    https://ssl.pstatic.net/tveta/libs/1299/1299024/1d60478ef90a5eb689a3_20200806171050953.jpg
    https://ssl.pstatic.net/static/common/gnb/2014/bg_svclyr1_v2.png
    http://blogimgs.naver.net/nblog/mylog/post/ico_file.gif
    https://s.pstatic.net/shopping.phinf/20201030_5/435a8fe5-a825-42c6-ae9b-cf42801458dc.jpg?type=f214_292
    http://blogimgs.naver.net/nblog/mylog/post/btn_originaldn.gif
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/094.png
    http://www.implbits.com/products/hashtab/start
    https://ssl.pstatic.net/static/common/gnb/2014/promo_npay.png
    https://s.pstatic.net/shopping.phinf/20200804_10/64a7b3ec-a01d-44ad-ab3f-a4fbd5ee3acc.jpg
    http://blogimgs.naver.net/nblog/ico_notice2.gif
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/214.png
    http://cfile10.uf.tistory.com/image/180935404E6576DA0FB9B6
    https://ssl.pstatic.net/static/pwe/nm/ico_mail1_140508_2.png
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0806%2FcropImg_339x222_38646627959058016.jpeg%22
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/241.png
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/404.png
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/975.png
    https://t1.daumcdn.net/tistory_admin/blogs/plugins/tatterDesk/js/ttDesklightbox.js?_version_=9024c9023ed6ab26b00b4f2905e46ffa08aeb336
    http://www.lduhtrp.net/7l101snrflj4AA8DE7A46595D9EA
    http://digitaldsp.com/api/submit_form_request?p=02c2d834-ae2b-4dbf-9eea-9b4d836c0d9c
    https://s.pstatic.net/static/www/mobile/edit/2018/0206/cropImg_166x108_118372854064949290.jpeg
    https://s.pstatic.net/static/www/mobile/edit/2018/0208/cropImg_166x108_118523995535361464.jpeg
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/013.png
    https://t1.daumcdn.net/tistory_admin/blogs/plugins/tatterDesk/image/img_delete_module.gif?_version_=9024c9023ed6ab26b00b4f2905e46ffa08aeb336
    https://mail.naver.com/css/mail_lazy_le.min.201022.css
    https://s.pstatic.net/static/newsstand/up/2017/1122/nsd113655834.png
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/529.png
    https://t1.daumcdn.net/tistory_admin/static/sns/socialShare_big2.png
    https://s.pstatic.net/shopping.phinf/20201102_17/4561fe87-b0cb-42f7-918f-02aba3960698.jpg
    https://mail.naver.com/css/cp_address_5.7.css
    https://ssl.pstatic.net/static/common/myarea/myInfo.gif
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/972.png
    https://s.pstatic.net/dthumb.phinf/?src=%22https%3A%2F%2Fs.pstatic.net%2Fstatic%2Fwww%2Fmobile%2Fedit%2F2020%2F1103%2Fupload_20315660827379308Gl6UU.jpg%22
    https://file-examples.com/wp-content/themes/file-examples/js/new-age.min.js
    https://s.pstatic.net/static/www/img/uit/2020/sp_main_1f05c0.png
    https://s.pstatic.net/shopping.phinf/20180209_29/e2bfa46f-7854-4a23-84f0-fae065f3e8d3.jpg
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/993.png
    https://tistory3.daumcdn.net/tistory/807805/skin/images/iconTag.gif
    https://search.pstatic.net/common/?src=http%3A%2F%2Fimgnews.naver.net%2Fimage%2Forigin%2F5016%2F2017%2F12%2F22%2F59912.jpg
    http://ac.search.naver.com/nx/ac?_callback=window.__jindo_callback._
    https://s.pstatic.net/shopping.phinf/20201103_26/95108891-93eb-4ad8-9057-b08fe39e11be.jpg
    http://blogimgs.naver.net/nblog/mylog/post/shadow01.png
    https://googleads.g.doubleclick.net/pagead/adview?ai=Cgydzjil9WqjlOozQ2QSw9ZWIBay4u5VQ9Zam3cgGZBABIKOlpCVgm4PphJwpoAHak8adA8gBAqkCUfIru3-VDz6oAwHIA8kEqgSeAU_Q00nPtf0AyyBeXaaNQj7Q5AK7ZM53e7mHWkr4qQnw7U5kKyg4kP419a2MVYX2qmxyM6-y5W6XV-iOnvDr6oQdyHXicj_hsqwLvDi9nVJzKx2qf60JKv0D_2yEFp7Llm75__5fK0zhH3g772rNWDZUoaidOIb_-GXR_0iVNZjoQgAVE1QnfFiWIVBqRykQUvovZd_ZN8HEclu03mbkwASonfrUvAGSBQQIBBgBkgUECAUYBKAGAoAHjuy5YqgHpr4b2AcB8gcEELKTDdIIBwiAYRABGAKACgHYEwI
    https://s.pstatic.net/shopping.phinf/20200723_14/1830ea29-778a-47c7-9367-e34230fa46cc.jpg
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/354.png
    http://t.static.blog.naver.net/mylog/versioning/MusicPlayer-571575557.js
    https://ssl.pstatic.net/static/pwe/nm/ico_mail_151020.png
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/052.png
    https://t1.daumcdn.net/tistory_admin/blogs/plugins/CommentCaptcha/css/captcha.css?_version_=9024c9023ed6ab26b00b4f2905e46ffa08aeb336
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/143.png
    https://ssl.pstatic.net/static/common/gnb/2014/bg_svclyr2_v2.png
    https://pagead2.googlesyndication.com/pagead/js/r20180205/r20170110/rum.js
    http://naver.com/
    https://www.google.com/url?q=http://homepages.inf.ed.ac.uk/neilb/TestWordDoc.doc
    https://s.pstatic.net/shopping.phinf/20201103_29/b7f719e8-5faa-4c51-9aee-28e99358c25b.jpg?type=f214_292
    https://s.pstatic.net/dthumb.phinf/?src=%22https%3A%2F%2Fs.pstatic.net%2Fstatic%2Fwww%2Fmobile%2Fedit%2F2020%2F1103%2Fupload_20300828918460612mqftA.jpg%22
    https://ssl.pstatic.net/tveta/libs/1287/1287125/ee8db39683ef28a03591_20200731100443041.jpg
    https://s.pstatic.net/shopping.phinf/20200804_1/bc931252-261c-424b-b3ef-7a4b28b14899.jpg
    https://ssl.pstatic.net/static/common/gnb/one/sp_gnb_4b16e6.png
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/025.png
    https://s.pstatic.net/dthumb.phinf/?src=%22https%3A%2F%2Fs.pstatic.net%2Fstatic%2Fwww%2Fmobile%2Fedit%2F2020%2F1103%2Fupload_20323040906212488l837Z.jpg%22
    https://s.pstatic.net/static/www/mobile/edit/2020/1029/cropImg_196x196_45903568834065744.jpeg
    https://s.pstatic.net/shopping.phinf/20200806_26/3cad46ab-3fa4-4756-9e01-d61372890bd0.jpg
    https://ssl.pstatic.net/tveta/libs/1299/1299478/77c31057afdb25f7911c_20200805155524599.jpg
    http://www.passport.com
    http://blogimgs.naver.com/nblog/skins/exchange/exchangecon_1_2.gif
    https://ssl.pstatic.net/static/nid/account/m_nudge_close.png
    https://tpc.googlesyndication.com/pagead/js/r20180205/r20110914/client/ext/m_qs_click_protection.js
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0805%2Fmobile_17061525298c.jpg%22
    https://search.pstatic.net/common/?src=http%3A%2F%2Fimgnews.naver.com%2Fimage%2F5016%2F2008%2F10%2F20%2Fadobe_1_.jpg
    http://blogimgs.naver.net/nblog/quickeditor/btn_clse_ly2.gif
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic1.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0717%2FcropImg_336x206_36936304039467960.png%22
    http://pagead2.googlesyndication.com/pagead/js/r20180205/r20170110/show_ads_impl.js
    https://ssl.pstatic.net/static/common/gnb/2014/ico_arrow_wh.gif
    http://deloton.com/afu.php?enc=lxnxZxzMxHF05exXWZjT-GBljoctGHvMvIuIDvz4UHw
    https://ssl.pstatic.net/static/pwe/nm/spr_tooltip.png
    https://mail.naver.com/js/uglified_se2_basic_201027.js
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0805%2Fmobile_170554491494c.jpg%22
    https://t1.daumcdn.net/tistory_admin/blogs/plugins/tatterDesk/css/ttDesk.css?_version_=9024c9023ed6ab26b00b4f2905e46ffa08aeb336
    https://tpc.googlesyndication.com/pagead/js/r20180205/r20110914/rum.js
    https://s.pstatic.net/static/www/img/uit/2020/sp_shop_bffdc9.png
    https://s.pstatic.net/imgshopping/static/sb/css/shopboxR0011_v3.css?v=2020080314
    https://nid.naver.com/login/css/e.css?150827
    https://fonts.adobe.com/k/f/wXgYHHPdzg-eD4sR0bqelbFmapgW1pvw90LmrCRtLy6ffwhpgsMZeMI6MK6f5Mw.eot
    http://194.147.115.117/zzztop/Daemon.exe
    https://search.pstatic.net/common/?src=http%3A%2F%2Ftvcast1.phinf.naver.net%2F20151119_280%2FT5nff_1447931473332Kb3Xs_JPEG%2F718418CNwfBGQbmqWAnYUjKhGA_rmcvideo_144P_256_100_32_logo.jpg
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/808.png
    http://blogimgs.naver.net/nblog/admin/layerpopup_shadow3.png
    https://ssl.pstatic.net/tveta/libs/res/www/common/info/da_access.png
    https://tistory3.daumcdn.net/tistory/807805/skin/images/btn_write.gif
    https://s.pstatic.net/dthumb.phinf/?src=%22https%3A%2F%2Fs.pstatic.net%2Fstatic%2Fwww%2Fmobile%2Fedit%2F2020%2F1103%2Fupload_20323221067770940N9teq.jpg%22
    https://mail.naver.com/js/uglified_ko_KR_201027.js
    https://s.pstatic.net/static/www/mobile/edit/2018/0205/cropImg_166x108_118265581501749059.png
    http://blogimgs.naver.com/nblog/skins/saying/saying02_body.gif
    https://s.pstatic.net/shopping.phinf/20201021_18/720e8b18-f3a5-4991-96c5-64b0cd2a3539.jpg
    https://mail.naver.com/css/mail2_le.min.201022.css
    https://pagead2.googlesyndication.com/pub-config/r20160913/ca-pub-2126773934770233.js
    https://rcaptcha.nid.naver.com/rcaptUi?key=h0FDC5Ij4587qT
    https://static.nid.naver.com/images/ui/login/pc_sp_login_170424.png
    https://search.like.naver.com/static/js/likeIt.list.js?20180209
    https://search.pstatic.net/common/?src=http%3A%2F%2Fcafefiles.naver.net%2FMjAxODAyMDZfMjE0%2FMDAxNTE3ODkyOTI3OTE0.33Lcf6FTYBE2tDQtHqefS5agwmZ7OeV33P0NaMCuMOMg.5ljl7BOV94JKQwYmBWep4aNNP-C8W-AKVSy2xIKFX98g.JPEG.pujo208%2F2018-02-06-13-50-42.jpg%23740x555
    https://ssl.pstatic.net/tveta/libs/1292/1292324/af1384def98e45cf0fd7_20200729175107242.PNG
    http://blogimgs.naver.net/imgs/nblog/spc.gif
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/903.png
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/079.png
    http://spi.naver.net/js/release/ko_EUC-KR/splugin.js?20180209
    https://s.pstatic.net/dthumb.phinf/?src=%22https%3A%2F%2Fs.pstatic.net%2Fstatic%2Fwww%2Fmobile%2Fedit%2F2020%2F1103%2Fupload_203197809842026342BUYV.jpg%22
    http://blogimgs.naver.com/blog20/blog/layout_photo/viewer2/btn_close.gif
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0729%2Fmobile_105320407546c.jpg%22
    https://pm.pstatic.net/dist/js/my.81be3c1d.js?o=www
    http://blogimgs.naver.net/nblog/quickeditor/bg_qk_intro3.gif
    https://ssl.pstatic.net/tveta/libs/external/js/CSSPlugin.min.js?20180423
    https://googleads.g.doubleclick.net/pagead/adview?ai=C00Ckjil9WsTfO4bx2ATfub3ACbnj0IJQwsDZg5IG3sCNk7cJEAEgo6WkJWCbg-mEnCmgAdKo48wDyAECqAMByAPJBKoEmgFP0PemANyMq1088g8VX784ZyG4ldaRZvRmlR6nXCSyPIl46KxPw6v9r7Ug-F2FpMHVmAKDphyfDzcY8-8Dqm7FAOeuU2UY64LJnwU5wrtUdmvQNq4Qz49lsWWpNSWcD0Pq4KSCAGTpdO6U0kYqzuVOQwzBmDw1LT34EpLhpJqvwUjP2QB-FQZlcNM4Zm6b7JSxAVYZIydVMA9MwATGgrSWNpIFBAgEGAGSBQQIBRgEoAYCgAeW15wzqAemvhvYBwHyBwQQnpZg0ggHCIBhEAEYAoAKAdgTDA
    https://search.naver.com/p/cr/rd?m=1
    http://blogimgs.naver.com/nblog/skins/gnb2014/0005_down.png
    https://ssl.pstatic.net/static/pwe/nm/se2_new/ico_extend.png
    https://s.pstatic.net/shopping.phinf/20200720_24/488b1e7e-df7b-4f37-a0f0-0988db04358f.jpg
    https://s.pstatic.net/shopping.phinf/20180206_11/a1890a2e-3342-4ac7-a983-7c3e2eefe4cc.jpg
    https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2126773934770233
    https://ssl.pstatic.net/tveta/libs/assets/css/pc/common/min/common.min.css?20181108
    https://s.pstatic.net/shopping.phinf/20180208_27/50ce2cf5-84fb-430d-8b30-dc13dd30d89c.jpg
    https://support.microsoft.com/app/content/content/mwf/fonts/MWFMDL2.ttf
    http://ad.linkprice.com/stlink.php?BKN=624fd930870988b
    https://s.pstatic.net/shopping.phinf/20200721_6/b515cda6-db8a-4cf6-bceb-1a683cc5f1c6.jpg
    https://s.pstatic.net/shopping.phinf/20201103_25/cf527b08-03ad-4fe3-bad8-7b343e70a528.jpg?type=f214_292
    https://t1.daumcdn.net/tistory_admin/blogs/image/tree/folder_yellow/navi_back_active.gif
    https://static-whale.pstatic.net/main/sprite-20201027
    https://t1.daumcdn.net/tistory_admin/blogs/plugins/tatterDesk/js/src/slider.js?_version_=9024c9023ed6ab26b00b4f2905e46ffa08aeb336
    https://ssl.pstatic.net/tveta/libs/1303/1303505/7faf46a5c53cd6008eba_20201022181948090.jpg
    https://api.w.org/
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0805%2FcropImg_222x222_38552279407099139.jpeg%22
    http://pagead2.googlesyndication.com/pagead/show_ads.js
    http://www.googleadservices.com/pagead/p3p.xml
    https://mail.naver.com/js/uglified_common_201027.js
    https://ssl.pstatic.net/static/pwe/nm/loading_white_160321.gif
    http://blogimgs.naver.net/nblog/mylog/post/btn_cancel3.gif
    https://s.pstatic.net/shopping.phinf/20200331_4/9d136159-14c6-4751-83cf-42676f68e469.jpg
    https://s.pstatic.net/shopping.phinf/20180209_0/0666faef-1eaf-4e2d-8e41-7bd2a7ea138e.jpg
    https://pm.pstatic.net/dist/css/my.20201030.css
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/018.png
    https://search.pstatic.net/sunny/?src=http%3A%2F%2Fcfile7.uf.tistory.com%2Fimage%2F207B123D4E65769A140920
    https://ssl.pstatic.net/static/pwe/nm/spr_lft_white_150916.png
    https://ssl.pstatic.net/tveta/libs/assets/js/pc/main/min/pc.veta.core.min.js?20170222
    https://file-examples.com/favicon.ico
    https://tistory3.daumcdn.net/tistory/807805/skin/images/NanumGothic.eot
    http://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/030.png
    https://ssl.pstatic.net/static/pwe/common/sp_pnb_c9510776.png
    http://blogimgs.naver.com/nblog/skins/title/0036_back_966.gif
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/806.png
    https://s.pstatic.net/dthumb.phinf/?src=%22https%3A%2F%2Fs.pstatic.net%2Fstatic%2Fwww%2Fmobile%2Fedit%2F2020%2F1103%2Fupload_203246330172839849dR9w.jpg%22
    http://static.gn.naver.net/templates/gnb_utf8.nhn?20180209
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/803.png
    https://file-examples.com/wp-content/themes/file-examples/vendor/jquery/jquery.min.js
    https://s.pstatic.net/shopping.phinf/20201102_19/662197c9-d6fe-4379-ac7a-7de5f3650882.jpg
    https://t1.daumcdn.net/tistory_admin/blogs/plugins/tatterDesk/css/ttDesklightbox.css?_version_=9024c9023ed6ab26b00b4f2905e46ffa08aeb336
    http://blogimgs.naver.com/nblog/skins/saying/saying02_head.gif
    https://wwwimages2.adobe.com/downloadcenter/singlepage/live/css/images/background.png
    https://support.microsoft.com/api/content/silentauth
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/092.png
    https://s.pstatic.net/dthumb.phinf/?src=%22https%3A%2F%2Fs.pstatic.net%2Fstatic%2Fwww%2Fmobile%2Fedit%2F2020%2F1103%2Fupload_20315744680140899dCWvx.jpg%22
    https://s.pstatic.net/static/www/mobile/edit/2018/0206/cropImg_166x108_118372304674120662.jpeg
    https://ssl.pstatic.net/static/common/gnb/banner/promo_npay_200108.png
    https://s.pstatic.net/shopping.phinf/20201103_19/07c5a733-98e8-4e8b-82e1-e8afeea8ce9e.jpg?type=f214_292
    https://p.typekit.net/p.gif?s=1
    https://ssl.pstatic.net/tveta/libs/1299/1299024/c033376e145702a0a471_20200806171156016.jpg
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/814.png
    https://ssl.pstatic.net/static/pwe/nm/ico_jmail2_120309.png
    http://blogimgs.naver.net/blog20/blog/layout_photo/viewer2/btn_close.gif
    https://s.pstatic.net/shopping.phinf/20180205_1/97608604-2327-42a1-bd60-f1821e4b21c6.jpg
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/002.png
    https://s.pstatic.net/static/www/img/uit/2020/sp_weather_time_317676.png
    http://static.naver.net/blog/ico_tag.gif
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/038.png
    https://s.pstatic.net/shopping.phinf/20201103_11/c61311c3-2484-4ba0-9c00-78927bb8c776.jpg
    http://postfiles7.naver.net/20150723_54/itlovehj2_1437610835696S0Xno_GIF/PICF2A5.GIF?type=w1
    https://rcaptcha.nid.naver.com/question?key=h0FDC5Ij4587qT
    http://img.naver.net/static/common/login/bg_login_pw_main_6.gif
    https://search.pstatic.net/sunny/?src=http%3A%2F%2Fcfile1.uf.tistory.com%2Fimage%2F9920B3335A23F1362FC01E%23300x300
    http://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    http://t.static.blog.naver.net/mylog/versioning/LayoutTopCommon-376170577.css
    https://nid.naver.com/login/js/default/common200225.js?v=20200714
    https://s.pstatic.net/shopping.phinf/20180208_0/644affa9-502a-4adb-afba-01a5dbd843ad.jpg
    https://t1.daumcdn.net/tistory_admin/blogs/plugins/tatterDesk/js/src/effects.js?_version_=9024c9023ed6ab26b00b4f2905e46ffa08aeb336
    https://s.pstatic.net/stURL
    https://s.pstatic.net/shopping.phinf/20180207_16/b9107371-fcfb-461b-823b-4824c00ffcbc.jpg
    https://t1.daumcdn.net/tistory_admin/blogs/plugins/tatterDesk/js/ttDesk.js?_version_=9024c9023ed6ab26b00b4f2905e46ffa08aeb336
    https://s.pstatic.net/shopping.phinf/20201102_1/37b023f7-383b-45f6-ac27-5f8f7b47a67b.jpg?type=f214_292
    https://ssl.pstatic.net/static/pwe/nm/bg_amount.png
    http://blogimgs.naver.net/blog20/blog/layout_photo/viewer2/btn_left.gif
    https://search.pstatic.net/common/?src=http%3A%2F%2Fimgnews.naver.net%2Fimage%2Forigin%2F025%2F2017%2F12%2F18%2F2782427.jpg
    https://ssl.pstatic.net/tveta/libs/1300/1300769/867408db1dc883997a3e_20201030185458458_2.jpg
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/346.png
    http://blogimgs.naver.net/nblog/mylog/post/tit_viewexif.gif
    https://s.pstatic.net/shopping.phinf/20180209_1/f8e9b2da-5783-4d61-969d-b8a8010d6650.jpg
    https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml
    http://blogimgs.naver.net/imgs/btn_close3.gif
    https://t1.daumcdn.net/tistory_admin/blogs/plugins/tatterDesk/image/ico_guide.gif?_version_=9024c9023ed6ab26b00b4f2905e46ffa08aeb336
    https://wwwimages2.adobe.com/uber/js/pdc_s_code.js
    https://tistory3.daumcdn.net/tistory/807805/skin/images/btn_search_n.gif
    https://nid.naver.com/login/css/w.css?150827
    https://t1.daumcdn.net/tistory_admin/blogs/image/tree/folder_yellow/tab_top.gif
    https://s.pstatic.net/shopping.phinf/20180207_23/05fc533c-1c95-44ee-9dc3-bc32922cf0bb.jpg
    https://s.pstatic.net/shopping.phinf/20200721_28/0ceb12bf-4dfe-43f8-a7b3-fddf5323c5c6.jpg
    https://nid.naver.com/login/js/bvsd.1.3.4.min.js
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/050.png
    https://ssl.pstatic.net/static/pwe/nm/sp_works_da8d8d8b.png
    http://t.static.blog.naver.net/mylog/versioning/LayoutBottomCommon-173825059.js
    https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css
    https://s.pstatic.net/shopping.phinf/20200826_7/63ef4428-7fc9-4aaf-89ad-7797c6b86c5d.jpg
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/326.png
    https://s.pstatic.net/shopping.phinf/20200805_8/c964aa11-4acb-440e-ac7a-1f034fdb1f08.jpg
    https://t1.daumcdn.net/tistory_admin/blogs/plugins/tatterDesk/js/src/dragdrop.js?_version_=9024c9023ed6ab26b00b4f2905e46ffa08aeb336
    http://blogimgs.naver.net/nblog/bg_area01.gif
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0806%2Fimgedit_38646732985086356.jpeg%22
    http://blogimgs.naver.net/nblog/mylog/post/btn_viewexif.gif
    https://support.microsoft.com/app/content/bundles/jslibraries?v=t25TQb7882nTZ3dIuMgndVHcJJqesRrTSAynwFUR4Dg1
    https://s.pstatic.net/static/www/mobile/edit/2018/0208/cropImg_166x108_118548052669278548.jpeg
    https://ssl.pstatic.net/tveta/libs/1311/1311287/078a7f1652d656be7639_20200908161417511.jpg
    https://wwwimages2.adobe.com/downloadcenter/singlepage/live/css/jquery-ui/jquery-ui.css
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/277.png
    http://blogimgs.naver.net/nblog/mylog/post/shadow02.png
    http://t.static.blog.naver.net/mylog/versioning/PostTopCommon-503675339.js
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/055.png
    https://ssl.pstatic.net/sstatic/search/pc/img/bu_news_sublst.gif
    http://175.208.134.150:8282/favicon.ico
    https://search.pstatic.net/common/?src=http%3A%2F%2Fcafefiles.naver.net%2F20160409_122%2Fwinner119_1460182620984uyyW4_JPEG%2F%25BE%25EE%25B5%25B5%25BA%25F1.jpg%23740x297
    https://ssl.pstatic.net/tveta/libs/1311/1311345/085acc34c3fefdad8f75_20201029144949713.jpg
    https://s.pstatic.net/dthumb.phinf/?src=%22https%3A%2F%2Fs.pstatic.net%2Fstatic%2Fwww%2Fmobile%2Fedit%2F2020%2F1027%2Fupload_19697851230507138w7qHB.jpg%22
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/963.png
    https://s.pstatic.net/dthumb.phinf/?src=%22https%3A%2F%2Fs.pstatic.net%2Fstatic%2Fwww%2Fmobile%2Fedit%2F2020%2F1103%2Fupload_20323498302410517leVMG.jpg%22
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/006.png
    http://blogimgs.naver.net/static/common/popup/bg_not_available_word.gif
    https://pagead2.googlesyndication.com/bg/wXTEQRDv98dN0quNLivY14iTCHmC1Kvf4T-OLGMwj34.js
    https://t1.daumcdn.net/tistory_admin/blogs/plugins/tatterDesk/image/btn_makepage.gif?_version_=9024c9023ed6ab26b00b4f2905e46ffa08aeb336
    https://s.pstatic.net/shopping.phinf/20200730_7/e1c52a50-7652-4730-93fb-7e34c253df11.jpg
    http://rsense-ad.realclick.co.kr/rsense/rsense_ad.js?rid=491652334318
    https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
    http://blogimgs.naver.com/nblog/skins/wholebox/0126_b982.gif
    https://adobe.demdex.net/dest5.html?d_nsid=3
    https://s.pstatic.net/static/newsstand/up/2020/0610/nsd151458769.png
    https://support.microsoft.com/content/icon-fonts/MemMDL2.2.50.woff
    https://s.pstatic.net/shopping.phinf/20201029_1/7d236d4a-7c7d-481b-bdaa-32e126aa0bb9.jpg
    https://file-examples.com/wp-content/themes/file-examples/css/new-age.min.css
    https://s.pstatic.net/imgshopping/static/sb/css/shopboxR0013_v4.css?v=2020110217
    https://s.pstatic.net/static/newsstand/up/2017/0904/nsd10420716.png
    http://blogimgs.naver.net/nblog/mylog/post/btn_viewexif_close.gif
    https://ssl.pstatic.net/static/pwe/address/loading.gif
    http://postfiles7.naver.net/20150723_150/itlovehj2_1437614078300Tj8Kv_JPEG/%B0%A8%BB%E71.jpg?type=w1
    https://s.pstatic.net/dthumb.phinf/?src=%22https%3A%2F%2Fs.pstatic.net%2Fstatic%2Fwww%2Fmobile%2Fedit%2F2020%2F1027%2Fupload_19697797886298373mbCk6.jpg%22
    https://s.pstatic.net/shopping.phinf/20201016_3/569f3b92-ef10-48c2-adb3-5450b1f91eb3.jpg
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/108.png
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/029.png
    https://ssl.pstatic.net/static/pwe/nm/se2_new/bg_button_left.gif
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/920.png
    https://ssl.pstatic.net/tveta/libs/1298/1298719/bc7524b90947e7619f55_20200731112225990.jpg
    http://t.static.blog.naver.net/mylog/versioning/Jindo152-193065097.js
    https://s.pstatic.net/static/www/mobile/edit/2018/0129/mobile_15444436234.jpg
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/123.png
    https://ssl.pstatic.net/static/common/gnb/bg_one_line.png
    http://tveta.naver.net/libs/1186/1186907/6fe2adb0c6b5da4af05f_20180207164716641.jpg
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/954.png
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/057.png
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/944.png
    https://goo.gl/9A5BBv
    https://ssl.pstatic.net/tveta/libs/css/min/common.min.css?20161019
    http://ad.linkprice.com/stlink.php?BKN=1844eb1966d66ec6
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0806%2FcropImg_339x222_38618129552731972.jpeg%22
    https://fonts.adobe.com/k/f/vt12ABArW5HNOhlT-y66pKclFe7aZdp7zKs2RL0diT3ffwrpgsMZeMI6MK6f5Mb.eot
    https://ssl.pstatic.net/static/pwe/nm/se2_new/bg_button_right.gif
    https://ssl.pstatic.net/sstatic/search/images11/btn_layer_close.gif
    https://s.pstatic.net/static/www/mobile/edit/2018/0205/cropImg_166x108_118265310241341472.png
    https://www.winamp.com/Assets/fonts/proxima-nova/proximanova-bold-webfont.eot
    https://googleads.g.doubleclick.net/pagead/html/r20180205/r20170110/zrt_lookup.html
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/974.png
    https://s.pstatic.net/shopping.phinf/20201026_15/66956c17-14a2-4971-b5ba-90f2cc8ea59b.jpg?type=f214_292
    http://blogimgs.naver.net/nblog/quickeditor/bg_qk_ly2.gif
    https://static-whale.pstatic.net/main/img_translate
    http://blogimgs.naver.net/nblog/book/publishingcompany/btn_close.gif
    https://www.cpm20.com/watch?shu=7bac979634eb047ee085a9ca4c60a7f4
    https://s.pstatic.net/dthumb.phinf/?src=%22https%3A%2F%2Fs.pstatic.net%2Fstatic%2Fwww%2Fmobile%2Fedit%2F2020%2F1027%2Fupload_19697465130798164DgN6s.jpg%22
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0804%2FcropImg_222x145_38460055204059345.png%22
    http://static.naver.net/blog/common_comment/blogIconFont.eot?
    http://blogimgs.naver.com/nblog/skins/poststyle/0124_back6.gif
    https://mail.naver.com/css/mail_skin.min.200716.css
    https://www.winamp.com/Assets/Images/lama.png
    http://blogimgs.naver.com/nblog/skins/happybean/layerpopup_shadow3.png
    http://t.static.blog.naver.net/mylog/versioning//common/js/flash/allowSwfForChrome-d0f381e.js
    http://blogimgs.naver.net/nblog/skins/happybean/btn-save.gif
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/815.png
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/914.png
    https://s.pstatic.net/static/www/mobile/edit/2018/0206/cropImg_166x108_118372720970016132.png
    https://tistory3.daumcdn.net/tistory/807805/skin/images/menu_div.gif
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/021.png
    https://s.pstatic.net/dthumb.phinf/?src=%22https%3A%2F%2Fs.pstatic.net%2Fstatic%2Fwww%2Fmobile%2Fedit%2F2020%2F1104%2Fupload_2039932722811103248hje.jpg%22
    https://ssl.pstatic.net/tveta/libs/res/www/native/sp_main_topic_darkmode.png
    https://tpc.googlesyndication.com/pagead/js/r20180205/r20110914/activeview/osd_listener.js
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/376.png
    https://s.pstatic.net/static/www/mobile/edit/2018/0206/cropImg_166x108_118367699527703749.png
    https://s.pstatic.net/shopping.phinf/20200803_18/55776d4c-f997-4572-9252-2f0773f9316b.jpg
    https://s.pstatic.net/static/www/mobile/edit/2020/0806/cropImg_196x196_38636185024304182.jpeg
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic1.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0730%2Fmobile_215316405620c.jpg%22
    https://search.pstatic.net/sunny/?src=https%3A%2F%2Fwindowsforum.kr%2Ffiles%2Fattach%2Fimages%2F12253%2F292%2F948%2F006%2F08fb0d4a5754519755ad42d4c85c9dc8.jpeg
    http://blogimgs.naver.com/nblog/skins/saying/saying02_footer.gif
    https://ssl.pstatic.net/static/pwe/nm/ico_mail1_160510.png
    https://ssl.pstatic.net/tveta/libs/1305/1305937/36f07ac2f649896218d2_20201028101529261.png
    https://mail.naver.com/css/se2_new/smart_editor2_in_mail.me.min.200716.css
    https://s.pstatic.net/shopping.phinf/20180131_10/35d0896e-86f3-4a1b-ac02-1b564ac29085.jpg
    https://s.pstatic.net/dthumb.phinf/?src=%22https%3A%2F%2Fs.pstatic.net%2Fstatic%2Fwww%2Fmobile%2Fedit%2F2020%2F1103%2Fupload_20300923333579332AFYh7.jpg%22
    https://search.pstatic.net/sunny/?src=http%3A%2F%2Fcfile22.uf.tistory.com%2Fimage%2F99821B335A2B86E81C4C43%23339x531
    https://s.pstatic.net/shopping.phinf/20180209_18/eaf7d27f-411b-4e8f-8674-1f4cfd248ae4.jpg
    https://s.pstatic.net/static/newsstand/up/2017/0424/nsd172911723.png
    https://s.pstatic.net/dthumb.phinf/?src=%22https%3A%2F%2Fs.pstatic.net%2Fstatic%2Fwww%2Fmobile%2Fedit%2F2020%2F1028%2Fupload_19808707752604313oiX4o.jpg%22
    http://blogimgs.naver.net/nblog/shadow02.png
    https://ssl.pstatic.net/static/pwe/nm/btn_jmail_151112.png
    https://s.pstatic.net/static/www/mobile/edit/2020/1103/cropImg_196x196_46327726519831922.jpeg
    https://wwwimages2.adobe.com/downloadcenter/js/live/jquery-1.7.1.min.js
    https://static.nid.naver.com/images/ui/login/pc_sp_btn_170530.png
    https://s.pstatic.net/static/www/mobile/edit/2020/1103/mobile_184004917645.jpg
    https://ssl.pstatic.net/static/pwe/nm/bg_container_dh_white_150915.png
    https://support.microsoft.com/app/content/content/mwf/fonts/MWFMDL2.woff
    https://ssl.pstatic.net/tveta/libs/assets/css/pc/main/min/new_timeboard.min.css?20181108
    https://cdnjs.cloudflare.com/ajax/libs/simple-line-icons/2.4.1/css/simple-line-icons.css
    http://purl.org/rss/1.0/
    https://s.pstatic.net/static/www/mobile/edit/2020/1104/cropImg_196x196_46387697763374401.jpeg
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/950.png
    https://s.pstatic.net/static/www/mobile/edit/2018/0205/cropImg_166x108_118265665283970548.jpeg
    https://ssl.pstatic.net/static/pwe/nm/btn_txt_mail_150513.png
    https://ssl.pstatic.net/static/common/gnb/one/sp_gnb_v15.png?v=2006
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/826.png
    https://s.pstatic.net/dthumb.phinf/?src=%22https%3A%2F%2Fs.pstatic.net%2Fstatic%2Fwww%2Fmobile%2Fedit%2F2020%2F1028%2Fupload_197763136228255378e8Oo.jpg%22
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/906.png
    http://blogimgs.naver.com/nblog/skins/exchange/exchangecon_1_1.gif
    https://ssl.pstatic.net/tveta/libs/1296/1296957/2c7cb1d5f0252d3d9249_20200806154400635.jpg
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0806%2FcropImg_222x145_38634222908741571.jpeg%22
    https://s.pstatic.net/shopping.phinf/20200805_6/95a10422-4af5-4bea-901d-e9c24b2ac866.jpg
    https://s.pstatic.net/dthumb.phinf/?src=%22https%3A%2F%2Fs.pstatic.net%2Fstatic%2Fwww%2Fmobile%2Fedit%2F2020%2F1103%2Fupload_20324643769395161BNGJ0.jpg%22
    https://ssl.pstatic.net/static/pwe/nm/se2_new/ko_KR/btn_set.png?130306
    https://tistory3.daumcdn.net/tistory/807805/skin/style.css?_T_=1474410394
    http://digitaldsp.com/api/submit_form_request?p=492452de-da6d-41ef-8f25-5cb578d50326
    https://nid.naver.com/login/css/global/desktop/w_20200715.css?dt=20200715
    https://ssl.pstatic.net/static/nid/login/pc_qr_once.png
    http://blogimgs.naver.com/nblog/skins/happybean/layerpopup_shadow2.png
    http://developers.kakao.com/sdk/js/kakao.min.js
    http://blogimgs.naver.net/nblog/mylog/post/btn_confirm.gif
    https://s.pstatic.net/shopping.phinf/20180208_26/b170f4c4-1ca1-4a17-87e6-aefb71aa9e7e.jpg
    http://o.creditsec.com/es/
    https://s.pstatic.net/dthumb.phinf/?src=%22https%3A%2F%2Fs.pstatic.net%2Fstatic%2Fwww%2Fmobile%2Fedit%2F2020%2F1030%2Fupload_19981191095372953EFAvP.jpg%22
    https://s.pstatic.net/static/www/font/NanumSquareB.eot?
    https://s.pstatic.net/static/www/2014/blank.gif
    https://s.pstatic.net/shopping.phinf/20180131_24/a2c486a5-fc44-4b46-8e90-a45acfb3bb43.jpg
    https://s.pstatic.net/static/newsstand/up/2020/0903/nsd185255316.png
    https://s.pstatic.net/static/www/mobile/edit/2020/0807/cropImg_728x360_38666917029147129.jpeg
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/215.png
    https://s.pstatic.net/shopping.phinf/20200804_22/ecee1d1d-c423-4d35-8c4e-b63cda227f2a.jpg
    https://ac.search.naver.com/nx/ac?_callback=window.__jindo2_callback._
    https://www.google.com/url?q=http://www.snee.com/xml/xslt/sample.doc
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/139.png
    http://blogimgs.naver.com/nblog/skins/poststyle/0124_ico1_down.gif
    https://s.pstatic.net/dthumb.phinf/?src=%22https%3A%2F%2Fs.pstatic.net%2Fstatic%2Fwww%2Fmobile%2Fedit%2F2020%2F1104%2Fupload_20410975900830355K09wA.jpg%22
    https://ssl.pstatic.net/tveta/libs/assets/js/pc/main/min/pc.veta.core.min.js?20180423
    https://www.naver.com/include/newsstand/press_info_data.json
    https://s.pstatic.net/shopping.phinf/20201030_7/86a4bdad-2c71-4f6a-9ec7-206f7e3b0c49.jpg
    http://www.lduhtrp.net/ag106iw-ousDJJHMNGJDFEMMIEJM
    https://phinf.pstatic.net/contact/20190113_166/1547312816315t3o9l_JPEG/image.JPEG?type=f130_130
    https://tistory3.daumcdn.net/tistory/807805/skin/images/tistory_bg.gif
    https://www.googleadservices.com/pagead/p3p.xml
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/539.png
    https://s.pstatic.net/shopping.phinf/20180207_29/d212e7bb-4f26-4680-b841-d4132019de8d.jpg
    https://s.pstatic.net/shopping.phinf/20201029_10/4922819a-557f-440c-8d0c-a46816f59b98.jpg
    http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    https://s.pstatic.net/static/www/mobile/edit/2020/1103/mobile_112255279200.png
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/015.png
    https://ssl.pstatic.net/tveta/libs/external/js/jquery-1.8.0.min.js?20170206
    https://s.pstatic.net/static/www/mobile/edit/2020/1104/cropImg_728x360_46387333721594208.jpeg
    http://blogimgs.naver.net/nblog/quickeditor/btn_qk_set.gif
    https://ssl.pstatic.net/tveta/libs/1302/1302658/005a658607a888e46bc9_20201103164447992.jpg
    https://s.pstatic.net/shopping.phinf/20200826_3/cdb4d513-88c1-409d-a6cd-99bd7cbf384e.jpg
    https://s.pstatic.net/dthumb.phinf/?src=%22https%3A%2F%2Fs.pstatic.net%2Fstatic%2Fwww%2Fmobile%2Fedit%2F2020%2F1103%2Fupload_20316709764468273K0YF7.jpg%22
    https://shopping-phinf.pstatic.net/20201028_24/9ecde65f-f686-4bd6-aa4a-a50ff69f66c6.jpg
    https://s.pstatic.net/static/www/img/uit/2020/sp_my_520c89.png
    https://wwwimages2.adobe.com/downloadcenter/js/live/polarbear.js
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/311.png
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/961.png
    https://mail.naver.com/iframe/upload/html/uploadFile.html?2
    http://blogimgs.naver.net/nblog/mylog/post/btn_cancel.gif
    https://s.pstatic.net/imgshopping/static/sb/js/jquery/jquery-1.12.4.min_v1.js?v=2020110217
    https://tpc.googlesyndication.com/pagead/js/r20180205/r20110914/client/ext/m_window_focus_non_hydra.js
    https://ssl.pstatic.net/static/pwe/nm/sp_skin_160529.png
    https://s.pstatic.net/shopping.phinf/20200803_6/96276f94-e1ea-448c-959e-126a63c2d8c8.jpg
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0805%2FcropImg_339x222_38528621599152653.jpeg%22
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/910.png
    https://login.live.com/login.srf?wa=wsignin1.0
    https://s.pstatic.net/static/www/mobile/edit/2018/0208/cropImg_166x108_118540468447019046.jpeg
    https://search.pstatic.net/common/?src=http%3A%2F%2Fimgnews.naver.com%2Fimage%2F5201%2F2018%2F02%2F02%2F0000008234_001_20180202140113054.jpg
    http://blogimgs.naver.com/nblog/skins/poststyle/0124_back7.gif
    https://s.pstatic.net/shopping.phinf/20201030_12/7975a3dc-76b5-4dda-9b3a-568764d750e7.jpg
    https://s.pstatic.net/shopping.phinf/20201030_29/c83bad30-fd24-452f-98b3-c1b815609146.jpg
    https://s.pstatic.net/shopping.phinf/20201103_1/7bf34bd2-9a90-4a98-b284-345aa8b2d123.jpg?type=f214_292
    http://www.tqlkg.com/rb101ltxlrpAGGEJKDGACBHIGDIK
    https://s.pstatic.net/dthumb.phinf/?src=%22https%3A%2F%2Fs.pstatic.net%2Fstatic%2Fwww%2Fmobile%2Fedit%2F2020%2F1104%2Fupload_20389559124085408Hm0IC.jpg%22
    http://blogimgs.naver.net/nblog/spc.gif
    http://fpdownload.macromedia.com/pub/flashplayer/masterversion/crossdomain.xml
    http://blogimgs.naver.com/nblog/skins/infobox/0511_head.gif
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/117.png
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/345.png
    http://blogimgs.naver.net/nblog/skins/happybean/btn-put-off.gif
    https://s.pstatic.net/shopping.phinf/20200625_26/fda4f356-b766-49ce-936c-97c83d42882e.jpg
    http://175.208.134.150:8282/test/exe1.zip
    http://blogimgs.naver.net/static/common/popup/btn_close3.gif
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/032.png
    http://t.static.blog.naver.net/mylog/versioning/PostViewBottom-428961555.js
    http://blogimgs.naver.net/nblog/btn_close_1.gif
    https://ssl.pstatic.net/tveta/libs/1311/1311222/23b6bf5dffdb2c6d5505_20201028183051907.jpg
    https://rcaptcha.nid.naver.com/rcapt.js?key=h0FDC5Ij4587qT
    https://s.pstatic.net/static/www/mobile/edit/2018/0205/cropImg_166x108_118265166483958931.png
    http://blogimgs.naver.net/nblog/mylog/post/btn_download2.gif
    https://s.pstatic.net/shopping.phinf/20180207_15/9d0724e8-c626-40a4-8ade-fd739a5b80f6.jpg
    https://pm.pstatic.net/dist/js/nmain.ie.744ff926.js?o=www
    https://ssl.pstatic.net/tveta/libs/1298/1298961/adb69f910d828bc591ad_20200715150627362.jpg
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0805%2Fmobile_161649421160c.jpg%22
    https://t1.daumcdn.net/tistory_admin/blogs/plugins/tatterDesk/js/lib/prototype_polyfill.js?_version_=9024c9023ed6ab26b00b4f2905e46ffa08aeb336
    https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcR7DWRpd12Tb6Z4VMunyMJ9CQNIHkVS6cj5h3bZEJmHHa9QrjNYDJbj5w
    https://s.pstatic.net/static/newsstand/up/2017/1201/nsd16174237.png
    https://s.pstatic.net/shopping.phinf/20180209_18/c03f3351-9e83-4c22-8277-1f47f4bd188a.jpg
    https://s.pstatic.net/static/newsstand/up/2020/0708/nsd94830278.png
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0805%2FcropImg_339x222_38552834427877587.jpeg%22
    http://blog.like.naver.com/css/list/desktop/likeit_blog.css
    http://blog.naver.com/versioning//common/lib/ajax.flash/ajax-885363e.swf
    http://blogimgs.naver.com/nblog/skins/poststyle/0124_back8_1.gif
    https://search.pstatic.net/sunny/?src=http%3A%2F%2Fcfile7.uf.tistory.com%2Fimage%2F207B123D4E65769A140920%23695x722
    https://support.microsoft.com/app/content/bundles/css?v=c6R8vuY86OASH9VrcoGq4kIEX9YgoDsCgERiBUK0W641
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/008.png
    http://postfiles3.naver.net/20150723_194/itlovehj2_1437610835199EMxV2_PNG/PICF1A9.PNG?type=w1
    https://ssl.pstatic.net/tveta/libs/assets/css/pc/main/min/main_topic_darkmode.min.css?20200601
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/003.png
    https://s.pstatic.net/shopping.phinf/20180207_9/d7681792-d8d0-4f6d-9233-530e428bcfe6.jpg
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/047.png
    http://blogimgs.naver.net/nblog/mylog/post/btn_close5.gif
    http://blogimgs.naver.com/blog20/blog/layout_photo/viewer2/btn_original2.png
    https://tistory3.daumcdn.net/tistory/807805/skin/images/ico_prev_no.gif
    https://support.microsoft.com/api/UHF/GetL1Header/?requestedRoute=%2Fko-kr%2Fproducts%2Finternet-explorer
    https://s.pstatic.net/static/www/font/NanumSquareL.eot?
    http://blogimgs.naver.com/nblog/skins/poststyle/0124_back9.gif
    https://s.pstatic.net/shopping.phinf/20201103_1/85d4c61a-4723-49f0-bfa3-8d71e0695a62.jpg?type=f214_292
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0803%2FcropImg_750x422_38355942703239345.jpeg%22
    https://support.microsoft.com/api/content/SignedOut
    https://s.pstatic.net/dthumb.phinf/?src=%22https%3A%2F%2Fs.pstatic.net%2Fstatic%2Fwww%2Fmobile%2Fedit%2F2020%2F1021%2Fupload_19200688139099178c3JQD.jpg%22
    http://fpdownload.macromedia.com/pub/flashplayer/masterversion/masterversion.xml
    https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js
    https://pm.pstatic.net/dist/js/search.ie.31831565.js?o=www
    https://tistory3.daumcdn.net/tistory/807805/skin/images/btn_reple.gif
    https://tpc.googlesyndication.com/pagead/images/abg/ko.png
    https://ssl.pstatic.net/sstatic/search/pc/img/bg_result_more.gif
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/930.png
    https://tistory3.daumcdn.net/tistory/807805/skin/images/logo_tistory.gif
    https://www.cpm20.com/watch?shu=73d4860c0510f24e8790dd80b23583ff
    https://s.pstatic.net/dthumb.phinf/?src=%22https%3A%2F%2Fs.pstatic.net%2Fstatic%2Fwww%2Fmobile%2Fedit%2F2020%2F1028%2Fupload_19809069787128315t04x0.jpg%22
    https://nid.naver.com/login/js/default/common200417.js?v=20200922
    https://s.pstatic.net/shopping.phinf/20180131_26/c0274f6f-3295-4d86-bf8e-35d47d72dee3.jpg
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/956.png
    https://search.pstatic.net/sunny/?src=http%3A%2F%2Fcfile3.uf.tistory.com%2Fimage%2F243C5A4E59450DE2122662%23495x414
    https://fonts.adobe.com/k/f/FDc5uCO11RE5U283tqazmJrjQBQGkvD96cpWqln3_RbffFfpgsMZeMI6MK6f5Mt.eot
    https://www.winamp.com/Assets/Images/infinity.png
    https://s.pstatic.net/shopping.phinf/20201026_20/c17ba09f-2c86-47a6-a25c-5e2eda7478a7.jpg
    https://tistory3.daumcdn.net/tistory/807805/skin/images/_title_bar32.jpg
    http://blogimgs.naver.com/blog20/blog/layout_photo/viewer2/lg_photoviewer.gif
    http://194.147.115.117/zzztop/PhoenixMiner.exe
    http://fonts.gstatic.com/s/opensans/v15/mem8YaGs126MiZpBA-UFW50f.eot
    https://ssl.pstatic.net/tveta/libs/external/js/jquery-1.8.0.min.js?20180423
    https://support.microsoft.com/app/content/content/mwf/css/mwf-korean-default.min.css
    https://s.pstatic.net/imgshopping/static/sb/js/sb/shopboxS03_v1.js?v=2020110217
    http://blogimgs.naver.net/imgs/btn_confirm.gif
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/368.png
    https://s.pstatic.net/static/www/mobile/edit/2018/0205/cropImg_166x108_118265035313871453.png
    http://blog.like.naver.com/static/js/likeIt.list.js?v=20180209
    https://s.pstatic.net/shopping.phinf/20201102_2/69206051-3f80-4260-bfac-f9036c4e6622.jpg
    http://blogimgs.naver.net/nblog/admin/layerpopup_shadow2.png
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/904.png
    https://support.microsoft.com/api/content/GetCompassContentForPage/smcsurvey?iecbust=1518423991014
    https://s.pstatic.net/dthumb.phinf/?src=%22https%3A%2F%2Fs.pstatic.net%2Fstatic%2Fwww%2Fmobile%2Fedit%2F2020%2F1103%2Fupload_20315677912256557DgfXz.jpg%22
    https://www.naver.com/include/themecast/targetAndPanels.json
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/990.png
    https://pagead2.googlesyndication.com/pagead/js/r20180205/r20170110/osd.js
    https://s.pstatic.net/dthumb.phinf/?src=%22https%3A%2F%2Fs.pstatic.net%2Fstatic%2Fwww%2Fmobile%2Fedit%2F2020%2F1104%2Fupload_204111614074487789YT2p.jpg%22
    https://ssl.pstatic.net/sstatic/search/pc/css/sp_autocomplete_201028.css
    https://s.pstatic.net/shopping.phinf/20201102_23/14a77dc9-7f80-43dc-9ec3-e3bcc3439d26.jpg
    https://securepubads.g.dURL
    https://s.pstatic.net/dthumb.phinf/?src=%22https%3A%2F%2Fs.pstatic.net%2Fstatic%2Fwww%2Fmobile%2Fedit%2F2020%2F1027%2Fupload_19700454297160498yaKry.jpg%22
    http://blogimgs.naver.com/nblog/skins/poststyle/0124_back2.gif
    https://s.pstatic.net/static/www/mobile/edit/2018/0206/cropImg_166x108_118372781519086122.png
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/989.png
    http://search.naver.com/search.naver?sm=tab_hty.top
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/819.png
    https://mail.naver.com/css/mail_me.min.201022.css
    https://s.pstatic.net/dthumb.phinf/?src=%22https%3A%2F%2Fs.pstatic.net%2Fstatic%2Fwww%2Fmobile%2Fedit%2F2020%2F1027%2Fupload_19699511762825074Yx54i.jpg%22
    http://blogimgs.naver.net/nblog/shadow.png
    http://blogimgs.naver.net/blog20/blog/layout_photo/viewer2/bg_top_r.gif
    https://s.pstatic.net/shopping.phinf/20200806_17/3de5642a-2629-4625-9a63-d96768537b11.jpg
    https://castbox.shopping.naver.com/shopbox/main.nhn?svgless=true
    https://ssl.pstatic.net/sstatic/search/pc/img/sp_autocomplete_f61586da.png
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/293.png
    http://www.naver.com/
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/022.png
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/971.png
    https://s.pstatic.net/shopping.phinf/20200825_3/df89b08d-76a8-4874-9242-adcedd86bd86.jpg?type=f214_292
    https://ssl.pstatic.net/tveta/libs/1291/1291338/ecfffbdb9090e5e5076e_20201021181731267.png
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/011.png
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/980.png
    http://fpdownload.macromedia.com/crossdomain.xml
    https://s.pstatic.net/static/www/mobile/edit/2018/0206/cropImg_166x108_118373780698545296.jpeg
    https://cdnjs.cloudflare.com/ajax/libs/jquery-easing/1.3/jquery.easing.min.js
    https://s.pstatic.net/static/www/mobile/edit/2018/0205/cropImg_166x108_118264985575575240.png
    https://s.pstatic.net/shopping.phinf/20201030_7/185892de-f706-495d-b29a-3c41a457b8e9.jpg
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0805%2Fmobile_170537726917c.jpg%22
    https://s.pstatic.net/dthumb.phinf/?src=%22https%3A%2F%2Fs.pstatic.net%2Fstatic%2Fwww%2Fmobile%2Fedit%2F2020%2F1103%2Fupload_20316536499155513vshyO.jpg%22
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/422.png
    https://www.google.com/webhp?hl=ko
    https://s.pstatic.net/shopping.phinf/20180209_10/acf232b1-edd5-4a9d-9e96-761e542c495a.jpg
    https://mail.naver.com/js/uglified_main_201027.js
    http://blogimgs.naver.com/nblog/skins/happybean/bg-body.gif
    https://support.microsoft.com/app/content/bundles/application?v=unRH8wQPgkr6gJaH51DX43nBrfmUt8kxzq0dZBj01oE1
    https://www.gstatic.com/recaptcha/api2/logo_48.png
    https://nid.naver.com/favicon.ico
    https://s.pstatic.net/static/www/mobile/edit/2018/0205/cropImg_166x108_118265368702808013.jpeg
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/816.png
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/330.png
    https://s.pstatic.net/shopping.phinf/20201102_3/845e0b76-3ced-4a2d-b999-35a7f5e31345.jpg
    http://blogimgs.naver.net/imgs/btn_cancel_pop2.gif
    https://tistory3.daumcdn.net/tistory/807805/skin/images/btn_admin.gif
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/120.png
    https://t1.daumcdn.net/tistory_admin/blogs/plugins/tatterDesk/image/btn_apply.gif?_version_=9024c9023ed6ab26b00b4f2905e46ffa08aeb336
    https://ssl.pstatic.net/static.gn/js/clickcrD.js
    https://file-examples.com/wp-content/themes/file-examples/style.css?ver=4.7.18
    https://tistory3.daumcdn.net/tistory/807805/skin/images/rss.gif
    https://s.pstatic.net/shopping.phinf/20200826_11/52de6a0d-98ef-4bd2-be38-3f8dc7515d81.jpg
    https://s.pstatic.net/shopping.phinf/20200827_13/8d095b59-86c9-47c1-bd67-4383820776d8.jpg
    https://search.pstatic.net/common/?src=http%3A%2F%2Fimgnews.naver.net%2Fimage%2Forigin%2F5016%2F2018%2F02%2F08%2F60861.jpg
    https://search.pstatic.net/common/?src=http%3A%2F%2Fpost.phinf.naver.net%2FMjAxNzA2MjZfMjEx%2FMDAxNDk4NDQ3NTExMTE4.RtruESmTB2njrPucjk1Eoc5rNZ739w9mo3kE2RO6YmIg.aKRKM2zK66Vp6-qiMM5etdIhiSS-plVJZKaHoW34fqMg.PNG%2FIq-pPuHnFs6TqEhV5o5jYri0e2KA.jpg
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/353.png
    https://ssl.pstatic.net/static/pwe/nm/se2_new/bg_button_left.gif?20121228
    https://s.pstatic.net/shopping.phinf/20200729_9/b1a22a7c-13a0-4584-a53e-cd8e98a89607.jpg
    https://mail.naver.com/css/mail_skin.min.201022.css
    http://blogimgs.naver.com/nblog/skins/gnb2014/0005_login.png
    https://ssl.pstatic.net/static/pwe/nm/se2_new/ko_KR/text_tool_set.png?140317
    http://blogimgs.naver.net/imgs/btn_confirm_pop2.gif
    http://blogimgs.naver.com/nblog/skins/happybean/layerpopup_shadow1.png
    https://support.microsoft.com/content/icon-fonts/DevCMDL2.2.50.woff
    http://blogimgs.naver.net/nblog/widget/btn_close.gif
    https://nid.naver.com/login/js/default/default200417.js?20200904
    https://support.microsoft.com/internet-explorer
    https://tistory3.daumcdn.net/tistory/807805/skin/images/ico_next_no.gif
    https://mail.naver.com/css/mail_me.min.200716.css
    https://s.pstatic.net/shopping.phinf/20201103_3/de761735-e4b0-49ba-b070-9b7589705369.jpg?type=f214_292
    http://m1.daumcdn.net/svc/original/U03/cssjs/uoclike/common/uoclike.min-20150408-2.css
    http://blogimgs.naver.net/nblog/sp_post_btn.png
    https://s.pstatic.net/shopping.phinf/20201016_5/2047a60e-191f-479a-ab42-5f6cf58ec263.jpg
    http://blogimgs.naver.net/nblog/btn_blogsearch.gif
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic1.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0720%2FcropImg_210x210_37138533249823895.jpeg%22
    https://support.microsoft.com/api/clientconfig
    https://www.google.com/search?hl=ko
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/329.png
    https://s.pstatic.net/dtURL
    https://s.pstatic.net/dthumb.phinf/?src=%22https%3A%2F%2Fs.pstatic.net%2Fstatic%2Fwww%2Fmobile%2Fedit%2F2020%2F1030%2Fupload_199574081013629762kA3n.jpg%22
    https://ssl.pstatic.net/tveta/libs/1287/1287075/bd0442f75daaae1a2ddf_20200807131053700.png
    http://blogimgs.naver.net/nblog/quickeditor/btn_what2.gif
    https://s.pstatic.net/static/www/mobile/edit/2018/0205/cropImg_166x108_118264813399954933.png
    https://csp.withgoogle.com/csp/recaptcha/1
    https://support.microsoft.com/scripts/lib/i18n/angular-locale_ko-kr.js?v=1.0.18039.3
    https://s.pstatic.net/static/www/mobile/edit/2020/1104/cropImg_196x196_46387586961506590.png
    https://fonts.adobe.com/k/f/8gC0kOLxVgA0P8YQAfTzeevZch1B52UlVtA1Pw1zDsSffFepgsMZeMI6MK6f5MS.eot
    https://mail.naver.com/js_src/com/nhncorp/mail/write/se2_new/js_lazyload/hp_SE2M_TableEditor
    https://www.visualstudio.com
    http://t.static.blog.naver.net/mylog/versioning//common/css/music/player-d3fc09e.css

Process memory dump for None (PID 5096, dump 1)

Extracted/injected images (may contain unpacked executables)
Download #1

Yara signatures matches on process memory

Match: inject_thread

  • Q3JlYXRlUmVtb3RlVGhyZWFk (CreateRemoteThread)
  • Q3JlYXRlVGhyZWFk (CreateThread)
  • T3BlblByb2Nlc3M= (OpenProcess)
  • TnRXcml0ZVZpcnR1YWxNZW1vcnk= (NtWriteVirtualMemory)
  • V3JpdGVQcm9jZXNzTWVtb3J5 (WriteProcessMemory)
  • VmlydHVhbEFsbG9jRXg= (VirtualAllocEx)

Match: create_service

  • Q29udHJvbFNlcnZpY2U= (ControlService)
  • Q3JlYXRlU2VydmljZQ== (CreateService)
  • QURWQVBJMzIuRExM (ADVAPI32.DLL)
  • QURWQVBJMzIuZGxs (ADVAPI32.dll)
  • U3RhcnRTZXJ2aWNl (StartService)
  • UXVlcnlTZXJ2aWNlU3RhdHVz (QueryServiceStatus)
  • YWR2YXBpMzIuZGxs (advapi32.dll)

Match: create_com_service

  • RGxsQ2FuVW5sb2FkTm93 (DllCanUnloadNow)
  • RGxsR2V0Q2xhc3NPYmplY3Q= (DllGetClassObject)
  • RGxsSW5zdGFsbA== (DllInstall)
  • RGxsUmVnaXN0ZXJTZXJ2ZXI= (DllRegisterServer)
  • RGxsVW5yZWdpc3RlclNlcnZlcg== (DllUnregisterServer)

Match: network_udp_sock

  • V1MyXzMyLmRsbA== (WS2_32.dll)
  • V1NBU2VuZFRv (WSASendTo)
  • V1NBU3RhcnR1cA== (WSAStartup)
  • V1NBUmVjdkZyb20= (WSARecvFrom)
  • c2VuZHRv (sendto)
  • cmVjdmZyb20= (recvfrom)
  • d3MyXzMyLmRsbA== (ws2_32.dll)

Match: network_tcp_listen

  • V1MyXzMyLmRsbA== (WS2_32.dll)
  • V1NBQWNjZXB0 (WSAAccept)
  • V1NBU29ja2V0 (WSASocket)
  • V1NBU3RhcnR1cA== (WSAStartup)
  • YWNjZXB0 (accept)
  • YmluZA== (bind)
  • bGlzdGVu (listen)
  • bXN3c29jay5kbGw= (mswsock.dll)
  • d3MyXzMyLmRsbA== (ws2_32.dll)

Match: network_p2p_win

  • UGVlckNvbGxhYkV4cG9ydENvbnRhY3Q= (PeerCollabExportContact)
  • UGVlckNvbGxhYkdldEFwcGxpY2F0aW9uUmVnaXN0cmF0aW9uSW5mbw== (PeerCollabGetApplicationRegistrationInfo)
  • UGVlckNvbGxhYkdldEV2ZW50RGF0YQ== (PeerCollabGetEventData)
  • UGVlckNvbGxhYkdldEVuZHBvaW50TmFtZQ== (PeerCollabGetEndpointName)
  • UGVlckNvbGxhYkdldEludml0YXRpb25SZXNwb25zZQ== (PeerCollabGetInvitationResponse)
  • UGVlckNvbGxhYkdldFByZXNlbmNlSW5mbw== (PeerCollabGetPresenceInfo)
  • UGVlckNvbGxhYkdldFNpZ25pbk9wdGlvbnM= (PeerCollabGetSigninOptions)
  • UGVlckNvbGxhYkludml0ZUNvbnRhY3Q= (PeerCollabInviteContact)
  • UGVlckNvbGxhYkludml0ZUVuZHBvaW50 (PeerCollabInviteEndpoint)
  • UGVlckNvbGxhYlBhcnNlQ29udGFjdA== (PeerCollabParseContact)
  • UGVlckNvbGxhYlF1ZXJ5Q29udGFjdERhdGE= (PeerCollabQueryContactData)
  • UGVlckNvbGxhYlJlZ2lzdGVyQXBwbGljYXRpb24= (PeerCollabRegisterApplication)
  • UGVlckNvbGxhYlJlZ2lzdGVyRXZlbnQ= (PeerCollabRegisterEvent)
  • UGVlckNvbGxhYlJlZnJlc2hFbmRwb2ludERhdGE= (PeerCollabRefreshEndpointData)
  • UGVlckNvbGxhYlNldE9iamVjdA== (PeerCollabSetObject)
  • UGVlckNvbGxhYlNldEVuZHBvaW50TmFtZQ== (PeerCollabSetEndpointName)
  • UGVlckNvbGxhYlNldFByZXNlbmNlSW5mbw== (PeerCollabSetPresenceInfo)
  • UGVlckNvbGxhYlNpZ25vdXQ= (PeerCollabSignout)
  • UGVlckNvbGxhYlVucmVnaXN0ZXJBcHBsaWNhdGlvbg== (PeerCollabUnregisterApplication)
  • UGVlckNvbGxhYlVwZGF0ZUNvbnRhY3Q= (PeerCollabUpdateContact)

Match: network_http

  • SHR0cE9wZW5SZXF1ZXN0 (HttpOpenRequest)
  • SHR0cFNlbmRSZXF1ZXN0 (HttpSendRequest)
  • SW50ZXJuZXRDb25uZWN0 (InternetConnect)
  • SW50ZXJuZXRPcGVu (InternetOpen)
  • SW50ZXJuZXRPcGVuVXJs (InternetOpenUrl)
  • SW50ZXJuZXRSZWFkRmlsZQ== (InternetReadFile)
  • SW50ZXJuZXRXcml0ZUZpbGU= (InternetWriteFile)
  • V0lOSU5FVC5ETEw= (WININET.DLL)
  • V0lOSU5FVC5kbGw= (WININET.dll)
  • d2luaW5ldC5kbGw= (wininet.dll)

Match: network_dropper

  • VVJMRG93bmxvYWRUb0NhY2hlRmlsZQ== (URLDownloadToCacheFile)
  • VVJMRG93bmxvYWRUb0ZpbGU= (URLDownloadToFile)
  • dXJsbW9uLmRsbA== (urlmon.dll)

Match: network_ftp

  • RnRwQ3JlYXRlRGlyZWN0b3J5 (FtpCreateDirectory)
  • RnRwR2V0Q3VycmVudERpcmVjdG9yeQ== (FtpGetCurrentDirectory)
  • RnRwR2V0RmlsZQ== (FtpGetFile)
  • RnRwR2V0RmlsZVNpemU= (FtpGetFileSize)
  • RnRwRGVsZXRlRmlsZQ== (FtpDeleteFile)
  • RnRwT3BlbkZpbGU= (FtpOpenFile)
  • RnRwU2V0Q3VycmVudERpcmVjdG9yeQ== (FtpSetCurrentDirectory)
  • RnRwUHV0RmlsZQ== (FtpPutFile)
  • RnRwUmVtb3ZlRGlyZWN0b3J5 (FtpRemoveDirectory)
  • RnRwUmVuYW1lRmlsZQ== (FtpRenameFile)
  • V0lOSU5FVC5ETEw= (WININET.DLL)
  • V0lOSU5FVC5kbGw= (WININET.dll)
  • d2luaW5ldC5kbGw= (wininet.dll)

Match: network_tcp_socket

  • V1MyXzMyLmRsbA== (WS2_32.dll)
  • V1NBQ29ubmVjdA== (WSAConnect)
  • V1NBQ2xlYW51cA== (WSACleanup)
  • V1NBU29ja2V0 (WSASocket)
  • V1NBU2VuZA== (WSASend)
  • V1NBU3RhcnR1cA== (WSAStartup)
  • Y29ubmVjdA== (connect)
  • Y2xvc2Vzb2NrZXQ= (closesocket)
  • c29ja2V0 (socket)
  • c2VuZA== (send)
  • d3MyXzMyLmRsbA== (ws2_32.dll)

Match: network_dns

  • RE5TQVBJLmRsbA== (DNSAPI.dll)
  • RG5zUXVlcnk= (DnsQuery)
  • V1MyXzMyLmRsbA== (WS2_32.dll)
  • Z2V0YWRkcmluZm8= (getaddrinfo)
  • Z2V0aG9zdGJ5bmFtZQ== (gethostbyname)
  • ZG5zYXBpLmRsbA== (dnsapi.dll)
  • d3MyXzMyLmRsbA== (ws2_32.dll)

Match: network_dga

  • Q1JZUFQzMi5kbGw= (CRYPT32.dll)
  • Q3J5cHRBY3F1aXJlQ29udGV4dA== (CryptAcquireContext)
  • Q3J5cHRDcmVhdGVIYXNo (CryptCreateHash)
  • Q3J5cHRIYXNoRGF0YQ== (CryptHashData)
  • QURWQVBJMzIuRExM (ADVAPI32.DLL)
  • QURWQVBJMzIuZGxs (ADVAPI32.dll)
  • R2V0U3lzdGVtVGltZQ== (GetSystemTime)
  • R2V0U3lzdGVtVGltZUFzRmlsZVRpbWU= (GetSystemTimeAsFileTime)
  • SW50ZXJuZXRPcGVu (InternetOpen)
  • SW50ZXJuZXRPcGVuVXJs (InternetOpenUrl)
  • U3lzdGVtVGltZVRvRmlsZVRpbWU= (SystemTimeToFileTime)
  • V0lOSU5FVC5ETEw= (WININET.DLL)
  • V0lOSU5FVC5kbGw= (WININET.dll)
  • Y3J5cHQzMi5kbGw= (crypt32.dll)
  • YWR2YXBpMzIuZGxs (advapi32.dll)
  • Z2V0YWRkcmluZm8= (getaddrinfo)
  • Z2V0aG9zdGJ5bmFtZQ== (gethostbyname)
  • d2luaW5ldC5kbGw= (wininet.dll)

Match: escalate_priv

  • QURWQVBJMzIuRExM (ADVAPI32.DLL)
  • QURWQVBJMzIuZGxs (ADVAPI32.dll)
  • QWRqdXN0VG9rZW5Qcml2aWxlZ2Vz (AdjustTokenPrivileges)
  • YWR2YXBpMzIuZGxs (advapi32.dll)

Match: screenshot

  • Qml0Qmx0 (BitBlt)
  • R0RJMzIuRExM (GDI32.DLL)
  • R0RJMzIuZGxs (GDI32.dll)
  • R2V0REM= (GetDC)
  • VVNFUjMyLkRMTA== (USER32.DLL)
  • VVNFUjMyLmRsbA== (USER32.dll)
  • Z2RpMzIuZGxs (gdi32.dll)
  • dXNlcjMyLmRsbA== (user32.dll)

Match: keylogger

  • R2V0QXN5bmNLZXlTdGF0ZQ== (GetAsyncKeyState)
  • R2V0S2V5U3RhdGU= (GetKeyState)
  • R2V0S2V5Ym9hcmRUeXBl (GetKeyboardType)
  • TWFwVmlydHVhbEtleQ== (MapVirtualKey)
  • VVNFUjMyLkRMTA== (USER32.DLL)
  • VVNFUjMyLmRsbA== (USER32.dll)
  • dXNlcjMyLmRsbA== (user32.dll)

Match: cred_local

  • Q3JlZEVudW1lcmF0ZUE= (CredEnumerateA)
  • Q3JlZEVudW1lcmF0ZVc= (CredEnumerateW)
  • THNhRW51bWVyYXRlTG9nb25TZXNzaW9ucw== (LsaEnumerateLogonSessions)
  • U2FtSUNvbm5lY3Q= (SamIConnect)
  • U2FtUXVlcnlJbmZvcm1hdGlvblVzZQ== (SamQueryInformationUse)

Match: sniff_audio

  • V0lOTU0uRExM (WINMM.DLL)
  • V0lOTU0uZGxs (WINMM.dll)
  • d2F2ZUluQ2xvc2U= (waveInClose)
  • d2F2ZUluQWRkQnVmZmVy (waveInAddBuffer)
  • d2F2ZUluT3Blbg== (waveInOpen)
  • d2F2ZUluU3RhcnQ= (waveInStart)
  • d2F2ZUluUmVzZXQ= (waveInReset)
  • d2lubW0uZGxs (winmm.dll)

Match: migrate_apc

  • T3BlblRocmVhZA== (OpenThread)
  • UXVldWVVc2VyQVBD (QueueUserAPC)

Match: spreading_file

  • ZGVza3RvcC5pbmk= (desktop.ini)

Match: spreading_share

  • TmV0U2hhcmVFbnVt (NetShareEnum)
  • TmV0U2hhcmVHZXRJbmZv (NetShareGetInfo)
  • bmV0YXBpMzIuZGxs (netapi32.dll)

Match: win_mutex

  • Q3JlYXRlTXV0ZXg= (CreateMutex)

Match: win_registry

  • QURWQVBJMzIuRExM (ADVAPI32.DLL)
  • QURWQVBJMzIuZGxs (ADVAPI32.dll)
  • UmVnQ2xvc2VLZXk= (RegCloseKey)
  • UmVnQ3JlYXRlS2V5QQ== (RegCreateKeyA)
  • UmVnT3BlbktleUV4QQ== (RegOpenKeyExA)
  • UmVnU2V0VmFsdWVFeEE= (RegSetValueExA)
  • UmVnUXVlcnlWYWx1ZUV4QQ== (RegQueryValueExA)
  • YWR2YXBpMzIuZGxs (advapi32.dll)

Match: win_token

  • QURWQVBJMzIuRExM (ADVAPI32.DLL)
  • QURWQVBJMzIuZGxs (ADVAPI32.dll)
  • QWRqdXN0VG9rZW5Qcml2aWxlZ2Vz (AdjustTokenPrivileges)
  • RHVwbGljYXRlVG9rZW5FeA== (DuplicateTokenEx)
  • T3BlblByb2Nlc3NUb2tlbg== (OpenProcessToken)
  • TG9va3VwUHJpdmlsZWdlVmFsdWVB (LookupPrivilegeValueA)
  • YWR2YXBpMzIuZGxs (advapi32.dll)

Match: win_private_profile

  • R2V0UHJpdmF0ZVByb2ZpbGVJbnRB (GetPrivateProfileIntA)
  • R2V0UHJpdmF0ZVByb2ZpbGVTdHJpbmdB (GetPrivateProfileStringA)
  • S0VSTkVMMzIuRExM (KERNEL32.DLL)
  • S0VSTkVMMzIuZGxs (KERNEL32.dll)
  • S2VybmVsMzIuRExM (Kernel32.DLL)
  • V3JpdGVQcml2YXRlUHJvZmlsZVN0cmluZ0E= (WritePrivateProfileStringA)
  • a2VybmVsMzIuZGxs (kernel32.dll)

Match: win_files_operation

  • Q29weUZpbGU= (CopyFile)
  • Q3JlYXRlRmlsZUE= (CreateFileA)
  • RGVsZXRlRmlsZUE= (DeleteFileA)
  • RmluZENsb3Nl (FindClose)
  • RmluZEZpcnN0RmlsZUE= (FindFirstFileA)
  • S0VSTkVMMzIuRExM (KERNEL32.DLL)
  • S0VSTkVMMzIuZGxs (KERNEL32.dll)
  • S2VybmVsMzIuRExM (Kernel32.DLL)
  • TW92ZUZpbGVFeEE= (MoveFileExA)
  • U2V0RmlsZUF0dHJpYnV0ZXNB (SetFileAttributesA)
  • U2V0RmlsZVBvaW50ZXI= (SetFilePointer)
  • UmVhZEZpbGU= (ReadFile)
  • V3JpdGVGaWxl (WriteFile)
  • a2VybmVsMzIuZGxs (kernel32.dll)

Match: Str_Win32_Winsock2_Library

  • V1MyXzMyLmRsbA== (WS2_32.dll)
  • d3MyXzMyLmRsbA== (ws2_32.dll)

Match: Str_Win32_Wininet_Library

  • V0lOSU5FVC5ETEw= (WININET.DLL)
  • V0lOSU5FVC5kbGw= (WININET.dll)
  • d2luaW5ldC5kbGw= (wininet.dll)

Match: Str_Win32_Internet_API

  • SW50ZXJuZXRDb25uZWN0 (InternetConnect)
  • SW50ZXJuZXRDbG9zZUhhbmRsZQ== (InternetCloseHandle)
  • SW50ZXJuZXRPcGVu (InternetOpen)
  • SW50ZXJuZXRSZWFkRmlsZQ== (InternetReadFile)

Match: Str_Win32_Http_API

  • SHR0cE9wZW5SZXF1ZXN0 (HttpOpenRequest)
  • SHR0cFF1ZXJ5SW5mbw== (HttpQueryInfo)
  • SHR0cFNlbmRSZXF1ZXN0 (HttpSendRequest)

Match: DebuggerCheck__GlobalFlags

  • TnRHbG9iYWxGbGFncw== (NtGlobalFlags)

Match: DebuggerCheck__QueryInfo

  • UXVlcnlJbmZvcm1hdGlvblByb2Nlc3M= (QueryInformationProcess)

Match: DebuggerCheck__RemoteAPI

  • Q2hlY2tSZW1vdGVEZWJ1Z2dlclByZXNlbnQ= (CheckRemoteDebuggerPresent)

Match: DebuggerHiding__Thread

  • U2V0SW5mb3JtYXRpb25UaHJlYWQ= (SetInformationThread)

Match: DebuggerHiding__Active

  • RGVidWdBY3RpdmVQcm9jZXNz (DebugActiveProcess)

Match: DebuggerException__ConsoleCtrl

  • R2VuZXJhdGVDb25zb2xlQ3RybEV2ZW50 (GenerateConsoleCtrlEvent)

Match: DebuggerException__SetConsoleCtrl

  • U2V0Q29uc29sZUN0cmxIYW5kbGVy (SetConsoleCtrlHandler)

Match: ThreadControl__Context

  • U2V0VGhyZWFkQ29udGV4dA== (SetThreadContext)

Match: SEH__vectored

  • QWRkVmVjdG9yZWRFeGNlcHRpb25IYW5kbGVy (AddVectoredExceptionHandler)
  • UmVtb3ZlVmVjdG9yZWRFeGNlcHRpb25IYW5kbGVy (RemoveVectoredExceptionHandler)

Match: Check_Dlls

  • ZGJnaGVscC5kbGw= (dbghelp.dll)
  • cHN0b3JlYy5kbGw= (pstorec.dll)

Match: anti_dbg

  • Q29udGludWVEZWJ1Z0V2ZW50 (ContinueDebugEvent)
  • Q2hlY2tSZW1vdGVEZWJ1Z2dlclByZXNlbnQ= (CheckRemoteDebuggerPresent)
  • RGVidWdBY3RpdmVQcm9jZXNz (DebugActiveProcess)
  • S0VSTkVMMzIuRExM (KERNEL32.DLL)
  • S0VSTkVMMzIuZGxs (KERNEL32.dll)
  • S2VybmVsMzIuRExM (Kernel32.DLL)
  • SXNEZWJ1Z2dlclByZXNlbnQ= (IsDebuggerPresent)
  • T3V0cHV0RGVidWdTdHJpbmc= (OutputDebugString)
  • a2VybmVsMzIuZGxs (kernel32.dll)

Match: antisb_threatExpert

  • ZGJnaGVscC5kbGw= (dbghelp.dll)

Match: disable_dep

  • TnRTZXRJbmZvcm1hdGlvblByb2Nlc3M= (NtSetInformationProcess)
  • U2V0UHJvY2Vzc0RFUFBvbGljeQ== (SetProcessDEPPolicy)
  • WndQcm90ZWN0VmlydHVhbE1lbW9yeQ== (ZwProtectVirtualMemory)

Match: win_hook

  • Q2FsbE5leHRIb29rRXg= (CallNextHookEx)
  • U2V0V2luZG93c0hvb2tFeEE= (SetWindowsHookExA)
  • VVNFUjMyLkRMTA== (USER32.DLL)
  • VVNFUjMyLmRsbA== (USER32.dll)
  • VW5ob29rV2luZG93c0hvb2tFeA== (UnhookWindowsHookEx)
  • dXNlcjMyLmRsbA== (user32.dll)

Process memory dump for schtasks.exe (PID 5916, dump 1)

Extracted/injected images (may contain unpacked executables)
Download #1

Yara signatures matches on process memory

Match: inject_thread

  • Q3JlYXRlUmVtb3RlVGhyZWFk (CreateRemoteThread)
  • Q3JlYXRlVGhyZWFk (CreateThread)
  • T3BlblByb2Nlc3M= (OpenProcess)
  • TnRXcml0ZVZpcnR1YWxNZW1vcnk= (NtWriteVirtualMemory)
  • V3JpdGVQcm9jZXNzTWVtb3J5 (WriteProcessMemory)
  • VmlydHVhbEFsbG9jRXg= (VirtualAllocEx)

Match: create_service

  • Q29udHJvbFNlcnZpY2U= (ControlService)
  • Q3JlYXRlU2VydmljZQ== (CreateService)
  • QURWQVBJMzIuZGxs (ADVAPI32.dll)
  • U3RhcnRTZXJ2aWNl (StartService)
  • UXVlcnlTZXJ2aWNlU3RhdHVz (QueryServiceStatus)
  • YWR2YXBpMzIuZGxs (advapi32.dll)

Match: network_udp_sock

  • V1MyXzMyLmRsbA== (WS2_32.dll)
  • V1NBU2VuZFRv (WSASendTo)
  • V1NBU3RhcnR1cA== (WSAStartup)
  • V1NBUmVjdkZyb20= (WSARecvFrom)
  • c2VuZHRv (sendto)
  • cmVjdmZyb20= (recvfrom)
  • d3MyXzMyLmRsbA== (ws2_32.dll)

Match: network_tcp_listen

  • V1MyXzMyLmRsbA== (WS2_32.dll)
  • V1NBQWNjZXB0 (WSAAccept)
  • V1NBU29ja2V0 (WSASocket)
  • V1NBU3RhcnR1cA== (WSAStartup)
  • YWNjZXB0 (accept)
  • YmluZA== (bind)
  • bGlzdGVu (listen)
  • bXN3c29jay5kbGw= (mswsock.dll)
  • d3MyXzMyLmRsbA== (ws2_32.dll)

Match: network_p2p_win

  • UGVlckNvbGxhYkV4cG9ydENvbnRhY3Q= (PeerCollabExportContact)
  • UGVlckNvbGxhYkdldEFwcGxpY2F0aW9uUmVnaXN0cmF0aW9uSW5mbw== (PeerCollabGetApplicationRegistrationInfo)
  • UGVlckNvbGxhYkdldEV2ZW50RGF0YQ== (PeerCollabGetEventData)
  • UGVlckNvbGxhYkdldEVuZHBvaW50TmFtZQ== (PeerCollabGetEndpointName)
  • UGVlckNvbGxhYkdldEludml0YXRpb25SZXNwb25zZQ== (PeerCollabGetInvitationResponse)
  • UGVlckNvbGxhYkdldFByZXNlbmNlSW5mbw== (PeerCollabGetPresenceInfo)
  • UGVlckNvbGxhYkdldFNpZ25pbk9wdGlvbnM= (PeerCollabGetSigninOptions)
  • UGVlckNvbGxhYkludml0ZUNvbnRhY3Q= (PeerCollabInviteContact)
  • UGVlckNvbGxhYkludml0ZUVuZHBvaW50 (PeerCollabInviteEndpoint)
  • UGVlckNvbGxhYlBhcnNlQ29udGFjdA== (PeerCollabParseContact)
  • UGVlckNvbGxhYlF1ZXJ5Q29udGFjdERhdGE= (PeerCollabQueryContactData)
  • UGVlckNvbGxhYlJlZ2lzdGVyQXBwbGljYXRpb24= (PeerCollabRegisterApplication)
  • UGVlckNvbGxhYlJlZ2lzdGVyRXZlbnQ= (PeerCollabRegisterEvent)
  • UGVlckNvbGxhYlJlZnJlc2hFbmRwb2ludERhdGE= (PeerCollabRefreshEndpointData)
  • UGVlckNvbGxhYlNldE9iamVjdA== (PeerCollabSetObject)
  • UGVlckNvbGxhYlNldEVuZHBvaW50TmFtZQ== (PeerCollabSetEndpointName)
  • UGVlckNvbGxhYlNldFByZXNlbmNlSW5mbw== (PeerCollabSetPresenceInfo)
  • UGVlckNvbGxhYlNpZ25vdXQ= (PeerCollabSignout)
  • UGVlckNvbGxhYlVucmVnaXN0ZXJBcHBsaWNhdGlvbg== (PeerCollabUnregisterApplication)
  • UGVlckNvbGxhYlVwZGF0ZUNvbnRhY3Q= (PeerCollabUpdateContact)

Match: network_http

  • SHR0cE9wZW5SZXF1ZXN0 (HttpOpenRequest)
  • SHR0cFNlbmRSZXF1ZXN0 (HttpSendRequest)
  • SW50ZXJuZXRDb25uZWN0 (InternetConnect)
  • SW50ZXJuZXRPcGVu (InternetOpen)
  • SW50ZXJuZXRPcGVuVXJs (InternetOpenUrl)
  • SW50ZXJuZXRSZWFkRmlsZQ== (InternetReadFile)
  • SW50ZXJuZXRXcml0ZUZpbGU= (InternetWriteFile)
  • d2luaW5ldC5kbGw= (wininet.dll)

Match: network_dropper

  • VVJMRG93bmxvYWRUb0NhY2hlRmlsZQ== (URLDownloadToCacheFile)
  • VVJMRG93bmxvYWRUb0ZpbGU= (URLDownloadToFile)
  • dXJsbW9uLmRsbA== (urlmon.dll)

Match: network_ftp

  • RnRwQ3JlYXRlRGlyZWN0b3J5 (FtpCreateDirectory)
  • RnRwR2V0Q3VycmVudERpcmVjdG9yeQ== (FtpGetCurrentDirectory)
  • RnRwR2V0RmlsZQ== (FtpGetFile)
  • RnRwR2V0RmlsZVNpemU= (FtpGetFileSize)
  • RnRwRGVsZXRlRmlsZQ== (FtpDeleteFile)
  • RnRwT3BlbkZpbGU= (FtpOpenFile)
  • RnRwU2V0Q3VycmVudERpcmVjdG9yeQ== (FtpSetCurrentDirectory)
  • RnRwUHV0RmlsZQ== (FtpPutFile)
  • RnRwUmVtb3ZlRGlyZWN0b3J5 (FtpRemoveDirectory)
  • RnRwUmVuYW1lRmlsZQ== (FtpRenameFile)
  • d2luaW5ldC5kbGw= (wininet.dll)

Match: network_tcp_socket

  • V1MyXzMyLmRsbA== (WS2_32.dll)
  • V1NBQ29ubmVjdA== (WSAConnect)
  • V1NBQ2xlYW51cA== (WSACleanup)
  • V1NBU29ja2V0 (WSASocket)
  • V1NBU2VuZA== (WSASend)
  • V1NBU3RhcnR1cA== (WSAStartup)
  • Y29ubmVjdA== (connect)
  • Y2xvc2Vzb2NrZXQ= (closesocket)
  • c29ja2V0 (socket)
  • c2VuZA== (send)
  • d3MyXzMyLmRsbA== (ws2_32.dll)

Match: network_dns

  • RG5zUXVlcnk= (DnsQuery)
  • V1MyXzMyLmRsbA== (WS2_32.dll)
  • Z2V0YWRkcmluZm8= (getaddrinfo)
  • Z2V0aG9zdGJ5bmFtZQ== (gethostbyname)
  • ZG5zYXBpLmRsbA== (dnsapi.dll)
  • d3MyXzMyLmRsbA== (ws2_32.dll)

Match: network_dga

  • Q1JZUFQzMi5kbGw= (CRYPT32.dll)
  • Q3J5cHRBY3F1aXJlQ29udGV4dA== (CryptAcquireContext)
  • Q3J5cHRDcmVhdGVIYXNo (CryptCreateHash)
  • Q3J5cHRIYXNoRGF0YQ== (CryptHashData)
  • QURWQVBJMzIuZGxs (ADVAPI32.dll)
  • R2V0U3lzdGVtVGltZQ== (GetSystemTime)
  • R2V0U3lzdGVtVGltZUFzRmlsZVRpbWU= (GetSystemTimeAsFileTime)
  • SW50ZXJuZXRPcGVu (InternetOpen)
  • SW50ZXJuZXRPcGVuVXJs (InternetOpenUrl)
  • U3lzdGVtVGltZVRvRmlsZVRpbWU= (SystemTimeToFileTime)
  • Y3J5cHQzMi5kbGw= (crypt32.dll)
  • YWR2YXBpMzIuZGxs (advapi32.dll)
  • Z2V0YWRkcmluZm8= (getaddrinfo)
  • Z2V0aG9zdGJ5bmFtZQ== (gethostbyname)
  • d2luaW5ldC5kbGw= (wininet.dll)

Match: escalate_priv

  • QURWQVBJMzIuZGxs (ADVAPI32.dll)
  • QWRqdXN0VG9rZW5Qcml2aWxlZ2Vz (AdjustTokenPrivileges)
  • YWR2YXBpMzIuZGxs (advapi32.dll)

Match: screenshot

  • Qml0Qmx0 (BitBlt)
  • R0RJMzIuZGxs (GDI32.dll)
  • R2V0REM= (GetDC)
  • VVNFUjMyLmRsbA== (USER32.dll)
  • Z2RpMzIuZGxs (gdi32.dll)
  • dXNlcjMyLmRsbA== (user32.dll)

Match: keylogger

  • R2V0QXN5bmNLZXlTdGF0ZQ== (GetAsyncKeyState)
  • R2V0S2V5U3RhdGU= (GetKeyState)
  • R2V0S2V5Ym9hcmRUeXBl (GetKeyboardType)
  • TWFwVmlydHVhbEtleQ== (MapVirtualKey)
  • VVNFUjMyLmRsbA== (USER32.dll)
  • dXNlcjMyLmRsbA== (user32.dll)

Match: cred_local

  • Q3JlZEVudW1lcmF0ZUE= (CredEnumerateA)
  • Q3JlZEVudW1lcmF0ZVc= (CredEnumerateW)
  • THNhRW51bWVyYXRlTG9nb25TZXNzaW9ucw== (LsaEnumerateLogonSessions)
  • U2FtSUNvbm5lY3Q= (SamIConnect)
  • U2FtUXVlcnlJbmZvcm1hdGlvblVzZQ== (SamQueryInformationUse)

Match: sniff_audio

  • d2F2ZUluQ2xvc2U= (waveInClose)
  • d2F2ZUluQWRkQnVmZmVy (waveInAddBuffer)
  • d2F2ZUluT3Blbg== (waveInOpen)
  • d2F2ZUluU3RhcnQ= (waveInStart)
  • d2F2ZUluUmVzZXQ= (waveInReset)
  • d2lubW0uZGxs (winmm.dll)

Match: migrate_apc

  • T3BlblRocmVhZA== (OpenThread)
  • UXVldWVVc2VyQVBD (QueueUserAPC)

Match: spreading_file

  • ZGVza3RvcC5pbmk= (desktop.ini)

Match: spreading_share

  • TmV0U2hhcmVFbnVt (NetShareEnum)
  • TmV0U2hhcmVHZXRJbmZv (NetShareGetInfo)
  • bmV0YXBpMzIuZGxs (netapi32.dll)

Match: win_mutex

  • Q3JlYXRlTXV0ZXg= (CreateMutex)

Match: win_registry

  • QURWQVBJMzIuZGxs (ADVAPI32.dll)
  • UmVnQ2xvc2VLZXk= (RegCloseKey)
  • UmVnQ3JlYXRlS2V5QQ== (RegCreateKeyA)
  • UmVnT3BlbktleUV4QQ== (RegOpenKeyExA)
  • UmVnU2V0VmFsdWVFeEE= (RegSetValueExA)
  • UmVnUXVlcnlWYWx1ZUV4QQ== (RegQueryValueExA)
  • YWR2YXBpMzIuZGxs (advapi32.dll)

Match: win_token

  • QURWQVBJMzIuZGxs (ADVAPI32.dll)
  • QWRqdXN0VG9rZW5Qcml2aWxlZ2Vz (AdjustTokenPrivileges)
  • RHVwbGljYXRlVG9rZW5FeA== (DuplicateTokenEx)
  • T3BlblByb2Nlc3NUb2tlbg== (OpenProcessToken)
  • TG9va3VwUHJpdmlsZWdlVmFsdWVB (LookupPrivilegeValueA)
  • YWR2YXBpMzIuZGxs (advapi32.dll)

Match: win_private_profile

  • R2V0UHJpdmF0ZVByb2ZpbGVJbnRB (GetPrivateProfileIntA)
  • R2V0UHJpdmF0ZVByb2ZpbGVTdHJpbmdB (GetPrivateProfileStringA)
  • S0VSTkVMMzIuZGxs (KERNEL32.dll)
  • V3JpdGVQcml2YXRlUHJvZmlsZVN0cmluZ0E= (WritePrivateProfileStringA)

Match: win_files_operation

  • Q29weUZpbGU= (CopyFile)
  • Q3JlYXRlRmlsZUE= (CreateFileA)
  • RGVsZXRlRmlsZUE= (DeleteFileA)
  • RmluZENsb3Nl (FindClose)
  • RmluZEZpcnN0RmlsZUE= (FindFirstFileA)
  • S0VSTkVMMzIuZGxs (KERNEL32.dll)
  • TW92ZUZpbGVFeEE= (MoveFileExA)
  • U2V0RmlsZUF0dHJpYnV0ZXNB (SetFileAttributesA)
  • U2V0RmlsZVBvaW50ZXI= (SetFilePointer)
  • UmVhZEZpbGU= (ReadFile)
  • V3JpdGVGaWxl (WriteFile)

Match: Str_Win32_Winsock2_Library

  • V1MyXzMyLmRsbA== (WS2_32.dll)
  • d3MyXzMyLmRsbA== (ws2_32.dll)

Match: Str_Win32_Wininet_Library

  • d2luaW5ldC5kbGw= (wininet.dll)

Match: Str_Win32_Internet_API

  • SW50ZXJuZXRDb25uZWN0 (InternetConnect)
  • SW50ZXJuZXRDbG9zZUhhbmRsZQ== (InternetCloseHandle)
  • SW50ZXJuZXRPcGVu (InternetOpen)
  • SW50ZXJuZXRSZWFkRmlsZQ== (InternetReadFile)

Match: Str_Win32_Http_API

  • SHR0cE9wZW5SZXF1ZXN0 (HttpOpenRequest)
  • SHR0cFF1ZXJ5SW5mbw== (HttpQueryInfo)
  • SHR0cFNlbmRSZXF1ZXN0 (HttpSendRequest)

Match: DebuggerCheck__GlobalFlags

  • TnRHbG9iYWxGbGFncw== (NtGlobalFlags)

Match: DebuggerCheck__QueryInfo

  • UXVlcnlJbmZvcm1hdGlvblByb2Nlc3M= (QueryInformationProcess)

Match: DebuggerCheck__RemoteAPI

  • Q2hlY2tSZW1vdGVEZWJ1Z2dlclByZXNlbnQ= (CheckRemoteDebuggerPresent)

Match: DebuggerHiding__Thread

  • U2V0SW5mb3JtYXRpb25UaHJlYWQ= (SetInformationThread)

Match: DebuggerHiding__Active

  • RGVidWdBY3RpdmVQcm9jZXNz (DebugActiveProcess)

Match: DebuggerException__ConsoleCtrl

  • R2VuZXJhdGVDb25zb2xlQ3RybEV2ZW50 (GenerateConsoleCtrlEvent)

Match: DebuggerException__SetConsoleCtrl

  • U2V0Q29uc29sZUN0cmxIYW5kbGVy (SetConsoleCtrlHandler)

Match: ThreadControl__Context

  • U2V0VGhyZWFkQ29udGV4dA== (SetThreadContext)

Match: SEH__vectored

  • QWRkVmVjdG9yZWRFeGNlcHRpb25IYW5kbGVy (AddVectoredExceptionHandler)
  • UmVtb3ZlVmVjdG9yZWRFeGNlcHRpb25IYW5kbGVy (RemoveVectoredExceptionHandler)

Match: Check_Dlls

  • ZGJnaGVscC5kbGw= (dbghelp.dll)
  • cHN0b3JlYy5kbGw= (pstorec.dll)

Match: anti_dbg

  • Q29udGludWVEZWJ1Z0V2ZW50 (ContinueDebugEvent)
  • Q2hlY2tSZW1vdGVEZWJ1Z2dlclByZXNlbnQ= (CheckRemoteDebuggerPresent)
  • RGVidWdBY3RpdmVQcm9jZXNz (DebugActiveProcess)
  • S0VSTkVMMzIuZGxs (KERNEL32.dll)
  • SXNEZWJ1Z2dlclByZXNlbnQ= (IsDebuggerPresent)
  • T3V0cHV0RGVidWdTdHJpbmc= (OutputDebugString)

Match: antisb_threatExpert

  • ZGJnaGVscC5kbGw= (dbghelp.dll)

Match: disable_dep

  • TnRTZXRJbmZvcm1hdGlvblByb2Nlc3M= (NtSetInformationProcess)
  • U2V0UHJvY2Vzc0RFUFBvbGljeQ== (SetProcessDEPPolicy)
  • WndQcm90ZWN0VmlydHVhbE1lbW9yeQ== (ZwProtectVirtualMemory)

Match: win_hook

  • Q2FsbE5leHRIb29rRXg= (CallNextHookEx)
  • U2V0V2luZG93c0hvb2tFeEE= (SetWindowsHookExA)
  • VVNFUjMyLmRsbA== (USER32.dll)
  • VW5ob29rV2luZG93c0hvb2tFeA== (UnhookWindowsHookEx)
  • dXNlcjMyLmRsbA== (user32.dll)

Process memory dump for None (PID 7688, dump 1)

Extracted/injected images (may contain unpacked executables)
Download #1

Yara signatures matches on process memory

Match: inject_thread

  • Q3JlYXRlUmVtb3RlVGhyZWFk (CreateRemoteThread)
  • Q3JlYXRlVGhyZWFk (CreateThread)
  • T3BlblByb2Nlc3M= (OpenProcess)
  • TnRXcml0ZVZpcnR1YWxNZW1vcnk= (NtWriteVirtualMemory)
  • V3JpdGVQcm9jZXNzTWVtb3J5 (WriteProcessMemory)
  • VmlydHVhbEFsbG9jRXg= (VirtualAllocEx)

Match: create_service

  • Q29udHJvbFNlcnZpY2U= (ControlService)
  • Q3JlYXRlU2VydmljZQ== (CreateService)
  • QURWQVBJMzIuRExM (ADVAPI32.DLL)
  • QURWQVBJMzIuZGxs (ADVAPI32.dll)
  • U3RhcnRTZXJ2aWNl (StartService)
  • UXVlcnlTZXJ2aWNlU3RhdHVz (QueryServiceStatus)
  • YWR2YXBpMzIuZGxs (advapi32.dll)

Match: create_com_service

  • RGxsQ2FuVW5sb2FkTm93 (DllCanUnloadNow)
  • RGxsR2V0Q2xhc3NPYmplY3Q= (DllGetClassObject)
  • RGxsSW5zdGFsbA== (DllInstall)
  • RGxsUmVnaXN0ZXJTZXJ2ZXI= (DllRegisterServer)
  • RGxsVW5yZWdpc3RlclNlcnZlcg== (DllUnregisterServer)

Match: network_udp_sock

  • V1MyXzMyLmRsbA== (WS2_32.dll)
  • V1NBU2VuZFRv (WSASendTo)
  • V1NBU3RhcnR1cA== (WSAStartup)
  • V1NBUmVjdkZyb20= (WSARecvFrom)
  • c2VuZHRv (sendto)
  • cmVjdmZyb20= (recvfrom)
  • d3MyXzMyLmRsbA== (ws2_32.dll)

Match: network_tcp_listen

  • V1MyXzMyLmRsbA== (WS2_32.dll)
  • V1NBQWNjZXB0 (WSAAccept)
  • V1NBU29ja2V0 (WSASocket)
  • V1NBU3RhcnR1cA== (WSAStartup)
  • YWNjZXB0 (accept)
  • YmluZA== (bind)
  • bGlzdGVu (listen)
  • bXN3c29jay5kbGw= (mswsock.dll)
  • d3MyXzMyLmRsbA== (ws2_32.dll)

Match: network_p2p_win

  • UGVlckNvbGxhYkV4cG9ydENvbnRhY3Q= (PeerCollabExportContact)
  • UGVlckNvbGxhYkdldEFwcGxpY2F0aW9uUmVnaXN0cmF0aW9uSW5mbw== (PeerCollabGetApplicationRegistrationInfo)
  • UGVlckNvbGxhYkdldEV2ZW50RGF0YQ== (PeerCollabGetEventData)
  • UGVlckNvbGxhYkdldEVuZHBvaW50TmFtZQ== (PeerCollabGetEndpointName)
  • UGVlckNvbGxhYkdldEludml0YXRpb25SZXNwb25zZQ== (PeerCollabGetInvitationResponse)
  • UGVlckNvbGxhYkdldFByZXNlbmNlSW5mbw== (PeerCollabGetPresenceInfo)
  • UGVlckNvbGxhYkdldFNpZ25pbk9wdGlvbnM= (PeerCollabGetSigninOptions)
  • UGVlckNvbGxhYkludml0ZUNvbnRhY3Q= (PeerCollabInviteContact)
  • UGVlckNvbGxhYkludml0ZUVuZHBvaW50 (PeerCollabInviteEndpoint)
  • UGVlckNvbGxhYlBhcnNlQ29udGFjdA== (PeerCollabParseContact)
  • UGVlckNvbGxhYlF1ZXJ5Q29udGFjdERhdGE= (PeerCollabQueryContactData)
  • UGVlckNvbGxhYlJlZ2lzdGVyQXBwbGljYXRpb24= (PeerCollabRegisterApplication)
  • UGVlckNvbGxhYlJlZ2lzdGVyRXZlbnQ= (PeerCollabRegisterEvent)
  • UGVlckNvbGxhYlJlZnJlc2hFbmRwb2ludERhdGE= (PeerCollabRefreshEndpointData)
  • UGVlckNvbGxhYlNldE9iamVjdA== (PeerCollabSetObject)
  • UGVlckNvbGxhYlNldEVuZHBvaW50TmFtZQ== (PeerCollabSetEndpointName)
  • UGVlckNvbGxhYlNldFByZXNlbmNlSW5mbw== (PeerCollabSetPresenceInfo)
  • UGVlckNvbGxhYlNpZ25vdXQ= (PeerCollabSignout)
  • UGVlckNvbGxhYlVucmVnaXN0ZXJBcHBsaWNhdGlvbg== (PeerCollabUnregisterApplication)
  • UGVlckNvbGxhYlVwZGF0ZUNvbnRhY3Q= (PeerCollabUpdateContact)

Match: network_http

  • SHR0cE9wZW5SZXF1ZXN0 (HttpOpenRequest)
  • SHR0cFNlbmRSZXF1ZXN0 (HttpSendRequest)
  • SW50ZXJuZXRDb25uZWN0 (InternetConnect)
  • SW50ZXJuZXRPcGVu (InternetOpen)
  • SW50ZXJuZXRPcGVuVXJs (InternetOpenUrl)
  • SW50ZXJuZXRSZWFkRmlsZQ== (InternetReadFile)
  • SW50ZXJuZXRXcml0ZUZpbGU= (InternetWriteFile)
  • V0lOSU5FVC5ETEw= (WININET.DLL)
  • V0lOSU5FVC5kbGw= (WININET.dll)
  • d2luaW5ldC5kbGw= (wininet.dll)

Match: network_dropper

  • VVJMRG93bmxvYWRUb0NhY2hlRmlsZQ== (URLDownloadToCacheFile)
  • VVJMRG93bmxvYWRUb0ZpbGU= (URLDownloadToFile)
  • dXJsbW9uLmRsbA== (urlmon.dll)

Match: network_ftp

  • RnRwQ3JlYXRlRGlyZWN0b3J5 (FtpCreateDirectory)
  • RnRwR2V0Q3VycmVudERpcmVjdG9yeQ== (FtpGetCurrentDirectory)
  • RnRwR2V0RmlsZQ== (FtpGetFile)
  • RnRwR2V0RmlsZVNpemU= (FtpGetFileSize)
  • RnRwRGVsZXRlRmlsZQ== (FtpDeleteFile)
  • RnRwT3BlbkZpbGU= (FtpOpenFile)
  • RnRwU2V0Q3VycmVudERpcmVjdG9yeQ== (FtpSetCurrentDirectory)
  • RnRwUHV0RmlsZQ== (FtpPutFile)
  • RnRwUmVtb3ZlRGlyZWN0b3J5 (FtpRemoveDirectory)
  • RnRwUmVuYW1lRmlsZQ== (FtpRenameFile)
  • V0lOSU5FVC5ETEw= (WININET.DLL)
  • V0lOSU5FVC5kbGw= (WININET.dll)
  • d2luaW5ldC5kbGw= (wininet.dll)

Match: network_tcp_socket

  • V1MyXzMyLmRsbA== (WS2_32.dll)
  • V1NBQ29ubmVjdA== (WSAConnect)
  • V1NBQ2xlYW51cA== (WSACleanup)
  • V1NBU29ja2V0 (WSASocket)
  • V1NBU2VuZA== (WSASend)
  • V1NBU3RhcnR1cA== (WSAStartup)
  • Y29ubmVjdA== (connect)
  • Y2xvc2Vzb2NrZXQ= (closesocket)
  • c29ja2V0 (socket)
  • c2VuZA== (send)
  • d3MyXzMyLmRsbA== (ws2_32.dll)

Match: network_dns

  • RE5TQVBJLmRsbA== (DNSAPI.dll)
  • RG5zUXVlcnk= (DnsQuery)
  • V1MyXzMyLmRsbA== (WS2_32.dll)
  • Z2V0YWRkcmluZm8= (getaddrinfo)
  • Z2V0aG9zdGJ5bmFtZQ== (gethostbyname)
  • ZG5zYXBpLmRsbA== (dnsapi.dll)
  • d3MyXzMyLmRsbA== (ws2_32.dll)

Match: network_dga

  • Q1JZUFQzMi5kbGw= (CRYPT32.dll)
  • Q3J5cHRBY3F1aXJlQ29udGV4dA== (CryptAcquireContext)
  • Q3J5cHRDcmVhdGVIYXNo (CryptCreateHash)
  • Q3J5cHRIYXNoRGF0YQ== (CryptHashData)
  • QURWQVBJMzIuRExM (ADVAPI32.DLL)
  • QURWQVBJMzIuZGxs (ADVAPI32.dll)
  • R2V0U3lzdGVtVGltZQ== (GetSystemTime)
  • R2V0U3lzdGVtVGltZUFzRmlsZVRpbWU= (GetSystemTimeAsFileTime)
  • SW50ZXJuZXRPcGVu (InternetOpen)
  • SW50ZXJuZXRPcGVuVXJs (InternetOpenUrl)
  • U3lzdGVtVGltZVRvRmlsZVRpbWU= (SystemTimeToFileTime)
  • V0lOSU5FVC5ETEw= (WININET.DLL)
  • V0lOSU5FVC5kbGw= (WININET.dll)
  • Y3J5cHQzMi5kbGw= (crypt32.dll)
  • YWR2YXBpMzIuZGxs (advapi32.dll)
  • Z2V0YWRkcmluZm8= (getaddrinfo)
  • Z2V0aG9zdGJ5bmFtZQ== (gethostbyname)
  • d2luaW5ldC5kbGw= (wininet.dll)

Match: escalate_priv

  • QURWQVBJMzIuRExM (ADVAPI32.DLL)
  • QURWQVBJMzIuZGxs (ADVAPI32.dll)
  • QWRqdXN0VG9rZW5Qcml2aWxlZ2Vz (AdjustTokenPrivileges)
  • YWR2YXBpMzIuZGxs (advapi32.dll)

Match: screenshot

  • Qml0Qmx0 (BitBlt)
  • R0RJMzIuRExM (GDI32.DLL)
  • R0RJMzIuZGxs (GDI32.dll)
  • R2V0REM= (GetDC)
  • VVNFUjMyLkRMTA== (USER32.DLL)
  • VVNFUjMyLmRsbA== (USER32.dll)
  • Z2RpMzIuZGxs (gdi32.dll)
  • dXNlcjMyLmRsbA== (user32.dll)

Match: keylogger

  • R2V0QXN5bmNLZXlTdGF0ZQ== (GetAsyncKeyState)
  • R2V0S2V5U3RhdGU= (GetKeyState)
  • R2V0S2V5Ym9hcmRUeXBl (GetKeyboardType)
  • TWFwVmlydHVhbEtleQ== (MapVirtualKey)
  • VVNFUjMyLkRMTA== (USER32.DLL)
  • VVNFUjMyLmRsbA== (USER32.dll)
  • dXNlcjMyLmRsbA== (user32.dll)

Match: cred_local

  • Q3JlZEVudW1lcmF0ZUE= (CredEnumerateA)
  • Q3JlZEVudW1lcmF0ZVc= (CredEnumerateW)
  • THNhRW51bWVyYXRlTG9nb25TZXNzaW9ucw== (LsaEnumerateLogonSessions)
  • U2FtSUNvbm5lY3Q= (SamIConnect)
  • U2FtUXVlcnlJbmZvcm1hdGlvblVzZQ== (SamQueryInformationUse)

Match: sniff_audio

  • V0lOTU0uRExM (WINMM.DLL)
  • V0lOTU0uZGxs (WINMM.dll)
  • d2F2ZUluQ2xvc2U= (waveInClose)
  • d2F2ZUluQWRkQnVmZmVy (waveInAddBuffer)
  • d2F2ZUluT3Blbg== (waveInOpen)
  • d2F2ZUluU3RhcnQ= (waveInStart)
  • d2F2ZUluUmVzZXQ= (waveInReset)
  • d2lubW0uZGxs (winmm.dll)

Match: migrate_apc

  • T3BlblRocmVhZA== (OpenThread)
  • UXVldWVVc2VyQVBD (QueueUserAPC)

Match: spreading_file

  • ZGVza3RvcC5pbmk= (desktop.ini)

Match: spreading_share

  • TmV0U2hhcmVFbnVt (NetShareEnum)
  • TmV0U2hhcmVHZXRJbmZv (NetShareGetInfo)
  • bmV0YXBpMzIuZGxs (netapi32.dll)

Match: win_mutex

  • Q3JlYXRlTXV0ZXg= (CreateMutex)

Match: win_registry

  • QURWQVBJMzIuRExM (ADVAPI32.DLL)
  • QURWQVBJMzIuZGxs (ADVAPI32.dll)
  • UmVnQ2xvc2VLZXk= (RegCloseKey)
  • UmVnQ3JlYXRlS2V5QQ== (RegCreateKeyA)
  • UmVnT3BlbktleUV4QQ== (RegOpenKeyExA)
  • UmVnU2V0VmFsdWVFeEE= (RegSetValueExA)
  • UmVnUXVlcnlWYWx1ZUV4QQ== (RegQueryValueExA)
  • YWR2YXBpMzIuZGxs (advapi32.dll)

Match: win_token

  • QURWQVBJMzIuRExM (ADVAPI32.DLL)
  • QURWQVBJMzIuZGxs (ADVAPI32.dll)
  • QWRqdXN0VG9rZW5Qcml2aWxlZ2Vz (AdjustTokenPrivileges)
  • RHVwbGljYXRlVG9rZW5FeA== (DuplicateTokenEx)
  • T3BlblByb2Nlc3NUb2tlbg== (OpenProcessToken)
  • TG9va3VwUHJpdmlsZWdlVmFsdWVB (LookupPrivilegeValueA)
  • YWR2YXBpMzIuZGxs (advapi32.dll)

Match: win_private_profile

  • R2V0UHJpdmF0ZVByb2ZpbGVJbnRB (GetPrivateProfileIntA)
  • R2V0UHJpdmF0ZVByb2ZpbGVTdHJpbmdB (GetPrivateProfileStringA)
  • S0VSTkVMMzIuRExM (KERNEL32.DLL)
  • S0VSTkVMMzIuZGxs (KERNEL32.dll)
  • S2VybmVsMzIuRExM (Kernel32.DLL)
  • V3JpdGVQcml2YXRlUHJvZmlsZVN0cmluZ0E= (WritePrivateProfileStringA)
  • a2VybmVsMzIuZGxs (kernel32.dll)

Match: win_files_operation

  • Q29weUZpbGU= (CopyFile)
  • Q3JlYXRlRmlsZUE= (CreateFileA)
  • RGVsZXRlRmlsZUE= (DeleteFileA)
  • RmluZENsb3Nl (FindClose)
  • RmluZEZpcnN0RmlsZUE= (FindFirstFileA)
  • S0VSTkVMMzIuRExM (KERNEL32.DLL)
  • S0VSTkVMMzIuZGxs (KERNEL32.dll)
  • S2VybmVsMzIuRExM (Kernel32.DLL)
  • TW92ZUZpbGVFeEE= (MoveFileExA)
  • U2V0RmlsZUF0dHJpYnV0ZXNB (SetFileAttributesA)
  • U2V0RmlsZVBvaW50ZXI= (SetFilePointer)
  • UmVhZEZpbGU= (ReadFile)
  • V3JpdGVGaWxl (WriteFile)
  • a2VybmVsMzIuZGxs (kernel32.dll)

Match: Str_Win32_Winsock2_Library

  • V1MyXzMyLmRsbA== (WS2_32.dll)
  • d3MyXzMyLmRsbA== (ws2_32.dll)

Match: Str_Win32_Wininet_Library

  • V0lOSU5FVC5ETEw= (WININET.DLL)
  • V0lOSU5FVC5kbGw= (WININET.dll)
  • d2luaW5ldC5kbGw= (wininet.dll)

Match: Str_Win32_Internet_API

  • SW50ZXJuZXRDb25uZWN0 (InternetConnect)
  • SW50ZXJuZXRDbG9zZUhhbmRsZQ== (InternetCloseHandle)
  • SW50ZXJuZXRPcGVu (InternetOpen)
  • SW50ZXJuZXRSZWFkRmlsZQ== (InternetReadFile)

Match: Str_Win32_Http_API

  • SHR0cE9wZW5SZXF1ZXN0 (HttpOpenRequest)
  • SHR0cFF1ZXJ5SW5mbw== (HttpQueryInfo)
  • SHR0cFNlbmRSZXF1ZXN0 (HttpSendRequest)

Match: DebuggerCheck__GlobalFlags

  • TnRHbG9iYWxGbGFncw== (NtGlobalFlags)

Match: DebuggerCheck__QueryInfo

  • UXVlcnlJbmZvcm1hdGlvblByb2Nlc3M= (QueryInformationProcess)

Match: DebuggerCheck__RemoteAPI

  • Q2hlY2tSZW1vdGVEZWJ1Z2dlclByZXNlbnQ= (CheckRemoteDebuggerPresent)

Match: DebuggerHiding__Thread

  • U2V0SW5mb3JtYXRpb25UaHJlYWQ= (SetInformationThread)

Match: DebuggerHiding__Active

  • RGVidWdBY3RpdmVQcm9jZXNz (DebugActiveProcess)

Match: DebuggerException__ConsoleCtrl

  • R2VuZXJhdGVDb25zb2xlQ3RybEV2ZW50 (GenerateConsoleCtrlEvent)

Match: DebuggerException__SetConsoleCtrl

  • U2V0Q29uc29sZUN0cmxIYW5kbGVy (SetConsoleCtrlHandler)

Match: ThreadControl__Context

  • U2V0VGhyZWFkQ29udGV4dA== (SetThreadContext)

Match: SEH__vectored

  • QWRkVmVjdG9yZWRFeGNlcHRpb25IYW5kbGVy (AddVectoredExceptionHandler)
  • UmVtb3ZlVmVjdG9yZWRFeGNlcHRpb25IYW5kbGVy (RemoveVectoredExceptionHandler)

Match: Check_Dlls

  • ZGJnaGVscC5kbGw= (dbghelp.dll)
  • cHN0b3JlYy5kbGw= (pstorec.dll)

Match: anti_dbg

  • Q29udGludWVEZWJ1Z0V2ZW50 (ContinueDebugEvent)
  • Q2hlY2tSZW1vdGVEZWJ1Z2dlclByZXNlbnQ= (CheckRemoteDebuggerPresent)
  • RGVidWdBY3RpdmVQcm9jZXNz (DebugActiveProcess)
  • S0VSTkVMMzIuRExM (KERNEL32.DLL)
  • S0VSTkVMMzIuZGxs (KERNEL32.dll)
  • S2VybmVsMzIuRExM (Kernel32.DLL)
  • SXNEZWJ1Z2dlclByZXNlbnQ= (IsDebuggerPresent)
  • T3V0cHV0RGVidWdTdHJpbmc= (OutputDebugString)
  • a2VybmVsMzIuZGxs (kernel32.dll)

Match: antisb_threatExpert

  • ZGJnaGVscC5kbGw= (dbghelp.dll)

Match: disable_dep

  • TnRTZXRJbmZvcm1hdGlvblByb2Nlc3M= (NtSetInformationProcess)
  • U2V0UHJvY2Vzc0RFUFBvbGljeQ== (SetProcessDEPPolicy)
  • WndQcm90ZWN0VmlydHVhbE1lbW9yeQ== (ZwProtectVirtualMemory)

Match: win_hook

  • Q2FsbE5leHRIb29rRXg= (CallNextHookEx)
  • U2V0V2luZG93c0hvb2tFeEE= (SetWindowsHookExA)
  • VVNFUjMyLkRMTA== (USER32.DLL)
  • VVNFUjMyLmRsbA== (USER32.dll)
  • VW5ob29rV2luZG93c0hvb2tFeA== (UnhookWindowsHookEx)
  • dXNlcjMyLmRsbA== (user32.dll)

Process memory dump for cmd.exe (PID 8064, dump 1)

Extracted/injected images (may contain unpacked executables)
Download #1

Yara signatures matches on process memory

Match: inject_thread

  • Q3JlYXRlUmVtb3RlVGhyZWFk (CreateRemoteThread)
  • Q3JlYXRlVGhyZWFk (CreateThread)
  • T3BlblByb2Nlc3M= (OpenProcess)
  • TnRXcml0ZVZpcnR1YWxNZW1vcnk= (NtWriteVirtualMemory)
  • V3JpdGVQcm9jZXNzTWVtb3J5 (WriteProcessMemory)
  • VmlydHVhbEFsbG9jRXg= (VirtualAllocEx)

Match: create_service

  • Q29udHJvbFNlcnZpY2U= (ControlService)
  • Q3JlYXRlU2VydmljZQ== (CreateService)
  • QURWQVBJMzIuRExM (ADVAPI32.DLL)
  • QURWQVBJMzIuZGxs (ADVAPI32.dll)
  • U3RhcnRTZXJ2aWNl (StartService)
  • UXVlcnlTZXJ2aWNlU3RhdHVz (QueryServiceStatus)
  • YWR2YXBpMzIuZGxs (advapi32.dll)

Match: network_udp_sock

  • V1MyXzMyLmRsbA== (WS2_32.dll)
  • V1NBU2VuZFRv (WSASendTo)
  • V1NBU3RhcnR1cA== (WSAStartup)
  • V1NBUmVjdkZyb20= (WSARecvFrom)
  • c2VuZHRv (sendto)
  • cmVjdmZyb20= (recvfrom)
  • d3MyXzMyLmRsbA== (ws2_32.dll)

Match: network_tcp_listen

  • V1MyXzMyLmRsbA== (WS2_32.dll)
  • V1NBQWNjZXB0 (WSAAccept)
  • V1NBU29ja2V0 (WSASocket)
  • V1NBU3RhcnR1cA== (WSAStartup)
  • YWNjZXB0 (accept)
  • YmluZA== (bind)
  • bGlzdGVu (listen)
  • bXN3c29jay5kbGw= (mswsock.dll)
  • d3MyXzMyLmRsbA== (ws2_32.dll)

Match: network_p2p_win

  • UGVlckNvbGxhYkV4cG9ydENvbnRhY3Q= (PeerCollabExportContact)
  • UGVlckNvbGxhYkdldEFwcGxpY2F0aW9uUmVnaXN0cmF0aW9uSW5mbw== (PeerCollabGetApplicationRegistrationInfo)
  • UGVlckNvbGxhYkdldEV2ZW50RGF0YQ== (PeerCollabGetEventData)
  • UGVlckNvbGxhYkdldEVuZHBvaW50TmFtZQ== (PeerCollabGetEndpointName)
  • UGVlckNvbGxhYkdldEludml0YXRpb25SZXNwb25zZQ== (PeerCollabGetInvitationResponse)
  • UGVlckNvbGxhYkdldFByZXNlbmNlSW5mbw== (PeerCollabGetPresenceInfo)
  • UGVlckNvbGxhYkdldFNpZ25pbk9wdGlvbnM= (PeerCollabGetSigninOptions)
  • UGVlckNvbGxhYkludml0ZUNvbnRhY3Q= (PeerCollabInviteContact)
  • UGVlckNvbGxhYkludml0ZUVuZHBvaW50 (PeerCollabInviteEndpoint)
  • UGVlckNvbGxhYlBhcnNlQ29udGFjdA== (PeerCollabParseContact)
  • UGVlckNvbGxhYlF1ZXJ5Q29udGFjdERhdGE= (PeerCollabQueryContactData)
  • UGVlckNvbGxhYlJlZ2lzdGVyQXBwbGljYXRpb24= (PeerCollabRegisterApplication)
  • UGVlckNvbGxhYlJlZ2lzdGVyRXZlbnQ= (PeerCollabRegisterEvent)
  • UGVlckNvbGxhYlJlZnJlc2hFbmRwb2ludERhdGE= (PeerCollabRefreshEndpointData)
  • UGVlckNvbGxhYlNldE9iamVjdA== (PeerCollabSetObject)
  • UGVlckNvbGxhYlNldEVuZHBvaW50TmFtZQ== (PeerCollabSetEndpointName)
  • UGVlckNvbGxhYlNldFByZXNlbmNlSW5mbw== (PeerCollabSetPresenceInfo)
  • UGVlckNvbGxhYlNpZ25vdXQ= (PeerCollabSignout)
  • UGVlckNvbGxhYlVucmVnaXN0ZXJBcHBsaWNhdGlvbg== (PeerCollabUnregisterApplication)
  • UGVlckNvbGxhYlVwZGF0ZUNvbnRhY3Q= (PeerCollabUpdateContact)

Match: network_http

  • SHR0cE9wZW5SZXF1ZXN0 (HttpOpenRequest)
  • SHR0cFNlbmRSZXF1ZXN0 (HttpSendRequest)
  • SW50ZXJuZXRDb25uZWN0 (InternetConnect)
  • SW50ZXJuZXRPcGVu (InternetOpen)
  • SW50ZXJuZXRPcGVuVXJs (InternetOpenUrl)
  • SW50ZXJuZXRSZWFkRmlsZQ== (InternetReadFile)
  • SW50ZXJuZXRXcml0ZUZpbGU= (InternetWriteFile)
  • d2luaW5ldC5kbGw= (wininet.dll)

Match: network_dropper

  • VVJMRG93bmxvYWRUb0NhY2hlRmlsZQ== (URLDownloadToCacheFile)
  • VVJMRG93bmxvYWRUb0ZpbGU= (URLDownloadToFile)
  • dXJsbW9uLmRsbA== (urlmon.dll)

Match: network_ftp

  • RnRwQ3JlYXRlRGlyZWN0b3J5 (FtpCreateDirectory)
  • RnRwR2V0Q3VycmVudERpcmVjdG9yeQ== (FtpGetCurrentDirectory)
  • RnRwR2V0RmlsZQ== (FtpGetFile)
  • RnRwR2V0RmlsZVNpemU= (FtpGetFileSize)
  • RnRwRGVsZXRlRmlsZQ== (FtpDeleteFile)
  • RnRwT3BlbkZpbGU= (FtpOpenFile)
  • RnRwU2V0Q3VycmVudERpcmVjdG9yeQ== (FtpSetCurrentDirectory)
  • RnRwUHV0RmlsZQ== (FtpPutFile)
  • RnRwUmVtb3ZlRGlyZWN0b3J5 (FtpRemoveDirectory)
  • RnRwUmVuYW1lRmlsZQ== (FtpRenameFile)
  • d2luaW5ldC5kbGw= (wininet.dll)

Match: network_tcp_socket

  • V1MyXzMyLmRsbA== (WS2_32.dll)
  • V1NBQ29ubmVjdA== (WSAConnect)
  • V1NBQ2xlYW51cA== (WSACleanup)
  • V1NBU29ja2V0 (WSASocket)
  • V1NBU2VuZA== (WSASend)
  • V1NBU3RhcnR1cA== (WSAStartup)
  • Y29ubmVjdA== (connect)
  • Y2xvc2Vzb2NrZXQ= (closesocket)
  • c29ja2V0 (socket)
  • c2VuZA== (send)
  • d3MyXzMyLmRsbA== (ws2_32.dll)

Match: network_dns

  • RG5zUXVlcnk= (DnsQuery)
  • V1MyXzMyLmRsbA== (WS2_32.dll)
  • Z2V0YWRkcmluZm8= (getaddrinfo)
  • Z2V0aG9zdGJ5bmFtZQ== (gethostbyname)
  • ZG5zYXBpLmRsbA== (dnsapi.dll)
  • d3MyXzMyLmRsbA== (ws2_32.dll)

Match: network_dga

  • Q3J5cHRBY3F1aXJlQ29udGV4dA== (CryptAcquireContext)
  • Q3J5cHRDcmVhdGVIYXNo (CryptCreateHash)
  • Q3J5cHRIYXNoRGF0YQ== (CryptHashData)
  • QURWQVBJMzIuRExM (ADVAPI32.DLL)
  • QURWQVBJMzIuZGxs (ADVAPI32.dll)
  • R2V0U3lzdGVtVGltZQ== (GetSystemTime)
  • R2V0U3lzdGVtVGltZUFzRmlsZVRpbWU= (GetSystemTimeAsFileTime)
  • SW50ZXJuZXRPcGVu (InternetOpen)
  • SW50ZXJuZXRPcGVuVXJs (InternetOpenUrl)
  • U3lzdGVtVGltZVRvRmlsZVRpbWU= (SystemTimeToFileTime)
  • Y3J5cHQzMi5kbGw= (crypt32.dll)
  • YWR2YXBpMzIuZGxs (advapi32.dll)
  • Z2V0YWRkcmluZm8= (getaddrinfo)
  • Z2V0aG9zdGJ5bmFtZQ== (gethostbyname)
  • d2luaW5ldC5kbGw= (wininet.dll)

Match: escalate_priv

  • QURWQVBJMzIuRExM (ADVAPI32.DLL)
  • QURWQVBJMzIuZGxs (ADVAPI32.dll)
  • QWRqdXN0VG9rZW5Qcml2aWxlZ2Vz (AdjustTokenPrivileges)
  • YWR2YXBpMzIuZGxs (advapi32.dll)

Match: screenshot

  • Qml0Qmx0 (BitBlt)
  • R0RJMzIuZGxs (GDI32.dll)
  • R2V0REM= (GetDC)
  • VVNFUjMyLmRsbA== (USER32.dll)
  • Z2RpMzIuZGxs (gdi32.dll)
  • dXNlcjMyLmRsbA== (user32.dll)

Match: keylogger

  • R2V0QXN5bmNLZXlTdGF0ZQ== (GetAsyncKeyState)
  • R2V0S2V5U3RhdGU= (GetKeyState)
  • R2V0S2V5Ym9hcmRUeXBl (GetKeyboardType)
  • TWFwVmlydHVhbEtleQ== (MapVirtualKey)
  • VVNFUjMyLmRsbA== (USER32.dll)
  • dXNlcjMyLmRsbA== (user32.dll)

Match: cred_local

  • Q3JlZEVudW1lcmF0ZUE= (CredEnumerateA)
  • Q3JlZEVudW1lcmF0ZVc= (CredEnumerateW)
  • THNhRW51bWVyYXRlTG9nb25TZXNzaW9ucw== (LsaEnumerateLogonSessions)
  • U2FtSUNvbm5lY3Q= (SamIConnect)
  • U2FtUXVlcnlJbmZvcm1hdGlvblVzZQ== (SamQueryInformationUse)

Match: sniff_audio

  • d2F2ZUluQ2xvc2U= (waveInClose)
  • d2F2ZUluQWRkQnVmZmVy (waveInAddBuffer)
  • d2F2ZUluT3Blbg== (waveInOpen)
  • d2F2ZUluU3RhcnQ= (waveInStart)
  • d2F2ZUluUmVzZXQ= (waveInReset)
  • d2lubW0uZGxs (winmm.dll)

Match: migrate_apc

  • T3BlblRocmVhZA== (OpenThread)
  • UXVldWVVc2VyQVBD (QueueUserAPC)

Match: spreading_share

  • TmV0U2hhcmVFbnVt (NetShareEnum)
  • TmV0U2hhcmVHZXRJbmZv (NetShareGetInfo)
  • bmV0YXBpMzIuZGxs (netapi32.dll)

Match: win_mutex

  • Q3JlYXRlTXV0ZXg= (CreateMutex)

Match: win_registry

  • QURWQVBJMzIuRExM (ADVAPI32.DLL)
  • QURWQVBJMzIuZGxs (ADVAPI32.dll)
  • UmVnQ2xvc2VLZXk= (RegCloseKey)
  • UmVnQ3JlYXRlS2V5QQ== (RegCreateKeyA)
  • UmVnT3BlbktleUV4QQ== (RegOpenKeyExA)
  • UmVnU2V0VmFsdWVFeEE= (RegSetValueExA)
  • UmVnUXVlcnlWYWx1ZUV4QQ== (RegQueryValueExA)
  • YWR2YXBpMzIuZGxs (advapi32.dll)

Match: win_token

  • QURWQVBJMzIuRExM (ADVAPI32.DLL)
  • QURWQVBJMzIuZGxs (ADVAPI32.dll)
  • QWRqdXN0VG9rZW5Qcml2aWxlZ2Vz (AdjustTokenPrivileges)
  • RHVwbGljYXRlVG9rZW5FeA== (DuplicateTokenEx)
  • T3BlblByb2Nlc3NUb2tlbg== (OpenProcessToken)
  • TG9va3VwUHJpdmlsZWdlVmFsdWVB (LookupPrivilegeValueA)
  • YWR2YXBpMzIuZGxs (advapi32.dll)

Match: win_private_profile

  • R2V0UHJpdmF0ZVByb2ZpbGVJbnRB (GetPrivateProfileIntA)
  • R2V0UHJpdmF0ZVByb2ZpbGVTdHJpbmdB (GetPrivateProfileStringA)
  • S0VSTkVMMzIuRExM (KERNEL32.DLL)
  • S0VSTkVMMzIuZGxs (KERNEL32.dll)
  • V3JpdGVQcml2YXRlUHJvZmlsZVN0cmluZ0E= (WritePrivateProfileStringA)
  • a2VybmVsMzIuZGxs (kernel32.dll)

Match: win_files_operation

  • Q29weUZpbGU= (CopyFile)
  • Q3JlYXRlRmlsZUE= (CreateFileA)
  • RGVsZXRlRmlsZUE= (DeleteFileA)
  • RmluZENsb3Nl (FindClose)
  • RmluZEZpcnN0RmlsZUE= (FindFirstFileA)
  • S0VSTkVMMzIuRExM (KERNEL32.DLL)
  • S0VSTkVMMzIuZGxs (KERNEL32.dll)
  • TW92ZUZpbGVFeEE= (MoveFileExA)
  • U2V0RmlsZUF0dHJpYnV0ZXNB (SetFileAttributesA)
  • U2V0RmlsZVBvaW50ZXI= (SetFilePointer)
  • UmVhZEZpbGU= (ReadFile)
  • V3JpdGVGaWxl (WriteFile)
  • a2VybmVsMzIuZGxs (kernel32.dll)

Match: Str_Win32_Winsock2_Library

  • V1MyXzMyLmRsbA== (WS2_32.dll)
  • d3MyXzMyLmRsbA== (ws2_32.dll)

Match: Str_Win32_Wininet_Library

  • d2luaW5ldC5kbGw= (wininet.dll)

Match: Str_Win32_Internet_API

  • SW50ZXJuZXRDb25uZWN0 (InternetConnect)
  • SW50ZXJuZXRDbG9zZUhhbmRsZQ== (InternetCloseHandle)
  • SW50ZXJuZXRPcGVu (InternetOpen)
  • SW50ZXJuZXRSZWFkRmlsZQ== (InternetReadFile)

Match: Str_Win32_Http_API

  • SHR0cE9wZW5SZXF1ZXN0 (HttpOpenRequest)
  • SHR0cFF1ZXJ5SW5mbw== (HttpQueryInfo)
  • SHR0cFNlbmRSZXF1ZXN0 (HttpSendRequest)

Match: DebuggerCheck__GlobalFlags

  • TnRHbG9iYWxGbGFncw== (NtGlobalFlags)

Match: DebuggerCheck__QueryInfo

  • UXVlcnlJbmZvcm1hdGlvblByb2Nlc3M= (QueryInformationProcess)

Match: DebuggerCheck__RemoteAPI

  • Q2hlY2tSZW1vdGVEZWJ1Z2dlclByZXNlbnQ= (CheckRemoteDebuggerPresent)

Match: DebuggerHiding__Thread

  • U2V0SW5mb3JtYXRpb25UaHJlYWQ= (SetInformationThread)

Match: DebuggerHiding__Active

  • RGVidWdBY3RpdmVQcm9jZXNz (DebugActiveProcess)

Match: DebuggerException__ConsoleCtrl

  • R2VuZXJhdGVDb25zb2xlQ3RybEV2ZW50 (GenerateConsoleCtrlEvent)

Match: DebuggerException__SetConsoleCtrl

  • U2V0Q29uc29sZUN0cmxIYW5kbGVy (SetConsoleCtrlHandler)

Match: ThreadControl__Context

  • U2V0VGhyZWFkQ29udGV4dA== (SetThreadContext)

Match: SEH__vectored

  • QWRkVmVjdG9yZWRFeGNlcHRpb25IYW5kbGVy (AddVectoredExceptionHandler)
  • UmVtb3ZlVmVjdG9yZWRFeGNlcHRpb25IYW5kbGVy (RemoveVectoredExceptionHandler)

Match: Check_Dlls

  • ZGJnaGVscC5kbGw= (dbghelp.dll)
  • cABzAHQAbwByAGUAYwAuAGQAbABsAA== (pstorec.dll)
  • cHN0b3JlYy5kbGw= (pstorec.dll)

Match: anti_dbg

  • Q29udGludWVEZWJ1Z0V2ZW50 (ContinueDebugEvent)
  • Q2hlY2tSZW1vdGVEZWJ1Z2dlclByZXNlbnQ= (CheckRemoteDebuggerPresent)
  • RGVidWdBY3RpdmVQcm9jZXNz (DebugActiveProcess)
  • S0VSTkVMMzIuRExM (KERNEL32.DLL)
  • S0VSTkVMMzIuZGxs (KERNEL32.dll)
  • SXNEZWJ1Z2dlclByZXNlbnQ= (IsDebuggerPresent)
  • T3V0cHV0RGVidWdTdHJpbmc= (OutputDebugString)
  • a2VybmVsMzIuZGxs (kernel32.dll)

Match: antisb_threatExpert

  • ZGJnaGVscC5kbGw= (dbghelp.dll)

Match: disable_dep

  • TnRTZXRJbmZvcm1hdGlvblByb2Nlc3M= (NtSetInformationProcess)
  • U2V0UHJvY2Vzc0RFUFBvbGljeQ== (SetProcessDEPPolicy)
  • WndQcm90ZWN0VmlydHVhbE1lbW9yeQ== (ZwProtectVirtualMemory)

Match: win_hook

  • Q2FsbE5leHRIb29rRXg= (CallNextHookEx)
  • U2V0V2luZG93c0hvb2tFeEE= (SetWindowsHookExA)
  • VVNFUjMyLmRsbA== (USER32.dll)
  • VW5ob29rV2luZG93c0hvb2tFeA== (UnhookWindowsHookEx)
  • dXNlcjMyLmRsbA== (user32.dll)

Process memory dump for PhoenixMiner.exe (PID 8400, dump 1)

Extracted/injected images (may contain unpacked executables)
Download #1

Yara signatures matches on process memory

Match: network_tcp_listen

  • QWNjZXB0RXg= (AcceptEx)
  • R2V0QWNjZXB0RXhTb2NrYWRkcnM= (GetAcceptExSockaddrs)
  • TVNXU09DSy5kbGw= (MSWSOCK.dll)
  • V1MyXzMyLmRsbA== (WS2_32.dll)
  • V1NBU29ja2V0 (WSASocket)
  • V1NBU3RhcnR1cA== (WSAStartup)
  • YWNjZXB0 (accept)
  • YmluZA== (bind)
  • bGlzdGVu (listen)

Match: network_tcp_socket

  • V1MyXzMyLmRsbA== (WS2_32.dll)
  • V1NBU29ja2V0 (WSASocket)
  • V1NBU2VuZA== (WSASend)
  • V1NBU3RhcnR1cA== (WSAStartup)
  • Y29ubmVjdA== (connect)
  • c29ja2V0 (socket)
  • c2VuZA== (send)

Match: network_dns

  • V1MyXzMyLmRsbA== (WS2_32.dll)
  • Z2V0YWRkcmluZm8= (getaddrinfo)
  • Z2V0aG9zdGJ5bmFtZQ== (gethostbyname)

Match: migrate_apc

  • T3BlblRocmVhZA== (OpenThread)
  • UXVldWVVc2VyQVBD (QueueUserAPC)

Match: win_mutex

  • Q3JlYXRlTXV0ZXg= (CreateMutex)

Match: win_registry

  • QURWQVBJMzIuZGxs (ADVAPI32.dll)
  • UmVnQ2xvc2VLZXk= (RegCloseKey)
  • UmVnT3BlbktleUV4QQ== (RegOpenKeyExA)
  • UmVnUXVlcnlWYWx1ZUV4QQ== (RegQueryValueExA)

Match: win_token

  • QURWQVBJMzIuZGxs (ADVAPI32.dll)
  • T3BlblByb2Nlc3NUb2tlbg== (OpenProcessToken)

Match: win_files_operation

  • RmluZENsb3Nl (FindClose)
  • S0VSTkVMMzIuZGxs (KERNEL32.dll)
  • U2V0RmlsZVBvaW50ZXI= (SetFilePointer)
  • UmVhZEZpbGU= (ReadFile)
  • V3JpdGVGaWxl (WriteFile)

Match: Str_Win32_Winsock2_Library

  • V1MyXzMyLmRsbA== (WS2_32.dll)

Match: DebuggerCheck__GlobalFlags

  • TnRHbG9iYWxGbGFncw== (NtGlobalFlags)

Match: DebuggerCheck__QueryInfo

  • UXVlcnlJbmZvcm1hdGlvblByb2Nlc3M= (QueryInformationProcess)

Match: DebuggerHiding__Thread

  • U2V0SW5mb3JtYXRpb25UaHJlYWQ= (SetInformationThread)

Match: DebuggerHiding__Active

  • RGVidWdBY3RpdmVQcm9jZXNz (DebugActiveProcess)

Match: DebuggerException__SetConsoleCtrl

  • U2V0Q29uc29sZUN0cmxIYW5kbGVy (SetConsoleCtrlHandler)

Match: ThreadControl__Context

  • U2V0VGhyZWFkQ29udGV4dA== (SetThreadContext)

Match: SEH__vectored

  • QWRkVmVjdG9yZWRFeGNlcHRpb25IYW5kbGVy (AddVectoredExceptionHandler)
  • UmVtb3ZlVmVjdG9yZWRFeGNlcHRpb25IYW5kbGVy (RemoveVectoredExceptionHandler)

Match: anti_dbg

  • RGVidWdBY3RpdmVQcm9jZXNz (DebugActiveProcess)
  • S0VSTkVMMzIuZGxs (KERNEL32.dll)
  • SXNEZWJ1Z2dlclByZXNlbnQ= (IsDebuggerPresent)
  • T3V0cHV0RGVidWdTdHJpbmc= (OutputDebugString)

Match: disable_dep

  • TnRTZXRJbmZvcm1hdGlvblByb2Nlc3M= (NtSetInformationProcess)
  • WndQcm90ZWN0VmlydHVhbE1lbW9yeQ== (ZwProtectVirtualMemory)

URLs found in process memory 
    https://curl.haxx.se/docs/http-cookies.html
    http://www.openssl.org/support/faq.html

Process memory dump for PhoenixMiner.exe (PID 8400, dump 2)

Extracted/injected images (may contain unpacked executables)
Download #1

Yara signatures matches on process memory

Match: inject_thread

  • Q3JlYXRlUmVtb3RlVGhyZWFk (CreateRemoteThread)
  • Q3JlYXRlVGhyZWFk (CreateThread)
  • T3BlblByb2Nlc3M= (OpenProcess)
  • TnRXcml0ZVZpcnR1YWxNZW1vcnk= (NtWriteVirtualMemory)
  • V3JpdGVQcm9jZXNzTWVtb3J5 (WriteProcessMemory)
  • VmlydHVhbEFsbG9jRXg= (VirtualAllocEx)

Match: create_service

  • Q29udHJvbFNlcnZpY2U= (ControlService)
  • Q3JlYXRlU2VydmljZQ== (CreateService)
  • QURWQVBJMzIuZGxs (ADVAPI32.dll)
  • U3RhcnRTZXJ2aWNl (StartService)
  • UXVlcnlTZXJ2aWNlU3RhdHVz (QueryServiceStatus)
  • YWR2YXBpMzIuZGxs (advapi32.dll)

Match: network_udp_sock

  • V1MyXzMyLkRMTA== (WS2_32.DLL)
  • V1MyXzMyLmRsbA== (WS2_32.dll)
  • V1NBU2VuZFRv (WSASendTo)
  • V1NBU3RhcnR1cA== (WSAStartup)
  • V1NBUmVjdkZyb20= (WSARecvFrom)
  • c2VuZHRv (sendto)
  • cmVjdmZyb20= (recvfrom)
  • d3MyXzMyLmRsbA== (ws2_32.dll)

Match: network_tcp_listen

  • QWNjZXB0RXg= (AcceptEx)
  • R2V0QWNjZXB0RXhTb2NrYWRkcnM= (GetAcceptExSockaddrs)
  • TVNXU09DSy5kbGw= (MSWSOCK.dll)
  • V1MyXzMyLkRMTA== (WS2_32.DLL)
  • V1MyXzMyLmRsbA== (WS2_32.dll)
  • V1NBQWNjZXB0 (WSAAccept)
  • V1NBU29ja2V0 (WSASocket)
  • V1NBU3RhcnR1cA== (WSAStartup)
  • YWNjZXB0 (accept)
  • YmluZA== (bind)
  • bGlzdGVu (listen)
  • bXN3c29jay5kbGw= (mswsock.dll)
  • d3MyXzMyLmRsbA== (ws2_32.dll)

Match: network_p2p_win

  • UGVlckNvbGxhYkV4cG9ydENvbnRhY3Q= (PeerCollabExportContact)
  • UGVlckNvbGxhYkdldEFwcGxpY2F0aW9uUmVnaXN0cmF0aW9uSW5mbw== (PeerCollabGetApplicationRegistrationInfo)
  • UGVlckNvbGxhYkdldEV2ZW50RGF0YQ== (PeerCollabGetEventData)
  • UGVlckNvbGxhYkdldEVuZHBvaW50TmFtZQ== (PeerCollabGetEndpointName)
  • UGVlckNvbGxhYkdldEludml0YXRpb25SZXNwb25zZQ== (PeerCollabGetInvitationResponse)
  • UGVlckNvbGxhYkdldFByZXNlbmNlSW5mbw== (PeerCollabGetPresenceInfo)
  • UGVlckNvbGxhYkdldFNpZ25pbk9wdGlvbnM= (PeerCollabGetSigninOptions)
  • UGVlckNvbGxhYkludml0ZUNvbnRhY3Q= (PeerCollabInviteContact)
  • UGVlckNvbGxhYkludml0ZUVuZHBvaW50 (PeerCollabInviteEndpoint)
  • UGVlckNvbGxhYlBhcnNlQ29udGFjdA== (PeerCollabParseContact)
  • UGVlckNvbGxhYlF1ZXJ5Q29udGFjdERhdGE= (PeerCollabQueryContactData)
  • UGVlckNvbGxhYlJlZ2lzdGVyQXBwbGljYXRpb24= (PeerCollabRegisterApplication)
  • UGVlckNvbGxhYlJlZ2lzdGVyRXZlbnQ= (PeerCollabRegisterEvent)
  • UGVlckNvbGxhYlJlZnJlc2hFbmRwb2ludERhdGE= (PeerCollabRefreshEndpointData)
  • UGVlckNvbGxhYlNldE9iamVjdA== (PeerCollabSetObject)
  • UGVlckNvbGxhYlNldEVuZHBvaW50TmFtZQ== (PeerCollabSetEndpointName)
  • UGVlckNvbGxhYlNldFByZXNlbmNlSW5mbw== (PeerCollabSetPresenceInfo)
  • UGVlckNvbGxhYlNpZ25vdXQ= (PeerCollabSignout)
  • UGVlckNvbGxhYlVucmVnaXN0ZXJBcHBsaWNhdGlvbg== (PeerCollabUnregisterApplication)
  • UGVlckNvbGxhYlVwZGF0ZUNvbnRhY3Q= (PeerCollabUpdateContact)

Match: network_http

  • SHR0cE9wZW5SZXF1ZXN0 (HttpOpenRequest)
  • SHR0cFNlbmRSZXF1ZXN0 (HttpSendRequest)
  • SW50ZXJuZXRDb25uZWN0 (InternetConnect)
  • SW50ZXJuZXRPcGVu (InternetOpen)
  • SW50ZXJuZXRPcGVuVXJs (InternetOpenUrl)
  • SW50ZXJuZXRSZWFkRmlsZQ== (InternetReadFile)
  • SW50ZXJuZXRXcml0ZUZpbGU= (InternetWriteFile)
  • d2luaW5ldC5kbGw= (wininet.dll)

Match: network_dropper

  • VVJMRG93bmxvYWRUb0NhY2hlRmlsZQ== (URLDownloadToCacheFile)
  • VVJMRG93bmxvYWRUb0ZpbGU= (URLDownloadToFile)
  • dXJsbW9uLmRsbA== (urlmon.dll)

Match: network_ftp

  • RnRwQ3JlYXRlRGlyZWN0b3J5 (FtpCreateDirectory)
  • RnRwR2V0Q3VycmVudERpcmVjdG9yeQ== (FtpGetCurrentDirectory)
  • RnRwR2V0RmlsZQ== (FtpGetFile)
  • RnRwR2V0RmlsZVNpemU= (FtpGetFileSize)
  • RnRwRGVsZXRlRmlsZQ== (FtpDeleteFile)
  • RnRwT3BlbkZpbGU= (FtpOpenFile)
  • RnRwU2V0Q3VycmVudERpcmVjdG9yeQ== (FtpSetCurrentDirectory)
  • RnRwUHV0RmlsZQ== (FtpPutFile)
  • RnRwUmVtb3ZlRGlyZWN0b3J5 (FtpRemoveDirectory)
  • RnRwUmVuYW1lRmlsZQ== (FtpRenameFile)
  • d2luaW5ldC5kbGw= (wininet.dll)

Match: network_tcp_socket

  • V1MyXzMyLkRMTA== (WS2_32.DLL)
  • V1MyXzMyLmRsbA== (WS2_32.dll)
  • V1NBQ29ubmVjdA== (WSAConnect)
  • V1NBQ2xlYW51cA== (WSACleanup)
  • V1NBU29ja2V0 (WSASocket)
  • V1NBU2VuZA== (WSASend)
  • V1NBU3RhcnR1cA== (WSAStartup)
  • Y29ubmVjdA== (connect)
  • Y2xvc2Vzb2NrZXQ= (closesocket)
  • c29ja2V0 (socket)
  • c2VuZA== (send)
  • d3MyXzMyLmRsbA== (ws2_32.dll)

Match: network_dns

  • RE5TQVBJLmRsbA== (DNSAPI.dll)
  • RG5zUXVlcnk= (DnsQuery)
  • V1MyXzMyLkRMTA== (WS2_32.DLL)
  • V1MyXzMyLmRsbA== (WS2_32.dll)
  • V1NBQXN5bmNHZXRIb3N0QnlOYW1l (WSAAsyncGetHostByName)
  • Z2V0YWRkcmluZm8= (getaddrinfo)
  • Z2V0aG9zdGJ5bmFtZQ== (gethostbyname)
  • ZG5zYXBpLmRsbA== (dnsapi.dll)
  • d3MyXzMyLmRsbA== (ws2_32.dll)

Match: network_dga

  • Q1JZUFQzMi5ETEw= (CRYPT32.DLL)
  • Q1JZUFQzMi5kbGw= (CRYPT32.dll)
  • Q3J5cHRBY3F1aXJlQ29udGV4dA== (CryptAcquireContext)
  • Q3J5cHRDcmVhdGVIYXNo (CryptCreateHash)
  • Q3J5cHRIYXNoRGF0YQ== (CryptHashData)
  • QURWQVBJMzIuZGxs (ADVAPI32.dll)
  • R2V0U3lzdGVtVGltZQ== (GetSystemTime)
  • R2V0U3lzdGVtVGltZUFzRmlsZVRpbWU= (GetSystemTimeAsFileTime)
  • SW50ZXJuZXRPcGVu (InternetOpen)
  • SW50ZXJuZXRPcGVuVXJs (InternetOpenUrl)
  • U3lzdGVtVGltZVRvRmlsZVRpbWU= (SystemTimeToFileTime)
  • Y3J5cHQzMi5kbGw= (crypt32.dll)
  • YWR2YXBpMzIuZGxs (advapi32.dll)
  • Z2V0YWRkcmluZm8= (getaddrinfo)
  • Z2V0aG9zdGJ5bmFtZQ== (gethostbyname)
  • d2luaW5ldC5kbGw= (wininet.dll)

Match: bitcoin

  • b3BlbmdsMzIuZGxs (opengl32.dll)
  • bnZjdWRhLmRsbA== (nvcuda.dll)
  • c3RyYXR1bQ== (stratum)

Match: escalate_priv

  • QURWQVBJMzIuZGxs (ADVAPI32.dll)
  • QWRqdXN0VG9rZW5Qcml2aWxlZ2Vz (AdjustTokenPrivileges)
  • YWR2YXBpMzIuZGxs (advapi32.dll)

Match: screenshot

  • Qml0Qmx0 (BitBlt)
  • R0RJMzIuZGxs (GDI32.dll)
  • R2V0REM= (GetDC)
  • VVNFUjMyLmRsbA== (USER32.dll)
  • Z2RpMzIuZGxs (gdi32.dll)
  • dXNlcjMyLmRsbA== (user32.dll)

Match: keylogger

  • R2V0QXN5bmNLZXlTdGF0ZQ== (GetAsyncKeyState)
  • R2V0S2V5U3RhdGU= (GetKeyState)
  • R2V0S2V5Ym9hcmRUeXBl (GetKeyboardType)
  • TWFwVmlydHVhbEtleQ== (MapVirtualKey)
  • VVNFUjMyLmRsbA== (USER32.dll)
  • dXNlcjMyLmRsbA== (user32.dll)

Match: cred_local

  • Q3JlZEVudW1lcmF0ZUE= (CredEnumerateA)
  • Q3JlZEVudW1lcmF0ZVc= (CredEnumerateW)
  • THNhRW51bWVyYXRlTG9nb25TZXNzaW9ucw== (LsaEnumerateLogonSessions)
  • U2FtSUNvbm5lY3Q= (SamIConnect)
  • U2FtUXVlcnlJbmZvcm1hdGlvblVzZQ== (SamQueryInformationUse)

Match: sniff_audio

  • d2F2ZUluQ2xvc2U= (waveInClose)
  • d2F2ZUluQWRkQnVmZmVy (waveInAddBuffer)
  • d2F2ZUluT3Blbg== (waveInOpen)
  • d2F2ZUluU3RhcnQ= (waveInStart)
  • d2F2ZUluUmVzZXQ= (waveInReset)
  • d2lubW0uZGxs (winmm.dll)

Match: migrate_apc

  • T3BlblRocmVhZA== (OpenThread)
  • UXVldWVVc2VyQVBD (QueueUserAPC)

Match: spreading_share

  • TmV0U2hhcmVFbnVt (NetShareEnum)
  • TmV0U2hhcmVHZXRJbmZv (NetShareGetInfo)
  • bmV0YXBpMzIuZGxs (netapi32.dll)

Match: win_mutex

  • Q3JlYXRlTXV0ZXg= (CreateMutex)

Match: win_registry

  • QURWQVBJMzIuZGxs (ADVAPI32.dll)
  • UmVnQ2xvc2VLZXk= (RegCloseKey)
  • UmVnQ3JlYXRlS2V5QQ== (RegCreateKeyA)
  • UmVnT3BlbktleUV4QQ== (RegOpenKeyExA)
  • UmVnU2V0VmFsdWVFeEE= (RegSetValueExA)
  • UmVnUXVlcnlWYWx1ZUV4QQ== (RegQueryValueExA)
  • YWR2YXBpMzIuZGxs (advapi32.dll)

Match: win_token

  • QURWQVBJMzIuZGxs (ADVAPI32.dll)
  • QWRqdXN0VG9rZW5Qcml2aWxlZ2Vz (AdjustTokenPrivileges)
  • RHVwbGljYXRlVG9rZW5FeA== (DuplicateTokenEx)
  • T3BlblByb2Nlc3NUb2tlbg== (OpenProcessToken)
  • TG9va3VwUHJpdmlsZWdlVmFsdWVB (LookupPrivilegeValueA)
  • YWR2YXBpMzIuZGxs (advapi32.dll)

Match: win_private_profile

  • R2V0UHJpdmF0ZVByb2ZpbGVJbnRB (GetPrivateProfileIntA)
  • R2V0UHJpdmF0ZVByb2ZpbGVTdHJpbmdB (GetPrivateProfileStringA)
  • S0VSTkVMMzIuZGxs (KERNEL32.dll)
  • V3JpdGVQcml2YXRlUHJvZmlsZVN0cmluZ0E= (WritePrivateProfileStringA)

Match: win_files_operation

  • Q29weUZpbGU= (CopyFile)
  • Q3JlYXRlRmlsZUE= (CreateFileA)
  • RGVsZXRlRmlsZUE= (DeleteFileA)
  • RmluZENsb3Nl (FindClose)
  • RmluZEZpcnN0RmlsZUE= (FindFirstFileA)
  • S0VSTkVMMzIuZGxs (KERNEL32.dll)
  • TW92ZUZpbGVFeEE= (MoveFileExA)
  • U2V0RmlsZUF0dHJpYnV0ZXNB (SetFileAttributesA)
  • U2V0RmlsZVBvaW50ZXI= (SetFilePointer)
  • UmVhZEZpbGU= (ReadFile)
  • V3JpdGVGaWxl (WriteFile)

Match: Str_Win32_Winsock2_Library

  • V1MyXzMyLkRMTA== (WS2_32.DLL)
  • V1MyXzMyLmRsbA== (WS2_32.dll)
  • d3MyXzMyLmRsbA== (ws2_32.dll)

Match: Str_Win32_Wininet_Library

  • d2luaW5ldC5kbGw= (wininet.dll)

Match: Str_Win32_Internet_API

  • SW50ZXJuZXRDb25uZWN0 (InternetConnect)
  • SW50ZXJuZXRDbG9zZUhhbmRsZQ== (InternetCloseHandle)
  • SW50ZXJuZXRPcGVu (InternetOpen)
  • SW50ZXJuZXRSZWFkRmlsZQ== (InternetReadFile)

Match: Str_Win32_Http_API

  • SHR0cE9wZW5SZXF1ZXN0 (HttpOpenRequest)
  • SHR0cFF1ZXJ5SW5mbw== (HttpQueryInfo)
  • SHR0cFNlbmRSZXF1ZXN0 (HttpSendRequest)

Match: DebuggerCheck__GlobalFlags

  • TnRHbG9iYWxGbGFncw== (NtGlobalFlags)

Match: DebuggerCheck__QueryInfo

  • UXVlcnlJbmZvcm1hdGlvblByb2Nlc3M= (QueryInformationProcess)

Match: DebuggerCheck__RemoteAPI

  • Q2hlY2tSZW1vdGVEZWJ1Z2dlclByZXNlbnQ= (CheckRemoteDebuggerPresent)

Match: DebuggerHiding__Thread

  • U2V0SW5mb3JtYXRpb25UaHJlYWQ= (SetInformationThread)

Match: DebuggerHiding__Active

  • RGVidWdBY3RpdmVQcm9jZXNz (DebugActiveProcess)

Match: DebuggerException__ConsoleCtrl

  • R2VuZXJhdGVDb25zb2xlQ3RybEV2ZW50 (GenerateConsoleCtrlEvent)

Match: DebuggerException__SetConsoleCtrl

  • U2V0Q29uc29sZUN0cmxIYW5kbGVy (SetConsoleCtrlHandler)

Match: ThreadControl__Context

  • U2V0VGhyZWFkQ29udGV4dA== (SetThreadContext)

Match: SEH__vectored

  • QWRkVmVjdG9yZWRFeGNlcHRpb25IYW5kbGVy (AddVectoredExceptionHandler)
  • UmVtb3ZlVmVjdG9yZWRFeGNlcHRpb25IYW5kbGVy (RemoveVectoredExceptionHandler)

Match: Check_Dlls

  • ZGJnaGVscC5kbGw= (dbghelp.dll)
  • cHN0b3JlYy5kbGw= (pstorec.dll)

Match: anti_dbg

  • Q29udGludWVEZWJ1Z0V2ZW50 (ContinueDebugEvent)
  • Q2hlY2tSZW1vdGVEZWJ1Z2dlclByZXNlbnQ= (CheckRemoteDebuggerPresent)
  • RGVidWdBY3RpdmVQcm9jZXNz (DebugActiveProcess)
  • S0VSTkVMMzIuZGxs (KERNEL32.dll)
  • SXNEZWJ1Z2dlclByZXNlbnQ= (IsDebuggerPresent)
  • T3V0cHV0RGVidWdTdHJpbmc= (OutputDebugString)

Match: antisb_threatExpert

  • ZGJnaGVscC5kbGw= (dbghelp.dll)

Match: disable_dep

  • TnRTZXRJbmZvcm1hdGlvblByb2Nlc3M= (NtSetInformationProcess)
  • U2V0UHJvY2Vzc0RFUFBvbGljeQ== (SetProcessDEPPolicy)
  • WndQcm90ZWN0VmlydHVhbE1lbW9yeQ== (ZwProtectVirtualMemory)

Match: win_hook

  • Q2FsbE5leHRIb29rRXg= (CallNextHookEx)
  • U2V0V2luZG93c0hvb2tFeEE= (SetWindowsHookExA)
  • VVNFUjMyLmRsbA== (USER32.dll)
  • VW5ob29rV2luZG93c0hvb2tFeA== (UnhookWindowsHookEx)
  • dXNlcjMyLmRsbA== (user32.dll)

URLs found in process memory 
    http://crl.comodo.net/TrustedCertificateServices.crl0
    http://users.ocsp.d-trust.net03
    http://crl.ssc.lt/root-b/cacrl.crl0
    http://crl.securetrust.com/STCA.crl0
    http://crl.securetrust.com/SGCA.crl0
    http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0=
    http://www.ssc.lt/cps03
    http://www.informatik.admin.ch/PKI/links/CPS_2_16_756_1_17_3_1_0.pdf0
    http://www.certificadodigital.com.br/repositorio/serasaca/crl/SerasaCAII.crl0
    https://curl.haxx.se/docs/http-cookies.html
    http://www.digsigtrust.com/DST_TRUST_CPS_v990701.html0
    http://www.microsoft.com/pki/certs/TrustListPCA.crt0
    https://www.certification.tn/cgi-bin/pub/crl/cacrl.crl0
    http://www.pkioverheid.nl/policies/root-policy0
    http://cps.chambersign.org/cps/chambersroot.html0
    http://www.e-szigno.hu/SZSZ/0
    http://www.entrust.net/CRL/Client1.crl0
    http://crl.chambersign.org/publicnotaryroot.crl0
    http://crl.comodo.net/AAACertificateServices.crl0
    http://www.certplus.com/CRL/class3.crl0
    http://logo.verisign.com/vslogo.gif0
    http://www.acabogacia.org/doc0
    http://www.disig.sk/ca/crl/ca_disig.crl0
    https://www.catcert.net/verarrel
    http://www.sk.ee/cps/0
    http://www.quovadis.bm0
    https://www.catcert.net/verarrel05
    http://www.certificadodigital.com.br/repositorio/serasaca/crl/SerasaCAI.crl0
    http://crl.chambersign.org/chambersroot.crl0
    http://www.certificadodigital.com.br/repositorio/serasaca/crl/SerasaCAIII.crl0
    http://crl.globalsign.net/root-r2.crl0
    http://certificates.starfieldtech.com/repository/1604
    http://www.d-trust.net0
    http://pki-root.ecertpki.cl/CertEnroll/E-CERT%20ROOT%20CA.crl0
    http://crl.ssc.lt/root-a/cacrl.crl0
    http://crl.usertrust.com/UTN-DATACorpSGC.crl0
    http://www.certicamara.com/certicamaraca.crl0
    http://www.d-trust.net/crl/d-trust_root_class_2_ca_2007.crl0
    http://crl.usertrust.com/UTN-USERFirst-Object.crl0)
    http://www.post.trust.ie/reposit/cps.html0
    http://www.d-trust.net/crl/d-trust_qualified_root_ca_1_2007_pn.crl0
    http://www2.public-trust.com/crl/ct/ctroot.crl0
    http://www.certicamara.com0
    http://www.pki.admin.ch/policy/CPS_2_16_756_1_17_3_21_1.pdf0
    http://fedir.comsign.co.il/cacert/ComSignAdvancedSecurityCA.crt0
    http://www.comsign.co.il/cps0
    http://crl.usertrust.com/UTN-USERFirst-NetworkApplications.crl0
    http://www.microsoft.com/pki/crl/products/TrustListPCA.crl
    http://acraiz.icpbrasil.gov.br/LCRacraiz.crl0
    http://www.signatur.rtr.at/de/directory/cps.html0
    http://www.globaltrust.info0
    http://ca.sia.it/secsrv/repository/CRL.der0J
    http://support.microsoft.com/kb/9311250
    http://crl.usertrust.com/UTN-USERFirst-ClientAuthenticationandEmail.crl0
    https://secure.a-cert.at/cgi-bin/a-cert-advanced.cgi0
    http://www.certplus.com/CRL/class3TS.crl0
    http://crl.usertrust.com/UTN-USERFirst-Hardware.crl01
    http://crl.xrampsecurity.com/XGCA.crl0
    http://repository.infonotary.com/cps/qcps.html0
    http://www.firmaprofesional.com0
    http://www.disig.sk/ca0f
    http://www.acabogacia.org0
    http://www.usertrust.com1
    http://www.e-certchile.cl/html/productos/download/CPSv1.7.pdf01
    http://www.pki.gva.es/cps0
    http://www.certicamara.com/dpc/0Z
    http://www.e-me.lv/repository0
    http://www.dnie.es/dpc0
    http://fedir.comsign.co.il/crl/ComSignCA.crl0
    http://www.wellsfargo.com/certpolicy0
    http://repository.swisssign.com/0
    https://www.certification.tn/cgi-bin/pub/crl/cacrl.crl0E
    http://crl.ssc.lt/root-c/cacrl.crl0
    http://fedir.comsign.co.il/crl/ComSignAdvancedSecurityCA.crl0
    https://www.netlock.hu/docs/
    http://www.quovadisglobal.com/cps0
    http://crl.pki.wellsfargo.com/wsprca.crl0
    http://www.a-cert.at0E
    http://www.e-szigno.hu/RootCA.crl
    http://www.e-szigno.hu/RootCA.crt0
    http://crl.netsolssl.com/NetworkSolutionsCertificateAuthority.crl0
    http://www.trustdst.com/certificates/policy/ACES-index.html0
    https://rca.e-szigno.hu/ocsp0-
    https://ca.sia.it/seccli/repository/CPS0
    http://www.chambersign.org1
    http://qual.ocsp.d-trust.net0
    http://www.ancert.com/cps0
    https://ca.sia.it/secsrv/repository/CPS0
    http://www.certifikat.dk/repository0
    http://www.entrust.net/CRL/net1.crl0
    http://www.trustcenter.de/guidelines0
    http://cps.chambersign.org/cps/publicnotaryroot.html0
    http://www.trustcenter.de/crl/v2/tc_class_2_ca_II.crl
    https://ocsp.quovadisoffshore.com0
    http://www.e-trust.be/CPS/QNcerts
    http://www.certplus.com/CRL/class1.crl0
    http://ocsp.infonotary.com/responder.cgi0V
    http://ca.disig.sk/ca/crl/ca_disig.crl0
    http://www.registradores.org/scr/normativa/cp_f2.htm0
    http://crl.oces.certifikat.dk/oces.crl0
    http://ca.sia.it/seccli/repository/CRL.der0J
    http://www.signatur.rtr.at/current.crl0
    http://www.certplus.com/CRL/class2.crl0
    http://www.a-cert.at/certificate-policy.html0
    http://www.crc.bg0
    http://crl.chambersign.org/chambersignroot.crl0
    http://www.certplus.com/CRL/class3P.crl0
    https://www.netlock.net/docs
    http://fedir.comsign.co.il/crl/ComSignSecuredCA.crl0
    http://www.microsoft.com/pki/certs/tspca.crt0
    http://ocsp.pki.gva.es0
    http://www.rootca.or.kr/rca/cps.html0
    http://crl.comodoca.com/TrustedCertificateServices.crl0:
    http://www.echoworx.com/ca/root2/cps.pdf0
    http://www.trustcenter.de/crl/v2/tc_class_3_ca_II.crl
    http://www.valicert.com/1
    http://www.openssl.org/support/faq.html
    http://crl.comodoca.com/AAACertificateServices.crl06
    http://www.sk.ee/juur/crl/0
    http://www.usertrust.com1604
    http://cps.chambersign.org/cps/chambersignroot.html0
    http://crl.comodoca.com/COMODOCertificationAuthority.crl0
    http://www.d-trust.net/crl/d-trust_root_class_3_ca_2007.crl0