popup
procMemory | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Process Memory

Process memory dump for Daemon.exe (PID 112, dump 1)

Extracted/injected images (may contain unpacked executables)
Download #1

Yara signatures matches on process memory

Match: inject_thread

  • Q3JlYXRlUmVtb3RlVGhyZWFk (CreateRemoteThread)
  • Q3JlYXRlVGhyZWFk (CreateThread)
  • T3BlblByb2Nlc3M= (OpenProcess)
  • TnRXcml0ZVZpcnR1YWxNZW1vcnk= (NtWriteVirtualMemory)
  • V3JpdGVQcm9jZXNzTWVtb3J5 (WriteProcessMemory)
  • VmlydHVhbEFsbG9jRXg= (VirtualAllocEx)

Match: hijack_network

  • U09GVFdBUkVcQ2xhc3Nlc1xQUk9UT0NPTFNcSGFuZGxlcg== (SOFTWARE\Classes\PROTOCOLS\Handler)
  • ZHJpdmVyc1xldGNcaG9zdHM= (drivers\etc\hosts)

Match: create_service

  • Q29udHJvbFNlcnZpY2U= (ControlService)
  • Q3JlYXRlU2VydmljZQ== (CreateService)
  • QURWQVBJMzIuRExM (ADVAPI32.DLL)
  • QURWQVBJMzIuZGxs (ADVAPI32.dll)
  • U3RhcnRTZXJ2aWNl (StartService)
  • UXVlcnlTZXJ2aWNlU3RhdHVz (QueryServiceStatus)
  • YWR2YXBpMzIuZGxs (advapi32.dll)

Match: create_com_service

  • RGxsQ2FuVW5sb2FkTm93 (DllCanUnloadNow)
  • RGxsR2V0Q2xhc3NPYmplY3Q= (DllGetClassObject)
  • RGxsSW5zdGFsbA== (DllInstall)
  • RGxsUmVnaXN0ZXJTZXJ2ZXI= (DllRegisterServer)
  • RGxsVW5yZWdpc3RlclNlcnZlcg== (DllUnregisterServer)

Match: network_udp_sock

  • U3lzdGVtLk5ldA== (System.Net)
  • V1MyXzMyLkRMTA== (WS2_32.DLL)
  • V1MyXzMyLmRsbA== (WS2_32.dll)
  • V1NBU2VuZFRv (WSASendTo)
  • V1NBU3RhcnR1cA== (WSAStartup)
  • V1NBUmVjdkZyb20= (WSARecvFrom)
  • V1NPQ0szMi5kbGw= (WSOCK32.dll)
  • c2VuZHRv (sendto)
  • cmVjdmZyb20= (recvfrom)
  • d3MyXzMyLmRsbA== (ws2_32.dll)

Match: network_tcp_listen

  • QWNjZXB0RXg= (AcceptEx)
  • R2V0QWNjZXB0RXhTb2NrYWRkcnM= (GetAcceptExSockaddrs)
  • TVNXU09DSy5kbGw= (MSWSOCK.dll)
  • U3lzdGVtLk5ldA== (System.Net)
  • V1MyXzMyLkRMTA== (WS2_32.DLL)
  • V1MyXzMyLmRsbA== (WS2_32.dll)
  • V1NBQWNjZXB0 (WSAAccept)
  • V1NBU29ja2V0 (WSASocket)
  • V1NBU3RhcnR1cA== (WSAStartup)
  • V1NPQ0szMi5kbGw= (WSOCK32.dll)
  • YWNjZXB0 (accept)
  • YmluZA== (bind)
  • bGlzdGVu (listen)
  • bXN3c29jay5kbGw= (mswsock.dll)
  • d3MyXzMyLmRsbA== (ws2_32.dll)

Match: network_toredo

  • XEN1cnJlbnRDb250cm9sU2V0XFNlcnZpY2VzXFRjcGlwNlxQYXJhbWV0ZXJzXEludGVyZmFjZXNc (\CurrentControlSet\Services\Tcpip6\Parameters\Interfaces\)
  • ZmlyZXdhbGxhcGkuZGxs (firewallapi.dll)

Match: network_p2p_win

  • UGVlckNvbGxhYkV4cG9ydENvbnRhY3Q= (PeerCollabExportContact)
  • UGVlckNvbGxhYkdldEFwcGxpY2F0aW9uUmVnaXN0cmF0aW9uSW5mbw== (PeerCollabGetApplicationRegistrationInfo)
  • UGVlckNvbGxhYkdldEV2ZW50RGF0YQ== (PeerCollabGetEventData)
  • UGVlckNvbGxhYkdldEVuZHBvaW50TmFtZQ== (PeerCollabGetEndpointName)
  • UGVlckNvbGxhYkdldEludml0YXRpb25SZXNwb25zZQ== (PeerCollabGetInvitationResponse)
  • UGVlckNvbGxhYkdldFByZXNlbmNlSW5mbw== (PeerCollabGetPresenceInfo)
  • UGVlckNvbGxhYkdldFNpZ25pbk9wdGlvbnM= (PeerCollabGetSigninOptions)
  • UGVlckNvbGxhYkludml0ZUNvbnRhY3Q= (PeerCollabInviteContact)
  • UGVlckNvbGxhYkludml0ZUVuZHBvaW50 (PeerCollabInviteEndpoint)
  • UGVlckNvbGxhYlBhcnNlQ29udGFjdA== (PeerCollabParseContact)
  • UGVlckNvbGxhYlF1ZXJ5Q29udGFjdERhdGE= (PeerCollabQueryContactData)
  • UGVlckNvbGxhYlJlZ2lzdGVyQXBwbGljYXRpb24= (PeerCollabRegisterApplication)
  • UGVlckNvbGxhYlJlZ2lzdGVyRXZlbnQ= (PeerCollabRegisterEvent)
  • UGVlckNvbGxhYlJlZnJlc2hFbmRwb2ludERhdGE= (PeerCollabRefreshEndpointData)
  • UGVlckNvbGxhYlNldE9iamVjdA== (PeerCollabSetObject)
  • UGVlckNvbGxhYlNldEVuZHBvaW50TmFtZQ== (PeerCollabSetEndpointName)
  • UGVlckNvbGxhYlNldFByZXNlbmNlSW5mbw== (PeerCollabSetPresenceInfo)
  • UGVlckNvbGxhYlNpZ25vdXQ= (PeerCollabSignout)
  • UGVlckNvbGxhYlVucmVnaXN0ZXJBcHBsaWNhdGlvbg== (PeerCollabUnregisterApplication)
  • UGVlckNvbGxhYlVwZGF0ZUNvbnRhY3Q= (PeerCollabUpdateContact)

Match: network_http

  • SHR0cE9wZW5SZXF1ZXN0 (HttpOpenRequest)
  • SHR0cFNlbmRSZXF1ZXN0 (HttpSendRequest)
  • SW50ZXJuZXRDb25uZWN0 (InternetConnect)
  • SW50ZXJuZXRPcGVu (InternetOpen)
  • SW50ZXJuZXRPcGVuVXJs (InternetOpenUrl)
  • SW50ZXJuZXRSZWFkRmlsZQ== (InternetReadFile)
  • SW50ZXJuZXRXcml0ZUZpbGU= (InternetWriteFile)
  • V0lOSU5FVC5kbGw= (WININET.dll)
  • d2luaW5ldC5kbGw= (wininet.dll)

Match: network_dropper

  • VVJMRG93bmxvYWRUb0NhY2hlRmlsZQ== (URLDownloadToCacheFile)
  • VVJMRG93bmxvYWRUb0ZpbGU= (URLDownloadToFile)
  • VVJMT3BlblB1bGxTdHJlYW0= (URLOpenPullStream)
  • VVJMT3BlblN0cmVhbQ== (URLOpenStream)
  • VXJsbW9uLmRsbA== (Urlmon.dll)
  • dXJsbW9uLmRsbA== (urlmon.dll)

Match: network_ftp

  • RnRwQ3JlYXRlRGlyZWN0b3J5 (FtpCreateDirectory)
  • RnRwR2V0Q3VycmVudERpcmVjdG9yeQ== (FtpGetCurrentDirectory)
  • RnRwR2V0RmlsZQ== (FtpGetFile)
  • RnRwR2V0RmlsZVNpemU= (FtpGetFileSize)
  • RnRwRGVsZXRlRmlsZQ== (FtpDeleteFile)
  • RnRwT3BlbkZpbGU= (FtpOpenFile)
  • RnRwU2V0Q3VycmVudERpcmVjdG9yeQ== (FtpSetCurrentDirectory)
  • RnRwUHV0RmlsZQ== (FtpPutFile)
  • RnRwUmVtb3ZlRGlyZWN0b3J5 (FtpRemoveDirectory)
  • RnRwUmVuYW1lRmlsZQ== (FtpRenameFile)
  • V0lOSU5FVC5kbGw= (WININET.dll)
  • d2luaW5ldC5kbGw= (wininet.dll)

Match: network_tcp_socket

  • V1MyXzMyLkRMTA== (WS2_32.DLL)
  • V1MyXzMyLmRsbA== (WS2_32.dll)
  • V1NBQ29ubmVjdA== (WSAConnect)
  • V1NBQ2xlYW51cA== (WSACleanup)
  • V1NBU29ja2V0 (WSASocket)
  • V1NBU2VuZA== (WSASend)
  • V1NBU3RhcnR1cA== (WSAStartup)
  • V1NPQ0szMi5kbGw= (WSOCK32.dll)
  • Y29ubmVjdA== (connect)
  • Y2xvc2Vzb2NrZXQ= (closesocket)
  • c29ja2V0 (socket)
  • c2VuZA== (send)
  • d3MyXzMyLmRsbA== (ws2_32.dll)

Match: network_dns

  • RE5TQVBJLmRsbA== (DNSAPI.dll)
  • RG5zUXVlcnk= (DnsQuery)
  • U3lzdGVtLk5ldA== (System.Net)
  • V1MyXzMyLkRMTA== (WS2_32.DLL)
  • V1MyXzMyLmRsbA== (WS2_32.dll)
  • V1NBQXN5bmNHZXRIb3N0QnlOYW1l (WSAAsyncGetHostByName)
  • V1NPQ0szMi5kbGw= (WSOCK32.dll)
  • Z2V0YWRkcmluZm8= (getaddrinfo)
  • Z2V0aG9zdGJ5bmFtZQ== (gethostbyname)
  • ZG5zYXBpLmRsbA== (dnsapi.dll)
  • d3MyXzMyLmRsbA== (ws2_32.dll)

Match: network_dga

  • Q1JZUFQzMi5ETEw= (CRYPT32.DLL)
  • Q1JZUFQzMi5kbGw= (CRYPT32.dll)
  • Q3J5cHRBY3F1aXJlQ29udGV4dA== (CryptAcquireContext)
  • Q3J5cHRDcmVhdGVIYXNo (CryptCreateHash)
  • Q3J5cHRIYXNoRGF0YQ== (CryptHashData)
  • QURWQVBJMzIuRExM (ADVAPI32.DLL)
  • QURWQVBJMzIuZGxs (ADVAPI32.dll)
  • R2V0U3lzdGVtVGltZQ== (GetSystemTime)
  • R2V0U3lzdGVtVGltZUFzRmlsZVRpbWU= (GetSystemTimeAsFileTime)
  • SW50ZXJuZXRPcGVu (InternetOpen)
  • SW50ZXJuZXRPcGVuVXJs (InternetOpenUrl)
  • U3lzdGVtVGltZVRvRmlsZVRpbWU= (SystemTimeToFileTime)
  • V0lOSU5FVC5kbGw= (WININET.dll)
  • Y3J5cHQzMi5kbGw= (crypt32.dll)
  • YWR2YXBpMzIuZGxs (advapi32.dll)
  • Z2V0YWRkcmluZm8= (getaddrinfo)
  • Z2V0aG9zdGJ5bmFtZQ== (gethostbyname)
  • d2luaW5ldC5kbGw= (wininet.dll)

Match: escalate_priv

  • QURWQVBJMzIuRExM (ADVAPI32.DLL)
  • QURWQVBJMzIuZGxs (ADVAPI32.dll)
  • QWRqdXN0VG9rZW5Qcml2aWxlZ2Vz (AdjustTokenPrivileges)
  • YWR2YXBpMzIuZGxs (advapi32.dll)

Match: screenshot

  • Qml0Qmx0 (BitBlt)
  • R0RJMzIuZGxs (GDI32.dll)
  • R2V0REM= (GetDC)
  • VVNFUjMyLkRMTA== (USER32.DLL)
  • VVNFUjMyLmRsbA== (USER32.dll)
  • Z2RpMzIuZGxs (gdi32.dll)
  • dXNlcjMyLmRsbA== (user32.dll)

Match: keylogger

  • R2V0QXN5bmNLZXlTdGF0ZQ== (GetAsyncKeyState)
  • R2V0S2V5U3RhdGU= (GetKeyState)
  • R2V0S2V5Ym9hcmRUeXBl (GetKeyboardType)
  • TWFwVmlydHVhbEtleQ== (MapVirtualKey)
  • VVNFUjMyLkRMTA== (USER32.DLL)
  • VVNFUjMyLmRsbA== (USER32.dll)
  • dXNlcjMyLmRsbA== (user32.dll)

Match: cred_local

  • Q3JlZEVudW1lcmF0ZUE= (CredEnumerateA)
  • Q3JlZEVudW1lcmF0ZVc= (CredEnumerateW)
  • THNhRW51bWVyYXRlTG9nb25TZXNzaW9ucw== (LsaEnumerateLogonSessions)
  • U2FtSUNvbm5lY3Q= (SamIConnect)
  • U2FtUXVlcnlJbmZvcm1hdGlvblVzZQ== (SamQueryInformationUse)

Match: sniff_audio

  • V0lOTU0uZGxs (WINMM.dll)
  • d2F2ZUluQ2xvc2U= (waveInClose)
  • d2F2ZUluQWRkQnVmZmVy (waveInAddBuffer)
  • d2F2ZUluT3Blbg== (waveInOpen)
  • d2F2ZUluU3RhcnQ= (waveInStart)
  • d2F2ZUluUmVzZXQ= (waveInReset)
  • d2lubW0uZGxs (winmm.dll)

Match: migrate_apc

  • T3BlblRocmVhZA== (OpenThread)
  • UXVldWVVc2VyQVBD (QueueUserAPC)

Match: spreading_file

  • ZGVza3RvcC5pbmk= (desktop.ini)

Match: spreading_share

  • TmV0U2hhcmVFbnVt (NetShareEnum)
  • TmV0U2hhcmVHZXRJbmZv (NetShareGetInfo)
  • bmV0YXBpMzIuZGxs (netapi32.dll)

Match: win_mutex

  • Q3JlYXRlTXV0ZXg= (CreateMutex)

Match: win_registry

  • QURWQVBJMzIuRExM (ADVAPI32.DLL)
  • QURWQVBJMzIuZGxs (ADVAPI32.dll)
  • UmVnQ2xvc2VLZXk= (RegCloseKey)
  • UmVnQ3JlYXRlS2V5QQ== (RegCreateKeyA)
  • UmVnT3BlbktleUV4QQ== (RegOpenKeyExA)
  • UmVnU2V0VmFsdWVFeEE= (RegSetValueExA)
  • UmVnUXVlcnlWYWx1ZUV4QQ== (RegQueryValueExA)
  • YWR2YXBpMzIuZGxs (advapi32.dll)

Match: win_token

  • QURWQVBJMzIuRExM (ADVAPI32.DLL)
  • QURWQVBJMzIuZGxs (ADVAPI32.dll)
  • QWRqdXN0VG9rZW5Qcml2aWxlZ2Vz (AdjustTokenPrivileges)
  • RHVwbGljYXRlVG9rZW5FeA== (DuplicateTokenEx)
  • T3BlblByb2Nlc3NUb2tlbg== (OpenProcessToken)
  • TG9va3VwUHJpdmlsZWdlVmFsdWVB (LookupPrivilegeValueA)
  • YWR2YXBpMzIuZGxs (advapi32.dll)

Match: win_private_profile

  • R2V0UHJpdmF0ZVByb2ZpbGVJbnRB (GetPrivateProfileIntA)
  • R2V0UHJpdmF0ZVByb2ZpbGVTdHJpbmdB (GetPrivateProfileStringA)
  • S0VSTkVMMzIuRExM (KERNEL32.DLL)
  • S0VSTkVMMzIuZGxs (KERNEL32.dll)
  • V3JpdGVQcml2YXRlUHJvZmlsZVN0cmluZ0E= (WritePrivateProfileStringA)
  • a2VybmVsMzIuZGxs (kernel32.dll)

Match: win_files_operation

  • Q29weUZpbGU= (CopyFile)
  • Q3JlYXRlRmlsZUE= (CreateFileA)
  • RGVsZXRlRmlsZUE= (DeleteFileA)
  • RmluZENsb3Nl (FindClose)
  • RmluZEZpcnN0RmlsZUE= (FindFirstFileA)
  • S0VSTkVMMzIuRExM (KERNEL32.DLL)
  • S0VSTkVMMzIuZGxs (KERNEL32.dll)
  • TW92ZUZpbGVFeEE= (MoveFileExA)
  • U2V0RmlsZUF0dHJpYnV0ZXNB (SetFileAttributesA)
  • U2V0RmlsZVBvaW50ZXI= (SetFilePointer)
  • UmVhZEZpbGU= (ReadFile)
  • V3JpdGVGaWxl (WriteFile)
  • a2VybmVsMzIuZGxs (kernel32.dll)

Match: Str_Win32_Winsock2_Library

  • V1MyXzMyLkRMTA== (WS2_32.DLL)
  • V1MyXzMyLmRsbA== (WS2_32.dll)
  • V1NPQ0szMi5kbGw= (WSOCK32.dll)
  • d3MyXzMyLmRsbA== (ws2_32.dll)

Match: Str_Win32_Wininet_Library

  • V0lOSU5FVC5kbGw= (WININET.dll)
  • d2luaW5ldC5kbGw= (wininet.dll)

Match: Str_Win32_Internet_API

  • SW50ZXJuZXRDb25uZWN0 (InternetConnect)
  • SW50ZXJuZXRDbG9zZUhhbmRsZQ== (InternetCloseHandle)
  • SW50ZXJuZXRPcGVu (InternetOpen)
  • SW50ZXJuZXRSZWFkRmlsZQ== (InternetReadFile)

Match: Str_Win32_Http_API

  • SHR0cE9wZW5SZXF1ZXN0 (HttpOpenRequest)
  • SHR0cFF1ZXJ5SW5mbw== (HttpQueryInfo)
  • SHR0cFNlbmRSZXF1ZXN0 (HttpSendRequest)

Match: DebuggerCheck__GlobalFlags

  • TnRHbG9iYWxGbGFncw== (NtGlobalFlags)

Match: DebuggerCheck__QueryInfo

  • UXVlcnlJbmZvcm1hdGlvblByb2Nlc3M= (QueryInformationProcess)

Match: DebuggerCheck__RemoteAPI

  • Q2hlY2tSZW1vdGVEZWJ1Z2dlclByZXNlbnQ= (CheckRemoteDebuggerPresent)

Match: DebuggerHiding__Thread

  • U2V0SW5mb3JtYXRpb25UaHJlYWQ= (SetInformationThread)

Match: DebuggerHiding__Active

  • RGVidWdBY3RpdmVQcm9jZXNz (DebugActiveProcess)

Match: DebuggerException__ConsoleCtrl

  • R2VuZXJhdGVDb25zb2xlQ3RybEV2ZW50 (GenerateConsoleCtrlEvent)

Match: DebuggerException__SetConsoleCtrl

  • U2V0Q29uc29sZUN0cmxIYW5kbGVy (SetConsoleCtrlHandler)

Match: ThreadControl__Context

  • U2V0VGhyZWFkQ29udGV4dA== (SetThreadContext)

Match: SEH__vectored

  • QWRkVmVjdG9yZWRFeGNlcHRpb25IYW5kbGVy (AddVectoredExceptionHandler)
  • UmVtb3ZlVmVjdG9yZWRFeGNlcHRpb25IYW5kbGVy (RemoveVectoredExceptionHandler)

Match: Check_Dlls

  • ZABiAGcAaABlAGwAcAAuAGQAbABsAA== (dbghelp.dll)
  • ZGJnaGVscC5kbGw= (dbghelp.dll)
  • cABzAHQAbwByAGUAYwAuAGQAbABsAA== (pstorec.dll)
  • cHN0b3JlYy5kbGw= (pstorec.dll)

Match: anti_dbg

  • Q29udGludWVEZWJ1Z0V2ZW50 (ContinueDebugEvent)
  • Q2hlY2tSZW1vdGVEZWJ1Z2dlclByZXNlbnQ= (CheckRemoteDebuggerPresent)
  • RGVidWdBY3RpdmVQcm9jZXNz (DebugActiveProcess)
  • S0VSTkVMMzIuRExM (KERNEL32.DLL)
  • S0VSTkVMMzIuZGxs (KERNEL32.dll)
  • SXNEZWJ1Z2dlclByZXNlbnQ= (IsDebuggerPresent)
  • T3V0cHV0RGVidWdTdHJpbmc= (OutputDebugString)
  • a2VybmVsMzIuZGxs (kernel32.dll)

Match: antisb_threatExpert

  • ZGJnaGVscC5kbGw= (dbghelp.dll)

Match: disable_dep

  • TnRTZXRJbmZvcm1hdGlvblByb2Nlc3M= (NtSetInformationProcess)
  • U2V0UHJvY2Vzc0RFUFBvbGljeQ== (SetProcessDEPPolicy)
  • WndQcm90ZWN0VmlydHVhbE1lbW9yeQ== (ZwProtectVirtualMemory)

Match: win_hook

  • Q2FsbE5leHRIb29rRXg= (CallNextHookEx)
  • U2V0V2luZG93c0hvb2tFeEE= (SetWindowsHookExA)
  • VVNFUjMyLkRMTA== (USER32.DLL)
  • VVNFUjMyLmRsbA== (USER32.dll)
  • VW5ob29rV2luZG93c0hvb2tFeA== (UnhookWindowsHookEx)
  • dXNlcjMyLmRsbA== (user32.dll)

URLs found in process memory 
    https://ssl.pstatic.net/tveta/libs/1287/1287046/6df1cc02334922baa2d4_20200806172035021.jpg
    https://ssl.pstatic.net/static/pwe/common/img_use_mobile_version.png
    https://fonts.gstatic.com/s/lato/v16/S6uyw4BMUTPHjx4wWA.woff
    http://google.com/
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0805%2FcropImg_339x222_38528621599152653.jpeg%22
    https://s.pstatic.net/static/www/mobile/edit/2020/0804/cropImg_728x360_38481254551659019.jpeg
    https://ssl.pstatic.net/tveta/libs/assets/js/common/min/probe.min.js
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic1.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0806%2FcropImg_222x145_38626953912837677.png%22
    https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct
    http://search.naver.com/search.naver?sm=tab_hty.top
    http://www.snee.com/xml/xslt/sample.doc
    http://www.yceml.net/0559/10408495-1499411010011
    https://s.pstatic.net/static/www/mobile/edit/2018/0206/cropImg_166x108_118371466370743504.jpeg
    https://s.pstatic.net/static/newsstand/up/2020/0615/nsd10319824.png
    https://fonts.gstatic.com/s/catamaran/v7/o-0bIpQoyXQa2RxT7-5B6Ryxs2E_6n1iPHjd5a7dvQ.woff
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0805%2FcropImg_339x222_38552809772500435.jpeg%22
    https://t1.daumcdn.net/tistory_admin/blogs/plugins/tatterDesk/js/src/controls.js?_version_=9024c9023ed6ab26b00b4f2905e46ffa08aeb336
    https://ssl.pstatic.net/static/pwe/nm/b.gif
    https://castbox.shopping.naver.com/js/lazyload.js
    https://s.pstatic.net/shopping.phinf/20200729_1/2931dd60-1842-4048-a39c-1e3389db4a0e.jpg
    https://ssl.pstatic.net/static/pwe/nm/spr_vertical_0d25bb77f8.png
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0805%2Fmobile_17061525298c.jpg%22
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/042.png
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/955.png
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/056.png
    http://www.buzzadnetwork.com/jump/next.php?stamat=m%7CM-4iM-4jaQdHQBH0dEdHP3xP.0e7%2CboDB7XrVJDfRqYwVNhmAc8QRCrIuseXl_bWuTf_latOFYiGEzPpb7ikp5t8RPmTHyMRYDe1i9EJZLC6LSuccW1-YPggnMxkcwVirdNVGfgK3hFUbeKvFvqNv0-u8VxfrNUFB1gFhMN_8GLCn1znxf5_p0FJe0MYRI7nbfyajoqg_H3fvzrjsMsC0vAMYn2un8v5vcBfzwM-DewoZ7WId7geGlrySfAHx5KiJ5Hm90CU%2C
    https://s.pstatic.net/shopping.phinf/20200720_22/e2297359-375a-403a-86c5-44ff86c708fc.jpg
    https://t1.daumcdn.net/tistory_admin/blogs/plugins/PreventCopyContents/js/functions.js?_version_=9024c9023ed6ab26b00b4f2905e46ffa08aeb336
    https://ssl.pstatic.net/tveta/libs/1298/1298853/743c01d46e807a376d99_20200730182507675.png
    https://tistory3.daumcdn.net/tistory/807805/skin/images/footerbg.jpg
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/820.png
    https://file-examples-com.github.io/uploads/2017/02/file-sample_1MB.doc
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/825.png
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/327.png
    https://fonts.gstatic.com/s/catamaran/v7/o-0bIpQoyXQa2RxT7-5B6Ryxs2E_6n1iPHjc5a7dvQ.woff
    http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    https://mail.naver.com/js_src/com/nhncorp/mail/write/se2_new/smart_editor2_inputarea_ie8.html?version=20190704
    https://static.nid.naver.com/loginv3/img/sp_login_20150113.gif
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/031.png
    https://tpc.googlesyndication.com/pagead/images/abg/icon.png
    https://search.pstatic.net/common/?src=http%3A%2F%2Fcafefiles.naver.net%2FMjAxNzExMDdfODcg%2FMDAxNTEwMDY0OTYzNTA5.y-bJj3BgRC8r80hM6EblWFHSqawqo5-vMJAzHBN6rEkg.vAPtUzoeY8mHPRaMuejD3HrMtW5xgv-cdeEaAc0q2Rog.PNG.flashcs7%2FScreenshot_2017-11-07-22-55-08.png%23600x1024
    https://www.gstatic.com/m/images/sy_stars_9.gif
    https://t1.daumcdn.net/tistory_admin/blogs/plugins/tatterDesk/js/src/dragdrop.js?_version_=9024c9023ed6ab26b00b4f2905e46ffa08aeb336
    https://phinf.pstatic.net/contact/20190113_166/1547312816315t3o9l_JPEG/image.JPEG?type=s80
    https://www.naver.com
    https://t1.daumcdn.net/tistory_admin/blogs/style/menubar.css?_version_=9024c9023ed6ab26b00b4f2905e46ffa08aeb336
    https://tpc.googlesyndication.com/pagead/js/r20180205/r20110914/abg.js
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/024.png
    https://c.microsoft.com/ms.js
    https://s.pstatic.net/shopping.phinf/20200806_26/3cad46ab-3fa4-4756-9e01-d61372890bd0.jpg
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0804%2Fmobile_212629657646c.jpg%22
    http://blogimgs.naver.net/nblog/skins/happybean/btn-put.gif
    https://search.pstatic.net/sunny/?src=http%3A%2F%2Fcfile3.uf.tistory.com%2Fimage%2F243C5A4E59450DE2122662%23495x414
    https://ssl.pstatic.net/tveta/libs/1291/1291338/cc656d357cbb8234799f_20200727150411687.png
    https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcTqwSwq-QDIHthGSWzqBLnUm6dtxp3vOUQnc7mSgJJsdnPqmvZCr4po_Q
    http://blogimgs.naver.com/nblog/skins/happybean/layerpopup_shadow2.png
    https://ssl.pstatic.net/static/pwe/nm/sp_mail_setup_140716.png
    https://s.pstatic.net/shopping.phinf/20180206_26/7e09abe6-c90b-4dc0-b6ef-e8ab8e8c4967.jpg
    https://www.google.com/favicon.ico
    https://mail.naver.com/js/uglified_jindo.js
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/812.png
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/932.png
    https://nid.naver.com/login/js/default/device.js
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0806%2Fmobile_152547536202c.jpg%22
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/410.png
    https://www.naver.com/favicon.ico?1
    https://s.pstatic.net/shopping.phinf/20200731_21/4628ed28-27dc-4586-871c-f7f22524da89.jpg?type=f214_292
    https://s.pstatic.net/imgshopping/static/sb/js/sb/nclktagS01_v1.js?v=2020080314
    https://castbox.shopping.naver.com/sb/main.nhn
    http://www.passport.com
    https://mail.naver.com/css/mail2_le.min.200716.css
    https://www.google-analytics.com/analytics.js
    http://v3rjvtt.com/watch?shu=d5898a8543a73e06e149801003435598
    https://s.pstatic.net/static/www/mobile/edit/2020/0804/cropImg_728x360_38481783035198675.jpeg
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/934.png
    https://s.pstatic.net/static/www/font/NanumSquareR.eot?
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/924.png
    https://fonts.googleapis.com/css?family=Open
    https://ssl.pstatic.net/tveta/libs/assets/js/pc/main/min/pc.veta.core.min.js
    https://search.pstatic.net/common/?src=http%3A%2F%2Fimage.nmv.naver.net%2Fblogucc28%2F2017%2F05%2F19%2F1052%2Fc09496170105db031e0c3c590a24708f69f3_ugcvideo_270P_01_16x9_s152.jpg
    https://file-examples.com/wp-content/themes/file-examples/vendor/font-awesome/css/font-awesome.min.css
    http://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
    https://mail.naver.com/favicon.ico?2
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/308.png
    https://s.pstatic.net/shopping.phinf/20200806_23/f63ac57a-d8b0-42f3-8f78-c2f8dbffb6a6.jpg?type=f214_292
    http://blogimgs.naver.net/nblog/guestbook/btn_close2.gif
    http://blogimgs.naver.net/nblog/btn_urlcopy.gif
    http://blogimgs.naver.net/imgs/btn_cancel.gif
    http://t.static.blog.naver.net/mylog/versioning/PostTopCommon-503675339.js
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/921.png
    http://blogimgs.naver.net/nblog/admin/layerpopup_shadow1.png
    https://s.pstatic.net/shopping.phinf/20180208_26/b170f4c4-1ca1-4a17-87e6-aefb71aa9e7e.jpg
    https://wwwimages2.adobe.com/ubi/template/identity/adobe/Cookie.js
    http://blogimgs.naver.net/nblog/skins/happybean/btn-save-off.gif
    https://s.pstatic.net/shopping.phinf/20200715_0/edf4da6f-f1d6-4a76-a095-b0506598dc0f.jpg
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0727%2FcropImg_552x408_37750071042531843.jpeg%22
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0805%2Fmobile_162859571510c.jpg%22
    https://s.pstatic.net/shopping.phinf/20200603_16/34b72b79-bb6a-40b2-b35d-ae82e0ee5115.jpg
    http://static.nid.naver.com/loginv3/commonLoginF_201505.swf
    https://fonts.gstatic.com/s/muli/v22/7Aulp_0qiz-aVz7u3PJLcUMYOFnOkEk30e4.woff
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0805%2Fmobile_17051541634c.jpg%22
    http://blogimgs.naver.net/imgs/nblog/spc.gif
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/355.png
    http://194.147.115.117/zzztop/PhoenixMiner.exe
    https://pm.pstatic.net/dist/lib/search.jindo.20200326.js?o=www
    https://s.pstatic.net/static/www/img/uit/2020/sp_shop.4e0461.png
    https://t1.daumcdn.net/tistory_admin/blogs/image/tree/folder_yellow/tab_treed_end.gif
    http://blogimgs.naver.com/blog20/blog/layout_photo/viewer2/btn_right.gif
    http://blogimgs.naver.net/imgs/btn_confirm_pop2.gif
    https://ssl.pstatic.net/static/pwe/nm/se2_new/bg_text_tool.gif
    https://nid.naver.com/login/ext/deviceConfirm.nhn?svctype=1
    https://www.winamp.com/Assets/fonts/proxima-nova/proximanovat-thin-webfont.eot
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/314.png
    http://blogimgs.naver.com/nblog/skins/infobox/0511_footer.gif
    https://fonts.gstatic.com/s/catamaran/v7/o-0bIpQoyXQa2RxT7-5B6Ryxs2E_6n1iPCbd5a7dvQ.woff
    https://ssl.pstatic.net/tveta/libs/external/js/TweenLite.min.js?20180423
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/915.png
    https://s.pstatic.net/static/newsstand/up/2017/0424/nsd144732945.png
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/005.png
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/020.png
    http://t.static.blog.naver.net/mylog/versioning/Hidden-426543577.js
    http://blogimgs.naver.net/blog20/blog/layout_photo/viewer2/btn_right.gif
    https://t1.daumcdn.net/tistory_admin/blogs/image/tree/folder_yellow/tab_opened.gif
    https://ssl.pstatic.net/tveta/libs/1296/1296957/74d4704a994b98e0aad9_20200806154233194.jpg
    https://s.pstatic.net/shopping.phinf/20200728_7/81547845-c636-45f3-9e17-9bc48e142627.jpg
    https://s.pstatic.net/shopping.phinf/20180206_3/a1ed9211-58e5-4b76-a630-fb98c98afd3a.jpg
    http://t.static.blog.naver.net/mylog/versioning/JindoComponent-190469086.js
    https://ssl.pstatic.net/tveta/libs/assets/js/pc/main/min/rollingboard_imagerolling_332_flexunit.min.js?20180423
    https://search.pstatic.net/common/?src=http%3A%2F%2Fimgnews.naver.com%2Fimage%2F5048%2F2008%2F10%2F20%2F50480000001559_0.jpg
    https://file-examples.com/?p=47
    https://www.naver.com/my.html
    https://s.pstatic.net/shopping.phinf/20200805_0/062355cb-541f-4bcc-a783-7a323705728d.jpg?type=f214_292
    http://t.static.blog.naver.net/mylog/versioning/MusicPlayer-571575557.js
    http://tveta.naver.net/libs/1187/1187983/0834f11dd0aa39a0703d_20180202155030063.jpg
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic1.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0804%2FcropImg_222x145_38437668708364905.jpeg%22
    https://s.pstatic.net/static/www/mobile/edit/2018/0207/cropImg_166x108_118447400612544791.jpeg
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0805%2Fmobile_171126163789c.jpg%22
    https://s.pstatic.net/shopping.phinf/20200730_22/d221948a-1151-457a-9c16-d1e733997523.jpg
    https://googleads.g.doubleclick.net/pagead/drt/si
    https://s.pstatic.net/static/www/mobile/edit/2018/0206/cropImg_166x108_118370784378819479.jpeg
    https://www.google.com/recaptcha/api/fallback?k=6Lc8mHQUAAAAAP8U58My2TKKpLBWSL1Ecqe2NVMN
    https://s.pstatic.net/static/www/mobile/edit/2020/0806/cropImg_196x196_38636265696584974.jpeg
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0806%2Fmobile_1805327339c.JPEG%22
    https://t1.daumcdn.net/tistory_admin/blogs/plugins/A_ShareEntryWithSNS/script/shareEntryWithSNS.js?_version_=9024c9023ed6ab26b00b4f2905e46ffa08aeb336
    https://cdn.datatables.net/1.10.15/css/jquery.dataTables.css
    https://s.pstatic.net/shopping.phinf/20200729_15/f1b08cd4-ffc2-42ba-977b-94098cd905ea.jpg
    https://file-examples.com/wp-content/themes/file-examples/vendor/device-mockups/device-mockups.min.css
    https://search.pstatic.net/common/?src=http%3A%2F%2Fblogfiles5.naver.net%2F20150715_141%2Fadc0420_1436928108569hRsr9_JPEG%2F%25C4%25B8%25C3%25B3_01.JPG
    http://postfiles12.naver.net/20150723_251/itlovehj2_1437610835458HlgQM_GIF/PICF227.GIF?type=w1
    https://my.sendinblue.com/public/theme/version4/assets/js/src/subscribe-validate.js?v=1526904693
    https://s.pstatic.net/static/newsstand/up/2017/1209/nsd14224593.png
    https://s.pstatic.net/shopping.phinf/20200805_0/1b6a18b9-c0b2-4746-bcc3-ac5c4fd1ce01.jpg
    https://s.pstatic.net/static/www/mobile/edit/2018/0202/mobile_163100259813.png
    http://blogimgs.naver.net/nblog/mylog/post/btn_thin_close.gif
    https://search.pstatic.net/common/?src=http%3A%2F%2Fimgnews.naver.net%2Fimage%2Forigin%2F5016%2F2017%2F07%2F26%2F57173.jpg
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/028.png
    http://blogimgs.naver.net/imgs/btn_close8.gif
    https://s.pstatic.net/shopping.phinf/20200804_16/530311ed-ce97-41bb-9b48-880b7654b40d.jpg?type=f214_292
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/312.png
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/368.png
    https://ssl.pstatic.net/tveta/libs/1188/1188212/9cdbcc9ac7fa60c50050_20180131133417705.png
    http://img.naver.net/static/common/login/bg_login_id_main_6.gif
    https://ssl.pstatic.net/static/common/gnb/2014/bg_svclyr2_v2.png
    http://www.saraminimage.co.kr/2020/1_237.png
    http://t.static.blog.naver.net/mylog/versioning/LayoutTopCommon-895325723.js
    https://support.microsoft.com/api/content/GetCompassContentForPage/?iecbust=1518423990683
    https://static.nid.naver.com/images/ui/login/pc_sp_login_190522.png
    https://t1.daumcdn.net/tistory_admin/blogs/image/tree/folder_yellow/tab_treed.gif
    http://blogimgs.naver.com/blog20/blog/layout_photo/viewer2/btn_left.gif
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/076.png
    https://tpc.googlesyndication.com/pagead/js/r20180205/r20110914/client/ext/m_js_controller.js
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/917.png
    https://happybean-phinf.pstatic.net/20200630_34/1593508643308EOp0P_JPEG/mm.jpg?type=f464_260
    https://fonts.adobe.com/k/f/wXgYHHPdzg-eD4sR0bqelbFmapgW1pvw90LmrCRtLy6ffwhpgsMZeMI6MK6f5Mw.eot
    https://t1.daumcdn.net/tistory_admin/blogs/plugins/A_ShareEntryWithSNS/css/shareEntryWithSNS.css?_version_=9024c9023ed6ab26b00b4f2905e46ffa08aeb336
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0805%2FcropImg_339x222_38552865355140281.jpeg%22
    https://s.pstatic.net/static/www/mobile/edit/2018/0206/cropImg_166x108_118370877201946159.jpeg
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/939.png
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/818.png
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0805%2Fmobile_161708319559c.jpg%22
    https://s.pstatic.net/shopping.phinf/20180209_10/34ec0d39-de3e-44be-adba-f6d9cb53297e.jpg
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/044.png
    https://www.gstatic.com/recaptcha/releases/IU7gZ7o6RDdDE6U4Y1YJJWnN/recaptcha__en.js
    http://blogimgs.naver.com/nblog/skins/poststyle/0124_back1.gif
    https://s.pstatic.net/static/www/mobile/edit/2018/0208/cropImg_166x108_118548107741178090.jpeg
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/140.png
    https://ssl.pstatic.net/tveta/libs/external/js/jquery-1.8.0.min.js?20171121
    https://ssl.pstatic.net/static/pwe/nm/se2_new/icon_set.gif
    https://fonts.gstatic.com/s/catamaran/v7/o-0bIpQoyXQa2RxT7-5B6Ryxs2E_6n1iPPja5a7dvQ.woff
    https://www.winamp.com/Assets/Images/wave-survey.png
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/968.png
    https://s.pstatic.net/static/www/font/NanumSquareEB.eot?
    https://assets.adobedtm.com/659ec8ada5450db95675e43beaaae92399591a11/satelliteLib-7123a14bc11ffd1ad43be190a593a8932494dcb0.js
    https://ssl.pstatic.net/tveta/libs/1288/1288590/0f835509a7be05524368_20200805153708880.png
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/973.png
    https://search.pstatic.net/common/?src=http%3A%2F%2Fimgnews.naver.net%2Fimage%2Forigin%2F5350%2F2018%2F02%2F08%2F19972.jpg
    https://www.google.com/url?q=https://www.winamp.com/
    https://fonts.googleapis.com/css?family=Lato
    https://www.google.com/images/branding/searchlogo/1x/googlelogo_desk_heirloom_color_150x55dp.gif
    https://www.winamp.com/
    http://blogimgs.naver.net/static/ws/btn_close.gif
    https://fonts.googleapis.com/css?family=Roboto:400
    https://ssl.pstatic.net/tveta/libs/1288/1288466/00817bb1ff9e20a0cbc7_20200731161431641.jpeg
    https://download.nullsoft.com/winamp/client/winamp58_3660_beta_full_en-us.exe
    http://t.static.blog.naver.net/mylog/versioning/Frameset-584891086.js
    https://t1.daumcdn.net/tistory_admin/blogs/image/tree/folder_yellow/tab_isleaf.gif
    https://ff.linkggo.com/?flux_fts=tcapxxxlaciacpttozetltaqaatxzoxxttioxb0cdb
    https://s.pstatic.net/shopping.phinf/20200721_6/b515cda6-db8a-4cf6-bceb-1a683cc5f1c6.jpg
    http://blogimgs.naver.net/nblog/mylog/post/ico_file.gif
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/014.png
    http://blogimgs.naver.net/nblog/guestbook/btn_ok.gif
    https://www.winamp.com/Assets/Images/mask_tw_blue
    https://search.pstatic.net/common/?src=http%3A%2F%2Ftvcast1.phinf.naver.net%2F20151119_280%2FT5nff_1447931473332Kb3Xs_JPEG%2F718418CNwfBGQbmqWAnYUjKhGA_rmcvideo_144P_256_100_32_logo.jpg
    https://ssl.pstatic.net/tveta/libs/1296/1296892/2114dc0131c2b06b4dc7_20200729173323711.png
    https://static.nid.naver.com/images/ui/login/t_sp_login_190522.png
    https://mail.naver.com/pv/read.jsp?mailsn=9633
    http://t.static.blog.naver.net/mylog/versioning//common/js/global/RemoveSubDomain-dea9950.js
    https://www.predictivadnetwork.com/script/preurl.php?stamat=m%7C%2Ck93djdiOqB1dQO0dEdHP3xP.afd%2CICsaLmdWejXEgAqyA-w26cYnRfPnHRNp3pTcFRmD1wLvV6S5pRnJYgp8ErXgAC3UKvHCPJFjWPSr5Ay1okP8ZA%2C%2C
    https://ssl.pstatic.net/static/pwe/address/deskhome/spr_cp_loading.png
    https://s.pstatic.net/shopping.phinf/20200805_3/0654fff5-0307-416f-9ce4-78f6f0494f07.jpg
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/050.png
    https://ssl.pstatic.net/mail.phinf/20200731_135/uclid_1596172881639m3kvI_JPEG/banner_img_200803.jpg
    https://wwwimages2.adobe.com/downloadcenter/singlepage/live/images/progress_bar.gif
    https://s.pstatic.net/static/www/img/uit/2020/sp_my.fb279b.png
    https://fileinfo.com/extension/doc
    https://search.pstatic.net/common/?src=http%3A%2F%2Fimage.nmv.naver.net%2Fblogucc28%2F2017%2F07%2F02%2F1635%2Fe67054c4755f23d62d3d63685ad5d7d1dd9e_ugcvideo_270P_01_16x9_s152.jpg
    https://ssl.pstatic.net/tveta/libs/1295/1295819/3a7f4c4cb962a54fae75_20200728093632144.jpg
    https://www.google.com/pagead/drt/ui
    https://www.winamp.com/Assets/Images/logo-winamp.svg
    https://static.nid.naver.com/images/web/user/sp_u_skip.png
    https://t1.daumcdn.net/tistory_admin/blogs/plugins/tatterDesk/image/TattertoolsSymbol.gif
    https://nid.naver.com/login/css/global/desktop/w_20190509.css?dt=20190509
    https://file-examples.com/wp-content/themes/file-examples/vendor/bootstrap/css/bootstrap.min.css
    http://blogimgs.naver.com/nblog/skins/happybean/bg-head.gif
    https://download.nullsoft.com/winamp/misc/winamp58_3660_beta_full_en-us.exe
    http://download.microsoft.com/download/2/5/7/257166C5-14B7-428B-8C1B-3E01E2330BA4/NeutralMSU/amd64fre/IE9-win7.msu
    http://blogimgs.naver.com/nblog/skins/infobox/0511_body.gif
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic1.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0805%2FcropImg_339x222_38550506010875940.jpeg%22
    http://t.static.blog.naver.net/mylog/versioning/PostView-760169613.css
    https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
    https://s.pstatic.net/shopping.phinf/20200804_22/ecee1d1d-c423-4d35-8c4e-b63cda227f2a.jpg
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/813.png
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0806%2Fmobile_180319101594c.JPEG%22
    http://blogimgs.naver.com/nblog/skins/wholebox/0126_f982.gif
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/990.png
    https://file-examples.com/index.php/sample-documents-download/sample-doc-download/
    http://blogimgs.naver.com/nblog/skins/poststyle/0124_input.gif
    http://blogimgs.naver.com/nblog/skins/poststyle/0124_back4.gif
    http://fpdownload.macromedia.com/crossdomain.xml
    https://www.winamp.com/Assets/Css/Layout.css
    https://tpc.googlesyndication.com/daca_images/simgad/10995222030990580869
    http://blogimgs.naver.com/nblog/skins/poststyle/0124_ico1_down.gif
    http://postfiles7.naver.net/20150723_150/itlovehj2_1437614078300Tj8Kv_JPEG/%B0%A8%BB%E71.jpg?type=w1
    https://www.google.com/url?q=http://www.winamp.com/
    https://ssl.pstatic.net/tveta/libs/external/js/EasePack.min.js?20180423
    https://tistory3.daumcdn.net/tistory/807805/skin/images/head_bg32.gif
    http://dol82net.tistory.com/api
    https://static.adobelogin.com/imslib/imslib.min.js
    https://ssl.pstatic.net/sstatic/search/pc/css/api_atcmp_200709.css
    https://www.google.com/url?q=https://file-examples.com/index.php/sample-documents-download/sample-doc-download/
    https://www.google.com/images/branding/googlelogo/1x/googlelogo_white_background_color_272x92dp.png
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0806%2FcropImg_339x222_38634621104613184.jpeg%22
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/928.png
    https://s.pstatic.net/shopping.phinf/20180209_16/ff3f750c-6195-4f95-b940-4394ae6d66f1.jpg
    https://file-examples.com/index.php/wp-json/
    http://www.microsoft.com/schemas/ie8tldlistdescription/1.0
    https://mail.naver.com/js/uglified_se2_basic_200618.js
    https://mail.naver.com/js/uglified_ko_KR_200716.js
    https://s.pstatic.net/shopping.phinf/20200806_21/ae57998c-7077-4b3a-92b8-5fb9ba84ed66.jpg?type=f214_292
    https://ssl.pstatic.net/tveta/libs/1299/1299116/106a563929b4062893f9_20200803152834605.png
    https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js
    https://mail.naver.com/js/uglified_write_200716.js
    http://www.saraminimage.co.kr/event/20200319/new_icn.png
    https://nid.naver.com/nidlogin.login?mode=form
    https://ssl.pstatic.net/static/nid/login/m_qr_once.png
    https://ssl.pstatic.net/sstatic/search/pc/img/bg_result_more.gif
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0806%2FcropImg_339x222_38654640285784495.jpeg%22
    https://ssl.pstatic.net/tveta/libs/1299/1299024/1d60478ef90a5eb689a3_20200806171050953.jpg
    https://ssl.pstatic.net/static/common/gnb/2014/bg_svclyr1_v2.png
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0806%2Fimgedit_38646732985086356.jpeg%22
    http://www.google.com/
    http://blogimgs.naver.net/nblog/mylog/post/btn_originaldn.gif
    http://www.implbits.com/products/hashtab/start
    https://nid.naver.com/nidlogin.login
    https://ssl.pstatic.net/static/common/gnb/2014/promo_npay.png
    https://s.pstatic.net/shopping.phinf/20200804_10/64a7b3ec-a01d-44ad-ab3f-a4fbd5ee3acc.jpg
    http://blogimgs.naver.net/nblog/ico_notice2.gif
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/214.png
    http://cfile10.uf.tistory.com/image/180935404E6576DA0FB9B6
    https://ssl.pstatic.net/static/pwe/nm/ico_mail1_140508_2.png
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0806%2FcropImg_339x222_38646627959058016.jpeg%22
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/241.png
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/404.png
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/975.png
    https://t1.daumcdn.net/tistory_admin/blogs/plugins/tatterDesk/js/ttDesklightbox.js?_version_=9024c9023ed6ab26b00b4f2905e46ffa08aeb336
    http://www.lduhtrp.net/7l101snrflj4AA8DE7A46595D9EA
    http://digitaldsp.com/api/submit_form_request?p=02c2d834-ae2b-4dbf-9eea-9b4d836c0d9c
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/081.png
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic1.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0805%2FcropImg_339x222_38550548470478020.jpeg%22
    https://s.pstatic.net/static/www/mobile/edit/2018/0208/cropImg_166x108_118523995535361464.jpeg
    https://t1.daumcdn.net/tistory_admin/blogs/plugins/tatterDesk/image/img_delete_module.gif?_version_=9024c9023ed6ab26b00b4f2905e46ffa08aeb336
    https://fonts.gstatic.com/s/catamaran/v7/o-0bIpQoyXQa2RxT7-5B6Ryxs2E_6n1iPNHa5a7dvQ.woff
    https://s.pstatic.net/static/newsstand/up/2017/1122/nsd113655834.png
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/529.png
    https://t1.daumcdn.net/tistory_admin/static/sns/socialShare_big2.png
    http://t.static.blog.naver.net/mylog/versioning//common/css/music/player-d3fc09e.css
    https://mail.naver.com/css/cp_address_5.7.css
    https://ssl.pstatic.net/static/common/myarea/myInfo.gif
    https://file-examples.com/wp-content/themes/file-examples/js/new-age.min.js
    https://mail.naver.com/pv/sendresult.jsp?attachID=undefined
    https://s.pstatic.net/shopping.phinf/20180209_29/e2bfa46f-7854-4a23-84f0-fae065f3e8d3.jpg
    https://tistory3.daumcdn.net/tistory/807805/skin/images/iconTag.gif
    https://search.pstatic.net/common/?src=http%3A%2F%2Fimgnews.naver.net%2Fimage%2Forigin%2F5016%2F2017%2F12%2F22%2F59912.jpg
    http://ac.search.naver.com/nx/ac?_callback=window.__jindo_callback._
    https://s.pstatic.net/shopping.phinf/20200806_10/b92ad300-4bde-42c6-97bd-de41d0b16785.jpg
    https://pm.pstatic.net/dist/js/nmain.ie.2179fb3a.js?o=www
    http://cfile7.uf.tistory.com/image/207B123D4E65769A140920
    https://ssl.pstatic.net/mail.phinf/20200731_16/uclid_1596172882828nxg3G_PNG/seemore.png
    http://blogimgs.naver.net/nblog/mylog/post/shadow01.png
    https://googleads.g.doubleclick.net/pagead/adview?ai=Cgydzjil9WqjlOozQ2QSw9ZWIBay4u5VQ9Zam3cgGZBABIKOlpCVgm4PphJwpoAHak8adA8gBAqkCUfIru3-VDz6oAwHIA8kEqgSeAU_Q00nPtf0AyyBeXaaNQj7Q5AK7ZM53e7mHWkr4qQnw7U5kKyg4kP419a2MVYX2qmxyM6-y5W6XV-iOnvDr6oQdyHXicj_hsqwLvDi9nVJzKx2qf60JKv0D_2yEFp7Llm75__5fK0zhH3g772rNWDZUoaidOIb_-GXR_0iVNZjoQgAVE1QnfFiWIVBqRykQUvovZd_ZN8HEclu03mbkwASonfrUvAGSBQQIBBgBkgUECAUYBKAGAoAHjuy5YqgHpr4b2AcB8gcEELKTDdIIBwiAYRABGAKACgHYEwI
    https://s.pstatic.net/shopping.phinf/20200723_14/1830ea29-778a-47c7-9367-e34230fa46cc.jpg
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/966.png
    https://www.winamp.com/Assets/Css/BootStrap/bootstrap-grid.min.css
    https://ssl.pstatic.net/static/pwe/nm/ico_mail_151020.png
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/052.png
    http://homepages.inf.ed.ac.uk/neilb/TestWordDoc.doc
    https://t1.daumcdn.net/tistory_admin/blogs/plugins/CommentCaptcha/css/captcha.css?_version_=9024c9023ed6ab26b00b4f2905e46ffa08aeb336
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/143.png
    https://www.google.com/url?q=https://fileinfo.com/extension/doc
    https://s.pstatic.net/shopping.phinf/20180207_29/d212e7bb-4f26-4680-b841-d4132019de8d.jpg
    https://fonts.gstatic.com/s/catamaran/v7/o-0bIpQoyXQa2RxT7-5B6Ryxs2E_6n1iPJ_a5a7dvQ.woff
    http://naver.com/
    https://www.google.com/url?q=http://homepages.inf.ed.ac.uk/neilb/TestWordDoc.doc
    https://t1.daumcdn.net/tistory_admin/blogs/image/tree/folder_yellow/navi_back_active.gif
    https://tistory3.daumcdn.net/tistory/807805/skin/style.css?_T_=1474410394
    https://ssl.pstatic.net/tveta/libs/1287/1287125/ee8db39683ef28a03591_20200731100443041.jpg
    https://s.pstatic.net/shopping.phinf/20200804_1/bc931252-261c-424b-b3ef-7a4b28b14899.jpg
    https://ssl.pstatic.net/static/common/gnb/one/sp_gnb_4b16e6.png
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/025.png
    http://t.static.blog.naver.net/mylog/versioning/PostBottomCommon-732655358.js
    http://blogimgs.naver.com/nblog/skins/rss/0114_image.gif
    https://ssl.pstatic.net/tveta/libs/1299/1299478/77c31057afdb25f7911c_20200805155524599.jpg
    https://www.winamp.com/Assets/fonts/proxima-nova/proximanova-regular-webfont.eot
    https://s.pstatic.net/shopping.phinf/20200806_11/78c843f5-d74a-422b-9a54-2526ffff90e9.jpg?type=f214_292
    https://file-examples.com/wp-content/themes/file-examples/vendor/bootstrap/js/bootstrap.min.js
    https://s.pstatic.net/shopping.phinf/20200803_2/fbe98710-0531-4f64-b52f-94ba04bcdb5a.jpg
    http://blogimgs.naver.com/nblog/skins/exchange/exchangecon_1_2.gif
    https://ssl.pstatic.net/static/nid/account/m_nudge_close.png
    http://t.static.blog.naver.net/mylog/versioning/nhn.keywordHighlighter-99428789.js
    https://tpc.googlesyndication.com/pagead/js/r20180205/r20110914/client/ext/m_qs_click_protection.js
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0804%2Fmobile_170853357851c.jpg%22
    https://nv.veta.naver.com/fxshow?su=SU10599
    https://search.pstatic.net/common/?src=http%3A%2F%2Fimgnews.naver.com%2Fimage%2F5016%2F2008%2F10%2F20%2Fadobe_1_.jpg
    http://blogimgs.naver.net/nblog/quickeditor/btn_clse_ly2.gif
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic1.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0717%2FcropImg_336x206_36936304039467960.png%22
    http://pagead2.googlesyndication.com/pagead/js/r20180205/r20170110/show_ads_impl.js
    https://ssl.pstatic.net/static/common/gnb/2014/ico_arrow_wh.gif
    http://deloton.com/afu.php?enc=lxnxZxzMxHF05exXWZjT-GBljoctGHvMvIuIDvz4UHw
    https://ssl.pstatic.net/static/pwe/nm/spr_tooltip.png
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/293.png
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0805%2Fmobile_170554491494c.jpg%22
    https://t1.daumcdn.net/tistory_admin/blogs/plugins/tatterDesk/css/ttDesk.css?_version_=9024c9023ed6ab26b00b4f2905e46ffa08aeb336
    https://happybean-phinf.pstatic.net/20200713_61/1594607258632Y72KT_JPEG/mm.jpg?type=f464_260
    https://www.naver.com/
    https://s.pstatic.net/imgshopping/static/sb/css/shopboxR0011_v3.css?v=2020080314
    https://nid.naver.com/login/css/e.css?150827
    https://my.sendinblue.com/public/theme/version4/assets/images/loader_sblue.gif
    https://www.winamp.com/Assets/Css/Font.css
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/916.png
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/808.png
    http://blogimgs.naver.net/nblog/admin/layerpopup_shadow3.png
    https://ssl.pstatic.net/tveta/libs/res/www/common/info/da_access.png
    https://fonts.gstatic.com/s/catamaran/v7/o-0bIpQoyXQa2RxT7-5B6Ryxs2E_6n1iPErd5a7dvQ.woff
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic2.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0806%2FcropImg_222x145_38638578068626057.jpeg%22
    https://tistory3.daumcdn.net/tistory/807805/skin/images/btn_write.gif
    https://fonts.gstatic.com/s/catamaran/v7/o-0bIpQoyXQa2RxT7-5B6Ryxs2E_6n1iPPjd5a7dvQ.woff
    http://blogimgs.naver.com/nblog/skins/saying/saying02_body.gif
    http://www.saraminimage.co.kr/sri/mail/common/mail_208x80.png
    https://file-examples-com.github.io/uploads/2017/02/file-sample_100kB.doc
    https://pagead2.googlesyndication.com/pub-config/r20160913/ca-pub-2126773934770233.js
    https://static.nid.naver.com/images/ui/login/pc_sp_login_170424.png
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/971.png
    http://blogimgs.naver.net/nblog/sp_post_btn.png
    https://search.like.naver.com/static/js/likeIt.list.js?20180209
    https://search.pstatic.net/common/?src=http%3A%2F%2Fcafefiles.naver.net%2FMjAxODAyMDZfMjE0%2FMDAxNTE3ODkyOTI3OTE0.33Lcf6FTYBE2tDQtHqefS5agwmZ7OeV33P0NaMCuMOMg.5ljl7BOV94JKQwYmBWep4aNNP-C8W-AKVSy2xIKFX98g.JPEG.pujo208%2F2018-02-06-13-50-42.jpg%23740x555
    https://pm.pstatic.net/dist/js/my.38133cb4.js?o=www
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/079.png
    http://blogimgs.naver.com/blog20/blog/layout_photo/viewer2/btn_close.gif
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0729%2Fmobile_105320407546c.jpg%22
    https://mail.naver.com/write/attach/
    https://phinf.pstatic.net/contact/20190113_166/1547312816315t3o9l_JPEG/image.JPEG?type=s160
    http://blogimgs.naver.net/nblog/quickeditor/bg_qk_intro3.gif
    https://ssl.pstatic.net/tveta/libs/external/js/CSSPlugin.min.js?20180423
    https://googleads.g.doubleclick.net/pagead/adview?ai=C00Ckjil9WsTfO4bx2ATfub3ACbnj0IJQwsDZg5IG3sCNk7cJEAEgo6WkJWCbg-mEnCmgAdKo48wDyAECqAMByAPJBKoEmgFP0PemANyMq1088g8VX784ZyG4ldaRZvRmlR6nXCSyPIl46KxPw6v9r7Ug-F2FpMHVmAKDphyfDzcY8-8Dqm7FAOeuU2UY64LJnwU5wrtUdmvQNq4Qz49lsWWpNSWcD0Pq4KSCAGTpdO6U0kYqzuVOQwzBmDw1LT34EpLhpJqvwUjP2QB-FQZlcNM4Zm6b7JSxAVYZIydVMA9MwATGgrSWNpIFBAgEGAGSBQQIBRgEoAYCgAeW15wzqAemvhvYBwHyBwQQnpZg0ggHCIBhEAEYAoAKAdgTDA
    https://search.naver.com/p/cr/rd?m=1
    https://tpc.googlesyndication.com/pagead/js/r20180205/r20110914/rum.js
    https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020073001.js
    http://blogimgs.naver.com/nblog/skins/gnb2014/0005_down.png
    https://ssl.pstatic.net/static/pwe/nm/se2_new/ico_extend.png
    https://s.pstatic.net/shopping.phinf/20200720_24/488b1e7e-df7b-4f37-a0f0-0988db04358f.jpg
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/942.png
    https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2126773934770233
    https://ssl.pstatic.net/tveta/libs/assets/css/pc/common/min/common.min.css?20181108
    https://www.winamp.com/favicon.ico
    https://nv.veta.naver.com/fxshow?su=SU10640
    https://nv.veta.naver.com/fxshow?su=SU10641
    https://nv.veta.naver.com/fxshow?su=SU10642
    http://194.147.115.117/zzztop/Daemon.exe
    https://support.microsoft.com/app/content/content/mwf/fonts/MWFMDL2.ttf
    http://ad.linkprice.com/stlink.php?BKN=624fd930870988b
    https://t1.daumcdn.net/tistory_admin/blogs/plugins/tatterDesk/js/src/slider.js?_version_=9024c9023ed6ab26b00b4f2905e46ffa08aeb336
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic1.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0803%2FcropImg_339x222_38375034536120880.jpeg%22
    https://api.w.org/
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0805%2FcropImg_222x222_38552279407099139.jpeg%22
    http://pagead2.googlesyndication.com/pagead/show_ads.js
    http://www.googleadservices.com/pagead/p3p.xml
    https://ssl.pstatic.net/static/pwe/nm/loading_white_160321.gif
    http://blogimgs.naver.net/nblog/mylog/post/btn_cancel3.gif
    https://s.pstatic.net/shopping.phinf/20200331_4/9d136159-14c6-4751-83cf-42676f68e469.jpg
    https://s.pstatic.net/shopping.phinf/20180209_0/0666faef-1eaf-4e2d-8e41-7bd2a7ea138e.jpg
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/018.png
    https://s.pstatic.net/shopping.phinf/20200806_26/86c7998f-8316-4ed6-ba96-5554d8632a09.jpg?type=f214_292
    https://ssl.pstatic.net/static/pwe/nm/spr_lft_white_150916.png
    https://ssl.pstatic.net/tveta/libs/assets/js/pc/main/min/pc.veta.core.min.js?20170222
    https://file-examples.com/favicon.ico
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/011.png
    https://mail.naver.com/js/uglified_main_200716.js
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/030.png
    http://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    https://ssl.pstatic.net/static/pwe/common/sp_pnb_c9510776.png
    http://blogimgs.naver.com/nblog/skins/title/0036_back_966.gif
    https://t1.daumcdn.net/tistory_admin/blogs/image/tree/folder_yellow/tab_closed.gif
    http://static.gn.naver.net/templates/gnb_utf8.nhn?20180209
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/803.png
    https://file-examples.com/wp-content/themes/file-examples/vendor/jquery/jquery.min.js
    https://t1.daumcdn.net/tistory_admin/blogs/plugins/tatterDesk/css/ttDesklightbox.css?_version_=9024c9023ed6ab26b00b4f2905e46ffa08aeb336
    http://blogimgs.naver.com/nblog/skins/saying/saying02_head.gif
    https://wwwimages2.adobe.com/downloadcenter/singlepage/live/css/images/background.png
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/422.png
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/092.png
    https://ssl.pstatic.net/static/common/gnb/banner/promo_npay_200108.png
    https://p.typekit.net/p.gif?s=1
    https://ssl.pstatic.net/tveta/libs/1299/1299024/c033376e145702a0a471_20200806171156016.jpg
    http://blogimgs.naver.net/nblog/widget/btn_close.gif
    https://www.gstatic.com/m/images/sy_stars_8.gif
    https://fileinfo.com/favicon.ico
    https://happybean-phinf.pstatic.net/20200806_260/1596682237009hVbC3_JPEG/06_%B8%EB_%EA%B8%B0%EB2.jpg?type=f464_260
    http://blogimgs.naver.net/blog20/blog/layout_photo/viewer2/btn_close.gif
    https://s.pstatic.net/shopping.phinf/20180205_1/97608604-2327-42a1-bd60-f1821e4b21c6.jpg
    https://mail.naver.com/read/9633
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/002.png
    https://s.pstatic.net/static/www/img/uit/2020/sp_weather_time_317676.png
    https://www.googletagmanager.com/gtag/js?id=UA-71635899-7
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/038.png
    https://gamez1a.com/?track=aHR0cHM6Ly9wbGFyaXVtLmNvbS9wbGF5L2VuL3Rocm9uZS8wMDJfcGFzdG9yYWxfbXVzaWNfZz9wbGlkPTEwNzQxNCZweGw9cHJvcGVsbGVyLWFkcyZjbGlja0lkPTQxNzg1MzcxNzk0OCZwdWJsaXNoZXJJZD0zMjQzMjk
    http://img.naver.net/static/common/login/bg_login_pw_main_6.gif
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/811.png
    https://t1.daumcdn.net/tistory_admin/blogs/plugins/tatterDesk/js/src/builder.js?_version_=9024c9023ed6ab26b00b4f2905e46ffa08aeb336
    https://search.pstatic.net/sunny/?src=http%3A%2F%2Fcfile1.uf.tistory.com%2Fimage%2F9920B3335A23F1362FC01E%23300x300
    http://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    http://t.static.blog.naver.net/mylog/versioning/LayoutTopCommon-376170577.css
    https://www.google.com/recaptcha/api.js?onload=myCallBack
    https://nid.naver.com/login/js/default/common200225.js?v=20200714
    https://s.pstatic.net/shopping.phinf/20180208_0/644affa9-502a-4adb-afba-01a5dbd843ad.jpg
    https://t1.daumcdn.net/tistory_admin/blogs/plugins/tatterDesk/js/src/effects.js?_version_=9024c9023ed6ab26b00b4f2905e46ffa08aeb336
    https://s.pstatic.net/static/www/mobile/edit/2018/0205/cropImg_166x108_118265035313871453.png
    https://ssl.pstatic.net/tveta/libs/1292/1292324/af1384def98e45cf0fd7_20200729175107242.PNG
    https://s.pstatic.net/shopping.phinf/20200803_18/55776d4c-f997-4572-9252-2f0773f9316b.jpg
    https://s.pstatic.net/stURL
    https://s.pstatic.net/shopping.phinf/20180207_16/b9107371-fcfb-461b-823b-4824c00ffcbc.jpg
    https://s.pstatic.net/static/www/img/uit/2020/sp_main_b46ce0.png
    https://t1.daumcdn.net/tistory_admin/blogs/plugins/tatterDesk/js/ttDesk.js?_version_=9024c9023ed6ab26b00b4f2905e46ffa08aeb336
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0807%2FcropImg_339x222_38695315372257020.jpeg%22
    https://ssl.pstatic.net/static/pwe/nm/bg_amount.png
    http://blogimgs.naver.net/blog20/blog/layout_photo/viewer2/btn_left.gif
    https://search.pstatic.net/common/?src=http%3A%2F%2Fimgnews.naver.net%2Fimage%2Forigin%2F025%2F2017%2F12%2F18%2F2782427.jpg
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/346.png
    http://blogimgs.naver.net/nblog/mylog/post/tit_viewexif.gif
    https://s.pstatic.net/static/www/mobile/edit/2018/0206/cropImg_166x108_118372304674120662.jpeg
    https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml
    http://blogimgs.naver.net/imgs/btn_close3.gif
    https://t1.daumcdn.net/tistory_admin/blogs/plugins/tatterDesk/image/ico_guide.gif?_version_=9024c9023ed6ab26b00b4f2905e46ffa08aeb336
    https://wwwimages2.adobe.com/uber/js/pdc_s_code.js
    https://tistory3.daumcdn.net/tistory/807805/skin/images/btn_search_n.gif
    https://nid.naver.com/login/css/w.css?150827
    https://s.pstatic.net/shopping.phinf/20200520_21/f1c43f58-55d8-4d21-a4dc-ac2abd9f9a72.jpg?type=f214_292
    https://t1.daumcdn.net/tistory_admin/blogs/image/tree/folder_yellow/tab_top.gif
    https://s.pstatic.net/shopping.phinf/20180207_23/05fc533c-1c95-44ee-9dc3-bc32922cf0bb.jpg
    https://s.pstatic.net/shopping.phinf/20200721_28/0ceb12bf-4dfe-43f8-a7b3-fddf5323c5c6.jpg
    https://nid.naver.com/login/js/bvsd.1.3.4.min.js
    https://www.gstatic.com/recaptcha/api2/logo_48.png
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0729%2Fmobile_105310608744c.jpg%22
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/824.png
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/326.png
    https://s.pstatic.net/static/newsstand/up/2017/1122/nsd113617499.png
    https://s.pstatic.net/shopping.phinf/20200805_8/c964aa11-4acb-440e-ac7a-1f034fdb1f08.jpg
    https://s.pstatic.net/shopping.phinf/20200805_17/7a86ab55-c91f-489b-a010-2bce1f23668d.jpg
    https://veta.naver.com/fxshow?su=SU10074
    http://blogimgs.naver.net/nblog/bg_area01.gif
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/396.png
    https://s.pstatic.net/shopping.phinf/20200803_2/e3dfb955-fcdf-404f-92ff-a9c720aeca13.jpg
    http://blogimgs.naver.net/nblog/mylog/post/btn_viewexif.gif
    https://support.microsoft.com/app/content/bundles/jslibraries?v=t25TQb7882nTZ3dIuMgndVHcJJqesRrTSAynwFUR4Dg1
    https://s.pstatic.net/static/www/mobile/edit/2018/0208/cropImg_166x108_118548052669278548.jpeg
    https://ssl.pstatic.net/static/pwe/address/deskhome/spr_cp_address_120618_cal.png
    https://wwwimages2.adobe.com/downloadcenter/singlepage/live/css/jquery-ui/jquery-ui.css
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/277.png
    http://blogimgs.naver.net/nblog/mylog/post/shadow02.png
    https://nid.naver.com/login/js/default/common200417.js?v=20200707
    https://nv.veta.naver.com/fxshow?su=SU10601
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/055.png
    https://ssl.pstatic.net/static/pwe/nm/sp_works_6b334935.png
    https://ssl.pstatic.net/sstatic/search/pc/img/bu_news_sublst.gif
    http://spi.naver.net/js/release/ko_EUC-KR/splugin.js?20180209
    https://search.pstatic.net/common/?src=http%3A%2F%2Fcafefiles.naver.net%2F20160409_122%2Fwinner119_1460182620984uyyW4_JPEG%2F%25BE%25EE%25B5%25B5%25BA%25F1.jpg%23740x297
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/952.png
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/006.png
    https://s.pstatic.net/static/www/mobile/edit/2020/0806/cropImg_196x196_38636284969421088.jpeg
    https://pagead2.googlesyndication.com/bg/wXTEQRDv98dN0quNLivY14iTCHmC1Kvf4T-OLGMwj34.js
    https://fonts.googleapis.com/css?family=Catamaran:100
    https://t1.daumcdn.net/tistory_admin/blogs/plugins/tatterDesk/image/btn_makepage.gif?_version_=9024c9023ed6ab26b00b4f2905e46ffa08aeb336
    https://s.pstatic.net/shopping.phinf/20200730_7/e1c52a50-7652-4730-93fb-7e34c253df11.jpg
    http://rsense-ad.realclick.co.kr/rsense/rsense_ad.js?rid=491652334318
    https://s.pstatic.net/shopping.phinf/20200715_7/8cbfb15b-1848-4115-8c68-5a33a19b33cc.jpg
    https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
    http://blogimgs.naver.com/nblog/skins/wholebox/0126_b982.gif
    http://blogimgs.naver.net/nblog/quickeditor/btn_qk_set.gif
    https://adobe.demdex.net/dest5.html?d_nsid=3
    https://s.pstatic.net/static/newsstand/up/2020/0610/nsd151458769.png
    https://support.microsoft.com/content/icon-fonts/MemMDL2.2.50.woff
    https://s.pstatic.net/shopping.phinf/20200806_18/26d101c9-56db-4201-b9c5-3989af948ce5.jpg?type=f214_292
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0807%2FcropImg_339x222_38694960064254392.png%22
    https://file-examples.com/wp-content/themes/file-examples/css/new-age.min.css
    https://s.pstatic.net/static/newsstand/up/2017/0904/nsd10420716.png
    http://blogimgs.naver.net/nblog/mylog/post/btn_viewexif_close.gif
    https://ssl.pstatic.net/static/pwe/address/loading.gif
    https://s.pstatic.net/shopping.phinf/20200803_13/9d1c5267-461b-45d3-a831-c37e49a65909.jpg
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/108.png
    https://ac.search.naver.com/nx/ac?_callback=window.__jindo2_callback._
    https://s.pstatic.net/static/newsstand/up/2017/0424/nsd14405515.png
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/029.png
    https://ssl.pstatic.net/static/pwe/nm/se2_new/bg_button_left.gif
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/920.png
    https://ssl.pstatic.net/tveta/libs/1298/1298719/bc7524b90947e7619f55_20200731112225990.jpg
    http://t.static.blog.naver.net/mylog/versioning/Jindo152-193065097.js
    http://blog.like.naver.com/static/js/likeIt.list.js?v=20180209
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/123.png
    https://nid.naver.com/login/js/default/captcha.js
    https://nid.naver.com/login/css/global/desktop/w_20200707.css?20200728
    http://tveta.naver.net/libs/1186/1186907/6fe2adb0c6b5da4af05f_20180207164716641.jpg
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/954.png
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/057.png
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/944.png
    https://goo.gl/9A5BBv
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0804%2Fmobile_165705245910c.JPEG%22
    http://ad.linkprice.com/stlink.php?BKN=1844eb1966d66ec6
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0806%2FcropImg_339x222_38618129552731972.jpeg%22
    https://fonts.adobe.com/k/f/vt12ABArW5HNOhlT-y66pKclFe7aZdp7zKs2RL0diT3ffwrpgsMZeMI6MK6f5Mb.eot
    https://ssl.pstatic.net/static/pwe/nm/se2_new/bg_button_right.gif
    https://ssl.pstatic.net/sstatic/search/images11/btn_layer_close.gif
    https://s.pstatic.net/static/www/mobile/edit/2018/0205/cropImg_166x108_118265310241341472.png
    https://www.winamp.com/Assets/fonts/proxima-nova/proximanova-bold-webfont.eot
    https://googleads.g.doubleclick.net/pagead/html/r20180205/r20170110/zrt_lookup.html
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/974.png
    http://blogimgs.naver.net/nblog/quickeditor/bg_qk_ly2.gif
    https://s.pstatic.net/static/www/mobile/edit/2020/0806/cropImg_728x360_38627488619452210.jpeg
    https://www.cpm20.com/watch?shu=7bac979634eb047ee085a9ca4c60a7f4
    http://blogimgs.naver.com/nblog/skins/poststyle/0124_back7.gif
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0804%2FcropImg_222x145_38460055204059345.png%22
    http://static.naver.net/blog/common_comment/blogIconFont.eot?
    http://blogimgs.naver.com/nblog/skins/poststyle/0124_back6.gif
    https://mail.naver.com/css/mail_skin.min.200716.css
    https://www.winamp.com/Assets/Images/lama.png
    http://blogimgs.naver.com/nblog/skins/happybean/layerpopup_shadow3.png
    http://t.static.blog.naver.net/mylog/versioning//common/js/flash/allowSwfForChrome-d0f381e.js
    http://blogimgs.naver.net/nblog/skins/happybean/btn-save.gif
    https://s.pstatic.net/static/www/mobile/edit/2018/0206/cropImg_166x108_118372720970016132.png
    https://tistory3.daumcdn.net/tistory/807805/skin/images/menu_div.gif
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/021.png
    https://ssl.pstatic.net/tveta/libs/res/www/native/sp_main_topic_darkmode.png
    https://tpc.googlesyndication.com/pagead/js/r20180205/r20110914/activeview/osd_listener.js
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/376.png
    https://s.pstatic.net/static/www/mobile/edit/2018/0206/cropImg_166x108_118367699527703749.png
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/943.png
    https://s.pstatic.net/static/www/mobile/edit/2020/0806/cropImg_196x196_38636185024304182.jpeg
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic1.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0730%2Fmobile_215316405620c.jpg%22
    https://search.pstatic.net/sunny/?src=https%3A%2F%2Fwindowsforum.kr%2Ffiles%2Fattach%2Fimages%2F12253%2F292%2F948%2F006%2F08fb0d4a5754519755ad42d4c85c9dc8.jpeg
    http://blogimgs.naver.com/nblog/skins/saying/saying02_footer.gif
    https://ssl.pstatic.net/static/pwe/nm/ico_mail1_160510.png
    https://cdn.datatables.net/1.10.15/js/jquery.dataTables.js
    https://ssl.pstatic.net/static/common/gnb/bg_one_line.png
    https://mail.naver.com/css/se2_new/smart_editor2_in_mail.me.min.200716.css
    https://s.pstatic.net/shopping.phinf/20180131_10/35d0896e-86f3-4a1b-ac02-1b564ac29085.jpg
    https://ssl.pstatic.net/sstatic/search/pc/img/atcmp_spat_v7.png
    https://s.pstatic.net/shopping.phinf/20200721_0/3c124f53-51b6-4d70-a7e1-a4dda7549626.jpg
    https://s.pstatic.net/shopping.phinf/20180208_27/50ce2cf5-84fb-430d-8b30-dc13dd30d89c.jpg
    https://search.pstatic.net/sunny/?src=http%3A%2F%2Fcfile22.uf.tistory.com%2Fimage%2F99821B335A2B86E81C4C43%23339x531
    https://file-examples-com.github.io/uploads/2017/02/file-sample_500kB.docx
    https://s.pstatic.net/shopping.phinf/20180209_18/eaf7d27f-411b-4e8f-8674-1f4cfd248ae4.jpg
    https://ajax.googleapis.com/ajax/libs/jquery/2.1.3/jquery.min.js
    https://www.google.com/search
    https://s.pstatic.net/imgshopping/static/sb/js/sb/shopboxS01_v1.js?v=2020080314
    https://s.pstatic.net/static/newsstand/up/2017/0424/nsd172911723.png
    https://tistory3.daumcdn.net/tistory/807805/skin/images/rss.gif
    https://ssl.pstatic.net/static/pwe/nm/se2_new/ko_KR/text_tool_set.png?140317
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/366.png
    http://blogimgs.naver.net/nblog/shadow02.png
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0805%2Fmobile_171121720927c.jpg%22
    https://ssl.pstatic.net/static/pwe/nm/btn_jmail_151112.png
    https://file-examples.com/wp-content/themes/file-examples/vendor/font-awesome/fonts/fontawesome-webfont.eot?
    https://wwwimages2.adobe.com/downloadcenter/js/live/jquery-1.7.1.min.js
    https://static.nid.naver.com/images/ui/login/pc_sp_btn_170530.png
    https://s.pstatic.net/shopping.phinf/20200805_10/f1e83251-9248-4d4e-8d2e-d1505a55bc83.jpg?type=f214_292
    https://ssl.pstatic.net/static/pwe/nm/bg_container_dh_white_150915.png
    https://support.microsoft.com/app/content/content/mwf/fonts/MWFMDL2.woff
    https://ssl.pstatic.net/tveta/libs/assets/css/pc/main/min/new_timeboard.min.css?20181108
    https://cdnjs.cloudflare.com/ajax/libs/simple-line-icons/2.4.1/css/simple-line-icons.css
    http://purl.org/rss/1.0/
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/950.png
    https://s.pstatic.net/static/www/mobile/edit/2018/0205/cropImg_166x108_118265665283970548.jpeg
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0727%2FcropImg_552x408_37750038188392052.jpeg%22
    https://ssl.pstatic.net/static/pwe/nm/btn_txt_mail_150513.png
    https://ssl.pstatic.net/static/common/gnb/one/sp_gnb_v15.png?v=2006
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/826.png
    https://www.winamp.com/Assets/Images/lama-stamp.png
    https://ssl.pstatic.net/tveta/libs/css/min/common.min.css?20161019
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/906.png
    http://blogimgs.naver.com/nblog/skins/exchange/exchangecon_1_1.gif
    https://ssl.pstatic.net/tveta/libs/1296/1296957/2c7cb1d5f0252d3d9249_20200806154400635.jpg
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0806%2FcropImg_222x145_38634222908741571.jpeg%22
    https://www.winamp.com/Assets/Images/mask_fb_blue
    https://s.pstatic.net/static/newsstand/up/2017/0424/nsd14392079.png
    https://s.pstatic.net/shopping.phinf/20200805_6/95a10422-4af5-4bea-901d-e9c24b2ac866.jpg
    https://ssl.pstatic.net/static/pwe/nm/se2_new/ko_KR/btn_set.png?130306
    http://static.naver.com/common/btn/btn_confirm2.gif
    http://digitaldsp.com/api/submit_form_request?p=492452de-da6d-41ef-8f25-5cb578d50326
    https://ssl.pstatic.net/static/nid/login/pc_qr_once.png
    https://mail.naver.com/js/uglified_common_200716.js
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0804%2Fmobile_17084868541c.jpg%22
    http://developers.kakao.com/sdk/js/kakao.min.js
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/023.png
    http://blogimgs.naver.net/nblog/mylog/post/btn_confirm.gif
    https://s.pstatic.net/static/www/mobile/edit/2020/0806/mobile_142917492915.png
    http://o.creditsec.com/es/
    https://s.pstatic.net/static/www/font/NanumSquareB.eot?
    https://s.pstatic.net/static/www/2014/blank.gif
    https://pagead2.googlesyndication.com/pagead/js/r20180205/r20170110/rum.js
    https://s.pstatic.net/shopping.phinf/20180131_24/a2c486a5-fc44-4b46-8e90-a45acfb3bb43.jpg
    https://mail.naver.com/pv/write.jsp?orderType=toMe
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0807%2FcropImg_222x145_38694363318637662.png%22
    https://s.pstatic.net/static/www/mobile/edit/2020/0807/cropImg_728x360_38666917029147129.jpeg
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/215.png
    https://www.google.com/url?q=http://www.snee.com/xml/xslt/sample.doc
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/139.png
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0804%2FcropImg_336x206_38466352545626545.png%22
    https://www.winamp.com/Assets/fonts/proxima-nova/proximanova-semibold-webfont.eot
    https://ssl.pstatic.net/tveta/libs/assets/js/pc/main/min/pc.veta.core.min.js?20180423
    https://www.naver.com/include/newsstand/press_info_data.json
    http://www.lduhtrp.net/ag106iw-ousDJJHMNGJDFEMMIEJM
    https://phinf.pstatic.net/contact/20190113_166/1547312816315t3o9l_JPEG/image.JPEG?type=f130_130
    https://tistory3.daumcdn.net/tistory/807805/skin/images/tistory_bg.gif
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/956.png
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/144.png
    https://www.googleadservices.com/pagead/p3p.xml
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/539.png
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/969.png
    https://s.pstatic.net/shopping.phinf/20200724_7/c238c52c-51b1-4395-9681-d453696c56c9.jpg
    http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    https://s.pstatic.net/shopping.phinf/20200804_1/d84f5f1f-e61f-4c62-a51f-cb82d23253f6.jpg?type=f214_292
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/015.png
    https://s.pstatic.net/shopping.phinf/20180206_11/a1890a2e-3342-4ac7-a983-7c3e2eefe4cc.jpg
    https://s.pstatic.net/static/www/mobile/edit/2018/0205/cropImg_166x108_118265581501749059.png
    http://blogimgs.naver.com/nblog/skins/menu/0129_966.gif
    https://wwwimages2.adobe.com/downloadcenter/js/live/polarbear.js
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/311.png
    https://www.gstatic.com/recaptcha/releases/IU7gZ7o6RDdDE6U4Y1YJJWnN/fallback__ltr.css
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/961.png
    https://mail.naver.com/iframe/upload/html/uploadFile.html?2
    https://s.pstatic.net/shopping.phinf/20200804_3/1a215b1b-a59d-4057-a173-04316c798632.jpg
    http://blogimgs.naver.net/nblog/mylog/post/btn_cancel.gif
    https://tpc.googlesyndication.com/pagead/js/r20180205/r20110914/client/ext/m_window_focus_non_hydra.js
    https://ssl.pstatic.net/static/pwe/nm/sp_skin_160529.png
    https://s.pstatic.net/shopping.phinf/20200803_6/96276f94-e1ea-448c-959e-126a63c2d8c8.jpg
    http://blogimgs.naver.net/nblog/book/publishingcompany/btn_close.gif
    https://www.winamp.com/Assets/fonts/proxima-nova/proximanova-light-webfont.eot
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/910.png
    https://login.live.com/login.srf?wa=wsignin1.0
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/016.png
    https://search.pstatic.net/common/?src=http%3A%2F%2Fimgnews.naver.com%2Fimage%2F5201%2F2018%2F02%2F02%2F0000008234_001_20180202140113054.jpg
    http://www.tqlkg.com/rb101ltxlrpAGGEJKDGACBHIGDIK
    http://blogimgs.naver.net/nblog/spc.gif
    http://fpdownload.macromedia.com/pub/flashplayer/masterversion/crossdomain.xml
    http://blogimgs.naver.com/nblog/skins/infobox/0511_head.gif
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/117.png
    https://pm.pstatic.net/dist/lib/nelo.20200617.js
    http://blogimgs.naver.net/nblog/skins/happybean/btn-put-off.gif
    https://s.pstatic.net/shopping.phinf/20200625_26/fda4f356-b766-49ce-936c-97c83d42882e.jpg
    http://blogimgs.naver.net/static/common/popup/btn_close3.gif
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/032.png
    http://t.static.blog.naver.net/mylog/versioning/PostViewBottom-428961555.js
    http://blogimgs.naver.net/nblog/btn_close_1.gif
    https://mail.naver.com/js/uglified_write_200618.js
    https://s.pstatic.net/static/www/mobile/edit/2018/0205/cropImg_166x108_118265166483958931.png
    http://blogimgs.naver.net/nblog/mylog/post/btn_download2.gif
    https://s.pstatic.net/shopping.phinf/20180207_15/9d0724e8-c626-40a4-8ade-fd739a5b80f6.jpg
    https://ssl.pstatic.net/static/nid/login/m_920_294_0729.png
    https://ssl.pstatic.net/tveta/libs/1298/1298961/adb69f910d828bc591ad_20200715150627362.jpg
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0805%2Fmobile_161649421160c.jpg%22
    https://mail.naver.com/css/se2_new/ko_KR/smart_editor2.me.min.200716.css
    https://t1.daumcdn.net/tistory_admin/blogs/plugins/tatterDesk/js/lib/prototype_polyfill.js?_version_=9024c9023ed6ab26b00b4f2905e46ffa08aeb336
    https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcR7DWRpd12Tb6Z4VMunyMJ9CQNIHkVS6cj5h3bZEJmHHa9QrjNYDJbj5w
    https://s.pstatic.net/static/newsstand/up/2017/1201/nsd16174237.png
    https://happybean-phinf.pstatic.net/20200806_78/1596682178946xQIxb_JPEG/05_%B8%EB_%EA%B8%B0%EB1.jpg?type=f464_260
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/138.png
    https://s.pstatic.net/shopping.phinf/20180209_18/c03f3351-9e83-4c22-8277-1f47f4bd188a.jpg
    https://s.pstatic.net/static/newsstand/up/2020/0708/nsd94830278.png
    http://blog.like.naver.com/css/list/desktop/likeit_blog.css
    https://www.google.com/?gws_rd=ssl
    http://blog.naver.com/versioning//common/lib/ajax.flash/ajax-885363e.swf
    http://blogimgs.naver.com/nblog/skins/poststyle/0124_back8_1.gif
    https://search.pstatic.net/sunny/?src=http%3A%2F%2Fcfile7.uf.tistory.com%2Fimage%2F207B123D4E65769A140920%23695x722
    https://happybean-phinf.pstatic.net/20200702_202/1593679639220zzsYm_JPEG/mm_m.jpg?type=f464_260
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/008.png
    https://s.pstatic.net/static/www/mobile/edit/2020/0807/cropImg_196x196_38699317823237099.jpeg
    https://ssl.pstatic.net/tveta/libs/assets/css/pc/main/min/main_topic_darkmode.min.css?20200601
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/003.png
    https://s.pstatic.net/shopping.phinf/20180207_9/d7681792-d8d0-4f6d-9233-530e428bcfe6.jpg
    https://s.pstatic.net/static/www/mobile/edit/2018/0208/cropImg_166x108_118540468447019046.jpeg
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/047.png
    https://tistory3.daumcdn.net/tistory/807805/skin/images/NanumGothic.eot
    https://ssl.pstatic.net/static/pwe/address/deskhome/spr_cp_loading_bar.gif
    https://nid.naver.com/login/js/default/default200417.js
    http://blogimgs.naver.com/blog20/blog/layout_photo/viewer2/btn_original2.png
    https://tistory3.daumcdn.net/tistory/807805/skin/images/ico_prev_no.gif
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0803%2Fmobile_215035136504c.JPEG%22
    https://s.pstatic.net/static/www/font/NanumSquareL.eot?
    http://blogimgs.naver.com/nblog/skins/poststyle/0124_back9.gif
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0803%2FcropImg_750x422_38355942703239345.jpeg%22
    http://t.static.blog.naver.net/mylog/versioning//css/navercomment/naver_comment_blog_base-61fa3cc.css
    https://support.microsoft.com/api/content/SignedOut
    http://fpdownload.macromedia.com/pub/flashplayer/masterversion/masterversion.xml
    https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js
    https://tistory3.daumcdn.net/tistory/807805/skin/images/btn_reple.gif
    https://tpc.googlesyndication.com/pagead/images/abg/ko.png
    https://search.pstatic.net/sunny/?src=http%3A%2F%2Fcfile7.uf.tistory.com%2Fimage%2F207B123D4E65769A140920
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/930.png
    https://tistory3.daumcdn.net/tistory/807805/skin/images/logo_tistory.gif
    https://www.cpm20.com/watch?shu=73d4860c0510f24e8790dd80b23583ff
    http://m1.daumcdn.net/svc/original/U03/cssjs/uoclike/common/uoclike.min-20150408-2.css
    https://s.pstatic.net/shopping.phinf/20180131_26/c0274f6f-3295-4d86-bf8e-35d47d72dee3.jpg
    https://securepubads.g.doubleclick.net/tag/js/gpt.js
    https://mail.naver.com/js/uglified_se2_basic_200716.js
    https://s.pstatic.net/shopping.phinf/20200807_1/381fe068-1c10-4a9e-9896-ebd6ddb42dad.jpg?type=f214_292
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/941.png
    https://fonts.adobe.com/k/f/FDc5uCO11RE5U283tqazmJrjQBQGkvD96cpWqln3_RbffFfpgsMZeMI6MK6f5Mt.eot
    https://s.pstatic.net/shopping.phinf/20200804_20/ab6864d6-296a-40f2-b792-0136670b1668.jpg
    http://blogimgs.naver.com/nblog/skins/poststyle/0124_back3.gif
    https://www.winamp.com/Assets/Images/infinity.png
    https://support.microsoft.com/app/content/bundles/css?v=c6R8vuY86OASH9VrcoGq4kIEX9YgoDsCgERiBUK0W641
    https://tistory3.daumcdn.net/tistory/807805/skin/images/_title_bar32.jpg
    http://blogimgs.naver.com/blog20/blog/layout_photo/viewer2/lg_photoviewer.gif
    https://ssl.pstatic.net/tveta/libs/assets/js/pc/main/min/pc.veta.core.min.js?20181008
    http://fonts.gstatic.com/s/opensans/v15/mem8YaGs126MiZpBA-UFW50f.eot
    https://ssl.pstatic.net/tveta/libs/external/js/jquery-1.8.0.min.js?20180423
    https://s.pstatic.net/static/www/mobile/edit/2020/0806/mobile_142908992435.png
    https://support.microsoft.com/app/content/content/mwf/css/mwf-korean-default.min.css
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/902.png
    http://postfiles3.naver.net/20150723_194/itlovehj2_1437610835199EMxV2_PNG/PICF1A9.PNG?type=w1
    https://pm.pstatic.net/dist/css/my.20200625.css
    http://blogimgs.naver.net/imgs/btn_confirm.gif
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0806%2Fmobile_180305907702c.JPEG%22
    https://fonts.gstatic.com/s/catamaran/v7/o-0bIpQoyXQa2RxT7-5B6Ryxs2E_6n1iPKba5a7dvQ.woff
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/923.png
    http://blogimgs.naver.net/nblog/admin/layerpopup_shadow2.png
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/904.png
    https://s.pstatic.net/static/www/mobile/edit/2020/0807/cropImg_196x196_38699350018944711.jpeg
    https://support.microsoft.com/api/content/GetCompassContentForPage/smcsurvey?iecbust=1518423991014
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/940.png
    https://www.naver.com/include/themecast/targetAndPanels.json
    https://www.winamp.com/Assets/fonts/proxima-nova/proximanova-regularitalic-webfont.eot
    https://pagead2.googlesyndication.com/pagead/js/r20180205/r20170110/osd.js
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/447.png
    http://blogimgs.naver.com/nblog/skins/poststyle/0124_back2.gif
    https://s.pstatic.net/static/www/mobile/edit/2018/0206/cropImg_166x108_118372781519086122.png
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/013.png
    https://mail.naver.com/css/mail_lazy_le.min.200716.css
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/819.png
    https://s.pstatic.net/shopping.phinf/20200729_23/d3681671-2bc8-4af8-a132-5a5f4d489e85.jpg
    http://blogimgs.naver.net/nblog/shadow.png
    http://blogimgs.naver.net/blog20/blog/layout_photo/viewer2/bg_top_r.gif
    https://s.pstatic.net/shopping.phinf/20200806_17/3de5642a-2629-4625-9a63-d96768537b11.jpg
    https://castbox.shopping.naver.com/shopbox/main.nhn?svgless=true
    https://ssl.pstatic.net/tveta/libs/external/js/jquery-1.8.0.min.js?20170206
    http://www.naver.com/
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/022.png
    https://tpc.googlesyndication.com/simgad/14421647784582040519
    http://postfiles7.naver.net/20150723_54/itlovehj2_1437610835696S0Xno_GIF/PICF2A5.GIF?type=w1
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0804%2Fmobile_163835681182c.JPEG%22
    https://s.pstatic.net/static/www/mobile/edit/2018/0205/cropImg_166x108_118264813399954933.png
    https://s.pstatic.net/static/www/mobile/edit/2018/0206/cropImg_166x108_118373780698545296.jpeg
    https://cdnjs.cloudflare.com/ajax/libs/jquery-easing/1.3/jquery.easing.min.js
    https://s.pstatic.net/static/www/mobile/edit/2018/0205/cropImg_166x108_118264985575575240.png
    http://t.static.blog.naver.net/mylog/versioning/LayoutBottomCommon-173825059.js
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0805%2Fmobile_170537726917c.jpg%22
    http://static.naver.net/blog/ico_tag.gif
    https://support.microsoft.com/api/content/silentauth
    https://www.google.com/webhp?hl=ko
    https://s.pstatic.net/shopping.phinf/20180209_10/acf232b1-edd5-4a9d-9e96-761e542c495a.jpg
    https://s.pstatic.net/shopping.phinf/20180209_1/f8e9b2da-5783-4d61-969d-b8a8010d6650.jpg
    http://blogimgs.naver.com/nblog/skins/happybean/bg-body.gif
    https://support.microsoft.com/app/content/bundles/application?v=unRH8wQPgkr6gJaH51DX43nBrfmUt8kxzq0dZBj01oE1
    https://www.winamp.com/Assets/Css/BootStrap/bootstrap.min.css
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic1.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0806%2FcropImg_339x222_38654779647481684.jpeg%22
    https://nid.naver.com/favicon.ico
    https://s.pstatic.net/static/www/mobile/edit/2018/0205/cropImg_166x108_118265368702808013.jpeg
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/816.png
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/330.png
    http://blogimgs.naver.net/imgs/btn_cancel_pop2.gif
    https://tistory3.daumcdn.net/tistory/807805/skin/images/btn_admin.gif
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/120.png
    https://t1.daumcdn.net/tistory_admin/blogs/plugins/tatterDesk/image/btn_apply.gif?_version_=9024c9023ed6ab26b00b4f2905e46ffa08aeb336
    https://ssl.pstatic.net/static.gn/js/clickcrD.js
    https://file-examples.com/wp-content/themes/file-examples/style.css?ver=4.7.18
    https://happybean-phinf.pstatic.net/20200709_158/1594277855780DSU5N_JPEG/336.jpg?type=f464_260
    https://static-whale.pstatic.net/main/sprite-20200709
    https://file-examples.com/wp-includes/js/wp-emoji-release.min.js?ver=4.7.18
    https://support.microsoft.com/api/UHF/GetL1Header/?requestedRoute=%2Fko-kr%2Fproducts%2Finternet-explorer
    http://blogimgs.naver.net/static/common/popup/bg_not_available_word.gif
    https://search.pstatic.net/common/?src=http%3A%2F%2Fimgnews.naver.net%2Fimage%2Forigin%2F5016%2F2018%2F02%2F08%2F60861.jpg
    https://search.pstatic.net/common/?src=http%3A%2F%2Fpost.phinf.naver.net%2FMjAxNzA2MjZfMjEx%2FMDAxNDk4NDQ3NTExMTE4.RtruESmTB2njrPucjk1Eoc5rNZ739w9mo3kE2RO6YmIg.aKRKM2zK66Vp6-qiMM5etdIhiSS-plVJZKaHoW34fqMg.PNG%2FIq-pPuHnFs6TqEhV5o5jYri0e2KA.jpg
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/353.png
    http://wwwimages.adobe.com/www.adobe.com/swf/software/flash/about/flash_about_793x170.swf
    https://ssl.pstatic.net/static/pwe/nm/se2_new/bg_button_left.gif?20121228
    https://s.pstatic.net/shopping.phinf/20200729_9/b1a22a7c-13a0-4584-a53e-cd8e98a89607.jpg
    http://blogimgs.naver.com/nblog/skins/gnb2014/0005_login.png
    https://s.pstatic.net/static/www/mobile/edit/2020/0806/cropImg_196x196_38627511634975243.jpeg
    https://fonts.googleapis.com/css?family=Muli
    https://s.pstatic.net/static/newsstand/up/2020/0730/nsd13728808.png
    https://nid.naver.com/login/ext/deviceAdd.nhn
    http://blogimgs.naver.com/nblog/skins/happybean/layerpopup_shadow1.png
    https://support.microsoft.com/content/icon-fonts/DevCMDL2.2.50.woff
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/807.png
    https://s.pstatic.net/shopping.phinf/20200729_3/cea102f8-cdb5-47e3-ae23-026774693ec9.jpg
    https://support.microsoft.com/internet-explorer
    https://tistory3.daumcdn.net/tistory/807805/skin/images/ico_next_no.gif
    https://ssl.pstatic.net/static/pwe/nm/ico_jmail2_120309.png
    https://mail.naver.com/css/mail_me.min.200716.css
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0805%2FcropImg_339x222_38552834427877587.jpeg%22
    https://mail.naver.com/js_src/com/nhncorp/mail/write/se2_new/js_lazyload/hp_SE2M_TableEditor
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/040.png
    http://blogimgs.naver.net/nblog/mylog/post/btn_close5.gif
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/991.png
    http://blogimgs.naver.net/nblog/btn_blogsearch.gif
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic1.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0720%2FcropImg_210x210_37138533249823895.jpeg%22
    https://support.microsoft.com/api/clientconfig
    https://www.google.com/search?hl=ko
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/440.png
    https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css
    https://ssl.pstatic.net/tveta/libs/1287/1287075/bd0442f75daaae1a2ddf_20200807131053700.png
    https://s.pstatic.net/imgshopping/static/sb/js/jquery/jquery-1.12.4.min_v1.js?v=2020080314
    http://blogimgs.naver.net/nblog/quickeditor/btn_what2.gif
    https://s.pstatic.net/static/www/mobile/edit/2018/0206/cropImg_166x108_118372854064949290.jpeg
    https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0806%2FcropImg_339x222_38607453904743633.jpeg%22
    https://pm.pstatic.net/dist/css/nmain.20200806.css
    https://csp.withgoogle.com/csp/recaptcha/1
    https://support.microsoft.com/scripts/lib/i18n/angular-locale_ko-kr.js?v=1.0.18039.3
    https://fonts.adobe.com/k/f/8gC0kOLxVgA0P8YQAfTzeevZch1B52UlVtA1Pw1zDsSffFepgsMZeMI6MK6f5MS.eot
    https://s.pstatic.net/static/newsstand/2020/logo/light/0604/009.png
    https://www.visualstudio.com
    https://cdnjs.cloudflare.com/ajax/libs/simple-line-icons/2.4.1/fonts/Simple-Line-Icons.eot?v=2.4.0

Process memory dump for schtasks.exe (PID 1572, dump 1)

Extracted/injected images (may contain unpacked executables)
Download #1

Yara signatures matches on process memory

Match: inject_thread

  • Q3JlYXRlUmVtb3RlVGhyZWFk (CreateRemoteThread)
  • Q3JlYXRlVGhyZWFk (CreateThread)
  • T3BlblByb2Nlc3M= (OpenProcess)
  • TnRXcml0ZVZpcnR1YWxNZW1vcnk= (NtWriteVirtualMemory)
  • V3JpdGVQcm9jZXNzTWVtb3J5 (WriteProcessMemory)
  • VmlydHVhbEFsbG9jRXg= (VirtualAllocEx)

Match: create_service

  • Q29udHJvbFNlcnZpY2U= (ControlService)
  • Q3JlYXRlU2VydmljZQ== (CreateService)
  • QURWQVBJMzIuZGxs (ADVAPI32.dll)
  • U3RhcnRTZXJ2aWNl (StartService)
  • UXVlcnlTZXJ2aWNlU3RhdHVz (QueryServiceStatus)
  • YWR2YXBpMzIuZGxs (advapi32.dll)

Match: network_udp_sock

  • V1MyXzMyLmRsbA== (WS2_32.dll)
  • V1NBU2VuZFRv (WSASendTo)
  • V1NBU3RhcnR1cA== (WSAStartup)
  • V1NBUmVjdkZyb20= (WSARecvFrom)
  • c2VuZHRv (sendto)
  • cmVjdmZyb20= (recvfrom)
  • d3MyXzMyLmRsbA== (ws2_32.dll)

Match: network_tcp_listen

  • V1MyXzMyLmRsbA== (WS2_32.dll)
  • V1NBQWNjZXB0 (WSAAccept)
  • V1NBU29ja2V0 (WSASocket)
  • V1NBU3RhcnR1cA== (WSAStartup)
  • YWNjZXB0 (accept)
  • YmluZA== (bind)
  • bGlzdGVu (listen)
  • bXN3c29jay5kbGw= (mswsock.dll)
  • d3MyXzMyLmRsbA== (ws2_32.dll)

Match: network_p2p_win

  • UGVlckNvbGxhYkV4cG9ydENvbnRhY3Q= (PeerCollabExportContact)
  • UGVlckNvbGxhYkdldEFwcGxpY2F0aW9uUmVnaXN0cmF0aW9uSW5mbw== (PeerCollabGetApplicationRegistrationInfo)
  • UGVlckNvbGxhYkdldEV2ZW50RGF0YQ== (PeerCollabGetEventData)
  • UGVlckNvbGxhYkdldEVuZHBvaW50TmFtZQ== (PeerCollabGetEndpointName)
  • UGVlckNvbGxhYkdldEludml0YXRpb25SZXNwb25zZQ== (PeerCollabGetInvitationResponse)
  • UGVlckNvbGxhYkdldFByZXNlbmNlSW5mbw== (PeerCollabGetPresenceInfo)
  • UGVlckNvbGxhYkdldFNpZ25pbk9wdGlvbnM= (PeerCollabGetSigninOptions)
  • UGVlckNvbGxhYkludml0ZUNvbnRhY3Q= (PeerCollabInviteContact)
  • UGVlckNvbGxhYkludml0ZUVuZHBvaW50 (PeerCollabInviteEndpoint)
  • UGVlckNvbGxhYlBhcnNlQ29udGFjdA== (PeerCollabParseContact)
  • UGVlckNvbGxhYlF1ZXJ5Q29udGFjdERhdGE= (PeerCollabQueryContactData)
  • UGVlckNvbGxhYlJlZ2lzdGVyQXBwbGljYXRpb24= (PeerCollabRegisterApplication)
  • UGVlckNvbGxhYlJlZ2lzdGVyRXZlbnQ= (PeerCollabRegisterEvent)
  • UGVlckNvbGxhYlJlZnJlc2hFbmRwb2ludERhdGE= (PeerCollabRefreshEndpointData)
  • UGVlckNvbGxhYlNldE9iamVjdA== (PeerCollabSetObject)
  • UGVlckNvbGxhYlNldEVuZHBvaW50TmFtZQ== (PeerCollabSetEndpointName)
  • UGVlckNvbGxhYlNldFByZXNlbmNlSW5mbw== (PeerCollabSetPresenceInfo)
  • UGVlckNvbGxhYlNpZ25vdXQ= (PeerCollabSignout)
  • UGVlckNvbGxhYlVucmVnaXN0ZXJBcHBsaWNhdGlvbg== (PeerCollabUnregisterApplication)
  • UGVlckNvbGxhYlVwZGF0ZUNvbnRhY3Q= (PeerCollabUpdateContact)

Match: network_http

  • SHR0cE9wZW5SZXF1ZXN0 (HttpOpenRequest)
  • SHR0cFNlbmRSZXF1ZXN0 (HttpSendRequest)
  • SW50ZXJuZXRDb25uZWN0 (InternetConnect)
  • SW50ZXJuZXRPcGVu (InternetOpen)
  • SW50ZXJuZXRPcGVuVXJs (InternetOpenUrl)
  • SW50ZXJuZXRSZWFkRmlsZQ== (InternetReadFile)
  • SW50ZXJuZXRXcml0ZUZpbGU= (InternetWriteFile)
  • d2luaW5ldC5kbGw= (wininet.dll)

Match: network_dropper

  • VVJMRG93bmxvYWRUb0NhY2hlRmlsZQ== (URLDownloadToCacheFile)
  • VVJMRG93bmxvYWRUb0ZpbGU= (URLDownloadToFile)
  • dXJsbW9uLmRsbA== (urlmon.dll)

Match: network_ftp

  • RnRwQ3JlYXRlRGlyZWN0b3J5 (FtpCreateDirectory)
  • RnRwR2V0Q3VycmVudERpcmVjdG9yeQ== (FtpGetCurrentDirectory)
  • RnRwR2V0RmlsZQ== (FtpGetFile)
  • RnRwR2V0RmlsZVNpemU= (FtpGetFileSize)
  • RnRwRGVsZXRlRmlsZQ== (FtpDeleteFile)
  • RnRwT3BlbkZpbGU= (FtpOpenFile)
  • RnRwU2V0Q3VycmVudERpcmVjdG9yeQ== (FtpSetCurrentDirectory)
  • RnRwUHV0RmlsZQ== (FtpPutFile)
  • RnRwUmVtb3ZlRGlyZWN0b3J5 (FtpRemoveDirectory)
  • RnRwUmVuYW1lRmlsZQ== (FtpRenameFile)
  • d2luaW5ldC5kbGw= (wininet.dll)

Match: network_tcp_socket

  • V1MyXzMyLmRsbA== (WS2_32.dll)
  • V1NBQ29ubmVjdA== (WSAConnect)
  • V1NBQ2xlYW51cA== (WSACleanup)
  • V1NBU29ja2V0 (WSASocket)
  • V1NBU2VuZA== (WSASend)
  • V1NBU3RhcnR1cA== (WSAStartup)
  • Y29ubmVjdA== (connect)
  • Y2xvc2Vzb2NrZXQ= (closesocket)
  • c29ja2V0 (socket)
  • c2VuZA== (send)
  • d3MyXzMyLmRsbA== (ws2_32.dll)

Match: network_dns

  • RG5zUXVlcnk= (DnsQuery)
  • V1MyXzMyLmRsbA== (WS2_32.dll)
  • Z2V0YWRkcmluZm8= (getaddrinfo)
  • Z2V0aG9zdGJ5bmFtZQ== (gethostbyname)
  • ZG5zYXBpLmRsbA== (dnsapi.dll)
  • d3MyXzMyLmRsbA== (ws2_32.dll)

Match: network_dga

  • Q1JZUFQzMi5kbGw= (CRYPT32.dll)
  • Q3J5cHRBY3F1aXJlQ29udGV4dA== (CryptAcquireContext)
  • Q3J5cHRDcmVhdGVIYXNo (CryptCreateHash)
  • Q3J5cHRIYXNoRGF0YQ== (CryptHashData)
  • QURWQVBJMzIuZGxs (ADVAPI32.dll)
  • R2V0U3lzdGVtVGltZQ== (GetSystemTime)
  • R2V0U3lzdGVtVGltZUFzRmlsZVRpbWU= (GetSystemTimeAsFileTime)
  • SW50ZXJuZXRPcGVu (InternetOpen)
  • SW50ZXJuZXRPcGVuVXJs (InternetOpenUrl)
  • U3lzdGVtVGltZVRvRmlsZVRpbWU= (SystemTimeToFileTime)
  • Y3J5cHQzMi5kbGw= (crypt32.dll)
  • YWR2YXBpMzIuZGxs (advapi32.dll)
  • Z2V0YWRkcmluZm8= (getaddrinfo)
  • Z2V0aG9zdGJ5bmFtZQ== (gethostbyname)
  • d2luaW5ldC5kbGw= (wininet.dll)

Match: escalate_priv

  • QURWQVBJMzIuZGxs (ADVAPI32.dll)
  • QWRqdXN0VG9rZW5Qcml2aWxlZ2Vz (AdjustTokenPrivileges)
  • YWR2YXBpMzIuZGxs (advapi32.dll)

Match: screenshot

  • Qml0Qmx0 (BitBlt)
  • R0RJMzIuZGxs (GDI32.dll)
  • R2V0REM= (GetDC)
  • VVNFUjMyLmRsbA== (USER32.dll)
  • Z2RpMzIuZGxs (gdi32.dll)
  • dXNlcjMyLmRsbA== (user32.dll)

Match: keylogger

  • R2V0QXN5bmNLZXlTdGF0ZQ== (GetAsyncKeyState)
  • R2V0S2V5U3RhdGU= (GetKeyState)
  • R2V0S2V5Ym9hcmRUeXBl (GetKeyboardType)
  • TWFwVmlydHVhbEtleQ== (MapVirtualKey)
  • VVNFUjMyLmRsbA== (USER32.dll)
  • dXNlcjMyLmRsbA== (user32.dll)

Match: cred_local

  • Q3JlZEVudW1lcmF0ZUE= (CredEnumerateA)
  • Q3JlZEVudW1lcmF0ZVc= (CredEnumerateW)
  • THNhRW51bWVyYXRlTG9nb25TZXNzaW9ucw== (LsaEnumerateLogonSessions)
  • U2FtSUNvbm5lY3Q= (SamIConnect)
  • U2FtUXVlcnlJbmZvcm1hdGlvblVzZQ== (SamQueryInformationUse)

Match: sniff_audio

  • d2F2ZUluQ2xvc2U= (waveInClose)
  • d2F2ZUluQWRkQnVmZmVy (waveInAddBuffer)
  • d2F2ZUluT3Blbg== (waveInOpen)
  • d2F2ZUluU3RhcnQ= (waveInStart)
  • d2F2ZUluUmVzZXQ= (waveInReset)
  • d2lubW0uZGxs (winmm.dll)

Match: migrate_apc

  • T3BlblRocmVhZA== (OpenThread)
  • UXVldWVVc2VyQVBD (QueueUserAPC)

Match: spreading_file

  • ZGVza3RvcC5pbmk= (desktop.ini)

Match: spreading_share

  • TmV0U2hhcmVFbnVt (NetShareEnum)
  • TmV0U2hhcmVHZXRJbmZv (NetShareGetInfo)
  • bmV0YXBpMzIuZGxs (netapi32.dll)

Match: win_mutex

  • Q3JlYXRlTXV0ZXg= (CreateMutex)

Match: win_registry

  • QURWQVBJMzIuZGxs (ADVAPI32.dll)
  • UmVnQ2xvc2VLZXk= (RegCloseKey)
  • UmVnQ3JlYXRlS2V5QQ== (RegCreateKeyA)
  • UmVnT3BlbktleUV4QQ== (RegOpenKeyExA)
  • UmVnU2V0VmFsdWVFeEE= (RegSetValueExA)
  • UmVnUXVlcnlWYWx1ZUV4QQ== (RegQueryValueExA)
  • YWR2YXBpMzIuZGxs (advapi32.dll)

Match: win_token

  • QURWQVBJMzIuZGxs (ADVAPI32.dll)
  • QWRqdXN0VG9rZW5Qcml2aWxlZ2Vz (AdjustTokenPrivileges)
  • RHVwbGljYXRlVG9rZW5FeA== (DuplicateTokenEx)
  • T3BlblByb2Nlc3NUb2tlbg== (OpenProcessToken)
  • TG9va3VwUHJpdmlsZWdlVmFsdWVB (LookupPrivilegeValueA)
  • YWR2YXBpMzIuZGxs (advapi32.dll)

Match: win_private_profile

  • R2V0UHJpdmF0ZVByb2ZpbGVJbnRB (GetPrivateProfileIntA)
  • R2V0UHJpdmF0ZVByb2ZpbGVTdHJpbmdB (GetPrivateProfileStringA)
  • S0VSTkVMMzIuZGxs (KERNEL32.dll)
  • V3JpdGVQcml2YXRlUHJvZmlsZVN0cmluZ0E= (WritePrivateProfileStringA)

Match: win_files_operation

  • Q29weUZpbGU= (CopyFile)
  • Q3JlYXRlRmlsZUE= (CreateFileA)
  • RGVsZXRlRmlsZUE= (DeleteFileA)
  • RmluZENsb3Nl (FindClose)
  • RmluZEZpcnN0RmlsZUE= (FindFirstFileA)
  • S0VSTkVMMzIuZGxs (KERNEL32.dll)
  • TW92ZUZpbGVFeEE= (MoveFileExA)
  • U2V0RmlsZUF0dHJpYnV0ZXNB (SetFileAttributesA)
  • U2V0RmlsZVBvaW50ZXI= (SetFilePointer)
  • UmVhZEZpbGU= (ReadFile)
  • V3JpdGVGaWxl (WriteFile)

Match: Str_Win32_Winsock2_Library

  • V1MyXzMyLmRsbA== (WS2_32.dll)
  • d3MyXzMyLmRsbA== (ws2_32.dll)

Match: Str_Win32_Wininet_Library

  • d2luaW5ldC5kbGw= (wininet.dll)

Match: Str_Win32_Internet_API

  • SW50ZXJuZXRDb25uZWN0 (InternetConnect)
  • SW50ZXJuZXRDbG9zZUhhbmRsZQ== (InternetCloseHandle)
  • SW50ZXJuZXRPcGVu (InternetOpen)
  • SW50ZXJuZXRSZWFkRmlsZQ== (InternetReadFile)

Match: Str_Win32_Http_API

  • SHR0cE9wZW5SZXF1ZXN0 (HttpOpenRequest)
  • SHR0cFF1ZXJ5SW5mbw== (HttpQueryInfo)
  • SHR0cFNlbmRSZXF1ZXN0 (HttpSendRequest)

Match: DebuggerCheck__GlobalFlags

  • TnRHbG9iYWxGbGFncw== (NtGlobalFlags)

Match: DebuggerCheck__QueryInfo

  • UXVlcnlJbmZvcm1hdGlvblByb2Nlc3M= (QueryInformationProcess)

Match: DebuggerCheck__RemoteAPI

  • Q2hlY2tSZW1vdGVEZWJ1Z2dlclByZXNlbnQ= (CheckRemoteDebuggerPresent)

Match: DebuggerHiding__Thread

  • U2V0SW5mb3JtYXRpb25UaHJlYWQ= (SetInformationThread)

Match: DebuggerHiding__Active

  • RGVidWdBY3RpdmVQcm9jZXNz (DebugActiveProcess)

Match: DebuggerException__ConsoleCtrl

  • R2VuZXJhdGVDb25zb2xlQ3RybEV2ZW50 (GenerateConsoleCtrlEvent)

Match: DebuggerException__SetConsoleCtrl

  • U2V0Q29uc29sZUN0cmxIYW5kbGVy (SetConsoleCtrlHandler)

Match: ThreadControl__Context

  • U2V0VGhyZWFkQ29udGV4dA== (SetThreadContext)

Match: SEH__vectored

  • QWRkVmVjdG9yZWRFeGNlcHRpb25IYW5kbGVy (AddVectoredExceptionHandler)
  • UmVtb3ZlVmVjdG9yZWRFeGNlcHRpb25IYW5kbGVy (RemoveVectoredExceptionHandler)

Match: Check_Dlls

  • ZGJnaGVscC5kbGw= (dbghelp.dll)
  • cHN0b3JlYy5kbGw= (pstorec.dll)

Match: anti_dbg

  • Q29udGludWVEZWJ1Z0V2ZW50 (ContinueDebugEvent)
  • Q2hlY2tSZW1vdGVEZWJ1Z2dlclByZXNlbnQ= (CheckRemoteDebuggerPresent)
  • RGVidWdBY3RpdmVQcm9jZXNz (DebugActiveProcess)
  • S0VSTkVMMzIuZGxs (KERNEL32.dll)
  • SXNEZWJ1Z2dlclByZXNlbnQ= (IsDebuggerPresent)
  • T3V0cHV0RGVidWdTdHJpbmc= (OutputDebugString)

Match: antisb_threatExpert

  • ZGJnaGVscC5kbGw= (dbghelp.dll)

Match: disable_dep

  • TnRTZXRJbmZvcm1hdGlvblByb2Nlc3M= (NtSetInformationProcess)
  • U2V0UHJvY2Vzc0RFUFBvbGljeQ== (SetProcessDEPPolicy)
  • WndQcm90ZWN0VmlydHVhbE1lbW9yeQ== (ZwProtectVirtualMemory)

Match: win_hook

  • Q2FsbE5leHRIb29rRXg= (CallNextHookEx)
  • U2V0V2luZG93c0hvb2tFeEE= (SetWindowsHookExA)
  • VVNFUjMyLmRsbA== (USER32.dll)
  • VW5ob29rV2luZG93c0hvb2tFeA== (UnhookWindowsHookEx)
  • dXNlcjMyLmRsbA== (user32.dll)

Process memory dump for cmd.exe (PID 2092, dump 1)

Extracted/injected images (may contain unpacked executables)
Download #1

Yara signatures matches on process memory

Match: inject_thread

  • Q3JlYXRlUmVtb3RlVGhyZWFk (CreateRemoteThread)
  • Q3JlYXRlVGhyZWFk (CreateThread)
  • T3BlblByb2Nlc3M= (OpenProcess)
  • TnRXcml0ZVZpcnR1YWxNZW1vcnk= (NtWriteVirtualMemory)
  • V3JpdGVQcm9jZXNzTWVtb3J5 (WriteProcessMemory)
  • VmlydHVhbEFsbG9jRXg= (VirtualAllocEx)

Match: create_service

  • Q29udHJvbFNlcnZpY2U= (ControlService)
  • Q3JlYXRlU2VydmljZQ== (CreateService)
  • QURWQVBJMzIuRExM (ADVAPI32.DLL)
  • QURWQVBJMzIuZGxs (ADVAPI32.dll)
  • U3RhcnRTZXJ2aWNl (StartService)
  • UXVlcnlTZXJ2aWNlU3RhdHVz (QueryServiceStatus)
  • YWR2YXBpMzIuZGxs (advapi32.dll)

Match: network_udp_sock

  • V1MyXzMyLmRsbA== (WS2_32.dll)
  • V1NBU2VuZFRv (WSASendTo)
  • V1NBU3RhcnR1cA== (WSAStartup)
  • V1NBUmVjdkZyb20= (WSARecvFrom)
  • c2VuZHRv (sendto)
  • cmVjdmZyb20= (recvfrom)
  • d3MyXzMyLmRsbA== (ws2_32.dll)

Match: network_tcp_listen

  • V1MyXzMyLmRsbA== (WS2_32.dll)
  • V1NBQWNjZXB0 (WSAAccept)
  • V1NBU29ja2V0 (WSASocket)
  • V1NBU3RhcnR1cA== (WSAStartup)
  • YWNjZXB0 (accept)
  • YmluZA== (bind)
  • bGlzdGVu (listen)
  • bXN3c29jay5kbGw= (mswsock.dll)
  • d3MyXzMyLmRsbA== (ws2_32.dll)

Match: network_p2p_win

  • UGVlckNvbGxhYkV4cG9ydENvbnRhY3Q= (PeerCollabExportContact)
  • UGVlckNvbGxhYkdldEFwcGxpY2F0aW9uUmVnaXN0cmF0aW9uSW5mbw== (PeerCollabGetApplicationRegistrationInfo)
  • UGVlckNvbGxhYkdldEV2ZW50RGF0YQ== (PeerCollabGetEventData)
  • UGVlckNvbGxhYkdldEVuZHBvaW50TmFtZQ== (PeerCollabGetEndpointName)
  • UGVlckNvbGxhYkdldEludml0YXRpb25SZXNwb25zZQ== (PeerCollabGetInvitationResponse)
  • UGVlckNvbGxhYkdldFByZXNlbmNlSW5mbw== (PeerCollabGetPresenceInfo)
  • UGVlckNvbGxhYkdldFNpZ25pbk9wdGlvbnM= (PeerCollabGetSigninOptions)
  • UGVlckNvbGxhYkludml0ZUNvbnRhY3Q= (PeerCollabInviteContact)
  • UGVlckNvbGxhYkludml0ZUVuZHBvaW50 (PeerCollabInviteEndpoint)
  • UGVlckNvbGxhYlBhcnNlQ29udGFjdA== (PeerCollabParseContact)
  • UGVlckNvbGxhYlF1ZXJ5Q29udGFjdERhdGE= (PeerCollabQueryContactData)
  • UGVlckNvbGxhYlJlZ2lzdGVyQXBwbGljYXRpb24= (PeerCollabRegisterApplication)
  • UGVlckNvbGxhYlJlZ2lzdGVyRXZlbnQ= (PeerCollabRegisterEvent)
  • UGVlckNvbGxhYlJlZnJlc2hFbmRwb2ludERhdGE= (PeerCollabRefreshEndpointData)
  • UGVlckNvbGxhYlNldE9iamVjdA== (PeerCollabSetObject)
  • UGVlckNvbGxhYlNldEVuZHBvaW50TmFtZQ== (PeerCollabSetEndpointName)
  • UGVlckNvbGxhYlNldFByZXNlbmNlSW5mbw== (PeerCollabSetPresenceInfo)
  • UGVlckNvbGxhYlNpZ25vdXQ= (PeerCollabSignout)
  • UGVlckNvbGxhYlVucmVnaXN0ZXJBcHBsaWNhdGlvbg== (PeerCollabUnregisterApplication)
  • UGVlckNvbGxhYlVwZGF0ZUNvbnRhY3Q= (PeerCollabUpdateContact)

Match: network_http

  • SHR0cE9wZW5SZXF1ZXN0 (HttpOpenRequest)
  • SHR0cFNlbmRSZXF1ZXN0 (HttpSendRequest)
  • SW50ZXJuZXRDb25uZWN0 (InternetConnect)
  • SW50ZXJuZXRPcGVu (InternetOpen)
  • SW50ZXJuZXRPcGVuVXJs (InternetOpenUrl)
  • SW50ZXJuZXRSZWFkRmlsZQ== (InternetReadFile)
  • SW50ZXJuZXRXcml0ZUZpbGU= (InternetWriteFile)
  • d2luaW5ldC5kbGw= (wininet.dll)

Match: network_dropper

  • VVJMRG93bmxvYWRUb0NhY2hlRmlsZQ== (URLDownloadToCacheFile)
  • VVJMRG93bmxvYWRUb0ZpbGU= (URLDownloadToFile)
  • dXJsbW9uLmRsbA== (urlmon.dll)

Match: network_ftp

  • RnRwQ3JlYXRlRGlyZWN0b3J5 (FtpCreateDirectory)
  • RnRwR2V0Q3VycmVudERpcmVjdG9yeQ== (FtpGetCurrentDirectory)
  • RnRwR2V0RmlsZQ== (FtpGetFile)
  • RnRwR2V0RmlsZVNpemU= (FtpGetFileSize)
  • RnRwRGVsZXRlRmlsZQ== (FtpDeleteFile)
  • RnRwT3BlbkZpbGU= (FtpOpenFile)
  • RnRwU2V0Q3VycmVudERpcmVjdG9yeQ== (FtpSetCurrentDirectory)
  • RnRwUHV0RmlsZQ== (FtpPutFile)
  • RnRwUmVtb3ZlRGlyZWN0b3J5 (FtpRemoveDirectory)
  • RnRwUmVuYW1lRmlsZQ== (FtpRenameFile)
  • d2luaW5ldC5kbGw= (wininet.dll)

Match: network_tcp_socket

  • V1MyXzMyLmRsbA== (WS2_32.dll)
  • V1NBQ29ubmVjdA== (WSAConnect)
  • V1NBQ2xlYW51cA== (WSACleanup)
  • V1NBU29ja2V0 (WSASocket)
  • V1NBU2VuZA== (WSASend)
  • V1NBU3RhcnR1cA== (WSAStartup)
  • Y29ubmVjdA== (connect)
  • Y2xvc2Vzb2NrZXQ= (closesocket)
  • c29ja2V0 (socket)
  • c2VuZA== (send)
  • d3MyXzMyLmRsbA== (ws2_32.dll)

Match: network_dns

  • RG5zUXVlcnk= (DnsQuery)
  • V1MyXzMyLmRsbA== (WS2_32.dll)
  • Z2V0YWRkcmluZm8= (getaddrinfo)
  • Z2V0aG9zdGJ5bmFtZQ== (gethostbyname)
  • ZG5zYXBpLmRsbA== (dnsapi.dll)
  • d3MyXzMyLmRsbA== (ws2_32.dll)

Match: network_dga

  • Q3J5cHRBY3F1aXJlQ29udGV4dA== (CryptAcquireContext)
  • Q3J5cHRDcmVhdGVIYXNo (CryptCreateHash)
  • Q3J5cHRIYXNoRGF0YQ== (CryptHashData)
  • QURWQVBJMzIuRExM (ADVAPI32.DLL)
  • QURWQVBJMzIuZGxs (ADVAPI32.dll)
  • R2V0U3lzdGVtVGltZQ== (GetSystemTime)
  • R2V0U3lzdGVtVGltZUFzRmlsZVRpbWU= (GetSystemTimeAsFileTime)
  • SW50ZXJuZXRPcGVu (InternetOpen)
  • SW50ZXJuZXRPcGVuVXJs (InternetOpenUrl)
  • U3lzdGVtVGltZVRvRmlsZVRpbWU= (SystemTimeToFileTime)
  • Y3J5cHQzMi5kbGw= (crypt32.dll)
  • YWR2YXBpMzIuZGxs (advapi32.dll)
  • Z2V0YWRkcmluZm8= (getaddrinfo)
  • Z2V0aG9zdGJ5bmFtZQ== (gethostbyname)
  • d2luaW5ldC5kbGw= (wininet.dll)

Match: escalate_priv

  • QURWQVBJMzIuRExM (ADVAPI32.DLL)
  • QURWQVBJMzIuZGxs (ADVAPI32.dll)
  • QWRqdXN0VG9rZW5Qcml2aWxlZ2Vz (AdjustTokenPrivileges)
  • YWR2YXBpMzIuZGxs (advapi32.dll)

Match: screenshot

  • Qml0Qmx0 (BitBlt)
  • R0RJMzIuZGxs (GDI32.dll)
  • R2V0REM= (GetDC)
  • VVNFUjMyLmRsbA== (USER32.dll)
  • Z2RpMzIuZGxs (gdi32.dll)
  • dXNlcjMyLmRsbA== (user32.dll)

Match: keylogger

  • R2V0QXN5bmNLZXlTdGF0ZQ== (GetAsyncKeyState)
  • R2V0S2V5U3RhdGU= (GetKeyState)
  • R2V0S2V5Ym9hcmRUeXBl (GetKeyboardType)
  • TWFwVmlydHVhbEtleQ== (MapVirtualKey)
  • VVNFUjMyLmRsbA== (USER32.dll)
  • dXNlcjMyLmRsbA== (user32.dll)

Match: cred_local

  • Q3JlZEVudW1lcmF0ZUE= (CredEnumerateA)
  • Q3JlZEVudW1lcmF0ZVc= (CredEnumerateW)
  • THNhRW51bWVyYXRlTG9nb25TZXNzaW9ucw== (LsaEnumerateLogonSessions)
  • U2FtSUNvbm5lY3Q= (SamIConnect)
  • U2FtUXVlcnlJbmZvcm1hdGlvblVzZQ== (SamQueryInformationUse)

Match: sniff_audio

  • d2F2ZUluQ2xvc2U= (waveInClose)
  • d2F2ZUluQWRkQnVmZmVy (waveInAddBuffer)
  • d2F2ZUluT3Blbg== (waveInOpen)
  • d2F2ZUluU3RhcnQ= (waveInStart)
  • d2F2ZUluUmVzZXQ= (waveInReset)
  • d2lubW0uZGxs (winmm.dll)

Match: migrate_apc

  • T3BlblRocmVhZA== (OpenThread)
  • UXVldWVVc2VyQVBD (QueueUserAPC)

Match: spreading_share

  • TmV0U2hhcmVFbnVt (NetShareEnum)
  • TmV0U2hhcmVHZXRJbmZv (NetShareGetInfo)
  • bmV0YXBpMzIuZGxs (netapi32.dll)

Match: win_mutex

  • Q3JlYXRlTXV0ZXg= (CreateMutex)

Match: win_registry

  • QURWQVBJMzIuRExM (ADVAPI32.DLL)
  • QURWQVBJMzIuZGxs (ADVAPI32.dll)
  • UmVnQ2xvc2VLZXk= (RegCloseKey)
  • UmVnQ3JlYXRlS2V5QQ== (RegCreateKeyA)
  • UmVnT3BlbktleUV4QQ== (RegOpenKeyExA)
  • UmVnU2V0VmFsdWVFeEE= (RegSetValueExA)
  • UmVnUXVlcnlWYWx1ZUV4QQ== (RegQueryValueExA)
  • YWR2YXBpMzIuZGxs (advapi32.dll)

Match: win_token

  • QURWQVBJMzIuRExM (ADVAPI32.DLL)
  • QURWQVBJMzIuZGxs (ADVAPI32.dll)
  • QWRqdXN0VG9rZW5Qcml2aWxlZ2Vz (AdjustTokenPrivileges)
  • RHVwbGljYXRlVG9rZW5FeA== (DuplicateTokenEx)
  • T3BlblByb2Nlc3NUb2tlbg== (OpenProcessToken)
  • TG9va3VwUHJpdmlsZWdlVmFsdWVB (LookupPrivilegeValueA)
  • YWR2YXBpMzIuZGxs (advapi32.dll)

Match: win_private_profile

  • R2V0UHJpdmF0ZVByb2ZpbGVJbnRB (GetPrivateProfileIntA)
  • R2V0UHJpdmF0ZVByb2ZpbGVTdHJpbmdB (GetPrivateProfileStringA)
  • S0VSTkVMMzIuRExM (KERNEL32.DLL)
  • S0VSTkVMMzIuZGxs (KERNEL32.dll)
  • V3JpdGVQcml2YXRlUHJvZmlsZVN0cmluZ0E= (WritePrivateProfileStringA)
  • a2VybmVsMzIuZGxs (kernel32.dll)

Match: win_files_operation

  • Q29weUZpbGU= (CopyFile)
  • Q3JlYXRlRmlsZUE= (CreateFileA)
  • RGVsZXRlRmlsZUE= (DeleteFileA)
  • RmluZENsb3Nl (FindClose)
  • RmluZEZpcnN0RmlsZUE= (FindFirstFileA)
  • S0VSTkVMMzIuRExM (KERNEL32.DLL)
  • S0VSTkVMMzIuZGxs (KERNEL32.dll)
  • TW92ZUZpbGVFeEE= (MoveFileExA)
  • U2V0RmlsZUF0dHJpYnV0ZXNB (SetFileAttributesA)
  • U2V0RmlsZVBvaW50ZXI= (SetFilePointer)
  • UmVhZEZpbGU= (ReadFile)
  • V3JpdGVGaWxl (WriteFile)
  • a2VybmVsMzIuZGxs (kernel32.dll)

Match: Str_Win32_Winsock2_Library

  • V1MyXzMyLmRsbA== (WS2_32.dll)
  • d3MyXzMyLmRsbA== (ws2_32.dll)

Match: Str_Win32_Wininet_Library

  • d2luaW5ldC5kbGw= (wininet.dll)

Match: Str_Win32_Internet_API

  • SW50ZXJuZXRDb25uZWN0 (InternetConnect)
  • SW50ZXJuZXRDbG9zZUhhbmRsZQ== (InternetCloseHandle)
  • SW50ZXJuZXRPcGVu (InternetOpen)
  • SW50ZXJuZXRSZWFkRmlsZQ== (InternetReadFile)

Match: Str_Win32_Http_API

  • SHR0cE9wZW5SZXF1ZXN0 (HttpOpenRequest)
  • SHR0cFF1ZXJ5SW5mbw== (HttpQueryInfo)
  • SHR0cFNlbmRSZXF1ZXN0 (HttpSendRequest)

Match: DebuggerCheck__GlobalFlags

  • TnRHbG9iYWxGbGFncw== (NtGlobalFlags)

Match: DebuggerCheck__QueryInfo

  • UXVlcnlJbmZvcm1hdGlvblByb2Nlc3M= (QueryInformationProcess)

Match: DebuggerCheck__RemoteAPI

  • Q2hlY2tSZW1vdGVEZWJ1Z2dlclByZXNlbnQ= (CheckRemoteDebuggerPresent)

Match: DebuggerHiding__Thread

  • U2V0SW5mb3JtYXRpb25UaHJlYWQ= (SetInformationThread)

Match: DebuggerHiding__Active

  • RGVidWdBY3RpdmVQcm9jZXNz (DebugActiveProcess)

Match: DebuggerException__ConsoleCtrl

  • R2VuZXJhdGVDb25zb2xlQ3RybEV2ZW50 (GenerateConsoleCtrlEvent)

Match: DebuggerException__SetConsoleCtrl

  • U2V0Q29uc29sZUN0cmxIYW5kbGVy (SetConsoleCtrlHandler)

Match: ThreadControl__Context

  • U2V0VGhyZWFkQ29udGV4dA== (SetThreadContext)

Match: SEH__vectored

  • QWRkVmVjdG9yZWRFeGNlcHRpb25IYW5kbGVy (AddVectoredExceptionHandler)
  • UmVtb3ZlVmVjdG9yZWRFeGNlcHRpb25IYW5kbGVy (RemoveVectoredExceptionHandler)

Match: Check_Dlls

  • ZGJnaGVscC5kbGw= (dbghelp.dll)
  • cABzAHQAbwByAGUAYwAuAGQAbABsAA== (pstorec.dll)
  • cHN0b3JlYy5kbGw= (pstorec.dll)

Match: anti_dbg

  • Q29udGludWVEZWJ1Z0V2ZW50 (ContinueDebugEvent)
  • Q2hlY2tSZW1vdGVEZWJ1Z2dlclByZXNlbnQ= (CheckRemoteDebuggerPresent)
  • RGVidWdBY3RpdmVQcm9jZXNz (DebugActiveProcess)
  • S0VSTkVMMzIuRExM (KERNEL32.DLL)
  • S0VSTkVMMzIuZGxs (KERNEL32.dll)
  • SXNEZWJ1Z2dlclByZXNlbnQ= (IsDebuggerPresent)
  • T3V0cHV0RGVidWdTdHJpbmc= (OutputDebugString)
  • a2VybmVsMzIuZGxs (kernel32.dll)

Match: antisb_threatExpert

  • ZGJnaGVscC5kbGw= (dbghelp.dll)

Match: disable_dep

  • TnRTZXRJbmZvcm1hdGlvblByb2Nlc3M= (NtSetInformationProcess)
  • U2V0UHJvY2Vzc0RFUFBvbGljeQ== (SetProcessDEPPolicy)
  • WndQcm90ZWN0VmlydHVhbE1lbW9yeQ== (ZwProtectVirtualMemory)

Match: win_hook

  • Q2FsbE5leHRIb29rRXg= (CallNextHookEx)
  • U2V0V2luZG93c0hvb2tFeEE= (SetWindowsHookExA)
  • VVNFUjMyLmRsbA== (USER32.dll)
  • VW5ob29rV2luZG93c0hvb2tFeA== (UnhookWindowsHookEx)
  • dXNlcjMyLmRsbA== (user32.dll)

Process memory dump for None (PID 2208, dump 1)

Extracted/injected images (may contain unpacked executables)
Download #1

Yara signatures matches on process memory

Match: inject_thread

  • Q3JlYXRlUmVtb3RlVGhyZWFk (CreateRemoteThread)
  • Q3JlYXRlVGhyZWFk (CreateThread)
  • T3BlblByb2Nlc3M= (OpenProcess)
  • TnRXcml0ZVZpcnR1YWxNZW1vcnk= (NtWriteVirtualMemory)
  • V3JpdGVQcm9jZXNzTWVtb3J5 (WriteProcessMemory)
  • VmlydHVhbEFsbG9jRXg= (VirtualAllocEx)

Match: create_service

  • Q29udHJvbFNlcnZpY2U= (ControlService)
  • Q3JlYXRlU2VydmljZQ== (CreateService)
  • QURWQVBJMzIuRExM (ADVAPI32.DLL)
  • QURWQVBJMzIuZGxs (ADVAPI32.dll)
  • U3RhcnRTZXJ2aWNl (StartService)
  • UXVlcnlTZXJ2aWNlU3RhdHVz (QueryServiceStatus)
  • YWR2YXBpMzIuZGxs (advapi32.dll)

Match: create_com_service

  • RGxsQ2FuVW5sb2FkTm93 (DllCanUnloadNow)
  • RGxsR2V0Q2xhc3NPYmplY3Q= (DllGetClassObject)
  • RGxsSW5zdGFsbA== (DllInstall)
  • RGxsUmVnaXN0ZXJTZXJ2ZXI= (DllRegisterServer)
  • RGxsVW5yZWdpc3RlclNlcnZlcg== (DllUnregisterServer)

Match: network_udp_sock

  • V1MyXzMyLmRsbA== (WS2_32.dll)
  • V1NBU2VuZFRv (WSASendTo)
  • V1NBU3RhcnR1cA== (WSAStartup)
  • V1NBUmVjdkZyb20= (WSARecvFrom)
  • c2VuZHRv (sendto)
  • cmVjdmZyb20= (recvfrom)
  • d3MyXzMyLmRsbA== (ws2_32.dll)

Match: network_tcp_listen

  • V1MyXzMyLmRsbA== (WS2_32.dll)
  • V1NBQWNjZXB0 (WSAAccept)
  • V1NBU29ja2V0 (WSASocket)
  • V1NBU3RhcnR1cA== (WSAStartup)
  • YWNjZXB0 (accept)
  • YmluZA== (bind)
  • bGlzdGVu (listen)
  • bXN3c29jay5kbGw= (mswsock.dll)
  • d3MyXzMyLmRsbA== (ws2_32.dll)

Match: network_p2p_win

  • UGVlckNvbGxhYkV4cG9ydENvbnRhY3Q= (PeerCollabExportContact)
  • UGVlckNvbGxhYkdldEFwcGxpY2F0aW9uUmVnaXN0cmF0aW9uSW5mbw== (PeerCollabGetApplicationRegistrationInfo)
  • UGVlckNvbGxhYkdldEV2ZW50RGF0YQ== (PeerCollabGetEventData)
  • UGVlckNvbGxhYkdldEVuZHBvaW50TmFtZQ== (PeerCollabGetEndpointName)
  • UGVlckNvbGxhYkdldEludml0YXRpb25SZXNwb25zZQ== (PeerCollabGetInvitationResponse)
  • UGVlckNvbGxhYkdldFByZXNlbmNlSW5mbw== (PeerCollabGetPresenceInfo)
  • UGVlckNvbGxhYkdldFNpZ25pbk9wdGlvbnM= (PeerCollabGetSigninOptions)
  • UGVlckNvbGxhYkludml0ZUNvbnRhY3Q= (PeerCollabInviteContact)
  • UGVlckNvbGxhYkludml0ZUVuZHBvaW50 (PeerCollabInviteEndpoint)
  • UGVlckNvbGxhYlBhcnNlQ29udGFjdA== (PeerCollabParseContact)
  • UGVlckNvbGxhYlF1ZXJ5Q29udGFjdERhdGE= (PeerCollabQueryContactData)
  • UGVlckNvbGxhYlJlZ2lzdGVyQXBwbGljYXRpb24= (PeerCollabRegisterApplication)
  • UGVlckNvbGxhYlJlZ2lzdGVyRXZlbnQ= (PeerCollabRegisterEvent)
  • UGVlckNvbGxhYlJlZnJlc2hFbmRwb2ludERhdGE= (PeerCollabRefreshEndpointData)
  • UGVlckNvbGxhYlNldE9iamVjdA== (PeerCollabSetObject)
  • UGVlckNvbGxhYlNldEVuZHBvaW50TmFtZQ== (PeerCollabSetEndpointName)
  • UGVlckNvbGxhYlNldFByZXNlbmNlSW5mbw== (PeerCollabSetPresenceInfo)
  • UGVlckNvbGxhYlNpZ25vdXQ= (PeerCollabSignout)
  • UGVlckNvbGxhYlVucmVnaXN0ZXJBcHBsaWNhdGlvbg== (PeerCollabUnregisterApplication)
  • UGVlckNvbGxhYlVwZGF0ZUNvbnRhY3Q= (PeerCollabUpdateContact)

Match: network_http

  • SHR0cE9wZW5SZXF1ZXN0 (HttpOpenRequest)
  • SHR0cFNlbmRSZXF1ZXN0 (HttpSendRequest)
  • SW50ZXJuZXRDb25uZWN0 (InternetConnect)
  • SW50ZXJuZXRPcGVu (InternetOpen)
  • SW50ZXJuZXRPcGVuVXJs (InternetOpenUrl)
  • SW50ZXJuZXRSZWFkRmlsZQ== (InternetReadFile)
  • SW50ZXJuZXRXcml0ZUZpbGU= (InternetWriteFile)
  • V0lOSU5FVC5ETEw= (WININET.DLL)
  • V0lOSU5FVC5kbGw= (WININET.dll)
  • d2luaW5ldC5kbGw= (wininet.dll)

Match: network_dropper

  • VVJMRG93bmxvYWRUb0NhY2hlRmlsZQ== (URLDownloadToCacheFile)
  • VVJMRG93bmxvYWRUb0ZpbGU= (URLDownloadToFile)
  • dXJsbW9uLmRsbA== (urlmon.dll)

Match: network_ftp

  • RnRwQ3JlYXRlRGlyZWN0b3J5 (FtpCreateDirectory)
  • RnRwR2V0Q3VycmVudERpcmVjdG9yeQ== (FtpGetCurrentDirectory)
  • RnRwR2V0RmlsZQ== (FtpGetFile)
  • RnRwR2V0RmlsZVNpemU= (FtpGetFileSize)
  • RnRwRGVsZXRlRmlsZQ== (FtpDeleteFile)
  • RnRwT3BlbkZpbGU= (FtpOpenFile)
  • RnRwU2V0Q3VycmVudERpcmVjdG9yeQ== (FtpSetCurrentDirectory)
  • RnRwUHV0RmlsZQ== (FtpPutFile)
  • RnRwUmVtb3ZlRGlyZWN0b3J5 (FtpRemoveDirectory)
  • RnRwUmVuYW1lRmlsZQ== (FtpRenameFile)
  • V0lOSU5FVC5ETEw= (WININET.DLL)
  • V0lOSU5FVC5kbGw= (WININET.dll)
  • d2luaW5ldC5kbGw= (wininet.dll)

Match: network_tcp_socket

  • V1MyXzMyLmRsbA== (WS2_32.dll)
  • V1NBQ29ubmVjdA== (WSAConnect)
  • V1NBQ2xlYW51cA== (WSACleanup)
  • V1NBU29ja2V0 (WSASocket)
  • V1NBU2VuZA== (WSASend)
  • V1NBU3RhcnR1cA== (WSAStartup)
  • Y29ubmVjdA== (connect)
  • Y2xvc2Vzb2NrZXQ= (closesocket)
  • c29ja2V0 (socket)
  • c2VuZA== (send)
  • d3MyXzMyLmRsbA== (ws2_32.dll)

Match: network_dns

  • RE5TQVBJLmRsbA== (DNSAPI.dll)
  • RG5zUXVlcnk= (DnsQuery)
  • V1MyXzMyLmRsbA== (WS2_32.dll)
  • Z2V0YWRkcmluZm8= (getaddrinfo)
  • Z2V0aG9zdGJ5bmFtZQ== (gethostbyname)
  • ZG5zYXBpLmRsbA== (dnsapi.dll)
  • d3MyXzMyLmRsbA== (ws2_32.dll)

Match: network_dga

  • Q1JZUFQzMi5kbGw= (CRYPT32.dll)
  • Q3J5cHRBY3F1aXJlQ29udGV4dA== (CryptAcquireContext)
  • Q3J5cHRDcmVhdGVIYXNo (CryptCreateHash)
  • Q3J5cHRIYXNoRGF0YQ== (CryptHashData)
  • QURWQVBJMzIuRExM (ADVAPI32.DLL)
  • QURWQVBJMzIuZGxs (ADVAPI32.dll)
  • R2V0U3lzdGVtVGltZQ== (GetSystemTime)
  • R2V0U3lzdGVtVGltZUFzRmlsZVRpbWU= (GetSystemTimeAsFileTime)
  • SW50ZXJuZXRPcGVu (InternetOpen)
  • SW50ZXJuZXRPcGVuVXJs (InternetOpenUrl)
  • U3lzdGVtVGltZVRvRmlsZVRpbWU= (SystemTimeToFileTime)
  • V0lOSU5FVC5ETEw= (WININET.DLL)
  • V0lOSU5FVC5kbGw= (WININET.dll)
  • Y3J5cHQzMi5kbGw= (crypt32.dll)
  • YWR2YXBpMzIuZGxs (advapi32.dll)
  • Z2V0YWRkcmluZm8= (getaddrinfo)
  • Z2V0aG9zdGJ5bmFtZQ== (gethostbyname)
  • d2luaW5ldC5kbGw= (wininet.dll)

Match: escalate_priv

  • QURWQVBJMzIuRExM (ADVAPI32.DLL)
  • QURWQVBJMzIuZGxs (ADVAPI32.dll)
  • QWRqdXN0VG9rZW5Qcml2aWxlZ2Vz (AdjustTokenPrivileges)
  • YWR2YXBpMzIuZGxs (advapi32.dll)

Match: screenshot

  • Qml0Qmx0 (BitBlt)
  • R0RJMzIuRExM (GDI32.DLL)
  • R0RJMzIuZGxs (GDI32.dll)
  • R2V0REM= (GetDC)
  • VVNFUjMyLkRMTA== (USER32.DLL)
  • VVNFUjMyLmRsbA== (USER32.dll)
  • Z2RpMzIuZGxs (gdi32.dll)
  • dXNlcjMyLmRsbA== (user32.dll)

Match: keylogger

  • R2V0QXN5bmNLZXlTdGF0ZQ== (GetAsyncKeyState)
  • R2V0S2V5U3RhdGU= (GetKeyState)
  • R2V0S2V5Ym9hcmRUeXBl (GetKeyboardType)
  • TWFwVmlydHVhbEtleQ== (MapVirtualKey)
  • VVNFUjMyLkRMTA== (USER32.DLL)
  • VVNFUjMyLmRsbA== (USER32.dll)
  • dXNlcjMyLmRsbA== (user32.dll)

Match: cred_local

  • Q3JlZEVudW1lcmF0ZUE= (CredEnumerateA)
  • Q3JlZEVudW1lcmF0ZVc= (CredEnumerateW)
  • THNhRW51bWVyYXRlTG9nb25TZXNzaW9ucw== (LsaEnumerateLogonSessions)
  • U2FtSUNvbm5lY3Q= (SamIConnect)
  • U2FtUXVlcnlJbmZvcm1hdGlvblVzZQ== (SamQueryInformationUse)

Match: sniff_audio

  • V0lOTU0uRExM (WINMM.DLL)
  • V0lOTU0uZGxs (WINMM.dll)
  • d2F2ZUluQ2xvc2U= (waveInClose)
  • d2F2ZUluQWRkQnVmZmVy (waveInAddBuffer)
  • d2F2ZUluT3Blbg== (waveInOpen)
  • d2F2ZUluU3RhcnQ= (waveInStart)
  • d2F2ZUluUmVzZXQ= (waveInReset)
  • d2lubW0uZGxs (winmm.dll)

Match: migrate_apc

  • T3BlblRocmVhZA== (OpenThread)
  • UXVldWVVc2VyQVBD (QueueUserAPC)

Match: spreading_file

  • ZGVza3RvcC5pbmk= (desktop.ini)

Match: spreading_share

  • TmV0U2hhcmVFbnVt (NetShareEnum)
  • TmV0U2hhcmVHZXRJbmZv (NetShareGetInfo)
  • bmV0YXBpMzIuZGxs (netapi32.dll)

Match: win_mutex

  • Q3JlYXRlTXV0ZXg= (CreateMutex)

Match: win_registry

  • QURWQVBJMzIuRExM (ADVAPI32.DLL)
  • QURWQVBJMzIuZGxs (ADVAPI32.dll)
  • UmVnQ2xvc2VLZXk= (RegCloseKey)
  • UmVnQ3JlYXRlS2V5QQ== (RegCreateKeyA)
  • UmVnT3BlbktleUV4QQ== (RegOpenKeyExA)
  • UmVnU2V0VmFsdWVFeEE= (RegSetValueExA)
  • UmVnUXVlcnlWYWx1ZUV4QQ== (RegQueryValueExA)
  • YWR2YXBpMzIuZGxs (advapi32.dll)

Match: win_token

  • QURWQVBJMzIuRExM (ADVAPI32.DLL)
  • QURWQVBJMzIuZGxs (ADVAPI32.dll)
  • QWRqdXN0VG9rZW5Qcml2aWxlZ2Vz (AdjustTokenPrivileges)
  • RHVwbGljYXRlVG9rZW5FeA== (DuplicateTokenEx)
  • T3BlblByb2Nlc3NUb2tlbg== (OpenProcessToken)
  • TG9va3VwUHJpdmlsZWdlVmFsdWVB (LookupPrivilegeValueA)
  • YWR2YXBpMzIuZGxs (advapi32.dll)

Match: win_private_profile

  • R2V0UHJpdmF0ZVByb2ZpbGVJbnRB (GetPrivateProfileIntA)
  • R2V0UHJpdmF0ZVByb2ZpbGVTdHJpbmdB (GetPrivateProfileStringA)
  • S0VSTkVMMzIuRExM (KERNEL32.DLL)
  • S0VSTkVMMzIuZGxs (KERNEL32.dll)
  • S2VybmVsMzIuRExM (Kernel32.DLL)
  • V3JpdGVQcml2YXRlUHJvZmlsZVN0cmluZ0E= (WritePrivateProfileStringA)
  • a2VybmVsMzIuZGxs (kernel32.dll)

Match: win_files_operation

  • Q29weUZpbGU= (CopyFile)
  • Q3JlYXRlRmlsZUE= (CreateFileA)
  • RGVsZXRlRmlsZUE= (DeleteFileA)
  • RmluZENsb3Nl (FindClose)
  • RmluZEZpcnN0RmlsZUE= (FindFirstFileA)
  • S0VSTkVMMzIuRExM (KERNEL32.DLL)
  • S0VSTkVMMzIuZGxs (KERNEL32.dll)
  • S2VybmVsMzIuRExM (Kernel32.DLL)
  • TW92ZUZpbGVFeEE= (MoveFileExA)
  • U2V0RmlsZUF0dHJpYnV0ZXNB (SetFileAttributesA)
  • U2V0RmlsZVBvaW50ZXI= (SetFilePointer)
  • UmVhZEZpbGU= (ReadFile)
  • V3JpdGVGaWxl (WriteFile)
  • a2VybmVsMzIuZGxs (kernel32.dll)

Match: Str_Win32_Winsock2_Library

  • V1MyXzMyLmRsbA== (WS2_32.dll)
  • d3MyXzMyLmRsbA== (ws2_32.dll)

Match: Str_Win32_Wininet_Library

  • V0lOSU5FVC5ETEw= (WININET.DLL)
  • V0lOSU5FVC5kbGw= (WININET.dll)
  • d2luaW5ldC5kbGw= (wininet.dll)

Match: Str_Win32_Internet_API

  • SW50ZXJuZXRDb25uZWN0 (InternetConnect)
  • SW50ZXJuZXRDbG9zZUhhbmRsZQ== (InternetCloseHandle)
  • SW50ZXJuZXRPcGVu (InternetOpen)
  • SW50ZXJuZXRSZWFkRmlsZQ== (InternetReadFile)

Match: Str_Win32_Http_API

  • SHR0cE9wZW5SZXF1ZXN0 (HttpOpenRequest)
  • SHR0cFF1ZXJ5SW5mbw== (HttpQueryInfo)
  • SHR0cFNlbmRSZXF1ZXN0 (HttpSendRequest)

Match: DebuggerCheck__GlobalFlags

  • TnRHbG9iYWxGbGFncw== (NtGlobalFlags)

Match: DebuggerCheck__QueryInfo

  • UXVlcnlJbmZvcm1hdGlvblByb2Nlc3M= (QueryInformationProcess)

Match: DebuggerCheck__RemoteAPI

  • Q2hlY2tSZW1vdGVEZWJ1Z2dlclByZXNlbnQ= (CheckRemoteDebuggerPresent)

Match: DebuggerHiding__Thread

  • U2V0SW5mb3JtYXRpb25UaHJlYWQ= (SetInformationThread)

Match: DebuggerHiding__Active

  • RGVidWdBY3RpdmVQcm9jZXNz (DebugActiveProcess)

Match: DebuggerException__ConsoleCtrl

  • R2VuZXJhdGVDb25zb2xlQ3RybEV2ZW50 (GenerateConsoleCtrlEvent)

Match: DebuggerException__SetConsoleCtrl

  • U2V0Q29uc29sZUN0cmxIYW5kbGVy (SetConsoleCtrlHandler)

Match: ThreadControl__Context

  • U2V0VGhyZWFkQ29udGV4dA== (SetThreadContext)

Match: SEH__vectored

  • QWRkVmVjdG9yZWRFeGNlcHRpb25IYW5kbGVy (AddVectoredExceptionHandler)
  • UmVtb3ZlVmVjdG9yZWRFeGNlcHRpb25IYW5kbGVy (RemoveVectoredExceptionHandler)

Match: Check_Dlls

  • ZGJnaGVscC5kbGw= (dbghelp.dll)
  • cHN0b3JlYy5kbGw= (pstorec.dll)

Match: anti_dbg

  • Q29udGludWVEZWJ1Z0V2ZW50 (ContinueDebugEvent)
  • Q2hlY2tSZW1vdGVEZWJ1Z2dlclByZXNlbnQ= (CheckRemoteDebuggerPresent)
  • RGVidWdBY3RpdmVQcm9jZXNz (DebugActiveProcess)
  • S0VSTkVMMzIuRExM (KERNEL32.DLL)
  • S0VSTkVMMzIuZGxs (KERNEL32.dll)
  • S2VybmVsMzIuRExM (Kernel32.DLL)
  • SXNEZWJ1Z2dlclByZXNlbnQ= (IsDebuggerPresent)
  • T3V0cHV0RGVidWdTdHJpbmc= (OutputDebugString)
  • a2VybmVsMzIuZGxs (kernel32.dll)

Match: antisb_threatExpert

  • ZGJnaGVscC5kbGw= (dbghelp.dll)

Match: disable_dep

  • TnRTZXRJbmZvcm1hdGlvblByb2Nlc3M= (NtSetInformationProcess)
  • U2V0UHJvY2Vzc0RFUFBvbGljeQ== (SetProcessDEPPolicy)
  • WndQcm90ZWN0VmlydHVhbE1lbW9yeQ== (ZwProtectVirtualMemory)

Match: win_hook

  • Q2FsbE5leHRIb29rRXg= (CallNextHookEx)
  • U2V0V2luZG93c0hvb2tFeEE= (SetWindowsHookExA)
  • VVNFUjMyLkRMTA== (USER32.DLL)
  • VVNFUjMyLmRsbA== (USER32.dll)
  • VW5ob29rV2luZG93c0hvb2tFeA== (UnhookWindowsHookEx)
  • dXNlcjMyLmRsbA== (user32.dll)

Process memory dump for PhoenixMiner.exe (PID 2488, dump 1)

Extracted/injected images (may contain unpacked executables)
Download #1

Yara signatures matches on process memory

Match: network_tcp_listen

  • QWNjZXB0RXg= (AcceptEx)
  • R2V0QWNjZXB0RXhTb2NrYWRkcnM= (GetAcceptExSockaddrs)
  • TVNXU09DSy5kbGw= (MSWSOCK.dll)
  • V1MyXzMyLmRsbA== (WS2_32.dll)
  • V1NBU29ja2V0 (WSASocket)
  • V1NBU3RhcnR1cA== (WSAStartup)
  • YWNjZXB0 (accept)
  • YmluZA== (bind)
  • bGlzdGVu (listen)

Match: network_tcp_socket

  • V1MyXzMyLmRsbA== (WS2_32.dll)
  • V1NBU29ja2V0 (WSASocket)
  • V1NBU2VuZA== (WSASend)
  • V1NBU3RhcnR1cA== (WSAStartup)
  • Y29ubmVjdA== (connect)
  • c29ja2V0 (socket)
  • c2VuZA== (send)

Match: network_dns

  • V1MyXzMyLmRsbA== (WS2_32.dll)
  • Z2V0YWRkcmluZm8= (getaddrinfo)
  • Z2V0aG9zdGJ5bmFtZQ== (gethostbyname)

Match: migrate_apc

  • T3BlblRocmVhZA== (OpenThread)
  • UXVldWVVc2VyQVBD (QueueUserAPC)

Match: win_mutex

  • Q3JlYXRlTXV0ZXg= (CreateMutex)

Match: win_registry

  • QURWQVBJMzIuZGxs (ADVAPI32.dll)
  • UmVnQ2xvc2VLZXk= (RegCloseKey)
  • UmVnT3BlbktleUV4QQ== (RegOpenKeyExA)
  • UmVnUXVlcnlWYWx1ZUV4QQ== (RegQueryValueExA)

Match: win_token

  • QURWQVBJMzIuZGxs (ADVAPI32.dll)
  • T3BlblByb2Nlc3NUb2tlbg== (OpenProcessToken)

Match: win_files_operation

  • RmluZENsb3Nl (FindClose)
  • S0VSTkVMMzIuZGxs (KERNEL32.dll)
  • U2V0RmlsZVBvaW50ZXI= (SetFilePointer)
  • UmVhZEZpbGU= (ReadFile)
  • V3JpdGVGaWxl (WriteFile)

Match: Str_Win32_Winsock2_Library

  • V1MyXzMyLmRsbA== (WS2_32.dll)

Match: DebuggerCheck__GlobalFlags

  • TnRHbG9iYWxGbGFncw== (NtGlobalFlags)

Match: DebuggerCheck__QueryInfo

  • UXVlcnlJbmZvcm1hdGlvblByb2Nlc3M= (QueryInformationProcess)

Match: DebuggerHiding__Thread

  • U2V0SW5mb3JtYXRpb25UaHJlYWQ= (SetInformationThread)

Match: DebuggerHiding__Active

  • RGVidWdBY3RpdmVQcm9jZXNz (DebugActiveProcess)

Match: DebuggerException__SetConsoleCtrl

  • U2V0Q29uc29sZUN0cmxIYW5kbGVy (SetConsoleCtrlHandler)

Match: ThreadControl__Context

  • U2V0VGhyZWFkQ29udGV4dA== (SetThreadContext)

Match: SEH__vectored

  • QWRkVmVjdG9yZWRFeGNlcHRpb25IYW5kbGVy (AddVectoredExceptionHandler)
  • UmVtb3ZlVmVjdG9yZWRFeGNlcHRpb25IYW5kbGVy (RemoveVectoredExceptionHandler)

Match: anti_dbg

  • RGVidWdBY3RpdmVQcm9jZXNz (DebugActiveProcess)
  • S0VSTkVMMzIuZGxs (KERNEL32.dll)
  • SXNEZWJ1Z2dlclByZXNlbnQ= (IsDebuggerPresent)
  • T3V0cHV0RGVidWdTdHJpbmc= (OutputDebugString)

Match: disable_dep

  • TnRTZXRJbmZvcm1hdGlvblByb2Nlc3M= (NtSetInformationProcess)
  • WndQcm90ZWN0VmlydHVhbE1lbW9yeQ== (ZwProtectVirtualMemory)

URLs found in process memory 
    https://curl.haxx.se/docs/http-cookies.html
    http://www.openssl.org/support/faq.html

Process memory dump for PhoenixMiner.exe (PID 2488, dump 2)

Extracted/injected images (may contain unpacked executables)
Download #1

Yara signatures matches on process memory

Match: inject_thread

  • Q3JlYXRlUmVtb3RlVGhyZWFk (CreateRemoteThread)
  • Q3JlYXRlVGhyZWFk (CreateThread)
  • T3BlblByb2Nlc3M= (OpenProcess)
  • TnRXcml0ZVZpcnR1YWxNZW1vcnk= (NtWriteVirtualMemory)
  • V3JpdGVQcm9jZXNzTWVtb3J5 (WriteProcessMemory)
  • VmlydHVhbEFsbG9jRXg= (VirtualAllocEx)

Match: create_service

  • Q29udHJvbFNlcnZpY2U= (ControlService)
  • Q3JlYXRlU2VydmljZQ== (CreateService)
  • QURWQVBJMzIuZGxs (ADVAPI32.dll)
  • U3RhcnRTZXJ2aWNl (StartService)
  • UXVlcnlTZXJ2aWNlU3RhdHVz (QueryServiceStatus)
  • YWR2YXBpMzIuZGxs (advapi32.dll)

Match: network_udp_sock

  • V1MyXzMyLkRMTA== (WS2_32.DLL)
  • V1MyXzMyLmRsbA== (WS2_32.dll)
  • V1NBU2VuZFRv (WSASendTo)
  • V1NBU3RhcnR1cA== (WSAStartup)
  • V1NBUmVjdkZyb20= (WSARecvFrom)
  • c2VuZHRv (sendto)
  • cmVjdmZyb20= (recvfrom)
  • d3MyXzMyLmRsbA== (ws2_32.dll)

Match: network_tcp_listen

  • QWNjZXB0RXg= (AcceptEx)
  • R2V0QWNjZXB0RXhTb2NrYWRkcnM= (GetAcceptExSockaddrs)
  • TVNXU09DSy5kbGw= (MSWSOCK.dll)
  • V1MyXzMyLkRMTA== (WS2_32.DLL)
  • V1MyXzMyLmRsbA== (WS2_32.dll)
  • V1NBQWNjZXB0 (WSAAccept)
  • V1NBU29ja2V0 (WSASocket)
  • V1NBU3RhcnR1cA== (WSAStartup)
  • YWNjZXB0 (accept)
  • YmluZA== (bind)
  • bGlzdGVu (listen)
  • bXN3c29jay5kbGw= (mswsock.dll)
  • d3MyXzMyLmRsbA== (ws2_32.dll)

Match: network_p2p_win

  • UGVlckNvbGxhYkV4cG9ydENvbnRhY3Q= (PeerCollabExportContact)
  • UGVlckNvbGxhYkdldEFwcGxpY2F0aW9uUmVnaXN0cmF0aW9uSW5mbw== (PeerCollabGetApplicationRegistrationInfo)
  • UGVlckNvbGxhYkdldEV2ZW50RGF0YQ== (PeerCollabGetEventData)
  • UGVlckNvbGxhYkdldEVuZHBvaW50TmFtZQ== (PeerCollabGetEndpointName)
  • UGVlckNvbGxhYkdldEludml0YXRpb25SZXNwb25zZQ== (PeerCollabGetInvitationResponse)
  • UGVlckNvbGxhYkdldFByZXNlbmNlSW5mbw== (PeerCollabGetPresenceInfo)
  • UGVlckNvbGxhYkdldFNpZ25pbk9wdGlvbnM= (PeerCollabGetSigninOptions)
  • UGVlckNvbGxhYkludml0ZUNvbnRhY3Q= (PeerCollabInviteContact)
  • UGVlckNvbGxhYkludml0ZUVuZHBvaW50 (PeerCollabInviteEndpoint)
  • UGVlckNvbGxhYlBhcnNlQ29udGFjdA== (PeerCollabParseContact)
  • UGVlckNvbGxhYlF1ZXJ5Q29udGFjdERhdGE= (PeerCollabQueryContactData)
  • UGVlckNvbGxhYlJlZ2lzdGVyQXBwbGljYXRpb24= (PeerCollabRegisterApplication)
  • UGVlckNvbGxhYlJlZ2lzdGVyRXZlbnQ= (PeerCollabRegisterEvent)
  • UGVlckNvbGxhYlJlZnJlc2hFbmRwb2ludERhdGE= (PeerCollabRefreshEndpointData)
  • UGVlckNvbGxhYlNldE9iamVjdA== (PeerCollabSetObject)
  • UGVlckNvbGxhYlNldEVuZHBvaW50TmFtZQ== (PeerCollabSetEndpointName)
  • UGVlckNvbGxhYlNldFByZXNlbmNlSW5mbw== (PeerCollabSetPresenceInfo)
  • UGVlckNvbGxhYlNpZ25vdXQ= (PeerCollabSignout)
  • UGVlckNvbGxhYlVucmVnaXN0ZXJBcHBsaWNhdGlvbg== (PeerCollabUnregisterApplication)
  • UGVlckNvbGxhYlVwZGF0ZUNvbnRhY3Q= (PeerCollabUpdateContact)

Match: network_http

  • SHR0cE9wZW5SZXF1ZXN0 (HttpOpenRequest)
  • SHR0cFNlbmRSZXF1ZXN0 (HttpSendRequest)
  • SW50ZXJuZXRDb25uZWN0 (InternetConnect)
  • SW50ZXJuZXRPcGVu (InternetOpen)
  • SW50ZXJuZXRPcGVuVXJs (InternetOpenUrl)
  • SW50ZXJuZXRSZWFkRmlsZQ== (InternetReadFile)
  • SW50ZXJuZXRXcml0ZUZpbGU= (InternetWriteFile)
  • d2luaW5ldC5kbGw= (wininet.dll)

Match: network_dropper

  • VVJMRG93bmxvYWRUb0NhY2hlRmlsZQ== (URLDownloadToCacheFile)
  • VVJMRG93bmxvYWRUb0ZpbGU= (URLDownloadToFile)
  • dXJsbW9uLmRsbA== (urlmon.dll)

Match: network_ftp

  • RnRwQ3JlYXRlRGlyZWN0b3J5 (FtpCreateDirectory)
  • RnRwR2V0Q3VycmVudERpcmVjdG9yeQ== (FtpGetCurrentDirectory)
  • RnRwR2V0RmlsZQ== (FtpGetFile)
  • RnRwR2V0RmlsZVNpemU= (FtpGetFileSize)
  • RnRwRGVsZXRlRmlsZQ== (FtpDeleteFile)
  • RnRwT3BlbkZpbGU= (FtpOpenFile)
  • RnRwU2V0Q3VycmVudERpcmVjdG9yeQ== (FtpSetCurrentDirectory)
  • RnRwUHV0RmlsZQ== (FtpPutFile)
  • RnRwUmVtb3ZlRGlyZWN0b3J5 (FtpRemoveDirectory)
  • RnRwUmVuYW1lRmlsZQ== (FtpRenameFile)
  • d2luaW5ldC5kbGw= (wininet.dll)

Match: network_tcp_socket

  • V1MyXzMyLkRMTA== (WS2_32.DLL)
  • V1MyXzMyLmRsbA== (WS2_32.dll)
  • V1NBQ29ubmVjdA== (WSAConnect)
  • V1NBQ2xlYW51cA== (WSACleanup)
  • V1NBU29ja2V0 (WSASocket)
  • V1NBU2VuZA== (WSASend)
  • V1NBU3RhcnR1cA== (WSAStartup)
  • Y29ubmVjdA== (connect)
  • Y2xvc2Vzb2NrZXQ= (closesocket)
  • c29ja2V0 (socket)
  • c2VuZA== (send)
  • d3MyXzMyLmRsbA== (ws2_32.dll)

Match: network_dns

  • RE5TQVBJLmRsbA== (DNSAPI.dll)
  • RG5zUXVlcnk= (DnsQuery)
  • V1MyXzMyLkRMTA== (WS2_32.DLL)
  • V1MyXzMyLmRsbA== (WS2_32.dll)
  • V1NBQXN5bmNHZXRIb3N0QnlOYW1l (WSAAsyncGetHostByName)
  • Z2V0YWRkcmluZm8= (getaddrinfo)
  • Z2V0aG9zdGJ5bmFtZQ== (gethostbyname)
  • ZG5zYXBpLmRsbA== (dnsapi.dll)
  • d3MyXzMyLmRsbA== (ws2_32.dll)

Match: network_dga

  • Q1JZUFQzMi5ETEw= (CRYPT32.DLL)
  • Q1JZUFQzMi5kbGw= (CRYPT32.dll)
  • Q3J5cHRBY3F1aXJlQ29udGV4dA== (CryptAcquireContext)
  • Q3J5cHRDcmVhdGVIYXNo (CryptCreateHash)
  • Q3J5cHRIYXNoRGF0YQ== (CryptHashData)
  • QURWQVBJMzIuZGxs (ADVAPI32.dll)
  • R2V0U3lzdGVtVGltZQ== (GetSystemTime)
  • R2V0U3lzdGVtVGltZUFzRmlsZVRpbWU= (GetSystemTimeAsFileTime)
  • SW50ZXJuZXRPcGVu (InternetOpen)
  • SW50ZXJuZXRPcGVuVXJs (InternetOpenUrl)
  • U3lzdGVtVGltZVRvRmlsZVRpbWU= (SystemTimeToFileTime)
  • Y3J5cHQzMi5kbGw= (crypt32.dll)
  • YWR2YXBpMzIuZGxs (advapi32.dll)
  • Z2V0YWRkcmluZm8= (getaddrinfo)
  • Z2V0aG9zdGJ5bmFtZQ== (gethostbyname)
  • d2luaW5ldC5kbGw= (wininet.dll)

Match: bitcoin

  • b3BlbmdsMzIuZGxs (opengl32.dll)
  • bnZjdWRhLmRsbA== (nvcuda.dll)
  • c3RyYXR1bQ== (stratum)

Match: escalate_priv

  • QURWQVBJMzIuZGxs (ADVAPI32.dll)
  • QWRqdXN0VG9rZW5Qcml2aWxlZ2Vz (AdjustTokenPrivileges)
  • YWR2YXBpMzIuZGxs (advapi32.dll)

Match: screenshot

  • Qml0Qmx0 (BitBlt)
  • R0RJMzIuZGxs (GDI32.dll)
  • R2V0REM= (GetDC)
  • VVNFUjMyLmRsbA== (USER32.dll)
  • Z2RpMzIuZGxs (gdi32.dll)
  • dXNlcjMyLmRsbA== (user32.dll)

Match: keylogger

  • R2V0QXN5bmNLZXlTdGF0ZQ== (GetAsyncKeyState)
  • R2V0S2V5U3RhdGU= (GetKeyState)
  • R2V0S2V5Ym9hcmRUeXBl (GetKeyboardType)
  • TWFwVmlydHVhbEtleQ== (MapVirtualKey)
  • VVNFUjMyLmRsbA== (USER32.dll)
  • dXNlcjMyLmRsbA== (user32.dll)

Match: cred_local

  • Q3JlZEVudW1lcmF0ZUE= (CredEnumerateA)
  • Q3JlZEVudW1lcmF0ZVc= (CredEnumerateW)
  • THNhRW51bWVyYXRlTG9nb25TZXNzaW9ucw== (LsaEnumerateLogonSessions)
  • U2FtSUNvbm5lY3Q= (SamIConnect)
  • U2FtUXVlcnlJbmZvcm1hdGlvblVzZQ== (SamQueryInformationUse)

Match: sniff_audio

  • d2F2ZUluQ2xvc2U= (waveInClose)
  • d2F2ZUluQWRkQnVmZmVy (waveInAddBuffer)
  • d2F2ZUluT3Blbg== (waveInOpen)
  • d2F2ZUluU3RhcnQ= (waveInStart)
  • d2F2ZUluUmVzZXQ= (waveInReset)
  • d2lubW0uZGxs (winmm.dll)

Match: migrate_apc

  • T3BlblRocmVhZA== (OpenThread)
  • UXVldWVVc2VyQVBD (QueueUserAPC)

Match: spreading_share

  • TmV0U2hhcmVFbnVt (NetShareEnum)
  • TmV0U2hhcmVHZXRJbmZv (NetShareGetInfo)
  • bmV0YXBpMzIuZGxs (netapi32.dll)

Match: win_mutex

  • Q3JlYXRlTXV0ZXg= (CreateMutex)

Match: win_registry

  • QURWQVBJMzIuZGxs (ADVAPI32.dll)
  • UmVnQ2xvc2VLZXk= (RegCloseKey)
  • UmVnQ3JlYXRlS2V5QQ== (RegCreateKeyA)
  • UmVnT3BlbktleUV4QQ== (RegOpenKeyExA)
  • UmVnU2V0VmFsdWVFeEE= (RegSetValueExA)
  • UmVnUXVlcnlWYWx1ZUV4QQ== (RegQueryValueExA)
  • YWR2YXBpMzIuZGxs (advapi32.dll)

Match: win_token

  • QURWQVBJMzIuZGxs (ADVAPI32.dll)
  • QWRqdXN0VG9rZW5Qcml2aWxlZ2Vz (AdjustTokenPrivileges)
  • RHVwbGljYXRlVG9rZW5FeA== (DuplicateTokenEx)
  • T3BlblByb2Nlc3NUb2tlbg== (OpenProcessToken)
  • TG9va3VwUHJpdmlsZWdlVmFsdWVB (LookupPrivilegeValueA)
  • YWR2YXBpMzIuZGxs (advapi32.dll)

Match: win_private_profile

  • R2V0UHJpdmF0ZVByb2ZpbGVJbnRB (GetPrivateProfileIntA)
  • R2V0UHJpdmF0ZVByb2ZpbGVTdHJpbmdB (GetPrivateProfileStringA)
  • S0VSTkVMMzIuZGxs (KERNEL32.dll)
  • V3JpdGVQcml2YXRlUHJvZmlsZVN0cmluZ0E= (WritePrivateProfileStringA)

Match: win_files_operation

  • Q29weUZpbGU= (CopyFile)
  • Q3JlYXRlRmlsZUE= (CreateFileA)
  • RGVsZXRlRmlsZUE= (DeleteFileA)
  • RmluZENsb3Nl (FindClose)
  • RmluZEZpcnN0RmlsZUE= (FindFirstFileA)
  • S0VSTkVMMzIuZGxs (KERNEL32.dll)
  • TW92ZUZpbGVFeEE= (MoveFileExA)
  • U2V0RmlsZUF0dHJpYnV0ZXNB (SetFileAttributesA)
  • U2V0RmlsZVBvaW50ZXI= (SetFilePointer)
  • UmVhZEZpbGU= (ReadFile)
  • V3JpdGVGaWxl (WriteFile)

Match: Str_Win32_Winsock2_Library

  • V1MyXzMyLkRMTA== (WS2_32.DLL)
  • V1MyXzMyLmRsbA== (WS2_32.dll)
  • d3MyXzMyLmRsbA== (ws2_32.dll)

Match: Str_Win32_Wininet_Library

  • d2luaW5ldC5kbGw= (wininet.dll)

Match: Str_Win32_Internet_API

  • SW50ZXJuZXRDb25uZWN0 (InternetConnect)
  • SW50ZXJuZXRDbG9zZUhhbmRsZQ== (InternetCloseHandle)
  • SW50ZXJuZXRPcGVu (InternetOpen)
  • SW50ZXJuZXRSZWFkRmlsZQ== (InternetReadFile)

Match: Str_Win32_Http_API

  • SHR0cE9wZW5SZXF1ZXN0 (HttpOpenRequest)
  • SHR0cFF1ZXJ5SW5mbw== (HttpQueryInfo)
  • SHR0cFNlbmRSZXF1ZXN0 (HttpSendRequest)

Match: DebuggerCheck__GlobalFlags

  • TnRHbG9iYWxGbGFncw== (NtGlobalFlags)

Match: DebuggerCheck__QueryInfo

  • UXVlcnlJbmZvcm1hdGlvblByb2Nlc3M= (QueryInformationProcess)

Match: DebuggerCheck__RemoteAPI

  • Q2hlY2tSZW1vdGVEZWJ1Z2dlclByZXNlbnQ= (CheckRemoteDebuggerPresent)

Match: DebuggerHiding__Thread

  • U2V0SW5mb3JtYXRpb25UaHJlYWQ= (SetInformationThread)

Match: DebuggerHiding__Active

  • RGVidWdBY3RpdmVQcm9jZXNz (DebugActiveProcess)

Match: DebuggerException__ConsoleCtrl

  • R2VuZXJhdGVDb25zb2xlQ3RybEV2ZW50 (GenerateConsoleCtrlEvent)

Match: DebuggerException__SetConsoleCtrl

  • U2V0Q29uc29sZUN0cmxIYW5kbGVy (SetConsoleCtrlHandler)

Match: ThreadControl__Context

  • U2V0VGhyZWFkQ29udGV4dA== (SetThreadContext)

Match: SEH__vectored

  • QWRkVmVjdG9yZWRFeGNlcHRpb25IYW5kbGVy (AddVectoredExceptionHandler)
  • UmVtb3ZlVmVjdG9yZWRFeGNlcHRpb25IYW5kbGVy (RemoveVectoredExceptionHandler)

Match: Check_Dlls

  • ZGJnaGVscC5kbGw= (dbghelp.dll)
  • cHN0b3JlYy5kbGw= (pstorec.dll)

Match: anti_dbg

  • Q29udGludWVEZWJ1Z0V2ZW50 (ContinueDebugEvent)
  • Q2hlY2tSZW1vdGVEZWJ1Z2dlclByZXNlbnQ= (CheckRemoteDebuggerPresent)
  • RGVidWdBY3RpdmVQcm9jZXNz (DebugActiveProcess)
  • S0VSTkVMMzIuZGxs (KERNEL32.dll)
  • SXNEZWJ1Z2dlclByZXNlbnQ= (IsDebuggerPresent)
  • T3V0cHV0RGVidWdTdHJpbmc= (OutputDebugString)

Match: antisb_threatExpert

  • ZGJnaGVscC5kbGw= (dbghelp.dll)

Match: disable_dep

  • TnRTZXRJbmZvcm1hdGlvblByb2Nlc3M= (NtSetInformationProcess)
  • U2V0UHJvY2Vzc0RFUFBvbGljeQ== (SetProcessDEPPolicy)
  • WndQcm90ZWN0VmlydHVhbE1lbW9yeQ== (ZwProtectVirtualMemory)

Match: win_hook

  • Q2FsbE5leHRIb29rRXg= (CallNextHookEx)
  • U2V0V2luZG93c0hvb2tFeEE= (SetWindowsHookExA)
  • VVNFUjMyLmRsbA== (USER32.dll)
  • VW5ob29rV2luZG93c0hvb2tFeA== (UnhookWindowsHookEx)
  • dXNlcjMyLmRsbA== (user32.dll)

URLs found in process memory 
    http://crl.comodo.net/TrustedCertificateServices.crl0
    http://users.ocsp.d-trust.net03
    http://crl.ssc.lt/root-b/cacrl.crl0
    http://crl.securetrust.com/STCA.crl0
    http://crl.securetrust.com/SGCA.crl0
    http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0=
    http://www.ssc.lt/cps03
    http://www.informatik.admin.ch/PKI/links/CPS_2_16_756_1_17_3_1_0.pdf0
    http://www.certificadodigital.com.br/repositorio/serasaca/crl/SerasaCAII.crl0
    https://curl.haxx.se/docs/http-cookies.html
    http://www.digsigtrust.com/DST_TRUST_CPS_v990701.html0
    http://www.microsoft.com/pki/certs/TrustListPCA.crt0
    https://www.certification.tn/cgi-bin/pub/crl/cacrl.crl0
    http://www.pkioverheid.nl/policies/root-policy0
    http://cps.chambersign.org/cps/chambersroot.html0
    http://www.e-szigno.hu/SZSZ/0
    http://www.entrust.net/CRL/Client1.crl0
    http://crl.chambersign.org/publicnotaryroot.crl0
    http://crl.comodo.net/AAACertificateServices.crl0
    http://www.certplus.com/CRL/class3.crl0
    http://logo.verisign.com/vslogo.gif0
    http://www.acabogacia.org/doc0
    http://www.disig.sk/ca/crl/ca_disig.crl0
    https://www.catcert.net/verarrel
    http://www.sk.ee/cps/0
    http://www.quovadis.bm0
    https://www.catcert.net/verarrel05
    http://www.certificadodigital.com.br/repositorio/serasaca/crl/SerasaCAI.crl0
    http://crl.chambersign.org/chambersroot.crl0
    http://www.certificadodigital.com.br/repositorio/serasaca/crl/SerasaCAIII.crl0
    http://crl.globalsign.net/root-r2.crl0
    http://certificates.starfieldtech.com/repository/1604
    http://www.d-trust.net0
    http://pki-root.ecertpki.cl/CertEnroll/E-CERT%20ROOT%20CA.crl0
    http://crl.ssc.lt/root-a/cacrl.crl0
    http://crl.usertrust.com/UTN-DATACorpSGC.crl0
    http://www.certicamara.com/certicamaraca.crl0
    http://www.d-trust.net/crl/d-trust_root_class_2_ca_2007.crl0
    http://crl.usertrust.com/UTN-USERFirst-Object.crl0)
    http://www.post.trust.ie/reposit/cps.html0
    http://www.d-trust.net/crl/d-trust_qualified_root_ca_1_2007_pn.crl0
    http://www2.public-trust.com/crl/ct/ctroot.crl0
    http://www.certicamara.com0
    http://www.pki.admin.ch/policy/CPS_2_16_756_1_17_3_21_1.pdf0
    http://fedir.comsign.co.il/cacert/ComSignAdvancedSecurityCA.crt0
    http://www.comsign.co.il/cps0
    http://crl.usertrust.com/UTN-USERFirst-NetworkApplications.crl0
    http://www.microsoft.com/pki/crl/products/TrustListPCA.crl
    http://acraiz.icpbrasil.gov.br/LCRacraiz.crl0
    http://www.signatur.rtr.at/de/directory/cps.html0
    http://www.globaltrust.info0
    http://ca.sia.it/secsrv/repository/CRL.der0J
    http://support.microsoft.com/kb/9311250
    http://crl.usertrust.com/UTN-USERFirst-ClientAuthenticationandEmail.crl0
    https://secure.a-cert.at/cgi-bin/a-cert-advanced.cgi0
    http://www.certplus.com/CRL/class3TS.crl0
    http://crl.usertrust.com/UTN-USERFirst-Hardware.crl01
    http://crl.xrampsecurity.com/XGCA.crl0
    http://repository.infonotary.com/cps/qcps.html0
    http://www.firmaprofesional.com0
    http://www.disig.sk/ca0f
    http://www.acabogacia.org0
    http://www.usertrust.com1
    http://www.e-certchile.cl/html/productos/download/CPSv1.7.pdf01
    http://www.pki.gva.es/cps0
    http://www.certicamara.com/dpc/0Z
    http://www.e-me.lv/repository0
    http://www.dnie.es/dpc0
    http://fedir.comsign.co.il/crl/ComSignCA.crl0
    http://www.wellsfargo.com/certpolicy0
    http://repository.swisssign.com/0
    https://www.certification.tn/cgi-bin/pub/crl/cacrl.crl0E
    http://crl.ssc.lt/root-c/cacrl.crl0
    http://fedir.comsign.co.il/crl/ComSignAdvancedSecurityCA.crl0
    https://www.netlock.hu/docs/
    http://www.quovadisglobal.com/cps0
    http://crl.pki.wellsfargo.com/wsprca.crl0
    http://www.a-cert.at0E
    http://www.e-szigno.hu/RootCA.crl
    http://www.e-szigno.hu/RootCA.crt0
    http://crl.netsolssl.com/NetworkSolutionsCertificateAuthority.crl0
    http://www.trustdst.com/certificates/policy/ACES-index.html0
    https://rca.e-szigno.hu/ocsp0-
    https://ca.sia.it/seccli/repository/CPS0
    http://www.chambersign.org1
    http://qual.ocsp.d-trust.net0
    http://www.ancert.com/cps0
    https://ca.sia.it/secsrv/repository/CPS0
    http://www.certifikat.dk/repository0
    http://www.entrust.net/CRL/net1.crl0
    http://www.trustcenter.de/guidelines0
    http://cps.chambersign.org/cps/publicnotaryroot.html0
    http://www.trustcenter.de/crl/v2/tc_class_2_ca_II.crl
    https://ocsp.quovadisoffshore.com0
    http://www.e-trust.be/CPS/QNcerts
    http://www.certplus.com/CRL/class1.crl0
    http://ocsp.infonotary.com/responder.cgi0V
    http://ca.disig.sk/ca/crl/ca_disig.crl0
    http://www.registradores.org/scr/normativa/cp_f2.htm0
    http://crl.oces.certifikat.dk/oces.crl0
    http://ca.sia.it/seccli/repository/CRL.der0J
    http://www.signatur.rtr.at/current.crl0
    http://www.certplus.com/CRL/class2.crl0
    http://www.a-cert.at/certificate-policy.html0
    http://www.crc.bg0
    http://crl.chambersign.org/chambersignroot.crl0
    http://www.certplus.com/CRL/class3P.crl0
    https://www.netlock.net/docs
    http://fedir.comsign.co.il/crl/ComSignSecuredCA.crl0
    http://www.microsoft.com/pki/certs/tspca.crt0
    http://ocsp.pki.gva.es0
    http://www.rootca.or.kr/rca/cps.html0
    http://crl.comodoca.com/TrustedCertificateServices.crl0:
    http://www.echoworx.com/ca/root2/cps.pdf0
    http://www.trustcenter.de/crl/v2/tc_class_3_ca_II.crl
    http://www.valicert.com/1
    http://www.openssl.org/support/faq.html
    http://crl.comodoca.com/AAACertificateServices.crl06
    http://www.sk.ee/juur/crl/0
    http://www.usertrust.com1604
    http://cps.chambersign.org/cps/chambersignroot.html0
    http://crl.comodoca.com/COMODOCertificationAuthority.crl0
    http://www.d-trust.net/crl/d-trust_root_class_3_ca_2007.crl0

Process memory dump for None (PID 2504, dump 1)

Extracted/injected images (may contain unpacked executables)
Download #1

Yara signatures matches on process memory

Match: inject_thread

  • Q3JlYXRlUmVtb3RlVGhyZWFk (CreateRemoteThread)
  • Q3JlYXRlVGhyZWFk (CreateThread)
  • T3BlblByb2Nlc3M= (OpenProcess)
  • TnRXcml0ZVZpcnR1YWxNZW1vcnk= (NtWriteVirtualMemory)
  • V3JpdGVQcm9jZXNzTWVtb3J5 (WriteProcessMemory)
  • VmlydHVhbEFsbG9jRXg= (VirtualAllocEx)

Match: create_service

  • Q29udHJvbFNlcnZpY2U= (ControlService)
  • Q3JlYXRlU2VydmljZQ== (CreateService)
  • QURWQVBJMzIuRExM (ADVAPI32.DLL)
  • QURWQVBJMzIuZGxs (ADVAPI32.dll)
  • U3RhcnRTZXJ2aWNl (StartService)
  • UXVlcnlTZXJ2aWNlU3RhdHVz (QueryServiceStatus)
  • YWR2YXBpMzIuZGxs (advapi32.dll)

Match: create_com_service

  • RGxsQ2FuVW5sb2FkTm93 (DllCanUnloadNow)
  • RGxsR2V0Q2xhc3NPYmplY3Q= (DllGetClassObject)
  • RGxsSW5zdGFsbA== (DllInstall)
  • RGxsUmVnaXN0ZXJTZXJ2ZXI= (DllRegisterServer)
  • RGxsVW5yZWdpc3RlclNlcnZlcg== (DllUnregisterServer)

Match: network_udp_sock

  • V1MyXzMyLmRsbA== (WS2_32.dll)
  • V1NBU2VuZFRv (WSASendTo)
  • V1NBU3RhcnR1cA== (WSAStartup)
  • V1NBUmVjdkZyb20= (WSARecvFrom)
  • c2VuZHRv (sendto)
  • cmVjdmZyb20= (recvfrom)
  • d3MyXzMyLmRsbA== (ws2_32.dll)

Match: network_tcp_listen

  • V1MyXzMyLmRsbA== (WS2_32.dll)
  • V1NBQWNjZXB0 (WSAAccept)
  • V1NBU29ja2V0 (WSASocket)
  • V1NBU3RhcnR1cA== (WSAStartup)
  • YWNjZXB0 (accept)
  • YmluZA== (bind)
  • bGlzdGVu (listen)
  • bXN3c29jay5kbGw= (mswsock.dll)
  • d3MyXzMyLmRsbA== (ws2_32.dll)

Match: network_p2p_win

  • UGVlckNvbGxhYkV4cG9ydENvbnRhY3Q= (PeerCollabExportContact)
  • UGVlckNvbGxhYkdldEFwcGxpY2F0aW9uUmVnaXN0cmF0aW9uSW5mbw== (PeerCollabGetApplicationRegistrationInfo)
  • UGVlckNvbGxhYkdldEV2ZW50RGF0YQ== (PeerCollabGetEventData)
  • UGVlckNvbGxhYkdldEVuZHBvaW50TmFtZQ== (PeerCollabGetEndpointName)
  • UGVlckNvbGxhYkdldEludml0YXRpb25SZXNwb25zZQ== (PeerCollabGetInvitationResponse)
  • UGVlckNvbGxhYkdldFByZXNlbmNlSW5mbw== (PeerCollabGetPresenceInfo)
  • UGVlckNvbGxhYkdldFNpZ25pbk9wdGlvbnM= (PeerCollabGetSigninOptions)
  • UGVlckNvbGxhYkludml0ZUNvbnRhY3Q= (PeerCollabInviteContact)
  • UGVlckNvbGxhYkludml0ZUVuZHBvaW50 (PeerCollabInviteEndpoint)
  • UGVlckNvbGxhYlBhcnNlQ29udGFjdA== (PeerCollabParseContact)
  • UGVlckNvbGxhYlF1ZXJ5Q29udGFjdERhdGE= (PeerCollabQueryContactData)
  • UGVlckNvbGxhYlJlZ2lzdGVyQXBwbGljYXRpb24= (PeerCollabRegisterApplication)
  • UGVlckNvbGxhYlJlZ2lzdGVyRXZlbnQ= (PeerCollabRegisterEvent)
  • UGVlckNvbGxhYlJlZnJlc2hFbmRwb2ludERhdGE= (PeerCollabRefreshEndpointData)
  • UGVlckNvbGxhYlNldE9iamVjdA== (PeerCollabSetObject)
  • UGVlckNvbGxhYlNldEVuZHBvaW50TmFtZQ== (PeerCollabSetEndpointName)
  • UGVlckNvbGxhYlNldFByZXNlbmNlSW5mbw== (PeerCollabSetPresenceInfo)
  • UGVlckNvbGxhYlNpZ25vdXQ= (PeerCollabSignout)
  • UGVlckNvbGxhYlVucmVnaXN0ZXJBcHBsaWNhdGlvbg== (PeerCollabUnregisterApplication)
  • UGVlckNvbGxhYlVwZGF0ZUNvbnRhY3Q= (PeerCollabUpdateContact)

Match: network_http

  • SHR0cE9wZW5SZXF1ZXN0 (HttpOpenRequest)
  • SHR0cFNlbmRSZXF1ZXN0 (HttpSendRequest)
  • SW50ZXJuZXRDb25uZWN0 (InternetConnect)
  • SW50ZXJuZXRPcGVu (InternetOpen)
  • SW50ZXJuZXRPcGVuVXJs (InternetOpenUrl)
  • SW50ZXJuZXRSZWFkRmlsZQ== (InternetReadFile)
  • SW50ZXJuZXRXcml0ZUZpbGU= (InternetWriteFile)
  • V0lOSU5FVC5ETEw= (WININET.DLL)
  • V0lOSU5FVC5kbGw= (WININET.dll)
  • d2luaW5ldC5kbGw= (wininet.dll)

Match: network_dropper

  • VVJMRG93bmxvYWRUb0NhY2hlRmlsZQ== (URLDownloadToCacheFile)
  • VVJMRG93bmxvYWRUb0ZpbGU= (URLDownloadToFile)
  • dXJsbW9uLmRsbA== (urlmon.dll)

Match: network_ftp

  • RnRwQ3JlYXRlRGlyZWN0b3J5 (FtpCreateDirectory)
  • RnRwR2V0Q3VycmVudERpcmVjdG9yeQ== (FtpGetCurrentDirectory)
  • RnRwR2V0RmlsZQ== (FtpGetFile)
  • RnRwR2V0RmlsZVNpemU= (FtpGetFileSize)
  • RnRwRGVsZXRlRmlsZQ== (FtpDeleteFile)
  • RnRwT3BlbkZpbGU= (FtpOpenFile)
  • RnRwU2V0Q3VycmVudERpcmVjdG9yeQ== (FtpSetCurrentDirectory)
  • RnRwUHV0RmlsZQ== (FtpPutFile)
  • RnRwUmVtb3ZlRGlyZWN0b3J5 (FtpRemoveDirectory)
  • RnRwUmVuYW1lRmlsZQ== (FtpRenameFile)
  • V0lOSU5FVC5ETEw= (WININET.DLL)
  • V0lOSU5FVC5kbGw= (WININET.dll)
  • d2luaW5ldC5kbGw= (wininet.dll)

Match: network_tcp_socket

  • V1MyXzMyLmRsbA== (WS2_32.dll)
  • V1NBQ29ubmVjdA== (WSAConnect)
  • V1NBQ2xlYW51cA== (WSACleanup)
  • V1NBU29ja2V0 (WSASocket)
  • V1NBU2VuZA== (WSASend)
  • V1NBU3RhcnR1cA== (WSAStartup)
  • Y29ubmVjdA== (connect)
  • Y2xvc2Vzb2NrZXQ= (closesocket)
  • c29ja2V0 (socket)
  • c2VuZA== (send)
  • d3MyXzMyLmRsbA== (ws2_32.dll)

Match: network_dns

  • RE5TQVBJLmRsbA== (DNSAPI.dll)
  • RG5zUXVlcnk= (DnsQuery)
  • V1MyXzMyLmRsbA== (WS2_32.dll)
  • Z2V0YWRkcmluZm8= (getaddrinfo)
  • Z2V0aG9zdGJ5bmFtZQ== (gethostbyname)
  • ZG5zYXBpLmRsbA== (dnsapi.dll)
  • d3MyXzMyLmRsbA== (ws2_32.dll)

Match: network_dga

  • Q1JZUFQzMi5kbGw= (CRYPT32.dll)
  • Q3J5cHRBY3F1aXJlQ29udGV4dA== (CryptAcquireContext)
  • Q3J5cHRDcmVhdGVIYXNo (CryptCreateHash)
  • Q3J5cHRIYXNoRGF0YQ== (CryptHashData)
  • QURWQVBJMzIuRExM (ADVAPI32.DLL)
  • QURWQVBJMzIuZGxs (ADVAPI32.dll)
  • R2V0U3lzdGVtVGltZQ== (GetSystemTime)
  • R2V0U3lzdGVtVGltZUFzRmlsZVRpbWU= (GetSystemTimeAsFileTime)
  • SW50ZXJuZXRPcGVu (InternetOpen)
  • SW50ZXJuZXRPcGVuVXJs (InternetOpenUrl)
  • U3lzdGVtVGltZVRvRmlsZVRpbWU= (SystemTimeToFileTime)
  • V0lOSU5FVC5ETEw= (WININET.DLL)
  • V0lOSU5FVC5kbGw= (WININET.dll)
  • Y3J5cHQzMi5kbGw= (crypt32.dll)
  • YWR2YXBpMzIuZGxs (advapi32.dll)
  • Z2V0YWRkcmluZm8= (getaddrinfo)
  • Z2V0aG9zdGJ5bmFtZQ== (gethostbyname)
  • d2luaW5ldC5kbGw= (wininet.dll)

Match: escalate_priv

  • QURWQVBJMzIuRExM (ADVAPI32.DLL)
  • QURWQVBJMzIuZGxs (ADVAPI32.dll)
  • QWRqdXN0VG9rZW5Qcml2aWxlZ2Vz (AdjustTokenPrivileges)
  • YWR2YXBpMzIuZGxs (advapi32.dll)

Match: screenshot

  • Qml0Qmx0 (BitBlt)
  • R0RJMzIuRExM (GDI32.DLL)
  • R0RJMzIuZGxs (GDI32.dll)
  • R2V0REM= (GetDC)
  • VVNFUjMyLkRMTA== (USER32.DLL)
  • VVNFUjMyLmRsbA== (USER32.dll)
  • Z2RpMzIuZGxs (gdi32.dll)
  • dXNlcjMyLmRsbA== (user32.dll)

Match: keylogger

  • R2V0QXN5bmNLZXlTdGF0ZQ== (GetAsyncKeyState)
  • R2V0S2V5U3RhdGU= (GetKeyState)
  • R2V0S2V5Ym9hcmRUeXBl (GetKeyboardType)
  • TWFwVmlydHVhbEtleQ== (MapVirtualKey)
  • VVNFUjMyLkRMTA== (USER32.DLL)
  • VVNFUjMyLmRsbA== (USER32.dll)
  • dXNlcjMyLmRsbA== (user32.dll)

Match: cred_local

  • Q3JlZEVudW1lcmF0ZUE= (CredEnumerateA)
  • Q3JlZEVudW1lcmF0ZVc= (CredEnumerateW)
  • THNhRW51bWVyYXRlTG9nb25TZXNzaW9ucw== (LsaEnumerateLogonSessions)
  • U2FtSUNvbm5lY3Q= (SamIConnect)
  • U2FtUXVlcnlJbmZvcm1hdGlvblVzZQ== (SamQueryInformationUse)

Match: sniff_audio

  • V0lOTU0uRExM (WINMM.DLL)
  • V0lOTU0uZGxs (WINMM.dll)
  • d2F2ZUluQ2xvc2U= (waveInClose)
  • d2F2ZUluQWRkQnVmZmVy (waveInAddBuffer)
  • d2F2ZUluT3Blbg== (waveInOpen)
  • d2F2ZUluU3RhcnQ= (waveInStart)
  • d2F2ZUluUmVzZXQ= (waveInReset)
  • d2lubW0uZGxs (winmm.dll)

Match: migrate_apc

  • T3BlblRocmVhZA== (OpenThread)
  • UXVldWVVc2VyQVBD (QueueUserAPC)

Match: spreading_file

  • ZGVza3RvcC5pbmk= (desktop.ini)

Match: spreading_share

  • TmV0U2hhcmVFbnVt (NetShareEnum)
  • TmV0U2hhcmVHZXRJbmZv (NetShareGetInfo)
  • bmV0YXBpMzIuZGxs (netapi32.dll)

Match: win_mutex

  • Q3JlYXRlTXV0ZXg= (CreateMutex)

Match: win_registry

  • QURWQVBJMzIuRExM (ADVAPI32.DLL)
  • QURWQVBJMzIuZGxs (ADVAPI32.dll)
  • UmVnQ2xvc2VLZXk= (RegCloseKey)
  • UmVnQ3JlYXRlS2V5QQ== (RegCreateKeyA)
  • UmVnT3BlbktleUV4QQ== (RegOpenKeyExA)
  • UmVnU2V0VmFsdWVFeEE= (RegSetValueExA)
  • UmVnUXVlcnlWYWx1ZUV4QQ== (RegQueryValueExA)
  • YWR2YXBpMzIuZGxs (advapi32.dll)

Match: win_token

  • QURWQVBJMzIuRExM (ADVAPI32.DLL)
  • QURWQVBJMzIuZGxs (ADVAPI32.dll)
  • QWRqdXN0VG9rZW5Qcml2aWxlZ2Vz (AdjustTokenPrivileges)
  • RHVwbGljYXRlVG9rZW5FeA== (DuplicateTokenEx)
  • T3BlblByb2Nlc3NUb2tlbg== (OpenProcessToken)
  • TG9va3VwUHJpdmlsZWdlVmFsdWVB (LookupPrivilegeValueA)
  • YWR2YXBpMzIuZGxs (advapi32.dll)

Match: win_private_profile

  • R2V0UHJpdmF0ZVByb2ZpbGVJbnRB (GetPrivateProfileIntA)
  • R2V0UHJpdmF0ZVByb2ZpbGVTdHJpbmdB (GetPrivateProfileStringA)
  • S0VSTkVMMzIuRExM (KERNEL32.DLL)
  • S0VSTkVMMzIuZGxs (KERNEL32.dll)
  • S2VybmVsMzIuRExM (Kernel32.DLL)
  • V3JpdGVQcml2YXRlUHJvZmlsZVN0cmluZ0E= (WritePrivateProfileStringA)
  • a2VybmVsMzIuZGxs (kernel32.dll)

Match: win_files_operation

  • Q29weUZpbGU= (CopyFile)
  • Q3JlYXRlRmlsZUE= (CreateFileA)
  • RGVsZXRlRmlsZUE= (DeleteFileA)
  • RmluZENsb3Nl (FindClose)
  • RmluZEZpcnN0RmlsZUE= (FindFirstFileA)
  • S0VSTkVMMzIuRExM (KERNEL32.DLL)
  • S0VSTkVMMzIuZGxs (KERNEL32.dll)
  • S2VybmVsMzIuRExM (Kernel32.DLL)
  • TW92ZUZpbGVFeEE= (MoveFileExA)
  • U2V0RmlsZUF0dHJpYnV0ZXNB (SetFileAttributesA)
  • U2V0RmlsZVBvaW50ZXI= (SetFilePointer)
  • UmVhZEZpbGU= (ReadFile)
  • V3JpdGVGaWxl (WriteFile)
  • a2VybmVsMzIuZGxs (kernel32.dll)

Match: Str_Win32_Winsock2_Library

  • V1MyXzMyLmRsbA== (WS2_32.dll)
  • d3MyXzMyLmRsbA== (ws2_32.dll)

Match: Str_Win32_Wininet_Library

  • V0lOSU5FVC5ETEw= (WININET.DLL)
  • V0lOSU5FVC5kbGw= (WININET.dll)
  • d2luaW5ldC5kbGw= (wininet.dll)

Match: Str_Win32_Internet_API

  • SW50ZXJuZXRDb25uZWN0 (InternetConnect)
  • SW50ZXJuZXRDbG9zZUhhbmRsZQ== (InternetCloseHandle)
  • SW50ZXJuZXRPcGVu (InternetOpen)
  • SW50ZXJuZXRSZWFkRmlsZQ== (InternetReadFile)

Match: Str_Win32_Http_API

  • SHR0cE9wZW5SZXF1ZXN0 (HttpOpenRequest)
  • SHR0cFF1ZXJ5SW5mbw== (HttpQueryInfo)
  • SHR0cFNlbmRSZXF1ZXN0 (HttpSendRequest)

Match: DebuggerCheck__GlobalFlags

  • TnRHbG9iYWxGbGFncw== (NtGlobalFlags)

Match: DebuggerCheck__QueryInfo

  • UXVlcnlJbmZvcm1hdGlvblByb2Nlc3M= (QueryInformationProcess)

Match: DebuggerCheck__RemoteAPI

  • Q2hlY2tSZW1vdGVEZWJ1Z2dlclByZXNlbnQ= (CheckRemoteDebuggerPresent)

Match: DebuggerHiding__Thread

  • U2V0SW5mb3JtYXRpb25UaHJlYWQ= (SetInformationThread)

Match: DebuggerHiding__Active

  • RGVidWdBY3RpdmVQcm9jZXNz (DebugActiveProcess)

Match: DebuggerException__ConsoleCtrl

  • R2VuZXJhdGVDb25zb2xlQ3RybEV2ZW50 (GenerateConsoleCtrlEvent)

Match: DebuggerException__SetConsoleCtrl

  • U2V0Q29uc29sZUN0cmxIYW5kbGVy (SetConsoleCtrlHandler)

Match: ThreadControl__Context

  • U2V0VGhyZWFkQ29udGV4dA== (SetThreadContext)

Match: SEH__vectored

  • QWRkVmVjdG9yZWRFeGNlcHRpb25IYW5kbGVy (AddVectoredExceptionHandler)
  • UmVtb3ZlVmVjdG9yZWRFeGNlcHRpb25IYW5kbGVy (RemoveVectoredExceptionHandler)

Match: Check_Dlls

  • ZGJnaGVscC5kbGw= (dbghelp.dll)
  • cHN0b3JlYy5kbGw= (pstorec.dll)

Match: anti_dbg

  • Q29udGludWVEZWJ1Z0V2ZW50 (ContinueDebugEvent)
  • Q2hlY2tSZW1vdGVEZWJ1Z2dlclByZXNlbnQ= (CheckRemoteDebuggerPresent)
  • RGVidWdBY3RpdmVQcm9jZXNz (DebugActiveProcess)
  • S0VSTkVMMzIuRExM (KERNEL32.DLL)
  • S0VSTkVMMzIuZGxs (KERNEL32.dll)
  • S2VybmVsMzIuRExM (Kernel32.DLL)
  • SXNEZWJ1Z2dlclByZXNlbnQ= (IsDebuggerPresent)
  • T3V0cHV0RGVidWdTdHJpbmc= (OutputDebugString)
  • a2VybmVsMzIuZGxs (kernel32.dll)

Match: antisb_threatExpert

  • ZGJnaGVscC5kbGw= (dbghelp.dll)

Match: disable_dep

  • TnRTZXRJbmZvcm1hdGlvblByb2Nlc3M= (NtSetInformationProcess)
  • U2V0UHJvY2Vzc0RFUFBvbGljeQ== (SetProcessDEPPolicy)
  • WndQcm90ZWN0VmlydHVhbE1lbW9yeQ== (ZwProtectVirtualMemory)

Match: win_hook

  • Q2FsbE5leHRIb29rRXg= (CallNextHookEx)
  • U2V0V2luZG93c0hvb2tFeEE= (SetWindowsHookExA)
  • VVNFUjMyLkRMTA== (USER32.DLL)
  • VVNFUjMyLmRsbA== (USER32.dll)
  • VW5ob29rV2luZG93c0hvb2tFeA== (UnhookWindowsHookEx)
  • dXNlcjMyLmRsbA== (user32.dll)