Free Automated Malware Analysis Service - powered by Falcon Sandbox - Viewing online file analysis results for 'n0kVoIP.exe'

Incident Response

Risk Assessment

Remote Access: Reads terminal service related keys (often RDP related)
Fingerprint: Reads the active computer name
Reads the cryptographic machine GUID
Network Behavior: Contacts 2 domains. View all details

MITRE ATT&CK™ Techniques Detection

This report has 17 indicators that were mapped to 10 attack techniques and 6 tactics. View all details

Persistence
ATT&CK ID	Name	Tactics	Description	Malicious Indicators	Suspicious Indicators	Informative Indicators
T1215	Kernel Modules and Extensions	Persistence	Loadable Kernel Modules (or LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. Learn more			Opens the Kernel Security Device Driver (KsecDD) of Windows
Defense Evasion
ATT&CK ID	Name	Tactics	Description	Malicious Indicators	Suspicious Indicators	Informative Indicators
T1112	Modify Registry	Defense Evasion	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in [[Persistence]] and [[Execution]]. Learn more		Modifies proxy settings	Creates or modifies windows services
T1107	File Deletion	Defense Evasion	Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces behind as to what was done within a network and how. Learn more		Marks file for deletion
T1045	Software Packing	Defense Evasion	Software packing is a method of compressing or encrypting an executable. Learn more		PE file is packed with UPX
Discovery
ATT&CK ID	Name	Tactics	Description	Malicious Indicators	Suspicious Indicators	Informative Indicators
T1012	Query Registry	Discovery	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software. Learn more		Queries the internet cache settings (often used to hide footprints in index.dat or internet cache) Reads information about supported languages Reads the active computer name Monitors specific registry key for changes Reads the cryptographic machine GUID Queries sensitive IE security settings
T1082	System Information Discovery	Discovery	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Learn more		Contains ability to read monitor info Contains ability to query CPU information
T1124	System Time Discovery	Discovery	The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network. Learn more			Contains ability to query machine time
Lateral Movement
ATT&CK ID	Name	Tactics	Description	Malicious Indicators	Suspicious Indicators	Informative Indicators
T1076	Remote Desktop Protocol	Lateral Movement	Remote desktop is a common feature in operating systems. Learn more		Reads terminal service related keys (often RDP related)
Collection
ATT&CK ID	Name	Tactics	Description	Malicious Indicators	Suspicious Indicators	Informative Indicators
T1114	Email Collection	Collection	Adversaries may target user email to collect sensitive information from a target. Learn more		1 confidential indicators
Exfiltration
ATT&CK ID	Name	Tactics	Description	Malicious Indicators	Suspicious Indicators	Informative Indicators
T1002	Data Compressed	Exfiltration	An adversary may compress data (e. Learn more			Matched Compiler/Packer signature

Indicators

Not all malicious and suspicious indicators are displayed. Get your own cloud service or the full version to view all details.

Malicious Indicators 4
External Systems
- Sample was identified as malicious by a trusted Antivirus engine
  
  details
  
  No specific details available
  
  source
  
  External System
  
  relevance
  
  5/10
- Sample was identified as malicious by at least one Antivirus engine
  
  details
  
  4/64 Antivirus vendors marked sample as malicious (6% detection rate)
  
  source
  
  External System
  
  relevance
  
  8/10
Unusual Characteristics
- Checks for a resource fork (ADS) file
  
  details
  
  "<Input Sample>" checked file "C:"
  
  source
  
  API Call
  
  relevance
  
  5/10
- Contains native function calls
  
  details
  
  NtdllDefWindowProc_W@NTDLL.DLL from n0kVoIP.exe (PID: 3580) (Show Stream)
  NtdllDefWindowProc_W@NTDLL.DLL from n0kVoIP.exe (PID: 3580) (Show Stream)
  
  source
  
  Hybrid Analysis Technology
  
  relevance
  
  5/10

Suspicious Indicators 28
Anti-Detection/Stealthyness
- Queries kernel debugger information
  
  details
  
  "<Input Sample>" at 00010884-00003580-00000033-7502652268
  
  source
  
  API Call
  
  relevance
  
  6/10
- Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)
  
  details
  
  "<Input Sample>" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "DISABLECACHINGOFSSLPAGES"; Value: "00000000040000000400000000000000")
  
  source
  
  Registry Access
  
  relevance
  
  3/10
  
  ATT&CK ID
  
  T1012 (Show technique in the MITRE ATT&CK™ matrix)
Anti-Reverse Engineering
- PE file has unusual entropy sections
  
  details
  
  UPX1 with unusual entropies 7.91740802727
  
  source
  
  Static Parser
  
  relevance
  
  10/10
- PE file is packed with UPX
  
  details
  
  "n0kVoIP.exe.bin" has a section named "UPX0"
  "n0kVoIP.exe.bin" has a section named "UPX1"
  
  source
  
  Static Parser
  
  relevance
  
  10/10
  
  ATT&CK ID
  
  T1045 (Show technique in the MITRE ATT&CK™ matrix)
Environment Awareness
- Contains ability to query CPU information
  
  details
  
  cpuid from n0kVoIP.exe (PID: 3580) (Show Stream)
  
  source
  
  Hybrid Analysis Technology
  
  relevance
  
  10/10
  
  ATT&CK ID
  
  T1082 (Show technique in the MITRE ATT&CK™ matrix)
- Contains ability to read monitor info
  
  details
  
  GetMonitorInfoW@USER32.DLL from n0kVoIP.exe (PID: 3580) (Show Stream)
  
  source
  
  Hybrid Analysis Technology
  
  relevance
  
  5/10
  
  ATT&CK ID
  
  T1082 (Show technique in the MITRE ATT&CK™ matrix)
- Reads the active computer name
  
  details
  
  "<Input Sample>" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME")
  
  source
  
  Registry Access
  
  relevance
  
  5/10
  
  ATT&CK ID
  
  T1012 (Show technique in the MITRE ATT&CK™ matrix)
- Reads the cryptographic machine GUID
  
  details
  
  "<Input Sample>" (Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY"; Key: "MACHINEGUID")
  
  source
  
  Registry Access
  
  relevance
  
  10/10
  
  ATT&CK ID
  
  T1012 (Show technique in the MITRE ATT&CK™ matrix)
External Systems
- Found an IP/URL artifact that was identified as malicious by at least one reputation engine
  
  details
  
  2/67 reputation engines marked "http://e.freewebhostingarea.com/403.html" as malicious (2% detection rate)
  
  source
  
  External System
  
  relevance
  
  10/10
General
- Contains ability to find and load resources of a specific module
  
  details
  
  FindResourceW@KERNEL32.DLL from n0kVoIP.exe (PID: 3580) (Show Stream)
  LockResource@KERNEL32.DLL from n0kVoIP.exe (PID: 3580) (Show Stream)
  FindResourceW@KERNEL32.DLL from n0kVoIP.exe (PID: 3580) (Show Stream)
  FindResourceW@KERNEL32.DLL from n0kVoIP.exe (PID: 3580) (Show Stream)
  LockResource@KERNEL32.DLL from n0kVoIP.exe (PID: 3580) (Show Stream)
  FindResourceW@KERNEL32.DLL from n0kVoIP.exe (PID: 3580) (Show Stream)
  FindResourceW@KERNEL32.DLL from n0kVoIP.exe (PID: 3580) (Show Stream)
  
  source
  
  Hybrid Analysis Technology
  
  relevance
  
  1/10
Installation/Persistance
- Contains ability to download files from the internet
  
  details
  
  URLDownloadToFileW@URLMON.DLL from n0kVoIP.exe (PID: 3580) (Show Stream)
  URLDownloadToFileW@URLMON.DLL from n0kVoIP.exe (PID: 3580) (Show Stream)
  
  source
  
  Hybrid Analysis Technology
  
  relevance
  
  10/10
- Monitors specific registry key for changes
  
  details
  
  "<Input Sample>" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\NameSpace_Catalog5" (Filter: 1; Subtree: 6388480)
  "<Input Sample>" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9" (Filter: 1; Subtree: 6388480)
  
  source
  
  API Call
  
  relevance
  
  4/10
  
  ATT&CK ID
  
  T1012 (Show technique in the MITRE ATT&CK™ matrix)
Network Related
- Found potential IP address in binary/memory
  
  details
  
  "216.143.130.36"
  "203.113.125.82"
  "81.89.194.16"
  "91.121.19.149"
  "81.95.148.12"
  "207.218.246.146"
  "203.176.131.7"
  "79.134.121.233"
  "85.13.205.218"
  "91.191.210.5"
  "74.222.2.21"
  "212.150.158.100"
  "203.2.134.1"
  "202.122.99.60"
  "123.30.69.4"
  "84.45.70.14"
  "200.119.223.228"
  "85.90.225.100"
  "213.175.221.14"
  "62.80.200.53"
  "95.154.218.39"
  "83.138.185.146"
  "85.204.232.10"
  "77.72.174.129"
  "85.119.188.3"
  "77.72.174.160"
  
  source
  
  File/Memory
  
  relevance
  
  3/10
- Uses a User Agent typical for browsers, although no browser was ever launched
  
  details
  
  Found user agent(s): Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
  
  source
  
  Network Traffic
  
  relevance
  
  10/10
Pattern Matching
- Contains ability to download files from the internet
  
  details
  
  URLDownloadToFileW@URLMON.DLL from n0kVoIP.exe (PID: 3580) (Show Stream)
  URLDownloadToFileW@URLMON.DLL from n0kVoIP.exe (PID: 3580) (Show Stream)
  
  source
  
  Hybrid Analysis Technology
  
  relevance
  
  10/10
Remote Access Related
- Reads terminal service related keys (often RDP related)
  
  details
  
  "<Input Sample>" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSUSERENABLED")
  
  source
  
  Registry Access
  
  relevance
  
  10/10
  
  ATT&CK ID
  
  T1076 (Show technique in the MITRE ATT&CK™ matrix)
Spyware/Information Retrieval
- Found an instant messenger related domain
  
  details
  
  "skype.com" (Indicator: "skype.com"; File: "00010884-00003580.00000001.13126.00401000.00000040.mdmp")
  "friendcaller.com" (Indicator: "friendcaller.com"; File: "00010884-00003580.00000001.13126.00401000.00000040.mdmp")
  "sip.skype.com" (Indicator: "skype.com"; File: "00010884-00003580.00000001.13126.00401000.00000040.mdmp")
  "proxy.friendcaller.com" (Indicator: "friendcaller.com"; File: "00010884-00003580.00000001.13126.00401000.00000040.mdmp")
  
  source
  
  File/Memory
  
  relevance
  
  10/10
System Destruction
- Marks file for deletion
  
  details
  
  "C:\n0kVoIP.exe" marked "C:\version" for deletion
  
  source
  
  API Call
  
  relevance
  
  10/10
  
  ATT&CK ID
  
  T1107 (Show technique in the MITRE ATT&CK™ matrix)
- Opens file with deletion access rights
  
  details
  
  "<Input Sample>" opened "C:\version" with delete access
  
  source
  
  API Call
  
  relevance
  
  7/10
System Security
- Modifies proxy settings
  
  details
  
  "<Input Sample>" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS")
  "<Input Sample>" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS")
  "<Input Sample>" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYENABLE"; Value: "00000000")
  "<Input Sample>" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYSERVER")
  "<Input Sample>" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYOVERRIDE")
  
  source
  
  Registry Access
  
  relevance
  
  10/10
  
  ATT&CK ID
  
  T1112 (Show technique in the MITRE ATT&CK™ matrix)
- Queries sensitive IE security settings
  
  details
  
  "<Input Sample>" (Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SECURITY"; Key: "DISABLESECURITYSETTINGSCHECK")
  
  source
  
  Registry Access
  
  relevance
  
  8/10
  
  ATT&CK ID
  
  T1012 (Show technique in the MITRE ATT&CK™ matrix)
Uncategorized Behavior
- PE file has a section name known to be used by a packer/protector
  
  details
  
  "n0kVoIP.exe.bin" has a section named "UPX0" which is known to be used by "UPX packer"
  "n0kVoIP.exe.bin" has a section named "UPX1" which is known to be used by "UPX packer"
  
  source
  
  Static Parser
  
  relevance
  
  10/10
Unusual Characteristics
- Entrypoint in PE header is within an uncommon section
  
  details
  
  "n0kVoIP.exe.bin" has an entrypoint in section "UPX1"
  
  source
  
  Static Parser
  
  relevance
  
  10/10
- Imports suspicious APIs
  
  details
  
  RegEnumKeyW
  VirtualProtect
  GetProcAddress
  VirtualAlloc
  LoadLibraryA
  ShellExecuteW
  URLDownloadToFileW
  
  source
  
  Static Parser
  
  relevance
  
  1/10
- Reads information about supported languages
  
  details
  
  "<Input Sample>" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409")
  
  source
  
  Registry Access
  
  relevance
  
  3/10
  
  ATT&CK ID
  
  T1012 (Show technique in the MITRE ATT&CK™ matrix)
Hiding 3 Suspicious Indicators
- All indicators are available only in the private webservice or standalone version

Informative 18
Anti-Reverse Engineering
- Contains ability to register a top-level exception handler (often used as anti-debugging trick)
  
  details
  
  SetUnhandledExceptionFilter@KERNEL32.DLL from n0kVoIP.exe (PID: 3580) (Show Stream)
  SetUnhandledExceptionFilter@KERNEL32.DLL from n0kVoIP.exe (PID: 3580) (Show Stream)
  SetUnhandledExceptionFilter@KERNEL32.DLL from n0kVoIP.exe (PID: 3580) (Show Stream)
  
  source
  
  Hybrid Analysis Technology
  
  relevance
  
  1/10
- Found strings in conjunction with a procedure lookup that resolve to a known API export symbol
  
  details
  
  Found reference to API InitCommonControls@COMCTL32.DLL from n0kVoIP.exe (PID: 3580) (Show Stream)
  Found reference to API InitializeCriticalSectionAndSpinCount@KERNEL32.DLL from n0kVoIP.exe (PID: 3580) (Show Stream)
  Found reference to API InitCommonControlsEx@COMCTL32.DLL from n0kVoIP.exe (PID: 3580) (Show Stream)
  Found reference to API FindActCtxSectionStringW@KERNEL32.DLL from n0kVoIP.exe (PID: 3580) (Show Stream)
  Found reference to API NotifyWinEvent@USER32.DLL from n0kVoIP.exe (PID: 3580) (Show Stream)
  
  source
  
  Hybrid Analysis Technology
  
  relevance
  
  10/10
- PE file contains zero-size sections
  
  details
  
  Raw size of "UPX0" is zero
  
  source
  
  Static Parser
  
  relevance
  
  10/10
Environment Awareness
- Contains ability to query machine time
  
  details
  
  GetSystemTimeAsFileTime@KERNEL32.DLL from n0kVoIP.exe (PID: 3580) (Show Stream)
  GetSystemTimeAsFileTime@KERNEL32.DLL from n0kVoIP.exe (PID: 3580) (Show Stream)
  
  source
  
  Hybrid Analysis Technology
  
  relevance
  
  1/10
  
  ATT&CK ID
  
  T1124 (Show technique in the MITRE ATT&CK™ matrix)
- Contains ability to query the machine version
  
  details
  
  GetVersionExA@KERNEL32.DLL from n0kVoIP.exe (PID: 3580) (Show Stream)
  GetVersion@KERNEL32.DLL from n0kVoIP.exe (PID: 3580) (Show Stream)
  GetVersion@KERNEL32.DLL from n0kVoIP.exe (PID: 3580) (Show Stream)
  GetVersionExA@KERNEL32.DLL from n0kVoIP.exe (PID: 3580) (Show Stream)
  GetVersionExA@KERNEL32.DLL from n0kVoIP.exe (PID: 3580) (Show Stream)
  GetVersionExA@KERNEL32.DLL from n0kVoIP.exe (PID: 3580) (Show Stream)
  
  source
  
  Hybrid Analysis Technology
  
  relevance
  
  1/10
- Makes a code branch decision directly after an API that is environment aware
  
  details
  
  Found API call GetVersionExA@KERNEL32.DLL directly followed by "cmp dword ptr [ebp-00000088h], 02h" and "jne 00437948h" from n0kVoIP.exe (PID: 3580) (Show Stream)
  Found API call GetVersionExA@KERNEL32.DLL directly followed by "cmp dword ptr [ebp-00000088h], 02h" and "xor ecx, ebp" from n0kVoIP.exe (PID: 3580) (Show Stream)
  Found API call GetVersionExA@KERNEL32.DLL directly followed by "cmp dword ptr [ebp-10h], 02h" and "jne 00437B65h" from n0kVoIP.exe (PID: 3580) (Show Stream)
  
  source
  
  Hybrid Analysis Technology
  
  relevance
  
  10/10
- Possibly tries to detect the presence of a debugger
  
  details
  
  GetProcessHeap@KERNEL32.DLL from n0kVoIP.exe (PID: 3580) (Show Stream)
  
  source
  
  Hybrid Analysis Technology
  
  relevance
  
  1/10
External Systems
- Sample was identified as clean by Antivirus engines
  
  details
  
  0/13 Antivirus vendors marked sample as malicious (0% detection rate)
  
  source
  
  External System
  
  relevance
  
  10/10
General
- Contacts domains
  
  details
  
  "n0kvoip.orgfree.com"
  "e.freewebhostingarea.com"
  
  source
  
  Network Traffic
  
  relevance
  
  1/10
- Creates mutants
  
  details
  
  "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex"
  "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex"
  "Local\ZonesLockedCacheCounterMutex"
  "Local\ZonesCacheCounterMutex"
  
  source
  
  Created Mutant
  
  relevance
  
  3/10
- GETs files from a webserver
  
  details
  
  "GET //version HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)Host: n0kvoip.orgfree.comConnection: Keep-Alive"
  "GET /403.html HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)Connection: Keep-AliveHost: e.freewebhostingarea.com"
  
  source
  
  Network Traffic
  
  relevance
  
  5/10
Installation/Persistance
- Connects to LPC ports
  
  details
  
  "<Input Sample>" connecting to "\ThemeApiPort"
  
  source
  
  API Call
  
  relevance
  
  1/10
- Dropped files
  
  details
  
  "403[1].htm" has type "HTML document UTF-8 Unicode (with BOM) text"
  "version" has type "HTML document UTF-8 Unicode (with BOM) text"
  
  source
  
  Binary File
  
  relevance
  
  3/10
- Touches files in the Windows directory
  
  details
  
  "<Input Sample>" touched file "C:\Windows\Fonts\StaticCache.dat"
  "<Input Sample>" touched file "C:\Windows\SysWOW64\rsaenh.dll"
  "<Input Sample>" touched file "C:\Windows\SysWOW64\wshqos.dll"
  "<Input Sample>" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls"
  "<Input Sample>" touched file "C:\Windows\SysWOW64\en-US\msctf.dll.mui"
  "<Input Sample>" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\CP53U0VR\403[1].htm"
  "<Input Sample>" touched file "C:\Users\%USERNAME%\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat"
  "<Input Sample>" touched file "C:\Users\%USERNAME%\AppData\Local\Microsoft\Windows\Temporary Internet Files"
  "<Input Sample>" touched file "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Cookies"
  "<Input Sample>" touched file "C:\Users\%USERNAME%\AppData\Local\Microsoft\Windows\History"
  "<Input Sample>" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\counters.dat"
  "<Input Sample>" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files"
  "<Input Sample>" touched file "%APPDATA%\Microsoft\Windows\Cookies"
  "<Input Sample>" touched file "%LOCALAPPDATA%\Microsoft\Windows\History"
  
  source
  
  API Call
  
  relevance
  
  7/10
Network Related
- Found potential URL in binary/memory
  
  details
  
  Pattern match: "http://192.168.56.151:2869/upnphost/udhisapi.dll?content=uuid:4f8e1a2d-3fec-4a15-86de-6f8fafe83a56"
  Pattern match: "http://[fe80::8d8d:12f:f3a3:d4a9]:2869/upnphost/udhisapi.dll?content=uuid:4f8e1a2d-3fec-4a15-86de-6f8fafe83a56"
  Pattern match: "http://e.freewebhostingarea.com/403.html"
  Heuristic match: "GET /403.html HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4."
  Pattern match: "http://www.freewebhostingarea.com/images/border.gif"
  Pattern match: "http://www.freewebhostingarea.com"
  Pattern match: "http://user99.freewebhostingarea.com/a/spot1e7xx.js"
  Pattern match: "http://user99.freewebhostingarea.com/a/spot2e3xx.js"
  Pattern match: "http://user99.freewebhostingarea.com/a/spot2e7xx.js"
  Heuristic match: "n0kvoip.orgfree.com"
  Heuristic match: "e.freewebhostingarea.com"
  Pattern match: "http://www.w3.org/XML/1998/namespace"
  Pattern match: "http://www.wapforum.org/DTD/prov.dtd"
  Pattern match: "http://www.w3.org/2000/xmlns/"
  Heuristic match: "zcu.cz"
  Heuristic match: "zappglobalfree.ro"
  Heuristic match: "zadarma.com"
  Heuristic match: "xsip.de"
  Heuristic match: "xs4all.nl"
  Heuristic match: "xphone.cz"
  Heuristic match: "xeloq.com"
  Heuristic match: "whistlephone.com"
  Heuristic match: "webcalldirect.com"
  Heuristic match: "vylmedia.com"
  Heuristic match: "vyke.com"
  Heuristic match: "vtx.ch"
  Heuristic match: "voxalot.com"
  Heuristic match: "vortel.de"
  Heuristic match: "vopium.com"
  Heuristic match: "voocall.com"
  Heuristic match: "falevono.com.br"
  Heuristic match: "vonage.com"
  Heuristic match: "volny.cz"
  Heuristic match: "voise.com.au"
  Heuristic match: "voipwise.com"
  Heuristic match: "voipvoip.com"
  Heuristic match: "voipuser.org"
  Heuristic match: "voiptiger.com"
  Heuristic match: "voiptalk.org"
  Heuristic match: "voipstunt.com"
  Heuristic match: "voipraider.com"
  Heuristic match: "voipq.nl"
  Heuristic match: "voipplanet.de"
  Heuristic match: "voipmove.com"
  Heuristic match: "voipmax.pl"
  Heuristic match: "voiplip.com"
  Heuristic match: "voipjumper.com"
  Heuristic match: "voiphit.com"
  Heuristic match: "voipgate.com"
  Heuristic match: "voipgain.com"
  Heuristic match: "voipfone.co.uk"
  Heuristic match: "voiper.net.au"
  Heuristic match: "voipdoup.com"
  Heuristic match: "voipdegraca.com.br"
  Heuristic match: "voipdiscount.com"
  Heuristic match: "voipchief.com"
  Heuristic match: "voipcheap.com"
  Heuristic match: "voipcaptain.com"
  Heuristic match: "voipbusterpro.com"
  Heuristic match: "voipbuster.com"
  Heuristic match: "voipblazer.com"
  Heuristic match: "voipblast.com"
  Heuristic match: "voipalot.com"
  Heuristic match: "voip.co.uk"
  Heuristic match: "voip.com"
  Heuristic match: "voiceglobe.net"
  Heuristic match: "voicehost.co.uk"
  Heuristic match: "vodini.com"
  Heuristic match: "vodafone.is"
  Heuristic match: "viva.gr"
  Heuristic match: "vitelity.net"
  Heuristic match: "viatalk.com"
  Heuristic match: "truevoip.com"
  Heuristic match: "versafon.com"
  Heuristic match: "vegatele.com"
  Heuristic match: "vccs.ca"
  Heuristic match: "vbuzzer.com"
  Heuristic match: "vaboomz.com"
  Heuristic match: "uvoipit.com"
  Heuristic match: "upc.at"
  Heuristic match: "unotel.dk"
  Heuristic match: "ucallweconn.net"
  Heuristic match: "tweak.nl"
  Heuristic match: "tpg.com.au"
  Heuristic match: "tpad.com"
  Heuristic match: "totnetcall.com"
  Heuristic match: "tml-service.eu"
  Heuristic match: "thaitel.com"
  Heuristic match: "tescointernetphone.com"
  Heuristic match: "terrasip.com"
  Heuristic match: "tenet.ua"
  Heuristic match: "teliax.com"
  Heuristic match: "telfort.nl"
  Heuristic match: "telesur.sr"
  Heuristic match: "telequant.com"
  Heuristic match: "talktt.com"
  Heuristic match: "talkfree.com"
  Heuristic match: "t-online.de"
  Heuristic match: "switzernet.com"
  Heuristic match: "swissipcom.ch"
  Heuristic match: "supersip.tk"
  Heuristic match: "stuntcalls.com"
  Heuristic match: "strato.de"
  Heuristic match: "spikko.com"
  Heuristic match: "speedsip.com"
  Heuristic match: "sparvoip.de"
  Heuristic match: "sonavoip.com.br"
  Heuristic match: "solomo.de"
  Heuristic match: "solcon.nl"
  Heuristic match: "softcall.me"
  Heuristic match: "smsdiscount.com"
  Heuristic match: "smartvoip.com"
  Heuristic match: "skystar.us"
  Heuristic match: "skysiptel.com"
  Heuristic match: "skype.com"
  Heuristic match: "skylineteleco.com"
  Heuristic match: "skyetel.net"
  Heuristic match: "siptraffic.com"
  Heuristic match: "sipsorcery.com"
  Heuristic match: "sip2sip.info"
  Heuristic match: "sipservice.eu"
  Heuristic match: "sipphone.co.th"
  Heuristic match: "sipnet.ru"
  Heuristic match: "sipme.me"
  Heuristic match: "sipme.com.au"
  Heuristic match: "sipload.de"
  Heuristic match: "sipkom.com"
  Heuristic match: "sipgate.com"
  Heuristic match: "sipgate.co.uk"
  Heuristic match: "sipgate.de"
  Heuristic match: "sipgate.at"
  Heuristic match: "sipdiscount.com"
  Heuristic match: "sipcall.cz"
  Heuristic match: "sipcall.at"
  Heuristic match: "sipbase.de"
  Heuristic match: "sightspeed.com"
  Heuristic match: "saunalahti.fi"
  Heuristic match: "sapo.pt"
  Heuristic match: "sacotechnology.com.au"
  Heuristic match: "rynga.com"
  Heuristic match: "roitel.com.tr"
  Heuristic match: "ringcentral.com"
  Heuristic match: "redspot.dk"
  Heuristic match: "redlibre.cl"
  Heuristic match: "rebvoice.com"
  Heuristic match: "quantumvoice.com"
  Heuristic match: "primetalker.com"
  Heuristic match: "powervoip.com"
  Heuristic match: "polfon.pl"
  Heuristic match: "poivy.com"
  Heuristic match: "plus.net"
  Heuristic match: "plfon.pl"
  Heuristic match: "planetphone.net"
  Heuristic match: "phonzo.com"
  Heuristic match: "phonevision.com.ar"
  Heuristic match: "phonetoall.com"
  Heuristic match: "phoneserve.com"
  Heuristic match: "phonegnome.com"
  Heuristic match: "pfingo.com"
  Heuristic match: "personal-voip.de"
  Heuristic match: "peoplefone.ch"
  Heuristic match: "pennytel.com.au"
  Heuristic match: "pccall.com"
  Heuristic match: "ovh.com"
  Heuristic match: "otelafrica.com"
  Heuristic match: "orbtalk.co.uk"
  Heuristic match: "openvoip.it"
  Heuristic match: "omysip.com"
  Heuristic match: "omnivoice.eu"
  Heuristic match: "odorik.cz"
  Heuristic match: "ocala-communications.com"
  Heuristic match: "o-fone.com"
  Heuristic match: "nymgo.com"
  Heuristic match: "nonoh.net"
  Heuristic match: "nomado.eu"
  Heuristic match: "nimbuzzcalls.com"
  Heuristic match: "nextvoiz.com"
  Heuristic match: "newfon.pl"
  Heuristic match: "neuftalk.sfr.fr"
  Heuristic match: "netvoip.ch"
  Heuristic match: "nettipuhelin.fi"
  Heuristic match: "nettalk.com.au"
  Heuristic match: "netappel.fr"
  Heuristic match: "neophone.hu"
  Heuristic match: "mywowcall.com"
  Heuristic match: "mywebfon.com"
  Heuristic match: "mywebcalls.com"
  Heuristic match: "myvoice.sg"
  Heuristic match: "mytcom.it"
  Heuristic match: "myphone.ge"
  Heuristic match: "mynetfone.com.au"
  Heuristic match: "myfon.pl"
  Heuristic match: "musimi.dk"
  Heuristic match: "multifon.ru"
  Heuristic match: "mukalameh.com"
  Heuristic match: "mouthmun.com"
  Heuristic match: "mondotalk.com"
  Heuristic match: "mobeely.net"
  Heuristic match: "mo-call.com"
  Heuristic match: "mixvoip.com"
  Heuristic match: "midwestsip.com"
  Heuristic match: "voip.microtech.cz"
  Heuristic match: "messagenet.it"
  Heuristic match: "megavoip.com"
  Heuristic match: "megafon.bg"
  Heuristic match: "maxtelecom.bg"
  Heuristic match: "maxo.com.au"
  Heuristic match: "mailxxl.com"
  Heuristic match: "lowratevoip.com"
  Heuristic match: "lovelycall.com"
  Heuristic match: "localphone.com"
  Heuristic match: "llamadaip.com"
  Heuristic match: "linphone.org"
  Heuristic match: "liberailvoip.it"
  Heuristic match: "les.net"
  Heuristic match: "kiwilink.co.nz"
  Heuristic match: "keyyo.fr"
  Heuristic match: "kebu.it"
  Heuristic match: "justvoip.com"
  Heuristic match: "jumblo.com"
  Heuristic match: "ivoz.net"
  Heuristic match: "itellvoip.com"
  Heuristic match: "israelnumber.com"
  Heuristic match: "ipworldcom.ch"
  Heuristic match: "ipvox.cz"
  Heuristic match: "iptel24.net"
  Heuristic match: "iptel.org"
  Heuristic match: "ippi.fr"
  Heuristic match: "iplink.no"
  Heuristic match: "ipfon.pl"
  Heuristic match: "ipcall.pl"
  Heuristic match: "intervoip.com"
  Heuristic match: "internode.on.net"
  Heuristic match: "internetcalls.com"
  Heuristic match: "intalk.com"
  Heuristic match: "inphonex.com"
  Heuristic match: "indivoip.com"
  Heuristic match: "imax.sg"
  Heuristic match: "iinet.net.au"
  Heuristic match: "ifone.vnn.vn"
  Heuristic match: "ifon.pl"
  Heuristic match: "ideasip.com"
  Heuristic match: "i3voiz.com"
  Heuristic match: "i2voip.com"
  Heuristic match: "hiptel.com"
  Heuristic match: "happycall.ro"
  Heuristic match: "happycall.pl"
  Heuristic match: "halonet.pl"
  Heuristic match: "gulfsip.com"
  Heuristic match: "gulffoon.com"
  Heuristic match: "gsmcall.com"
  Heuristic match: "gradwell.net"
  Heuristic match: "gotalk.com.au"
  Heuristic match: "gmx.net"
  Heuristic match: "glovip.com"
  Heuristic match: "globe7.com"
  Heuristic match: "getonsip.com"
  Heuristic match: "getjive.com"
  Heuristic match: "friendcaller.com"
  Heuristic match: "freshtel.net"
  Heuristic match: "freevoipdeal.com"
  Heuristic match: "free.net.il"
  Heuristic match: "freespeech.ie"
  Heuristic match: "freephonie.org"
  Heuristic match: "freenet.de"
  Heuristic match: "freeconet.pl"
  Heuristic match: "freecall.net.au"
  Heuristic match: "freecall.com"
  Heuristic match: "fonosip.com"
  Heuristic match: "fonet.dk"
  Heuristic match: "flaphone.com"
  Heuristic match: "fivitel.com"
  Heuristic match: "filiago.org"
  Heuristic match: "fastvoip.com"
  Heuristic match: "famocall.com"
  Heuristic match: "faktortel.com.au"
  Heuristic match: "ezytel.com.au"
  Heuristic match: "exetel.com.au"
  Heuristic match: "eutelia.it"
  Heuristic match: "esky.co"
  Heuristic match: "esiptel.pl"
  Heuristic match: "ephone.hu"
  Heuristic match: "engin.com.au"
  Heuristic match: "ekiga.net"
  Heuristic match: "efoneking.com"
  Heuristic match: "ecocaller.com"
  Heuristic match: "easyvoip.com"
  Heuristic match: "easyofficephone.com"
  Heuristic match: "easybell.de"
  Heuristic match: "e-fon.ch"
  Heuristic match: "dus.net"
  Heuristic match: "draytel.org"
  Heuristic match: "digisip.net"
  Heuristic match: "diamondcard.us"
  Heuristic match: "dcalling.de"
  Heuristic match: "darmowytelefon.pl"
  Heuristic match: "cybertel.at"
  Heuristic match: "cubioworld.com"
  Heuristic match: "cotas.com"
  Heuristic match: "cosmovoice.com"
  Heuristic match: "corbina.ru"
  Heuristic match: "personal.coms.com"
  Heuristic match: "connexin.co.uk"
  Heuristic match: "comcen.com.au"
  Heuristic match: "cip-tele.com"
  Heuristic match: "cheapnet.it"
  Heuristic match: "cellip.com"
  Heuristic match: "carpo.de"
  Heuristic match: "callwithus.com"
  Heuristic match: "calltopbx.com"
  Heuristic match: "callromania.ro"
  Heuristic match: "callpal.net"
  Heuristic match: "callnet.co.nz"
  Heuristic match: "callcentric.com"
  Heuristic match: "budgetsip.com"
  Heuristic match: "budgetphone.nl"
  Heuristic match: "broadvoice.com"
  Heuristic match: "bravoip.com"
  Heuristic match: "brasilconnecting.com.br"
  Heuristic match: "braintel.net.pk"
  Heuristic match: "brains.net"
  Heuristic match: "bluesip.net"
  Heuristic match: "blueface.ie"
  Heuristic match: "bgopen.net"
  Heuristic match: "bellsip.com"
  Heuristic match: "bbpglobal.com"
  Heuristic match: "barablu.com"
  Heuristic match: "bankoi.com"
  Heuristic match: "babytel.ca"
  Heuristic match: "axvoice.com"
  Heuristic match: "avego.de"
  Heuristic match: "atpnet.com.au"
  Heuristic match: "arcor.de"
  Heuristic match: "aql.com"
  Heuristic match: "aptela.com"
  Heuristic match: "altecom.info"
  Heuristic match: "alonia.ro"
  Heuristic match: "allo.md"
  Heuristic match: "annatel.net"
  Heuristic match: "amivox.com"
  Heuristic match: "airtelgold.com"
  Heuristic match: "airtelasia.com"
  Heuristic match: "adphone.com"
  Heuristic match: "adeptotele.com"
  Heuristic match: "adamvozip.es"
  Heuristic match: "adam.com.au"
  Heuristic match: "actionvoip.com"
  Heuristic match: "actionring.com"
  Heuristic match: "actio.pl"
  Heuristic match: "acanac.com"
  Heuristic match: "abbeyphone.com"
  Heuristic match: "abbatel.com"
  Heuristic match: "a1.net"
  Heuristic match: "3starsnet.com"
  Heuristic match: "2talk.co.nz"
  Heuristic match: "2talk.com"
  Heuristic match: "1und1.de"
  Heuristic match: "1legcall.com"
  Heuristic match: "12connect.com"
  Heuristic match: "12voip.com"
  Heuristic match: "007voip.com"
  Heuristic match: "voip.zappmobile.ro"
  Heuristic match: "sip.zadarma.com"
  Heuristic match: "node1.xsip.de"
  Heuristic match: "sip.xs4all.nl"
  Heuristic match: "sip2.xphone.cz"
  Heuristic match: "sip.goandcall.com"
  Heuristic match: "proxy.whistlephone.com"
  Heuristic match: "sip.webcalldirect.com"
  Heuristic match: "rnktel.com"
  Heuristic match: "sip:sip.vyke.com"
  Heuristic match: "sip.vyke.com"
  Heuristic match: "voip.vtx.ch"
  Heuristic match: "us.voxalot.com"
  Heuristic match: "eu.voxalot.com"
  Heuristic match: "au.voxalot.com"
  Heuristic match: "sip.vortel.de"
  Heuristic match: "rtsip.vopium.com"
  Heuristic match: "sip.voocall.cz"
  Heuristic match: "vono.net.br"
  Heuristic match: "sphone.vopr.vonage.net"
  Heuristic match: "sip.volny.cz"
  Heuristic match: "sip.voise.com.au"
  Heuristic match: "sip.voipwise.com"
  Heuristic match: "sip.voipuser.org"
  Pattern match: "www.voiptigersip.com"
  Heuristic match: "nat.voiptalk.org"
  Heuristic match: "sip.voipstunt.com"
  Heuristic match: "sip.voipraider.com"
  Heuristic match: "pbx.voipq.nl"
  Heuristic match: "sip3.voipplanet.nl"
  Heuristic match: "sip.voipmove.com"
  Heuristic match: "proxy.voipmax.pl"
  Heuristic match: "sip.voipjumper.com"
  Heuristic match: "sip.voiphit.com"
  Heuristic match: "register.voipgate.com"
  Heuristic match: "sip.voipgain.com"
  Heuristic match: "sip.voipfone.ne"
  Heuristic match: "registrar.proxy.mycg.net"
  Heuristic match: "sip.voipdoup.com"
  Heuristic match: "sip.voipdegraca.com.br"
  Heuristic match: "sip.voipdiscount.com"
  Heuristic match: "sip.voipchief.com"
  Heuristic match: "sip.voipcaptain.com"
  Heuristic match: "sip.voipbusterpro.com"
  Heuristic match: "sip.voipbuster.com"
  Heuristic match: "sip.voipblazer.com"
  Heuristic match: "sip.voipblast.com"
  Heuristic match: "sip.voipalot.com"
  Heuristic match: "proxy.voip.co.uk"
  Heuristic match: "sd1.voip.com"
  Heuristic match: "sip1.voiceglobe.net"
  Heuristic match: "sip.voicehost.co.uk"
  Heuristic match: "sip.vodini.com"
  Heuristic match: "sip.vodafone.is"
  Heuristic match: "voip.viva.gr"
  Heuristic match: "sip4.vitelity.net"
  Heuristic match: "shockwave.vtnoc.net"
  Heuristic match: "pbx.viapbx.com"
  Heuristic match: "vg1.vegatele.com"
  Heuristic match: "sip.vccs.ca"
  Heuristic match: "sip3.voipvoip.com"
  Heuristic match: "tel.vaboomz.com"
  Heuristic match: "sip.uvoipit.com"
  Heuristic match: "p1.voip.inode.at"
  Heuristic match: "sip2.unotel.dk"
  Heuristic match: "conus.ucallweconn.net"
  Heuristic match: "sip.tweakphone.nl"
  Heuristic match: "tpgphone.tpg.com.au"
  Heuristic match: "sip.tpad.com"
  Heuristic match: "gsm.thaitelplus.com"
  Heuristic match: "sip.tescointernetphone.com"
  Heuristic match: "sip:terrasip.net"
  Heuristic match: "terrasip.net"
  Heuristic match: "sip.tenet.ua"
  Heuristic match: "den.teliax.net"
  Heuristic match: "sip.telefoniedienst.nl"
  Heuristic match: "tel.telefoniedienst.nl"
  Heuristic match: "telesip.reasonnet.com"
  Heuristic match: "voip.telequant.com"
  Heuristic match: "sip.talktt.com"
  Heuristic match: "sip04.us.overvoip.net"
  Heuristic match: "tel.t-online.de"
  Heuristic match: "sip.myvoipaccount.net"
  Heuristic match: "sip4.supersip.tk"
  Heuristic match: "sip3.supersip.tk"
  Heuristic match: "sip2.supersip.tk"
  Heuristic match: "sip.supersip.tk"
  Heuristic match: "sip.stuntcalls.com"
  Heuristic match: "strato-iphone.de"
  Heuristic match: "sip.speedsip.com"
  Heuristic match: "sip.sparvoip.de"
  Heuristic match: "sip.sonavoip.com.br"
  Heuristic match: "voip.solomo.de"
  Heuristic match: "sip.solcon.nl"
  Heuristic match: "sip.softcall.me"
  Heuristic match: "sip.smsdiscount.com"
  Heuristic match: "sip.smartvoip.com"
  Heuristic match: "sip.skysiptel.com"
  Heuristic match: "sip.skype.com"
  Heuristic match: "sip.sky.od.ua"
  Heuristic match: "sip.skyetel.net"
  Heuristic match: "sip.siptraffic.com"
  Heuristic match: "voip.sipservice.eu"
  Heuristic match: "server5.sipphone.co.th"
  Heuristic match: "sip.sipme.com.au"
  Heuristic match: "sip.sipload.com"
  Heuristic match: "sip.sipdiscount.com"
  Heuristic match: "sip.backbone.ch"
  Heuristic match: "voipgateway.org"
  Heuristic match: "sip.sightspeed.com"
  Heuristic match: "voip.saunalahti.fi"
  Heuristic match: "proxy.voip.sapo.pt"
  Heuristic match: "voip.sapo.pt"
  Heuristic match: "sip.rynga.com"
  Heuristic match: "sip.roitel.com.tr"
  Heuristic match: "sip.ringcentral.com"
  Heuristic match: "voice.redspot.dk"
  Heuristic match: "sip.relibre.cl"
  Heuristic match: "sip.rebvoice.com"
  Heuristic match: "sipdr.quantumvoice-sip.com"
  Heuristic match: "sip.primetalker.com"
  Heuristic match: "sip.powervoip.com"
  Heuristic match: "sip.polfon.com.pl"
  Heuristic match: "sip.poivy.com"
  Heuristic match: "natproxy.plus.net"
  Heuristic match: "sip.plus.net"
  Heuristic match: "app1.plfon.pl"
  Heuristic match: "sip.planetphone.net"
  Heuristic match: "sip.phonzo.com"
  Heuristic match: "voip.phonevision.com.ar"
  Heuristic match: "adp1.winnerip.com"
  Heuristic match: "pgp01.televolution.net"
  Heuristic match: "sip.pfingo.com"
  Heuristic match: "app1.peoplefone.ch"
  Heuristic match: "sip.pennytel.com"
  Heuristic match: "call1.pccall.com"
  Heuristic match: "sip.ovh.be"
  Heuristic match: "sip01.otel.co.za"
  Heuristic match: "nat.orbtalk.co.uk"
  Heuristic match: "talk.orbtalk.co.uk"
  Heuristic match: "sip.openvoip.it"
  Heuristic match: "o7.omysip.com"
  Heuristic match: "o6.omysip.com"
  Heuristic match: "sip.omnivoice.eu"
  Heuristic match: "sip.odorik.cz"
  Heuristic match: "sip.varphonex.com"
  Heuristic match: "sip.o-fone.com"
  Heuristic match: "ata.nymgo.com"
  Heuristic match: "sip.nonoh.net"
  Heuristic match: "sip.nomado.eu"
  Heuristic match: "sip.nimbuzzcalls.com"
  Heuristic match: "gw.nimbuzzcalls.com"
  Heuristic match: "dialnet.pl"
  Heuristic match: "voip.wengo.fr"
  Heuristic match: "sip.netvoip.ch"
  Heuristic match: "sip.netappel.fr"
  Heuristic match: "sip.neophonex.hu"
  Heuristic match: "voip.mywowcall.com"
  Heuristic match: "sip.mywebfon.com"
  Heuristic match: "sipagate.com"
  Heuristic match: "myaccount.ajpbiz.com"
  Heuristic match: "sip.mytcom.it"
  Heuristic match: "sip.myphone.ge"
  Heuristic match: "sip01.mynetfone.com.au"
  Heuristic match: "sip.myfon.pl"
  Heuristic match: "sbc.multifon.ru"
  Heuristic match: "sip.mukalameh.com"
  Heuristic match: "voip.mouthmun.com"
  Heuristic match: "sip99.mondotalk.com"
  Heuristic match: "sip.mo-callnet.com"
  Heuristic match: "sipregister.mixvoip.com"
  Heuristic match: "sipreg.midwestsip.com"
  Heuristic match: "mikrotech.sipcz.net"
  Heuristic match: "sip.messagenet.it"
  Heuristic match: "sip.megavoip.com"
  Heuristic match: "sip.megafon.bg"
  Heuristic match: "ast1.ozsite.net"
  Heuristic match: "sip.mailxxl.com"
  Heuristic match: "sip.lowratevoip.com"
  Heuristic match: "proxy.localphone.com"
  Heuristic match: "ar.llamadaip.org"
  Heuristic match: "sip.linphone.org"
  Heuristic match: "sip.liberailvoip.it"
  Heuristic match: "did.voip.les.net"
  Heuristic match: "sip.kiwilink.co.nz"
  Heuristic match: "keyyo.net"
  Heuristic match: "sip.kebu.it"
  Heuristic match: "sip.justvoip.com"
  Heuristic match: "sip.jumblo.com"
  Heuristic match: "ca01.ivoz.net"
  Heuristic match: "sip.itellvoip.com"
  Heuristic match: "sip.com"
  Heuristic match: "sip.worldcom.ch"
  Heuristic match: "sip.ipvox.cz"
  Heuristic match: "sip.iptel24.net"
  Heuristic match: "sipit.iplink.no"
  Heuristic match: "sip.ipfon.pl"
  Heuristic match: "voip.ipcall.pl"
  Heuristic match: "sip.intervoip.com"
  Heuristic match: "sip.internode.on.net"
  Heuristic match: "sip.internetcalls.com"
  Heuristic match: "it.voipdnsservers.com"
  Heuristic match: "sip.inphonex.com"
  Heuristic match: "voip.IndiVoIP.com"
  Heuristic match: "ip.asiaxl.com"
  Heuristic match: "sip.wa.iinet.net.au"
  Heuristic match: "iinetphone.iinet.net.au"
  Heuristic match: "sip.ifon.pl"
  Heuristic match: "proxy.ideasip.com"
  Heuristic match: "sip.i3voiz.com"
  Heuristic match: "sip.i2voip.com"
  Heuristic match: "sip.vonworldwide.com"
  Heuristic match: "sip.happycall.ro"
  Heuristic match: "sip.2call.pl"
  Heuristic match: "sip.halonet.pl"
  Heuristic match: "sip.gulfsip.com"
  Heuristic match: "gw.gulffoon.com"
  Heuristic match: "voip.gsmcall.com"
  Heuristic match: "nat.gradwell.net"
  Heuristic match: "sip.gradwell.net"
  Heuristic match: "sip.gotalk.com"
  Heuristic match: "sip.gmx.net"
  Heuristic match: "sx01.glovip.com"
  Heuristic match: "sip.onsip.com"
  Heuristic match: "proxy.friendcaller.com"
  Heuristic match: "sip.freshtel.net"
  Heuristic match: "fwd.pulver.com"
  Heuristic match: "sip.freevoipdeal.com"
  Heuristic match: "imfree.co.il"
  Heuristic match: "freephonie.net"
  Heuristic match: "sip.freeconet.pl"
  Heuristic match: "proxy.freecall.net.au"
  Heuristic match: "sip.voiparound.com"
  Heuristic match: "gw1.fonet.dk"
  Heuristic match: "proxy.sipthor.net"
  Heuristic match: "sip.fivitel.com"
  Heuristic match: "sip.voipcs.de"
  Heuristic match: "sip.fastvoip.com"
  Heuristic match: "sip.famocall.com"
  Heuristic match: "sip.faktortel.com.au"
  Heuristic match: "sip.ezytel.net.au"
  Heuristic match: "sip1.exetel.com.au"
  Heuristic match: "voip.eutelia.it"
  Heuristic match: "enum.esky.co"
  Heuristic match: "sip.inotel.pl"
  Heuristic match: "inotel.pl"
  Heuristic match: "sip.ephone.hu"
  Heuristic match: "syd.byo.engin.com.au"
  Heuristic match: "byo.engin.com.au"
  Heuristic match: "proxy.voip.emt.ee"
  Heuristic match: "voip.emt.ee"
  Heuristic match: "sip.efoneking.com"
  Heuristic match: "sip.ecocaller.com"
  Heuristic match: "sip.easyvoip.com"
  Heuristic match: "sip.enhancedvoip.net"
  Heuristic match: "sip.easybell.de"
  Heuristic match: "sip01.e-fon.ch"
  Heuristic match: "proxy.dus.net"
  Heuristic match: "proxy.digisip.net"
  Heuristic match: "sip.diamondcard.us"
  Heuristic match: "sip.dcalling.de"
  Heuristic match: "sip.darmowytelefon.pl"
  Heuristic match: "cubio.net"
  Heuristic match: "sip.cosmovoice.com"
  Heuristic match: "sip.corbina.net"
  Heuristic match: "sip.coms.com"
  Heuristic match: "voip.comcen.com.au"
  Heuristic match: "sip.cheapnet.it"
  Heuristic match: "sip.carpo.de"
  Heuristic match: "sip.callwithus.com"
  Heuristic match: "sip.calltopbx.com"
  Heuristic match: "sip.callromania.ro"
  Heuristic match: "voip1.callpal.net"
  Heuristic match: "sip.budgetsip.com"
  Heuristic match: "sip1.budgetphone.nl"
  Heuristic match: "proxy.nyc.broadvoice.com"
  Heuristic match: "sip.broadvoice.com"
  Heuristic match: "sip.bravoip.com"
  Heuristic match: "sip.brasilconnecting.com.br"
  Heuristic match: "brain.net.pk"
  Heuristic match: "sip.blueface.ie"
  Heuristic match: "sip.bgopen.net"
  Heuristic match: "bellshare.com"
  Heuristic match: "gw.barablu.com"
  Heuristic match: "voip3.bankoi.com"
  Heuristic match: "nat.babytel.ca"
  Heuristic match: "sip.babytel.ca"
  Heuristic match: "s-p-voip.de"
  Heuristic match: "gw1.atpnet.com.au"
  Heuristic match: "02131.sip.arcor.de"
  Heuristic match: "call.arcor.de"
  Heuristic match: "sip.aql.com"
  Heuristic match: "voip.aptela.com"
  Heuristic match: "sip1.altecom.net"
  Heuristic match: "altecom.net"
  Heuristic match: "sip.allo.md"
  Heuristic match: "sip.annatel.net"
  Heuristic match: "m.amivox.com"
  Heuristic match: "sip.airtelgold.com"
  Heuristic match: "gw.Airtelasia.com"
  Heuristic match: "sip04dk.call-it.biz"
  Heuristic match: "sip.adamvozip.es"
  Heuristic match: "sip.adam.com.au"
  Heuristic match: "sip.actionvoip.com"
  Heuristic match: "sip.voipcheap.com"
  Heuristic match: "voip5.acanac.com"
  Heuristic match: "sip.abbeyphone.com"
  Heuristic match: "switch.Abbatel.com"
  Heuristic match: "sip.a1.net"
  Heuristic match: "sip.1und1.de"
  Heuristic match: "sip03.us.overvoip.net"
  Heuristic match: "sip.12connect.com"
  Heuristic match: "sip.12voip.com"
  Heuristic match: "sip1.007voip.com"
  Heuristic match: "stun.goandcall.com"
  Heuristic match: "stun.rnktel.com"
  Heuristic match: "stun.webcalldirect.com"
  Heuristic match: "stun.voxalot.com"
  Heuristic match: "stun.vortel.de"
  Heuristic match: "stun.voipwise.com"
  Heuristic match: "stun.voipstunt.com"
  Heuristic match: "stun.voipraider.com"
  Heuristic match: "stun.voiphit.com"
  Heuristic match: "stun.voipgate.com"
  Heuristic match: "stun.voipgain.com"
  Heuristic match: "stun.voipdiscount.com"
  Heuristic match: "stun.voipcheap.com"
  Heuristic match: "stun.voipcaptain.com"
  Heuristic match: "stun.voipbusterpro.com"
  Heuristic match: "stun.voipbuster.com"
  Heuristic match: "stun.voicehost.co.uk"
  Heuristic match: "stun.viva.gr"
  Heuristic match: "stun.freeswitch.org"
  Heuristic match: "stun.unotel.dk"
  Heuristic match: "stun.terrasip.net"
  Heuristic match: "stun.t-online.de"
  Heuristic match: "stun.stuntcalls.com"
  Heuristic match: "iphone-stun.strato-iphone.de"
  Heuristic match: "sip.spikko.com"
  Heuristic match: "stun.speedsip.com"
  Heuristic match: "stun.sparvoip.de"
  Heuristic match: "stun.softcall.me"
  Heuristic match: "stun.smsdiscount.com"
  Heuristic match: "stun.smartvoip.com"
  Heuristic match: "stun.siptraffic.com"
  Heuristic match: "stun.sipnet.ru"
  Heuristic match: "stun1.sipload.com"
  Heuristic match: "stun.sipkom.com"
  Heuristic match: "stun.sipgate.net"
  Heuristic match: "stun.sipdiscount.com"
  Heuristic match: "stun.sightspeed.com"
  Heuristic match: "stun.rynga.com"
  Heuristic match: "stun.powervoip.com"
  Heuristic match: "stun.poivy.com"
  Heuristic match: "stun.personal-voip.de"
  Heuristic match: "stun.voip.ovh.net"
  Heuristic match: "sip.ovh.net"
  Heuristic match: "stunserver.org"
  Heuristic match: "stun.nonoh.net"
  Heuristic match: "stun01.sipphone.com"
  Heuristic match: "ip.dialnet.pl"
  Heuristic match: "stun.netappel.fr"
  Heuristic match: "stun.xten.net"
  Heuristic match: "stun.sipagate.com"
  Heuristic match: "stun.myphone.ge"
  Heuristic match: "stun.musimi.dk"
  Heuristic match: "stun.mixvoip.com"
  Heuristic match: "stun.megavoip.com"
  Heuristic match: "stun.lowratevoip.com"
  Heuristic match: "stun.jumblo.com"
  Heuristic match: "stun.intervoip.com"
  Heuristic match: "stun.internetcalls.com"
  Heuristic match: "stun.ideasip.com"
  Heuristic match: "stun.vonworldwide.com"
  Heuristic match: "stun.halonet.pl"
  Heuristic match: "stun.gmx.net"
  Heuristic match: "stun.voiparound.com"
  Heuristic match: "stun.fonosip.com"
  Heuristic match: "stun.voipcs.de"
  Heuristic match: "stun.voip.eutelia.it"
  Heuristic match: "stun.easybell.de"
  Heuristic match: "stun.e-fon.ch"
  Heuristic match: "stun.cosmovoice.com"
  Heuristic match: "stun.carpo.de"
  Heuristic match: "stun.callwithus.com"
  Heuristic match: "stun.xten.com"
  Heuristic match: "stun.budgetsip.com"
  Heuristic match: "stun.bluesip.net"
  Heuristic match: "stun.bellshare.com"
  Heuristic match: "stun.voipinfocenter.com"
  Heuristic match: "stun.actionvoip.com"
  Heuristic match: "stun.fwdnet.net"
  Heuristic match: "sip.actio.pl"
  Heuristic match: "stun.2talk.com"
  Heuristic match: "stun.1und1.de"
  Heuristic match: "stun.12connect.com"
  Heuristic match: "stun.12voip.com"
  Heuristic match: "stun.007voip.com"
  Pattern match: "www.umc.ua"
  Pattern match: "www.jeans.ua"
  Heuristic match: "general.t-mobile.uk"
  Heuristic match: "payandgo.o2.co.uk"
  Heuristic match: "mobile.o2.co.uk"
  Pattern match: "www.dtac.co.th"
  Heuristic match: "gprs.swisscom.ch"
  Heuristic match: "isplnk1.swip.net"
  Heuristic match: "online.telia.se"
  Heuristic match: "airtelnet.es"
  Heuristic match: "movistar.es"
  Heuristic match: "internet.primtel.ru"
  Heuristic match: "internet.mts.ru"
  Heuristic match: "internet.beeline.ru"
  Heuristic match: "internet.vodafone.pt"
  Pattern match: "www.globe.com.ph"
  Pattern match: "www.plusgsm.pl"
  Pattern match: "www.idea.pl"
  Heuristic match: "internet.netcom.no"
  Pattern match: "www.vodafone.net.nz"
  Heuristic match: "office.vodafone.nl"
  Heuristic match: "web.vodafone.nl"
  Heuristic match: "internet.itelcel.com"
  Heuristic match: "timenet.com.my"
  Heuristic match: "vox.lu"
  Heuristic match: "web.pt.lu"
  Heuristic match: "gprs.omnitel.net"
  Heuristic match: "uni.tim.it"
  Heuristic match: "web.omnitel.it"
  Heuristic match: "isp.vodafone.ie"
  Heuristic match: "satelindogprs.com"
  Pattern match: "www.indosat-m3.net"
  Heuristic match: "bplgprs.com"
  Heuristic match: "airtelgprs.com"
  Heuristic match: "standardnet.vodafone.hu"
  Heuristic match: "vitamax.snet.internet.net"
  Heuristic match: "web.orangehk.com"
  Heuristic match: "internet.vodafone.gr"
  Heuristic match: "gnet.b-online.gr"
  Heuristic match: "quam.de"
  Heuristic match: "internet.t-d1.de"
  Heuristic match: "internet.eplus.de"
  Heuristic match: "web.vodafone.de"
  Heuristic match: "orange.fr"
  Heuristic match: "b2bouygtel.com"
  Heuristic match: "ebouygtel.com"
  Heuristic match: "internet.emt.ee"
  Heuristic match: "internet.vodafone.net"
  Heuristic match: "web.orange.dk"
  Heuristic match: "internet.t-mobile.cz"
  Heuristic match: "gprs5.vipnet.hr"
  Heuristic match: "gprs0.vipnet.hr"
  Heuristic match: "imovil.entelpcs.cl"
  Heuristic match: "internet.fido.ca"
  Heuristic match: "vpn.com"
  Heuristic match: "internet.com"
  Heuristic match: "tim.br"
  Heuristic match: "claro.com.br"
  Heuristic match: "internet.proximus.be"
  Heuristic match: "web.pro.be"
  Heuristic match: "web@telering.at"
  Heuristic match: "gprs@a1plus.at"
  Heuristic match: "A1.net"
  Heuristic match: "vfinternet.au"
  Pattern match: "http://www.freewebhostingarea.com/agreement.html"
  Pattern match: "http://www.freewebhostingarea.com/contact/"
  Pattern match: "http://www.freewebhostingarea.com/images/app.png"
  Pattern match: "http://user99.freewebhostingarea.com/a/spot1e3xx.js"
  Pattern match: "http://www.freewebhostingarea.com/images/database.png"
  Pattern match: "http://www.freewebhostingarea.com/images/users.png"
  Pattern match: "http://www.1freecounter.com"
  
  source
  
  File/Memory
  
  relevance
  
  10/10
System Security
- Creates or modifies windows services
  
  details
  
  "<Input Sample>" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\TCPIP\PARAMETERS")
  
  source
  
  Registry Access
  
  relevance
  
  10/10
  
  ATT&CK ID
  
  T1112 (Show technique in the MITRE ATT&CK™ matrix)
- Opens the Kernel Security Device Driver (KsecDD) of Windows
  
  details
  
  "<Input Sample>" opened "\Device\KsecDD"
  
  source
  
  API Call
  
  relevance
  
  10/10
  
  ATT&CK ID
  
  T1215 (Show technique in the MITRE ATT&CK™ matrix)
Unusual Characteristics
- Matched Compiler/Packer signature
  
  details
  
  "n0kVoIP.exe.bin" was detected as "UPX v1.25 (Delphi) Stub"
  
  source
  
  Static Parser
  
  relevance
  
  10/10
  
  ATT&CK ID
  
  T1002 (Show technique in the MITRE ATT&CK™ matrix)

File Details

All Details:

n0kVoIP.exe

Filename: n0kVoIP.exe
Size: 155KiB (158208 bytes)
Type: peexe executable
Description: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Architecture
: WINDOWS
SHA256
: 6261ba6acc1c69dfaf358ef7f063f62d5df5e070a63850055a4f6e70a94dde54
MD5
: 80d84acaf65b6828c76307c9524c6020
SHA1
: 98076837b4f7e460595546334834299a08e30145
ssdeep
: 3072:MxcMLl8r2016EN3IND7J794EFLVM8zyYt3qTc+Ar3Z340rEvVCglSdJv4w:Cfs9wD71BVM8Pt6TTA7Z37raWd3
imphash
: d3ed1643cc2b4282b7ea2c42d3b0ab0b
authentihash
: d04970294cfcd028fb68341239f0b94a9ca7c2d54d0fe911ee8c56124d67cd30
Compiler/Packer
: UPX v1.25 (Delphi) Stub

Resources

Language
: FINNISH
Icon

Visualization

Input File (PortEx)

Version Info

LegalCopyright: All rights reserved.
FileVersion: 2014, 3, 16, 0
ProductVersion: 2014, 3, 16, 0
Translation: 0x0409 0x04e4

Classification (TrID)

42.3% (.EXE) UPX compressed Win32 Executable
36.7% (.EXE) Win32 EXE Yoda's Crypter
9.1% (.DLL) Win32 Dynamic Link Library (generic)
6.2% (.EXE) Win32 Executable (generic)
2.7% (.EXE) Generic Win/DOS Executable

File Metadata

1 .OBJ Files (COFF) linked with LINK.EXE 8.00 (Visual Studio 2005) (build: 50727)
1 .RES Files linked with CVTRES.EXE 8.00 (Visual Studio 2005) (build: 50727)
1 .EXP Files linked with LINK.EXE 8.00 (Visual Studio 2005) (build: 50727)
24 .CPP Files (with LTCG) compiled with CL.EXE 14.00 (Visual Studio 2005) (build: 50727)
114 .CPP Files compiled with CL.EXE 14.00 (Visual Studio 2005) (build: 50727)
161 .C Files compiled with CL.EXE 14.00 (Visual Studio 2005) (build: 50727)
26 .ASM Files assembled with MASM 8.00 (Visual Studio 2005) (build: 50727)

23 .LIB Files generated with LIB.EXE 7.10 (Visual Studio .NET 2003) (build: 4035)
7 .C Files compiled with CL.EXE 13.10 (Visual Studio .NET 2003) (build: 4035)
2 .OBJ Files linked with ALIASOBJ.EXE 8.00 (Internal OLDNAMES.LIB Tool) (build: 50327)

File contains C++ code
File contains assembly code
File appears to contain raw COFF/OMF content
File was optimized using LTCG and/or POGO
File is the product of a large codebase (325 files)

File Sections

Details	Name	Entropy	Virtual Address	Virtual Size	Raw Size	MD5	Characteristics
Name UPX0 Entropy 0 Virtual Address 0x1000 Virtual Size 0x81000 Raw Size 0x0 MD5 d41d8cd98f00b204e9800998ecf8427e	UPX0	0	0x1000	0x81000	0x0	d41d8cd98f00b204e9800998ecf8427e	-
Name UPX1 Entropy 7.91740802727 Virtual Address 0x82000 Virtual Size 0x25000 Raw Size 0x24800 MD5 b38a16a752ba083a26c8fadf35072bd2	UPX1	7.91740802727	0x82000	0x25000	0x24800	b38a16a752ba083a26c8fadf35072bd2	-
Name .rsrc Entropy 4.93809261957 Virtual Address 0xa7000 Virtual Size 0x2000 Raw Size 0x1e00 MD5 7ca460444c9e619022677975eaf2790a	.rsrc	4.93809261957	0xa7000	0x2000	0x1e00	7ca460444c9e619022677975eaf2790a	-

File Resources

Details	Name	RVA	Size	Type	Language
Name RT_CURSOR RVA 0x9dc10 Size 0x134 Type SysEx File - Language Finnish	RT_CURSOR	0x9dc10	0x134	SysEx File -	Finnish
Name RT_CURSOR RVA 0x9dd44 Size 0xb4 Type data Language Finnish	RT_CURSOR	0x9dd44	0xb4	data	Finnish
Name RT_CURSOR RVA 0x9ddf8 Size 0x134 Type data Language Finnish	RT_CURSOR	0x9ddf8	0x134	data	Finnish
Name RT_CURSOR RVA 0x9df2c Size 0x134 Type data Language Finnish	RT_CURSOR	0x9df2c	0x134	data	Finnish
Name RT_CURSOR RVA 0x9e060 Size 0x134 Type data Language Finnish	RT_CURSOR	0x9e060	0x134	data	Finnish
Name RT_CURSOR RVA 0x9e194 Size 0x134 Type data Language Finnish	RT_CURSOR	0x9e194	0x134	data	Finnish
Name RT_CURSOR RVA 0x9e2c8 Size 0x134 Type data Language Finnish	RT_CURSOR	0x9e2c8	0x134	data	Finnish
Name RT_CURSOR RVA 0x9e3fc Size 0x134 Type data Language Finnish	RT_CURSOR	0x9e3fc	0x134	data	Finnish
Name RT_CURSOR RVA 0x9e530 Size 0x134 Type data Language Finnish	RT_CURSOR	0x9e530	0x134	data	Finnish
Name RT_CURSOR RVA 0x9e664 Size 0x134 Type data Language Finnish	RT_CURSOR	0x9e664	0x134	data	Finnish
Name RT_CURSOR RVA 0x9e798 Size 0x134 Type data Language Finnish	RT_CURSOR	0x9e798	0x134	data	Finnish
Name RT_CURSOR RVA 0x9e8cc Size 0x134 Type data Language Finnish	RT_CURSOR	0x9e8cc	0x134	data	Finnish
Name RT_CURSOR RVA 0x9ea00 Size 0x134 Type data Language Finnish	RT_CURSOR	0x9ea00	0x134	data	Finnish
Name RT_CURSOR RVA 0x9eb34 Size 0x134 Type data Language Finnish	RT_CURSOR	0x9eb34	0x134	data	Finnish
Name RT_CURSOR RVA 0x9ec68 Size 0x134 Type data Language Finnish	RT_CURSOR	0x9ec68	0x134	data	Finnish
Name RT_CURSOR RVA 0x9ed9c Size 0x134 Type data Language Finnish	RT_CURSOR	0x9ed9c	0x134	data	Finnish
Name RT_BITMAP RVA 0x9eed0 Size 0xb8 Type data Language Finnish	RT_BITMAP	0x9eed0	0xb8	data	Finnish
Name RT_BITMAP RVA 0x9ef88 Size 0x144 Type data Language Finnish	RT_BITMAP	0x9ef88	0x144	data	Finnish
Name RT_ICON RVA 0xa7c14 Size 0xca8 Type dBase IV DBT of @.DBF, block length 3072, next free block index 40, next free block 0, next used block 0 Language English	RT_ICON	0xa7c14	0xca8	dBase IV DBT of @.DBF, block length 3072, next free block index 40, next free block 0, next used block 0	English
Name RT_DIALOG RVA 0x9fd74 Size 0x118 Type data Language English	RT_DIALOG	0x9fd74	0x118	data	English
Name RT_DIALOG RVA 0x9fe8c Size 0xf0 Type data Language English	RT_DIALOG	0x9fe8c	0xf0	data	English
Name RT_DIALOG RVA 0x9ff7c Size 0x50e Type data Language English	RT_DIALOG	0x9ff7c	0x50e	data	English
Name RT_DIALOG RVA 0xa048c Size 0x2e6 Type data Language English	RT_DIALOG	0xa048c	0x2e6	data	English
Name RT_DIALOG RVA 0xa0774 Size 0x79a Type data Language English	RT_DIALOG	0xa0774	0x79a	data	English
Name RT_DIALOG RVA 0xa0f10 Size 0xe8 Type data Language Finnish	RT_DIALOG	0xa0f10	0xe8	data	Finnish
Name RT_DIALOG RVA 0xa0ff8 Size 0x34 Type data Language Finnish	RT_DIALOG	0xa0ff8	0x34	data	Finnish
Name RT_STRING RVA 0xa102c Size 0x30 Type 8086 relocatable (Microsoft) Language Finnish	RT_STRING	0xa102c	0x30	8086 relocatable (Microsoft)	Finnish
Name RT_STRING RVA 0xa105c Size 0x82 Type data Language Finnish	RT_STRING	0xa105c	0x82	data	Finnish
Name RT_STRING RVA 0xa10e0 Size 0x2a Type data Language Finnish	RT_STRING	0xa10e0	0x2a	data	Finnish
Name RT_STRING RVA 0xa110c Size 0x192 Type data Language Finnish	RT_STRING	0xa110c	0x192	data	Finnish
Name RT_STRING RVA 0xa12a0 Size 0x4e2 Type data Language Finnish	RT_STRING	0xa12a0	0x4e2	data	Finnish
Name RT_STRING RVA 0xa1784 Size 0x31a Type Sendmail frozen configuration - version 8SG\020;\316\302Y\022F\2617!b\352\256\276W@a1\331<\306R\215\213D\271\013\207\013q @o[.\254\303\013/\21767A\002\002;\202E Language Finnish	RT_STRING	0xa1784	0x31a	Sendmail frozen configuration - version 8SG\020;\316\302Y\022F\2617!b\352\256\276W@a1\331<\306R\215\213D\271\013\207\013q @o[.\254\303\013/\21767A\002\002;\202E	Finnish
Name RT_STRING RVA 0xa1aa0 Size 0x2dc Type data Language Finnish	RT_STRING	0xa1aa0	0x2dc	data	Finnish
Name RT_STRING RVA 0xa1d7c Size 0x8a Type data Language Finnish	RT_STRING	0xa1d7c	0x8a	data	Finnish
Name RT_STRING RVA 0xa1e08 Size 0xac Type data Language Finnish	RT_STRING	0xa1e08	0xac	data	Finnish
Name RT_STRING RVA 0xa1eb4 Size 0xde Type data Language Finnish	RT_STRING	0xa1eb4	0xde	data	Finnish
Name RT_STRING RVA 0xa1f94 Size 0x4c4 Type data Language Finnish	RT_STRING	0xa1f94	0x4c4	data	Finnish
Name RT_STRING RVA 0xa2458 Size 0x264 Type data Language Finnish	RT_STRING	0xa2458	0x264	data	Finnish
Name RT_STRING RVA 0xa26bc Size 0x2c Type data Language Finnish	RT_STRING	0xa26bc	0x2c	data	Finnish
Name RT_STRING RVA 0xa26e8 Size 0x42 Type data Language Finnish	RT_STRING	0xa26e8	0x42	data	Finnish
Name RT_GROUP_CURSOR RVA 0xa272c Size 0x22 Type data Language Finnish	RT_GROUP_CURSOR	0xa272c	0x22	data	Finnish
Name RT_GROUP_CURSOR RVA 0xa2750 Size 0x14 Type data Language Finnish	RT_GROUP_CURSOR	0xa2750	0x14	data	Finnish
Name RT_GROUP_CURSOR RVA 0xa2764 Size 0x14 Type data Language Finnish	RT_GROUP_CURSOR	0xa2764	0x14	data	Finnish
Name RT_GROUP_CURSOR RVA 0xa2778 Size 0x14 Type data Language Finnish	RT_GROUP_CURSOR	0xa2778	0x14	data	Finnish
Name RT_GROUP_CURSOR RVA 0xa278c Size 0x14 Type DOS executable (COM) Language Finnish	RT_GROUP_CURSOR	0xa278c	0x14	DOS executable (COM)	Finnish
Name RT_GROUP_CURSOR RVA 0xa27a0 Size 0x14 Type Non-ISO extended-ASCII text, with no line terminators Language Finnish	RT_GROUP_CURSOR	0xa27a0	0x14	Non-ISO extended-ASCII text, with no line terminators	Finnish
Name RT_GROUP_CURSOR RVA 0xa27b4 Size 0x14 Type data Language Finnish	RT_GROUP_CURSOR	0xa27b4	0x14	data	Finnish
Name RT_GROUP_CURSOR RVA 0xa27c8 Size 0x14 Type data Language Finnish	RT_GROUP_CURSOR	0xa27c8	0x14	data	Finnish
Name RT_GROUP_CURSOR RVA 0xa27dc Size 0x14 Type data Language Finnish	RT_GROUP_CURSOR	0xa27dc	0x14	data	Finnish
Name RT_GROUP_CURSOR RVA 0xa27f0 Size 0x14 Type data Language Finnish	RT_GROUP_CURSOR	0xa27f0	0x14	data	Finnish
Name RT_GROUP_CURSOR RVA 0xa2804 Size 0x14 Type data Language Finnish	RT_GROUP_CURSOR	0xa2804	0x14	data	Finnish
Name RT_GROUP_CURSOR RVA 0xa2818 Size 0x14 Type Non-ISO extended-ASCII text, with no line terminators Language Finnish	RT_GROUP_CURSOR	0xa2818	0x14	Non-ISO extended-ASCII text, with no line terminators	Finnish
Name RT_GROUP_CURSOR RVA 0xa282c Size 0x14 Type PGP\011Secret Key - Language Finnish	RT_GROUP_CURSOR	0xa282c	0x14	PGP\011Secret Key -	Finnish
Name RT_GROUP_CURSOR RVA 0xa2840 Size 0x14 Type data Language Finnish	RT_GROUP_CURSOR	0xa2840	0x14	data	Finnish
Name RT_GROUP_CURSOR RVA 0xa2854 Size 0x14 Type data Language Finnish	RT_GROUP_CURSOR	0xa2854	0x14	data	Finnish
Name RT_GROUP_ICON RVA 0xa88c0 Size 0x14 Type MS Windows icon resource - 1 icon, 32x32 Language English	RT_GROUP_ICON	0xa88c0	0x14	MS Windows icon resource - 1 icon, 32x32	English
Name RT_VERSION RVA 0xa88d8 Size 0x1b0 Type data Language Finnish	RT_VERSION	0xa88d8	0x1b0	data	Finnish
Name RT_MANIFEST RVA 0xa8a8c Size 0x56 Type ASCII text, with CRLF line terminators Language English	RT_MANIFEST	0xa8a8c	0x56	ASCII text, with CRLF line terminators	English
Name None RVA 0xa2a84 Size 0x64a Type data Language English	None	0xa2a84	0x64a	data	English

File Imports

RegEnumKeyW

Escape

ExitProcess

GetProcAddress

LoadLibraryA

VirtualAlloc

VirtualFree

VirtualProtect

VariantInit

ShellExecuteW

PathFindFileNameW

URLDownloadToFileW

GetDC

ClosePrinter

Screenshots

Loading content, please wait...

Hybrid Analysis

Tip: Click an analysed process below to view more details.

Analysed 1 process in total.

n0kVoIP.exe (PID: 3580) 3/73

Logged Script Calls	Logged Stdout	Extracted Streams	Memory Dumps
Reduced Monitoring	Network Activityy	Network Error	Multiscan Match

Network Analysis

DNS Requests

Domain

Address

Registrar

Country

n0kvoip.orgfree.com
OSINT

Associated Artifacts for n0kvoip.orgfree.com

Whois Field	Value
Address	P.O. Box 97
City	Moergestel
Country	NL
Creation Date	Fri, 28 Jan 2005 00:00:00 GMT
Creation Date	Fri, 28 Jan 2005 20:25:42 GMT
DNSSEC	Unsigned
Domain Name	ORGFREE.COM
EMail	support@freewha.com
EMail	a-b-u-s-e.whois.field@netearthone.com
Expiration Date	Sun, 28 Jan 2018 00:00:00 GMT
Expiration Date	Sun, 28 Jan 2018 20:25:42 GMT
Name Server	NS12.ORGFREE.COM
Organization	FreeWebHostingArea.com
Referral URL	http://www.netearthone.com
Reigstrar	NetEarth One, Inc.
State	Zuid-Holland
Status	clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Last Update	Fri, 08 Apr 2016 00:00:00 GMT
Last Update	Sat, 11 Mar 2017 17:04:35 GMT
Whois Server	whois.netearthone.com
Zip Code	5066

173.208.195.156
TTL: 14399

NetEarth One, Inc.

United States

e.freewebhostingarea.com
OSINT

Associated Artifacts for e.freewebhostingarea.com

Whois Field	Value
Address	P.O. Box 97
City	Moergestel
Country	NL
Creation Date	Fri, 17 Mar 2006 00:00:00 GMT
Creation Date	Fri, 17 Mar 2006 08:04:38 GMT
DNSSEC	Unsigned
Domain Name	FREEWEBHOSTINGAREA.COM
EMail	support@freewha.com
EMail	abuse-contact@publicdomainregistry.com
Expiration Date	Sat, 17 Mar 2018 00:00:00 GMT
Expiration Date	Sat, 17 Mar 2018 07:04:38 GMT
Name Server	NS2.PROTONHOSTING.COM
Referral URL	http://www.publicdomainregistry.com
Reigstrar	PDR Ltd. d/b/a PublicDomainRegistry.com
State	Zuid-Holland
Status	clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Last Update	Wed, 18 Mar 2015 00:00:00 GMT
Last Update	Wed, 18 Mar 2015 13:11:38 GMT
Whois Server	whois.publicdomainregistry.com
Zip Code	5066

Details	Associated SHA256	Threat Level	Positives	Scan Date	Reference
Associated SHA256 4944b20fd5c35bc4eaa929e5ff0a89c59c9fe91d736b4e2e92e7ebe1400ae41f Threat Level no verdict Positives - Scan Date 04/07/2018 15:12:39 Reference AlienVault	4944b20fd5c35bc4eaa929e5ff0a89c59c9fe91d736b4e2e92e7ebe1400ae41f	no verdict	-	04/07/2018 15:12:39	AlienVault
Associated SHA256 2adb4f3a3ef25f8d121304571be70bd20fcbf9fa344ab98f32d5249cc1e87eaa Threat Level no verdict Positives - Scan Date 03/03/2018 03:27:20 Reference AlienVault	2adb4f3a3ef25f8d121304571be70bd20fcbf9fa344ab98f32d5249cc1e87eaa	no verdict	-	03/03/2018 03:27:20	AlienVault
Associated SHA256 291de4af5bbe479052d82385390922b8d040c70e7e6e6d7bbc7a8bb4fe80ea32 Threat Level no verdict Positives - Scan Date 03/02/2018 06:44:40 Reference AlienVault	291de4af5bbe479052d82385390922b8d040c70e7e6e6d7bbc7a8bb4fe80ea32	no verdict	-	03/02/2018 06:44:40	AlienVault
Associated SHA256 00e4990ad17a3be18c6355d74d0a44a466d55855652aa7c5f7dbee5eb10b4572 Threat Level no verdict Positives - Scan Date 01/07/2018 13:46:13 Reference AlienVault	00e4990ad17a3be18c6355d74d0a44a466d55855652aa7c5f7dbee5eb10b4572	no verdict	-	01/07/2018 13:46:13	AlienVault
Associated SHA256 02796555951bf1dede55aa3fda31643b02dfbd068b04eeeacfb18e6c0520bf71 Threat Level no verdict Positives - Scan Date 01/06/2018 04:37:09 Reference AlienVault	02796555951bf1dede55aa3fda31643b02dfbd068b04eeeacfb18e6c0520bf71	no verdict	-	01/06/2018 04:37:09	AlienVault

72.9.150.244
TTL: 6972

PDR Ltd. d/b/a PublicDomainRegistry.com

United States

Contacted Hosts

No relevant hosts were contacted.

HTTP Traffic

Endpoint

Request

URL

Data

173.208.195.156:80 (n0kvoip.orgfree.com)

GET

n0kvoip.orgfree.com//version

GET //version HTTP/1.1 Accept: */* Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3) Host: n0kvoip.orgfree.com Connection: Keep-Alive More Details

Format

Details

Request

GET //version HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: n0kvoip.orgfree.com
Connection: Keep-Alive

Raw Hex

     0 : 0A 00 27 00 00 00 0A 00 27 C1 9E 6D 08 00 45 00 [..'.....'..m..E.]
    10 : 01 6E 02 05 40 00 80 06 8C D8 C0 A8 38 97 AD D0 [.n..@.......8...]
    20 : C3 9C C0 1F 00 50 49 A3 54 90 1B D3 40 65 50 18 [.....PI.T...@eP.]
    30 : 01 00 BC C3 00 00 47 45 54 20 2F 2F 76 65 72 73 [......GET //vers]
    40 : 69 6F 6E 20 48 54 54 50 2F 31 2E 31 0D 0A 41 63 [ion HTTP/1.1..Ac]
    50 : 63 65 70 74 3A 20 2A 2F 2A 0D 0A 41 63 63 65 70 [cept: */*..Accep]
    60 : 74 2D 45 6E 63 6F 64 69 6E 67 3A 20 67 7A 69 70 [t-Encoding: gzip]
    70 : 2C 20 64 65 66 6C 61 74 65 0D 0A 55 73 65 72 2D [, deflate..User-]
    80 : 41 67 65 6E 74 3A 20 4D 6F 7A 69 6C 6C 61 2F 34 [Agent: Mozilla/4]
    90 : 2E 30 20 28 63 6F 6D 70 61 74 69 62 6C 65 3B 20 [.0 (compatible; ]
    A0 : 4D 53 49 45 20 37 2E 30 3B 20 57 69 6E 64 6F 77 [MSIE 7.0; Window]
    B0 : 73 20 4E 54 20 36 2E 31 3B 20 57 4F 57 36 34 3B [s NT 6.1; WOW64;]
    C0 : 20 54 72 69 64 65 6E 74 2F 37 2E 30 3B 20 53 4C [ Trident/7.0; SL]
    D0 : 43 43 32 3B 20 2E 4E 45 54 20 43 4C 52 20 32 2E [CC2; .NET CLR 2.]
    E0 : 30 2E 35 30 37 32 37 3B 20 2E 4E 45 54 20 43 4C [0.50727; .NET CL]
    F0 : 52 20 33 2E 35 2E 33 30 37 32 39 3B 20 2E 4E 45 [R 3.5.30729; .NE]
   100 : 54 20 43 4C 52 20 33 2E 30 2E 33 30 37 32 39 3B [T CLR 3.0.30729;]
   110 : 20 4D 65 64 69 61 20 43 65 6E 74 65 72 20 50 43 [ Media Center PC]
   120 : 20 36 2E 30 3B 20 2E 4E 45 54 34 2E 30 43 3B 20 [ 6.0; .NET4.0C; ]
   130 : 2E 4E 45 54 34 2E 30 45 3B 20 49 6E 66 6F 50 61 [.NET4.0E; InfoPa]
   140 : 74 68 2E 33 29 0D 0A 48 6F 73 74 3A 20 6E 30 6B [th.3)..Host: n0k]
   150 : 76 6F 69 70 2E 6F 72 67 66 72 65 65 2E 63 6F 6D [voip.orgfree.com]
   160 : 0D 0A 43 6F 6E 6E 65 63 74 69 6F 6E 3A 20 4B 65 [..Connection: Ke]
   170 : 65 70 2D 41 6C 69 76 65 0D 0A 0D 0A [ep-Alive....]

72.9.150.244:80 (e.freewebhostingarea.com)

GET

e.freewebhostingarea.com/403.html

GET /403.html HTTP/1.1 Accept: */* Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3) Connection: Keep-Alive Host: e.freewebhostingarea.com More Details

Format

Details

Request

GET /403.html HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Connection: Keep-Alive
Host: e.freewebhostingarea.com

Raw Hex

     0 : 0A 00 27 00 00 00 0A 00 27 C1 9E 6D 08 00 45 00 [..'.....'..m..E.]
    10 : 01 73 02 0A 40 00 80 06 1F 3E C0 A8 38 97 48 09 [.s..@....>..8.H.]
    20 : 96 F4 C0 20 00 50 AE 7D FB 60 B9 81 B4 CE 50 18 [... .P.}.`....P.]
    30 : 01 00 F1 3A 00 00 47 45 54 20 2F 34 30 33 2E 68 [...:..GET /403.h]
    40 : 74 6D 6C 20 48 54 54 50 2F 31 2E 31 0D 0A 41 63 [tml HTTP/1.1..Ac]
    50 : 63 65 70 74 3A 20 2A 2F 2A 0D 0A 41 63 63 65 70 [cept: */*..Accep]
    60 : 74 2D 45 6E 63 6F 64 69 6E 67 3A 20 67 7A 69 70 [t-Encoding: gzip]
    70 : 2C 20 64 65 66 6C 61 74 65 0D 0A 55 73 65 72 2D [, deflate..User-]
    80 : 41 67 65 6E 74 3A 20 4D 6F 7A 69 6C 6C 61 2F 34 [Agent: Mozilla/4]
    90 : 2E 30 20 28 63 6F 6D 70 61 74 69 62 6C 65 3B 20 [.0 (compatible; ]
    A0 : 4D 53 49 45 20 37 2E 30 3B 20 57 69 6E 64 6F 77 [MSIE 7.0; Window]
    B0 : 73 20 4E 54 20 36 2E 31 3B 20 57 4F 57 36 34 3B [s NT 6.1; WOW64;]
    C0 : 20 54 72 69 64 65 6E 74 2F 37 2E 30 3B 20 53 4C [ Trident/7.0; SL]
    D0 : 43 43 32 3B 20 2E 4E 45 54 20 43 4C 52 20 32 2E [CC2; .NET CLR 2.]
    E0 : 30 2E 35 30 37 32 37 3B 20 2E 4E 45 54 20 43 4C [0.50727; .NET CL]
    F0 : 52 20 33 2E 35 2E 33 30 37 32 39 3B 20 2E 4E 45 [R 3.5.30729; .NE]
   100 : 54 20 43 4C 52 20 33 2E 30 2E 33 30 37 32 39 3B [T CLR 3.0.30729;]
   110 : 20 4D 65 64 69 61 20 43 65 6E 74 65 72 20 50 43 [ Media Center PC]
   120 : 20 36 2E 30 3B 20 2E 4E 45 54 34 2E 30 43 3B 20 [ 6.0; .NET4.0C; ]
   130 : 2E 4E 45 54 34 2E 30 45 3B 20 49 6E 66 6F 50 61 [.NET4.0E; InfoPa]
   140 : 74 68 2E 33 29 0D 0A 43 6F 6E 6E 65 63 74 69 6F [th.3)..Connectio]
   150 : 6E 3A 20 4B 65 65 70 2D 41 6C 69 76 65 0D 0A 48 [n: Keep-Alive..H]
   160 : 6F 73 74 3A 20 65 2E 66 72 65 65 77 65 62 68 6F [ost: e.freewebho]
   170 : 73 74 69 6E 67 61 72 65 61 2E 63 6F 6D 0D 0A 0D [stingarea.com...]
   180 : 0A [.]

Memory Forensics

String	Context	Stream UID
stun.1und1.de	Domain/IP reference	00010884-00003580-56441-4234-00415E42
n0kvoip.orgfree.com/	Domain/IP reference	00010884-00003580-56441-6043-00401EBE
http://www.wapforum.org/dtd/prov.dtd	Domain/IP reference	00010884-00003580-56441-4233-00414111
http://www.w3.org/xml/1998/namespace	Domain/IP reference	00010884-00003580-56441-4028-00409204

Extracted Strings

Download All Memory Strings (20KiB)

!"#$%&'()*+,

Ansi based on Memory/File Scan (n0kVoIP.exe.bin)

!This program cannot be run in DOS mode.$

Ansi based on Memory/File Scan (n0kVoIP.exe.bin)

"http://www.wapforum.org/DTD/prov.dtd">

Ansi based on Hybrid Analysis (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

#FiAqRe<I

Ansi based on Memory/File Scan (n0kVoIP.exe.bin)

$$~1Wx571

Ansi based on Memory/File Scan (n0kVoIP.exe.bin)

%1 has a bad format."%1 contained an unexpected object. %1 contains an incorrect schema.

Unicode based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

&provider=

Ansi based on Hybrid Analysis (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

&provider=CUSTOM|

Ansi based on Hybrid Analysis (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

'(au(mu"@

Ansi based on Memory/File Scan (n0kVoIP.exe.bin)

(nNOTIFY * HTTP/1.1Host:239.255.255.250:1900NT:upnp:rootdeviceNTS:ssdp:byebyeLocation:http://192.168.56.151:2869/upnphost/udhisapi.dll?content=uuid:4f8e1a2d-3fec-4a15-86de-6f8fafe83a56USN:uuid:4f8e1a2d-3fec-4a15-86de-6f8fafe83a56::upnp:rootdeviceCache-Control:max-age=900Server:Microsoft-Windows-NT/5.1 UPnP/1.0 UPnP-Device-Host/1.0OPT:"http://schemas.upnp.org/upnp/1/0/"; ns=0101-NLS:acef2efcb427e8d053aa03e36a4f0fc2

Ansi based on PCAP Processing (network.pcap)

**,GdHfo$,

Ansi based on Memory/File Scan (n0kVoIP.exe.bin)

,,youha,ee_,,en_d,omeaud,o,e,a_dpob,em,w,__epo,,de,,

Ansi based on Image Processing (screen_1.png)

,P-9J.G*+b

Ansi based on Memory/File Scan (n0kVoIP.exe.bin)

- <strong>one click autoinstaller</strong> (free forum, blog): Joomla, phpBB3, SMF, WordPress, Drupal, Mambo;</p>

Ansi based on Dropped File (version)

- account manager - tool to change account details, File Manager (WYSIWYG File Editor, FTP client - browser based, tool to set file permissions, to create directories, to create files, tool for renaming, zip/unzip utility and more).<br>

Ansi based on Dropped File (version)

- Detailed Statistics for Visitor Activity (Hourly Visitors, Pages Visited, Referrers, Keywords, Search Engines, Countries)<br>

Ansi based on Dropped File (version)

- Detailed Statistics for Visitor Technology (Operating Systems, Web Browsers, Screen Resolutions)<br>- Detailed Analysis Of The Last Visitors</span><br>

Ansi based on Dropped File (version)

- domain address has illegal characters

Unicode based on Hybrid Analysis (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

- domain is missing

Unicode based on Hybrid Analysis (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

- noise during the VoIP calls silent periods try to disable VAD and see if it helps

Unicode based on Hybrid Analysis (n0kVoIP.exe , 00010884-00003580.00000001.13126.00400000.00000002.mdmp)

- one way audio, one possible reason could be that remote end is not handling speech codec negotiation in right way. If this is the case its recommended to disable speech codecs that are not supported by remote end

Unicode based on Hybrid Analysis (n0kVoIP.exe , 00010884-00003580.00000001.13126.00400000.00000002.mdmp)

- outbound proxy address has illegal characters

Unicode based on Hybrid Analysis (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

- outbound proxy port must be a value between 1 - 65535

Unicode based on Hybrid Analysis (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

- password is missing

Unicode based on Hybrid Analysis (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

- proxy/registrar address has illegal characters

Unicode based on Hybrid Analysis (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

- proxy/registrar is missing

Unicode based on Hybrid Analysis (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

- registrar port must be a value between 1 - 65535

Unicode based on Hybrid Analysis (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

- stun port must be a value between 1 - 65535

Unicode based on Hybrid Analysis (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

- stun server address has illegal characters

Unicode based on Hybrid Analysis (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

- unlimited accounts/databases allowed (database number per account is limited, but you can create more accounts);</p>

Ansi based on Dropped File (version)

- username is missing

Unicode based on Hybrid Analysis (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

-//WAPFORUM//DTD PROV 1.0//EN

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.?AUCThreadData@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.?AUIAccessible@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.?AUIAccessibleProxy@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.?AUIAtlStringMgr@ATL@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.?AUIDispatch@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.?AUIOleWindow@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.?AUIUnknown@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.?AV?$CComObjectRootEx@VCComSingleThreadModel@ATL@@@ATL@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.?AV?$CMFCComObject@VCAccessibleProxy@ATL@@@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.?AV?$IAccessibleProxyImpl@VCAccessibleProxy@ATL@@@ATL@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.?AV_AFX_BASE_MODULE_STATE@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.?AV_AFX_HTMLHELP_STATE@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.?AV_AFX_THREAD_STATE@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.?AVAFX_MODULE_STATE@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.?AVAFX_MODULE_THREAD_STATE@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.?AVbad_exception@std@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.?AVCAccessibleProxy@ATL@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.?AVCAfxStringMgr@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.?AVCArchiveException@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.?AVCButton@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.?AVCByteArray@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.?AVCCmdTarget@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.?AVCCmdUI@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.?AVCCodecSettings@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.?AVCComboBox@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.?AVCComCtlWrapper@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.?AVCCommDlgWrapper@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.?AVCComObjectRootBase@ATL@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.?AVCDC@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.?AVCDialog@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.?AVCDllIsolationWrapperBase@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.?AVCEdit@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.?AVCException@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.?AVCGdiObject@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.?AVCHandleMap@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.?AVCInit@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.?AVCInvalidArgException@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.?AVCMainDlg@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.?AVCMapPtrToPtr@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.?AVCMemoryException@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.?AVCMenu@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.?AVCNoTrackObject@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.?AVCNotSupportedException@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.?AVCObject@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.?AVCOleException@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.?AVCPaintDC@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.?AVCProgressCtrl@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.?AVCResourceException@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.?AVCSimpleException@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.?AVCTestCmdUI@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.?AVCUserException@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.?AVCVoIPConfApp@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.?AVCWinApp@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.?AVCWinThread@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.?AVCWnd@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.?AVexception@std@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.?AVTab1@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.?AVTab2@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.?AVtype_info@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.?AVXAccessible@CWnd@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.?AVXAccessibleServer@CWnd@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.PAVCArchiveException@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.PAVCException@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.PAVCInvalidArgException@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.PAVCMemoryException@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.PAVCNotSupportedException@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.PAVCObject@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.PAVCOleException@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.PAVCResourceException@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.PAVCSimpleException@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.PAVCUserException@@

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

.tD_t-uB;x|

Ansi based on Memory/File Scan (n0kVoIP.exe.bin)

//version

Ansi based on PCAP Processing (PCAP)

/403.html

Ansi based on PCAP Processing (PCAP)

0.0.0.0"/>

Ansi based on Hybrid Analysis (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

0000000000000000

Ansi based on Hybrid Analysis (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

0000100000000000

Ansi based on Hybrid Analysis (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

0001100000000000

Ansi based on Hybrid Analysis (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

0001100000100000

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

0001200000000000

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

0002345678100000

Ansi based on Hybrid Analysis (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

00060101.00060101

Unicode based on Runtime Data (n0kVoIP.exe )

007voip.com

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

0103456789200000

Ansi based on Hybrid Analysis (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

02131.sip.arcor.de

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

0?0______0

Ansi based on Image Processing (screen_1.png)

0Ox0(wHcB

Ansi based on Memory/File Scan (n0kVoIP.exe.bin)

1001100001100000

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

1001111111000000

Ansi based on Hybrid Analysis (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

1001111111100000

Ansi based on Hybrid Analysis (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

1101100001100000

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

1101111111000000

Ansi based on Hybrid Analysis (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

1101111111011100

Ansi based on Hybrid Analysis (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

1101111111100000

Ansi based on Hybrid Analysis (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

1101111111111100

Ansi based on Hybrid Analysis (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

1204589:;<306700

Ansi based on Hybrid Analysis (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

123.30.69.4

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

12Connect

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

12connect.com

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

12voip.com

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

16384"/>

Ansi based on Hybrid Analysis (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

1legcall.com

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

1und1.de

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

200.119.223.228

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

2000100004300000

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

2014, 3, 16, 0

Unicode based on Memory/File Scan (n0kVoIP.exe.bin)

202.122.99.60

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

203.113.125.82

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

203.176.131.7

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

203.2.134.1

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

207.218.246.146

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

208 dual-sim

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

208 single-sim

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

212.150.158.100

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

213.175.221.14

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

216.143.130.36

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

23456789:;<=>?@ABC

Ansi based on Memory/File Scan (n0kVoIP.exe.bin)

2cybertel.com:5060

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

2Talk (COM)

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

2Talk (NZ)

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

2talk.co.nz

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

2talk.com

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

3200100005400000

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

33FF">http://www.freewebhostingarea.com</span></a> or short <a href="http://www.freewha.com" style="text-decoration: none"><span style="color: #3333FF">http://www.freewha.com</span></a>.</span><p style="margin: 10px 7px; font-family: Verdana, Geneva, Tahoma, sans-serif; font-size: 14px;"><strong><a href="http://www.freewebhostingarea.com" style="color: #3333FF">Free Short Subdomain</a></strong><span style="font-size: 14px">: <strong>yourname.6te.net</strong> or <strong>yourname.eu5.org</strong> or <strong>yourname.xp3.biz</strong> or<strong>yourname.orgfree.com</strong> or <strong>yourname.ueuo.com</strong> and more - <a href="http://www.freewebhostingarea.com"><strong style="color: #3333FF">Free Hosting</strong></a> for already registered domains</span><p style="margin: 10px 7px; font-family: Verdana, Geneva, Tahoma, sans-serif; font-size: 14px;"><span style="color: #FF0000; font-size: 13px"><strong>!!! Most likely this account was terminated for <a href="http://www.freewebhostingarea.com/agreement.html"><span style="color: #FF0000">terms</span></a> infringement or account is new and index is missing.</strong></span><span style="font-size: 13px"> <strong><a href="http://www.freewebhostingarea.com/contact/"><span style="color: #000000">Contact us</span></a></strong> if you want more details about this problem.</span></td></tr><tr><td style="background-color: #F1F1F1; height: 110px;" colspan="2"><p style="tex

Ansi based on PCAP Processing (network.pcap)

3netaccess

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

3StarsNet

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

3starsnet.com

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

4 vBv9g_X

Ansi based on Memory/File Scan (n0kVoIP.exe.bin)

515 dual-sim

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

515 single-sim

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

62.80.200.53

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

6260 slide

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

732766MEDIAQO8Q

Ansi based on Memory/File Scan (n0kVoIP.exe.bin)

74.222.2.21

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

77.72.174.129

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

77.72.174.160

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

79.134.121.233

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

7libship\atl

Ansi based on Memory/File Scan (n0kVoIP.exe.bin)

7p`9Q\t'QU

Ansi based on Memory/File Scan (n0kVoIP.exe.bin)

81.89.194.16

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

81.95.148.12

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

83.138.185.146

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

84.45.70.14

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

85.119.188.3

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

85.13.205.218

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

85.204.232.10

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

85.90.225.100

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

9 84CMx}R

Ansi based on Memory/File Scan (n0kVoIP.exe.bin)

91.121.19.149

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

91.191.210.5

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

95.154.218.39

Ansi based on Memory/File Scan (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

: center;"><p style="text-align: center; margin-top: 0; margin-bottom: 0;"><script type='text/javascript' src='http://user99.freewebhostingarea.com/a/spot2e3xx.js'></script></p></td></tr><tr><td style="background-color: #FFFFFF;" colspan="2"><p style="font-family: Verdana, Geneva, Tahoma, sans-serif; font-size: 13px; margin: 5px 7px 0px 0px"><img src="http://www.freewebhostingarea.com/images/database.png" alt="" style="float: left; height: 48px; width: 48px; border-style: solid; border-width: 8px; border-color: #FFFFFF">- <strong>free MySQL 5 database</strong> (latest stable 5.5 version);<br>- <strong>phpMyAdmin</strong> preinstalled; one click database backup; one click database import;<br>- unlimited accounts/databases allowed (database number per account is limited, but you can create more accounts);</p><p style="font-family: Verdana, Geneva, Tahoma, sans-serif; font-size: 13px; margin: 0px 7px 0px 0px"><img src="http://www.freewebhostingarea.com/images/users.png" alt="" style="float: left; height: 48px; width: 48px; border-style: solid; border-width: 8px; border-color: #FFFFFF">- account manager - tool to change account details, File Manager (WYSIWYG File Editor, FTP client - browser based, tool to set file permissions, to create directories, to create files, tool for renaming, zip/unzip utility and more).<br>- <strong>one click autoinstaller</strong> (free forum, blog): Joomla, phpBB3, SMF, WordPress, Drupal,

Ansi based on PCAP Processing (network.pcap)

<!DOCTYPE html>

Ansi based on Dropped File (version)

<!DOCTYPE html><html lang="en"><head><title>Error - Forbidden</title><meta content="text/html; charset=utf-8" http-equiv="Content-Type"><meta name="description" content="Free Web Hosting Area provides unmetered traffic and free web space for domain or subdomain with php, mail, mysql, ftp support, no ads"><meta name="keywords" content="free web hosting, free hosting, free web space, free php hosting, free mysql database, no ads"><base target="_blank"><script type="text/javascript">if (top.location != location) { top.location.href = location.href; }</script></head><body><table style="width: 800px; border: 2px solid #97C8E4; margin-left: auto; margin-right: auto;"><tr><td style="height: 2px; background-image: url('http://www.freewebhostingarea.com/images/border.gif'); background-color: #97C8E4;" colspan="2"></td></tr><tr><td style="background-color: #FFFFFF" colspan="2"><p style="margin: 10px 7px; font-family: Verdana, Geneva, Tahoma, sans-serif; font-size: 14px;">Welcome to <strong>Free Web Hosting Area</strong>!!<br><span style="font-size: 12px">Create your free account NOW at <a href="http://www.freewebhostingarea.com" style="text-decoration: none"><span style="color: #33

Ansi based on PCAP Processing (network.pcap)

<!DOCTYPE wap-provisioningdoc PUBLIC "-//WAPFORUM//DTD PROV 1.0//EN"

Ansi based on Hybrid Analysis (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

</characteristic>

Ansi based on Hybrid Analysis (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

</table>

Ansi based on Dropped File (version)

</td></tr>

Ansi based on Dropped File (version)

</wap-provisioningdoc>

Ansi based on Hybrid Analysis (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

<;2s[S;7|G

Ansi based on Memory/File Scan (n0kVoIP.exe.bin)

<?xml version="1.0"?>

Ansi based on Hybrid Analysis (n0kVoIP.exe , 00010884-00003580.00000001.13126.00401000.00000040.mdmp)

Ansi based on Dropped File (version)

<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"></assembly>PA

Ansi based on Memory/File Scan (n0kVoIP.exe.bin)

<at9<rt,<wt