Malware Analysis Report

2025-01-02 15:04

Sample ID 201026-cmeqlbq3s2
Target dcadc504c887859715283b1ae4077d5e
SHA256 721b2b38e67387f73ebad1c347c8190d222034cbf6527bcfe9053dde8fcdd3cc
Tags
ransomware cerber
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

721b2b38e67387f73ebad1c347c8190d222034cbf6527bcfe9053dde8fcdd3cc

Threat Level: Known bad

The file dcadc504c887859715283b1ae4077d5e was found to be: Known bad.

Malicious Activity Summary

ransomware cerber

Cerber

Blacklisted process makes network request

Drops startup file

Loads dropped DLL

Deletes itself

Suspicious use of SetThreadContext

Sets desktop wallpaper using registry

Drops file in Windows directory

Drops file in Program Files directory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Modifies registry class

Kills process with taskkill

Runs ping.exe

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2020-10-26 08:02

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2020-10-26 08:02

Reported

2020-10-26 08:11

Platform

win7

Max time kernel

143s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe"

Signatures

Cerber

ransomware cerber

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp65B5.bmp" C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 108 set thread context of 1280 N/A C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification \??\c:\program files (x86)\microsoft\office C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\powerpoint C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe N/A
File opened for modification \??\c:\program files (x86)\onenote C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe N/A
File opened for modification \??\c:\program files (x86)\outlook C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe N/A
File opened for modification \??\c:\program files (x86)\thunderbird C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe N/A
File opened for modification \??\c:\program files (x86)\bitcoin C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft sql server C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\excel C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\onenote C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe N/A
File opened for modification \??\c:\program files (x86)\office C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe N/A
File opened for modification \??\c:\program files (x86)\the bat! C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe N/A
File opened for modification \??\c:\program files (x86)\word C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe N/A
File opened for modification \??\c:\program files\ C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe N/A
File opened for modification \??\c:\program files (x86)\ C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\microsoft sql server C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\outlook C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe N/A
File opened for modification \??\c:\program files (x86)\steam C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe N/A
File opened for modification \??\c:\program files (x86)\excel C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\word C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe N/A
File opened for modification \??\c:\program files (x86)\powerpoint C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification \??\c:\windows\ C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\taskkill.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\DllHost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 108 wrote to memory of 1280 N/A C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe
PID 108 wrote to memory of 1280 N/A C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe
PID 108 wrote to memory of 1280 N/A C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe
PID 108 wrote to memory of 1280 N/A C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe
PID 108 wrote to memory of 1280 N/A C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe
PID 1280 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe C:\Windows\SysWOW64\mshta.exe
PID 1280 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe C:\Windows\SysWOW64\mshta.exe
PID 1280 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe C:\Windows\SysWOW64\mshta.exe
PID 1280 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe C:\Windows\SysWOW64\mshta.exe
PID 1280 wrote to memory of 1572 N/A C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe C:\Windows\system32\cmd.exe
PID 1280 wrote to memory of 1572 N/A C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe C:\Windows\system32\cmd.exe
PID 1280 wrote to memory of 1572 N/A C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe C:\Windows\system32\cmd.exe
PID 1280 wrote to memory of 1572 N/A C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe C:\Windows\system32\cmd.exe
PID 1572 wrote to memory of 1496 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1572 wrote to memory of 1496 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1572 wrote to memory of 1496 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1572 wrote to memory of 1260 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\PING.EXE
PID 1572 wrote to memory of 1260 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\PING.EXE
PID 1572 wrote to memory of 1260 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\PING.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe

"C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe"

C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe

"C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe"

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_HELP_HELP_HELP_6OU0FY.hta"

C:\Windows\SysWOW64\DllHost.exe

C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}

C:\Windows\SysWOW64\DllHost.exe

C:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\taskkill.exe

taskkill /f /im "dcadc504c887859715283b1ae4077d5e.exe"

C:\Windows\system32\PING.EXE

ping -n 1 127.0.0.1

Network

Country Destination Domain Proto
N/A 90.2.1.0:6892 udp
N/A 90.2.1.1:6892 udp
N/A 90.2.1.2:6892 udp
N/A 90.2.1.3:6892 udp
N/A 90.2.1.4:6892 udp
N/A 90.2.1.5:6892 udp
N/A 90.2.1.6:6892 udp
N/A 90.2.1.7:6892 udp
N/A 90.2.1.8:6892 udp
N/A 90.2.1.9:6892 udp
N/A 90.2.1.10:6892 udp
N/A 90.2.1.11:6892 udp
N/A 90.2.1.12:6892 udp
N/A 90.2.1.13:6892 udp
N/A 90.2.1.14:6892 udp
N/A 90.2.1.15:6892 udp
N/A 90.2.1.16:6892 udp
N/A 90.2.1.17:6892 udp
N/A 90.2.1.18:6892 udp
N/A 90.2.1.19:6892 udp
N/A 90.2.1.20:6892 udp
N/A 90.2.1.21:6892 udp
N/A 90.2.1.22:6892 udp
N/A 90.2.1.23:6892 udp
N/A 90.2.1.24:6892 udp
N/A 90.2.1.25:6892 udp
N/A 90.2.1.26:6892 udp
N/A 90.2.1.27:6892 udp
N/A 90.2.1.28:6892 udp
N/A 90.2.1.29:6892 udp
N/A 90.2.1.30:6892 udp
N/A 90.2.1.31:6892 udp
N/A 90.3.1.0:6892 udp
N/A 90.3.1.1:6892 udp
N/A 90.3.1.2:6892 udp
N/A 90.3.1.3:6892 udp
N/A 90.3.1.4:6892 udp
N/A 90.3.1.5:6892 udp
N/A 90.3.1.6:6892 udp
N/A 90.3.1.7:6892 udp
N/A 90.3.1.8:6892 udp
N/A 90.3.1.9:6892 udp
N/A 90.3.1.10:6892 udp
N/A 90.3.1.11:6892 udp
N/A 90.3.1.12:6892 udp
N/A 90.3.1.13:6892 udp
N/A 90.3.1.14:6892 udp
N/A 90.3.1.15:6892 udp
N/A 90.3.1.16:6892 udp
N/A 90.3.1.17:6892 udp
N/A 90.3.1.18:6892 udp
N/A 90.3.1.19:6892 udp
N/A 90.3.1.20:6892 udp
N/A 90.3.1.21:6892 udp
N/A 90.3.1.22:6892 udp
N/A 90.3.1.23:6892 udp
N/A 90.3.1.24:6892 udp
N/A 90.3.1.25:6892 udp
N/A 90.3.1.26:6892 udp
N/A 90.3.1.27:6892 udp
N/A 90.3.1.28:6892 udp
N/A 90.3.1.29:6892 udp
N/A 90.3.1.30:6892 udp
N/A 90.3.1.31:6892 udp
N/A 91.239.24.0:6892 udp
N/A 91.239.24.1:6892 udp
N/A 91.239.24.2:6892 udp
N/A 91.239.24.3:6892 udp
N/A 91.239.24.4:6892 udp
N/A 91.239.24.5:6892 udp
N/A 91.239.24.6:6892 udp
N/A 91.239.24.7:6892 udp
N/A 91.239.24.8:6892 udp
N/A 91.239.24.9:6892 udp
N/A 91.239.24.10:6892 udp
N/A 91.239.24.11:6892 udp
N/A 91.239.24.12:6892 udp
N/A 91.239.24.13:6892 udp
N/A 91.239.24.14:6892 udp
N/A 91.239.24.15:6892 udp
N/A 91.239.24.16:6892 udp
N/A 91.239.24.17:6892 udp
N/A 91.239.24.18:6892 udp
N/A 91.239.24.19:6892 udp
N/A 91.239.24.20:6892 udp
N/A 91.239.24.21:6892 udp
N/A 91.239.24.22:6892 udp
N/A 91.239.24.23:6892 udp
N/A 91.239.24.24:6892 udp
N/A 91.239.24.25:6892 udp
N/A 91.239.24.26:6892 udp
N/A 91.239.24.27:6892 udp
N/A 91.239.24.28:6892 udp
N/A 91.239.24.29:6892 udp
N/A 91.239.24.30:6892 udp
N/A 91.239.24.31:6892 udp
N/A 91.239.24.32:6892 udp
N/A 91.239.24.33:6892 udp
N/A 91.239.24.34:6892 udp
N/A 91.239.24.35:6892 udp
N/A 91.239.24.36:6892 udp
N/A 91.239.24.37:6892 udp
N/A 91.239.24.38:6892 udp
N/A 91.239.24.39:6892 udp
N/A 91.239.24.40:6892 udp
N/A 91.239.24.41:6892 udp
N/A 91.239.24.42:6892 udp
N/A 91.239.24.43:6892 udp
N/A 91.239.24.44:6892 udp
N/A 91.239.24.45:6892 udp
N/A 91.239.24.46:6892 udp
N/A 91.239.24.47:6892 udp
N/A 91.239.24.48:6892 udp
N/A 91.239.24.49:6892 udp
N/A 91.239.24.50:6892 udp
N/A 91.239.24.51:6892 udp
N/A 91.239.24.52:6892 udp
N/A 91.239.24.53:6892 udp
N/A 91.239.24.54:6892 udp
N/A 91.239.24.55:6892 udp
N/A 91.239.24.56:6892 udp
N/A 91.239.24.57:6892 udp
N/A 91.239.24.58:6892 udp
N/A 91.239.24.59:6892 udp
N/A 91.239.24.60:6892 udp
N/A 91.239.24.61:6892 udp
N/A 91.239.24.62:6892 udp
N/A 91.239.24.63:6892 udp
N/A 91.239.24.64:6892 udp
N/A 91.239.24.65:6892 udp
N/A 91.239.24.66:6892 udp
N/A 91.239.24.67:6892 udp
N/A 91.239.24.68:6892 udp
N/A 91.239.24.69:6892 udp
N/A 91.239.24.70:6892 udp
N/A 91.239.24.71:6892 udp
N/A 91.239.24.72:6892 udp
N/A 91.239.24.73:6892 udp
N/A 91.239.24.74:6892 udp
N/A 91.239.24.75:6892 udp
N/A 91.239.24.76:6892 udp
N/A 91.239.24.77:6892 udp
N/A 91.239.24.78:6892 udp
N/A 91.239.24.79:6892 udp
N/A 91.239.24.80:6892 udp
N/A 91.239.24.81:6892 udp
N/A 91.239.24.82:6892 udp
N/A 91.239.24.83:6892 udp
N/A 91.239.24.84:6892 udp
N/A 91.239.24.85:6892 udp
N/A 91.239.24.86:6892 udp
N/A 91.239.24.87:6892 udp
N/A 91.239.24.88:6892 udp
N/A 91.239.24.89:6892 udp
N/A 91.239.24.90:6892 udp
N/A 91.239.24.91:6892 udp
N/A 91.239.24.92:6892 udp
N/A 91.239.24.93:6892 udp
N/A 91.239.24.94:6892 udp
N/A 91.239.24.95:6892 udp
N/A 91.239.24.96:6892 udp
N/A 91.239.24.97:6892 udp
N/A 91.239.24.98:6892 udp
N/A 91.239.24.99:6892 udp
N/A 91.239.24.100:6892 udp
N/A 91.239.24.101:6892 udp
N/A 91.239.24.102:6892 udp
N/A 91.239.24.103:6892 udp
N/A 91.239.24.104:6892 udp
N/A 91.239.24.105:6892 udp
N/A 91.239.24.106:6892 udp
N/A 91.239.24.107:6892 udp
N/A 91.239.24.108:6892 udp
N/A 91.239.24.109:6892 udp
N/A 91.239.24.110:6892 udp
N/A 91.239.24.111:6892 udp
N/A 91.239.24.112:6892 udp
N/A 91.239.24.113:6892 udp
N/A 91.239.24.114:6892 udp
N/A 91.239.24.115:6892 udp
N/A 91.239.24.116:6892 udp
N/A 91.239.24.117:6892 udp
N/A 91.239.24.118:6892 udp
N/A 91.239.24.119:6892 udp
N/A 91.239.24.120:6892 udp
N/A 91.239.24.121:6892 udp
N/A 91.239.24.122:6892 udp
N/A 91.239.24.123:6892 udp
N/A 91.239.24.124:6892 udp
N/A 91.239.24.125:6892 udp
N/A 91.239.24.126:6892 udp
N/A 91.239.24.127:6892 udp
N/A 91.239.24.128:6892 udp
N/A 91.239.24.129:6892 udp
N/A 91.239.24.130:6892 udp
N/A 91.239.24.131:6892 udp
N/A 91.239.24.132:6892 udp
N/A 91.239.24.133:6892 udp
N/A 91.239.24.134:6892 udp
N/A 91.239.24.135:6892 udp
N/A 91.239.24.136:6892 udp
N/A 91.239.24.137:6892 udp
N/A 91.239.24.138:6892 udp
N/A 91.239.24.139:6892 udp
N/A 91.239.24.140:6892 udp
N/A 91.239.24.141:6892 udp
N/A 91.239.24.142:6892 udp
N/A 91.239.24.143:6892 udp
N/A 91.239.24.144:6892 udp
N/A 91.239.24.145:6892 udp
N/A 91.239.24.146:6892 udp
N/A 91.239.24.147:6892 udp
N/A 91.239.24.148:6892 udp
N/A 91.239.24.149:6892 udp
N/A 91.239.24.150:6892 udp
N/A 91.239.24.151:6892 udp
N/A 91.239.24.152:6892 udp
N/A 91.239.24.153:6892 udp
N/A 91.239.24.154:6892 udp
N/A 91.239.24.155:6892 udp
N/A 91.239.24.156:6892 udp
N/A 91.239.24.157:6892 udp
N/A 91.239.24.158:6892 udp
N/A 91.239.24.159:6892 udp
N/A 91.239.24.160:6892 udp
N/A 91.239.24.161:6892 udp
N/A 91.239.24.162:6892 udp
N/A 91.239.24.163:6892 udp
N/A 91.239.24.164:6892 udp
N/A 91.239.24.165:6892 udp
N/A 91.239.24.166:6892 udp
N/A 91.239.24.167:6892 udp
N/A 91.239.24.168:6892 udp
N/A 91.239.24.169:6892 udp
N/A 91.239.24.170:6892 udp
N/A 91.239.24.171:6892 udp
N/A 91.239.24.172:6892 udp
N/A 91.239.24.173:6892 udp
N/A 91.239.24.174:6892 udp
N/A 91.239.24.175:6892 udp
N/A 91.239.24.176:6892 udp
N/A 91.239.24.177:6892 udp
N/A 91.239.24.178:6892 udp
N/A 91.239.24.179:6892 udp
N/A 91.239.24.180:6892 udp
N/A 91.239.24.181:6892 udp
N/A 91.239.24.182:6892 udp
N/A 91.239.24.183:6892 udp
N/A 91.239.24.184:6892 udp
N/A 91.239.24.185:6892 udp
N/A 91.239.24.186:6892 udp
N/A 91.239.24.187:6892 udp
N/A 91.239.24.188:6892 udp
N/A 91.239.24.189:6892 udp
N/A 91.239.24.190:6892 udp
N/A 91.239.24.191:6892 udp
N/A 91.239.24.192:6892 udp
N/A 91.239.24.193:6892 udp
N/A 91.239.24.194:6892 udp
N/A 91.239.24.195:6892 udp
N/A 91.239.24.196:6892 udp
N/A 91.239.24.197:6892 udp
N/A 91.239.24.198:6892 udp
N/A 91.239.24.199:6892 udp
N/A 91.239.24.200:6892 udp
N/A 91.239.24.201:6892 udp
N/A 91.239.24.202:6892 udp
N/A 91.239.24.203:6892 udp
N/A 91.239.24.204:6892 udp
N/A 91.239.24.205:6892 udp
N/A 91.239.24.206:6892 udp
N/A 91.239.24.207:6892 udp
N/A 91.239.24.208:6892 udp
N/A 91.239.24.209:6892 udp
N/A 91.239.24.210:6892 udp
N/A 91.239.24.211:6892 udp
N/A 91.239.24.212:6892 udp
N/A 91.239.24.213:6892 udp
N/A 91.239.24.214:6892 udp
N/A 91.239.24.215:6892 udp
N/A 91.239.24.216:6892 udp
N/A 91.239.24.217:6892 udp
N/A 91.239.24.218:6892 udp
N/A 91.239.24.219:6892 udp
N/A 91.239.24.220:6892 udp
N/A 91.239.24.221:6892 udp
N/A 91.239.24.222:6892 udp
N/A 91.239.24.223:6892 udp
N/A 91.239.24.224:6892 udp
N/A 91.239.24.225:6892 udp
N/A 91.239.24.226:6892 udp
N/A 91.239.24.227:6892 udp
N/A 91.239.24.228:6892 udp
N/A 91.239.24.229:6892 udp
N/A 91.239.24.230:6892 udp
N/A 91.239.24.231:6892 udp
N/A 91.239.24.232:6892 udp
N/A 91.239.24.233:6892 udp
N/A 91.239.24.234:6892 udp
N/A 91.239.24.235:6892 udp
N/A 91.239.24.236:6892 udp
N/A 91.239.24.237:6892 udp
N/A 91.239.24.238:6892 udp
N/A 91.239.24.239:6892 udp
N/A 91.239.24.240:6892 udp
N/A 91.239.24.241:6892 udp
N/A 91.239.24.242:6892 udp
N/A 91.239.24.243:6892 udp
N/A 91.239.24.244:6892 udp
N/A 91.239.24.245:6892 udp
N/A 91.239.24.246:6892 udp
N/A 91.239.24.247:6892 udp
N/A 91.239.24.248:6892 udp
N/A 91.239.24.249:6892 udp
N/A 91.239.24.250:6892 udp
N/A 91.239.24.251:6892 udp
N/A 91.239.24.252:6892 udp
N/A 91.239.24.253:6892 udp
N/A 91.239.24.254:6892 udp
N/A 91.239.24.255:6892 udp
N/A 91.239.25.0:6892 udp
N/A 91.239.25.1:6892 udp
N/A 91.239.25.2:6892 udp
N/A 91.239.25.3:6892 udp
N/A 91.239.25.4:6892 udp
N/A 91.239.25.5:6892 udp
N/A 91.239.25.6:6892 udp
N/A 91.239.25.7:6892 udp
N/A 91.239.25.8:6892 udp
N/A 91.239.25.9:6892 udp
N/A 91.239.25.10:6892 udp
N/A 91.239.25.11:6892 udp
N/A 91.239.25.12:6892 udp
N/A 91.239.25.13:6892 udp
N/A 91.239.25.14:6892 udp
N/A 91.239.25.15:6892 udp
N/A 91.239.25.16:6892 udp
N/A 91.239.25.17:6892 udp
N/A 91.239.25.18:6892 udp
N/A 91.239.25.19:6892 udp
N/A 91.239.25.20:6892 udp
N/A 91.239.25.21:6892 udp
N/A 91.239.25.22:6892 udp
N/A 91.239.25.23:6892 udp
N/A 91.239.25.24:6892 udp
N/A 91.239.25.25:6892 udp
N/A 91.239.25.26:6892 udp
N/A 91.239.25.27:6892 udp
N/A 91.239.25.28:6892 udp
N/A 91.239.25.29:6892 udp
N/A 91.239.25.30:6892 udp
N/A 91.239.25.31:6892 udp
N/A 91.239.25.32:6892 udp
N/A 91.239.25.33:6892 udp
N/A 91.239.25.34:6892 udp
N/A 91.239.25.35:6892 udp
N/A 91.239.25.36:6892 udp
N/A 91.239.25.37:6892 udp
N/A 91.239.25.38:6892 udp
N/A 91.239.25.39:6892 udp
N/A 91.239.25.40:6892 udp
N/A 91.239.25.41:6892 udp
N/A 91.239.25.42:6892 udp
N/A 91.239.25.43:6892 udp
N/A 91.239.25.44:6892 udp
N/A 91.239.25.45:6892 udp
N/A 91.239.25.46:6892 udp
N/A 91.239.25.47:6892 udp
N/A 91.239.25.48:6892 udp
N/A 91.239.25.49:6892 udp
N/A 91.239.25.50:6892 udp
N/A 91.239.25.51:6892 udp
N/A 91.239.25.52:6892 udp
N/A 91.239.25.53:6892 udp
N/A 91.239.25.54:6892 udp
N/A 91.239.25.55:6892 udp
N/A 91.239.25.56:6892 udp
N/A 91.239.25.57:6892 udp
N/A 91.239.25.58:6892 udp
N/A 91.239.25.59:6892 udp
N/A 91.239.25.60:6892 udp
N/A 91.239.25.61:6892 udp
N/A 91.239.25.62:6892 udp
N/A 91.239.25.63:6892 udp
N/A 91.239.25.64:6892 udp
N/A 91.239.25.65:6892 udp
N/A 91.239.25.66:6892 udp
N/A 91.239.25.67:6892 udp
N/A 91.239.25.68:6892 udp
N/A 91.239.25.69:6892 udp
N/A 91.239.25.70:6892 udp
N/A 91.239.25.71:6892 udp
N/A 91.239.25.72:6892 udp
N/A 91.239.25.73:6892 udp
N/A 91.239.25.74:6892 udp
N/A 91.239.25.75:6892 udp
N/A 91.239.25.76:6892 udp
N/A 91.239.25.77:6892 udp
N/A 91.239.25.78:6892 udp
N/A 91.239.25.79:6892 udp
N/A 91.239.25.80:6892 udp
N/A 91.239.25.81:6892 udp
N/A 91.239.25.82:6892 udp
N/A 91.239.25.83:6892 udp
N/A 91.239.25.84:6892 udp
N/A 91.239.25.85:6892 udp
N/A 91.239.25.86:6892 udp
N/A 91.239.25.87:6892 udp
N/A 91.239.25.88:6892 udp
N/A 91.239.25.89:6892 udp
N/A 91.239.25.90:6892 udp
N/A 91.239.25.91:6892 udp
N/A 91.239.25.92:6892 udp
N/A 91.239.25.93:6892 udp
N/A 91.239.25.94:6892 udp
N/A 91.239.25.95:6892 udp
N/A 91.239.25.96:6892 udp
N/A 91.239.25.97:6892 udp
N/A 91.239.25.98:6892 udp
N/A 91.239.25.99:6892 udp
N/A 91.239.25.100:6892 udp
N/A 91.239.25.101:6892 udp
N/A 91.239.25.102:6892 udp
N/A 91.239.25.103:6892 udp
N/A 91.239.25.104:6892 udp
N/A 91.239.25.105:6892 udp
N/A 91.239.25.106:6892 udp
N/A 91.239.25.107:6892 udp
N/A 91.239.25.108:6892 udp
N/A 91.239.25.109:6892 udp
N/A 91.239.25.110:6892 udp
N/A 91.239.25.111:6892 udp
N/A 91.239.25.112:6892 udp
N/A 91.239.25.113:6892 udp
N/A 91.239.25.114:6892 udp
N/A 91.239.25.115:6892 udp
N/A 91.239.25.116:6892 udp
N/A 91.239.25.117:6892 udp
N/A 91.239.25.118:6892 udp
N/A 91.239.25.119:6892 udp
N/A 91.239.25.120:6892 udp
N/A 91.239.25.121:6892 udp
N/A 91.239.25.122:6892 udp
N/A 91.239.25.123:6892 udp
N/A 91.239.25.124:6892 udp
N/A 91.239.25.125:6892 udp
N/A 91.239.25.126:6892 udp
N/A 91.239.25.127:6892 udp
N/A 91.239.25.128:6892 udp
N/A 91.239.25.129:6892 udp
N/A 91.239.25.130:6892 udp
N/A 91.239.25.131:6892 udp
N/A 91.239.25.132:6892 udp
N/A 91.239.25.133:6892 udp
N/A 91.239.25.134:6892 udp
N/A 91.239.25.135:6892 udp
N/A 91.239.25.136:6892 udp
N/A 91.239.25.137:6892 udp
N/A 91.239.25.138:6892 udp
N/A 91.239.25.139:6892 udp
N/A 91.239.25.140:6892 udp
N/A 91.239.25.141:6892 udp
N/A 91.239.25.142:6892 udp
N/A 91.239.25.143:6892 udp
N/A 91.239.25.144:6892 udp
N/A 91.239.25.145:6892 udp
N/A 91.239.25.146:6892 udp
N/A 91.239.25.147:6892 udp
N/A 91.239.25.148:6892 udp
N/A 91.239.25.149:6892 udp
N/A 91.239.25.150:6892 udp
N/A 91.239.25.151:6892 udp
N/A 91.239.25.152:6892 udp
N/A 91.239.25.153:6892 udp
N/A 91.239.25.154:6892 udp
N/A 91.239.25.155:6892 udp
N/A 91.239.25.156:6892 udp
N/A 91.239.25.157:6892 udp
N/A 91.239.25.158:6892 udp
N/A 91.239.25.159:6892 udp
N/A 91.239.25.160:6892 udp
N/A 91.239.25.161:6892 udp
N/A 91.239.25.162:6892 udp
N/A 91.239.25.163:6892 udp
N/A 91.239.25.164:6892 udp
N/A 91.239.25.165:6892 udp
N/A 91.239.25.166:6892 udp
N/A 91.239.25.167:6892 udp
N/A 91.239.25.168:6892 udp
N/A 91.239.25.169:6892 udp
N/A 91.239.25.170:6892 udp
N/A 91.239.25.171:6892 udp
N/A 91.239.25.172:6892 udp
N/A 91.239.25.173:6892 udp
N/A 91.239.25.174:6892 udp
N/A 91.239.25.175:6892 udp
N/A 91.239.25.176:6892 udp
N/A 91.239.25.177:6892 udp
N/A 91.239.25.178:6892 udp
N/A 91.239.25.179:6892 udp
N/A 91.239.25.180:6892 udp
N/A 91.239.25.181:6892 udp
N/A 91.239.25.182:6892 udp
N/A 91.239.25.183:6892 udp
N/A 91.239.25.184:6892 udp
N/A 91.239.25.185:6892 udp
N/A 91.239.25.186:6892 udp
N/A 91.239.25.187:6892 udp
N/A 91.239.25.188:6892 udp
N/A 91.239.25.189:6892 udp
N/A 91.239.25.190:6892 udp
N/A 91.239.25.191:6892 udp
N/A 91.239.25.192:6892 udp
N/A 91.239.25.193:6892 udp
N/A 91.239.25.194:6892 udp
N/A 91.239.25.195:6892 udp
N/A 91.239.25.196:6892 udp
N/A 91.239.25.197:6892 udp
N/A 91.239.25.198:6892 udp
N/A 91.239.25.199:6892 udp
N/A 91.239.25.200:6892 udp
N/A 91.239.25.201:6892 udp
N/A 91.239.25.202:6892 udp
N/A 91.239.25.203:6892 udp
N/A 91.239.25.204:6892 udp
N/A 91.239.25.205:6892 udp
N/A 91.239.25.206:6892 udp
N/A 91.239.25.207:6892 udp
N/A 91.239.25.208:6892 udp
N/A 91.239.25.209:6892 udp
N/A 91.239.25.210:6892 udp
N/A 91.239.25.211:6892 udp
N/A 91.239.25.212:6892 udp
N/A 91.239.25.213:6892 udp
N/A 91.239.25.214:6892 udp
N/A 91.239.25.215:6892 udp
N/A 91.239.25.216:6892 udp
N/A 91.239.25.217:6892 udp
N/A 91.239.25.218:6892 udp
N/A 91.239.25.219:6892 udp
N/A 91.239.25.220:6892 udp
N/A 91.239.25.221:6892 udp
N/A 91.239.25.222:6892 udp
N/A 91.239.25.223:6892 udp
N/A 91.239.25.224:6892 udp
N/A 91.239.25.225:6892 udp
N/A 91.239.25.226:6892 udp
N/A 91.239.25.227:6892 udp
N/A 91.239.25.228:6892 udp
N/A 91.239.25.229:6892 udp
N/A 91.239.25.230:6892 udp
N/A 91.239.25.231:6892 udp
N/A 91.239.25.232:6892 udp
N/A 91.239.25.233:6892 udp
N/A 91.239.25.234:6892 udp
N/A 91.239.25.235:6892 udp
N/A 91.239.25.236:6892 udp
N/A 91.239.25.237:6892 udp
N/A 91.239.25.238:6892 udp
N/A 91.239.25.239:6892 udp
N/A 91.239.25.240:6892 udp
N/A 91.239.25.241:6892 udp
N/A 91.239.25.242:6892 udp
N/A 91.239.25.243:6892 udp
N/A 91.239.25.244:6892 udp
N/A 91.239.25.245:6892 udp
N/A 91.239.25.246:6892 udp
N/A 91.239.25.247:6892 udp
N/A 91.239.25.248:6892 udp
N/A 91.239.25.249:6892 udp
N/A 91.239.25.250:6892 udp
N/A 91.239.25.251:6892 udp
N/A 91.239.25.252:6892 udp
N/A 91.239.25.253:6892 udp
N/A 91.239.25.254:6892 udp
N/A 91.239.25.255:6892 udp
N/A 90.2.1.0:6892 udp
N/A 90.2.1.1:6892 udp
N/A 90.2.1.2:6892 udp
N/A 90.2.1.3:6892 udp
N/A 90.2.1.4:6892 udp
N/A 90.2.1.5:6892 udp
N/A 90.2.1.6:6892 udp
N/A 90.2.1.7:6892 udp
N/A 90.2.1.8:6892 udp
N/A 90.2.1.9:6892 udp
N/A 90.2.1.10:6892 udp
N/A 90.2.1.11:6892 udp
N/A 90.2.1.12:6892 udp
N/A 90.2.1.13:6892 udp
N/A 90.2.1.14:6892 udp
N/A 90.2.1.15:6892 udp
N/A 90.2.1.16:6892 udp
N/A 90.2.1.17:6892 udp
N/A 90.2.1.18:6892 udp
N/A 90.2.1.19:6892 udp
N/A 90.2.1.20:6892 udp
N/A 90.2.1.21:6892 udp
N/A 90.2.1.22:6892 udp
N/A 90.2.1.23:6892 udp
N/A 90.2.1.24:6892 udp
N/A 90.2.1.25:6892 udp
N/A 90.2.1.26:6892 udp
N/A 90.2.1.27:6892 udp
N/A 90.2.1.28:6892 udp
N/A 90.2.1.29:6892 udp
N/A 90.2.1.30:6892 udp
N/A 90.2.1.31:6892 udp
N/A 90.3.1.0:6892 udp
N/A 90.3.1.1:6892 udp
N/A 90.3.1.2:6892 udp
N/A 90.3.1.3:6892 udp
N/A 90.3.1.4:6892 udp
N/A 90.3.1.5:6892 udp
N/A 90.3.1.6:6892 udp
N/A 90.3.1.7:6892 udp
N/A 90.3.1.8:6892 udp
N/A 90.3.1.9:6892 udp
N/A 90.3.1.10:6892 udp
N/A 90.3.1.11:6892 udp
N/A 90.3.1.12:6892 udp
N/A 90.3.1.13:6892 udp
N/A 90.3.1.14:6892 udp
N/A 90.3.1.15:6892 udp
N/A 90.3.1.16:6892 udp
N/A 90.3.1.17:6892 udp
N/A 90.3.1.18:6892 udp
N/A 90.3.1.19:6892 udp
N/A 90.3.1.20:6892 udp
N/A 90.3.1.21:6892 udp
N/A 90.3.1.22:6892 udp
N/A 90.3.1.23:6892 udp
N/A 90.3.1.24:6892 udp
N/A 90.3.1.25:6892 udp
N/A 90.3.1.26:6892 udp
N/A 90.3.1.27:6892 udp
N/A 90.3.1.28:6892 udp
N/A 90.3.1.29:6892 udp
N/A 90.3.1.30:6892 udp
N/A 90.3.1.31:6892 udp
N/A 91.239.24.0:6892 udp
N/A 91.239.24.1:6892 udp
N/A 91.239.24.2:6892 udp
N/A 91.239.24.3:6892 udp
N/A 91.239.24.4:6892 udp
N/A 91.239.24.5:6892 udp
N/A 91.239.24.6:6892 udp
N/A 91.239.24.7:6892 udp
N/A 91.239.24.8:6892 udp
N/A 91.239.24.9:6892 udp
N/A 91.239.24.10:6892 udp
N/A 91.239.24.11:6892 udp
N/A 91.239.24.12:6892 udp
N/A 91.239.24.13:6892 udp
N/A 91.239.24.14:6892 udp
N/A 91.239.24.15:6892 udp
N/A 91.239.24.16:6892 udp
N/A 91.239.24.17:6892 udp
N/A 91.239.24.18:6892 udp
N/A 91.239.24.19:6892 udp
N/A 91.239.24.20:6892 udp
N/A 91.239.24.21:6892 udp
N/A 91.239.24.22:6892 udp
N/A 91.239.24.23:6892 udp
N/A 91.239.24.24:6892 udp
N/A 91.239.24.25:6892 udp
N/A 91.239.24.26:6892 udp
N/A 91.239.24.27:6892 udp
N/A 91.239.24.28:6892 udp
N/A 91.239.24.29:6892 udp
N/A 91.239.24.30:6892 udp
N/A 91.239.24.31:6892 udp
N/A 91.239.24.32:6892 udp
N/A 91.239.24.33:6892 udp
N/A 91.239.24.34:6892 udp
N/A 91.239.24.35:6892 udp
N/A 91.239.24.36:6892 udp
N/A 91.239.24.37:6892 udp
N/A 91.239.24.38:6892 udp
N/A 91.239.24.39:6892 udp
N/A 91.239.24.40:6892 udp
N/A 91.239.24.41:6892 udp
N/A 91.239.24.42:6892 udp
N/A 91.239.24.43:6892 udp
N/A 91.239.24.44:6892 udp
N/A 91.239.24.45:6892 udp
N/A 91.239.24.46:6892 udp
N/A 91.239.24.47:6892 udp
N/A 91.239.24.48:6892 udp
N/A 91.239.24.49:6892 udp
N/A 91.239.24.50:6892 udp
N/A 91.239.24.51:6892 udp
N/A 91.239.24.52:6892 udp
N/A 91.239.24.53:6892 udp
N/A 91.239.24.54:6892 udp
N/A 91.239.24.55:6892 udp
N/A 91.239.24.56:6892 udp
N/A 91.239.24.57:6892 udp
N/A 91.239.24.58:6892 udp
N/A 91.239.24.59:6892 udp
N/A 91.239.24.60:6892 udp
N/A 91.239.24.61:6892 udp
N/A 91.239.24.62:6892 udp
N/A 91.239.24.63:6892 udp
N/A 91.239.24.64:6892 udp
N/A 91.239.24.65:6892 udp
N/A 91.239.24.66:6892 udp
N/A 91.239.24.67:6892 udp
N/A 91.239.24.68:6892 udp
N/A 91.239.24.69:6892 udp
N/A 91.239.24.70:6892 udp
N/A 91.239.24.71:6892 udp
N/A 91.239.24.72:6892 udp
N/A 91.239.24.73:6892 udp
N/A 91.239.24.74:6892 udp
N/A 91.239.24.75:6892 udp
N/A 91.239.24.76:6892 udp
N/A 91.239.24.77:6892 udp
N/A 91.239.24.78:6892 udp
N/A 91.239.24.79:6892 udp
N/A 91.239.24.80:6892 udp
N/A 91.239.24.81:6892 udp
N/A 91.239.24.82:6892 udp
N/A 91.239.24.83:6892 udp
N/A 91.239.24.84:6892 udp
N/A 91.239.24.85:6892 udp
N/A 91.239.24.86:6892 udp
N/A 91.239.24.87:6892 udp
N/A 91.239.24.88:6892 udp
N/A 91.239.24.89:6892 udp
N/A 91.239.24.90:6892 udp
N/A 91.239.24.91:6892 udp
N/A 91.239.24.92:6892 udp
N/A 91.239.24.93:6892 udp
N/A 91.239.24.94:6892 udp
N/A 91.239.24.95:6892 udp
N/A 91.239.24.96:6892 udp
N/A 91.239.24.97:6892 udp
N/A 91.239.24.98:6892 udp
N/A 91.239.24.99:6892 udp
N/A 91.239.24.100:6892 udp
N/A 91.239.24.101:6892 udp
N/A 91.239.24.102:6892 udp
N/A 91.239.24.103:6892 udp
N/A 91.239.24.104:6892 udp
N/A 91.239.24.105:6892 udp
N/A 91.239.24.106:6892 udp
N/A 91.239.24.107:6892 udp
N/A 91.239.24.108:6892 udp
N/A 91.239.24.109:6892 udp
N/A 91.239.24.110:6892 udp
N/A 91.239.24.111:6892 udp
N/A 91.239.24.112:6892 udp
N/A 91.239.24.113:6892 udp
N/A 91.239.24.114:6892 udp
N/A 91.239.24.115:6892 udp
N/A 91.239.24.116:6892 udp
N/A 91.239.24.117:6892 udp
N/A 91.239.24.118:6892 udp
N/A 91.239.24.119:6892 udp
N/A 91.239.24.120:6892 udp
N/A 91.239.24.121:6892 udp
N/A 91.239.24.122:6892 udp
N/A 91.239.24.123:6892 udp
N/A 91.239.24.124:6892 udp
N/A 91.239.24.125:6892 udp
N/A 91.239.24.126:6892 udp
N/A 91.239.24.127:6892 udp
N/A 91.239.24.128:6892 udp
N/A 91.239.24.129:6892 udp
N/A 91.239.24.130:6892 udp
N/A 91.239.24.131:6892 udp
N/A 91.239.24.132:6892 udp
N/A 91.239.24.133:6892 udp
N/A 91.239.24.134:6892 udp
N/A 91.239.24.135:6892 udp
N/A 91.239.24.136:6892 udp
N/A 91.239.24.137:6892 udp
N/A 91.239.24.138:6892 udp
N/A 91.239.24.139:6892 udp
N/A 91.239.24.140:6892 udp
N/A 91.239.24.141:6892 udp
N/A 91.239.24.142:6892 udp
N/A 91.239.24.143:6892 udp
N/A 91.239.24.144:6892 udp
N/A 91.239.24.145:6892 udp
N/A 91.239.24.146:6892 udp
N/A 91.239.24.147:6892 udp
N/A 91.239.24.148:6892 udp
N/A 91.239.24.149:6892 udp
N/A 91.239.24.150:6892 udp
N/A 91.239.24.151:6892 udp
N/A 91.239.24.152:6892 udp
N/A 91.239.24.153:6892 udp
N/A 91.239.24.154:6892 udp
N/A 91.239.24.155:6892 udp
N/A 91.239.24.156:6892 udp
N/A 91.239.24.157:6892 udp
N/A 91.239.24.158:6892 udp
N/A 91.239.24.159:6892 udp
N/A 91.239.24.160:6892 udp
N/A 91.239.24.161:6892 udp
N/A 91.239.24.162:6892 udp
N/A 91.239.24.163:6892 udp
N/A 91.239.24.164:6892 udp
N/A 91.239.24.165:6892 udp
N/A 91.239.24.166:6892 udp
N/A 91.239.24.167:6892 udp
N/A 91.239.24.168:6892 udp
N/A 91.239.24.169:6892 udp
N/A 91.239.24.170:6892 udp
N/A 91.239.24.171:6892 udp
N/A 91.239.24.172:6892 udp
N/A 91.239.24.173:6892 udp
N/A 91.239.24.174:6892 udp
N/A 91.239.24.175:6892 udp
N/A 91.239.24.176:6892 udp
N/A 91.239.24.177:6892 udp
N/A 91.239.24.178:6892 udp
N/A 91.239.24.179:6892 udp
N/A 91.239.24.180:6892 udp
N/A 91.239.24.181:6892 udp
N/A 91.239.24.182:6892 udp
N/A 91.239.24.183:6892 udp
N/A 91.239.24.184:6892 udp
N/A 91.239.24.185:6892 udp
N/A 91.239.24.186:6892 udp
N/A 91.239.24.187:6892 udp
N/A 91.239.24.188:6892 udp
N/A 91.239.24.189:6892 udp
N/A 91.239.24.190:6892 udp
N/A 91.239.24.191:6892 udp
N/A 91.239.24.192:6892 udp
N/A 91.239.24.193:6892 udp
N/A 91.239.24.194:6892 udp
N/A 91.239.24.195:6892 udp
N/A 91.239.24.196:6892 udp
N/A 91.239.24.197:6892 udp
N/A 91.239.24.198:6892 udp
N/A 91.239.24.199:6892 udp
N/A 91.239.24.200:6892 udp
N/A 91.239.24.201:6892 udp
N/A 91.239.24.202:6892 udp
N/A 91.239.24.203:6892 udp
N/A 91.239.24.204:6892 udp
N/A 91.239.24.205:6892 udp
N/A 91.239.24.206:6892 udp
N/A 91.239.24.207:6892 udp
N/A 91.239.24.208:6892 udp
N/A 91.239.24.209:6892 udp
N/A 91.239.24.210:6892 udp
N/A 91.239.24.211:6892 udp
N/A 91.239.24.212:6892 udp
N/A 91.239.24.213:6892 udp
N/A 91.239.24.214:6892 udp
N/A 91.239.24.215:6892 udp
N/A 91.239.24.216:6892 udp
N/A 91.239.24.217:6892 udp
N/A 91.239.24.218:6892 udp
N/A 91.239.24.219:6892 udp
N/A 91.239.24.220:6892 udp
N/A 91.239.24.221:6892 udp
N/A 91.239.24.222:6892 udp
N/A 91.239.24.223:6892 udp
N/A 91.239.24.224:6892 udp
N/A 91.239.24.225:6892 udp
N/A 91.239.24.226:6892 udp
N/A 91.239.24.227:6892 udp
N/A 91.239.24.228:6892 udp
N/A 91.239.24.229:6892 udp
N/A 91.239.24.230:6892 udp
N/A 91.239.24.231:6892 udp
N/A 91.239.24.232:6892 udp
N/A 91.239.24.233:6892 udp
N/A 91.239.24.234:6892 udp
N/A 91.239.24.235:6892 udp
N/A 91.239.24.236:6892 udp
N/A 91.239.24.237:6892 udp
N/A 91.239.24.238:6892 udp
N/A 91.239.24.239:6892 udp
N/A 91.239.24.240:6892 udp
N/A 91.239.24.241:6892 udp
N/A 91.239.24.242:6892 udp
N/A 91.239.24.243:6892 udp
N/A 91.239.24.244:6892 udp
N/A 91.239.24.245:6892 udp
N/A 91.239.24.246:6892 udp
N/A 91.239.24.247:6892 udp
N/A 91.239.24.248:6892 udp
N/A 91.239.24.249:6892 udp
N/A 91.239.24.250:6892 udp
N/A 91.239.24.251:6892 udp
N/A 91.239.24.252:6892 udp
N/A 91.239.24.253:6892 udp
N/A 91.239.24.254:6892 udp
N/A 91.239.24.255:6892 udp
N/A 91.239.25.0:6892 udp
N/A 91.239.25.1:6892 udp
N/A 91.239.25.2:6892 udp
N/A 91.239.25.3:6892 udp
N/A 91.239.25.4:6892 udp
N/A 91.239.25.5:6892 udp
N/A 91.239.25.6:6892 udp
N/A 91.239.25.7:6892 udp
N/A 91.239.25.8:6892 udp
N/A 91.239.25.9:6892 udp
N/A 91.239.25.10:6892 udp
N/A 91.239.25.11:6892 udp
N/A 91.239.25.12:6892 udp
N/A 91.239.25.13:6892 udp
N/A 91.239.25.14:6892 udp
N/A 91.239.25.15:6892 udp
N/A 91.239.25.16:6892 udp
N/A 91.239.25.17:6892 udp
N/A 91.239.25.18:6892 udp
N/A 91.239.25.19:6892 udp
N/A 91.239.25.20:6892 udp
N/A 91.239.25.21:6892 udp
N/A 91.239.25.22:6892 udp
N/A 91.239.25.23:6892 udp
N/A 91.239.25.24:6892 udp
N/A 91.239.25.25:6892 udp
N/A 91.239.25.26:6892 udp
N/A 91.239.25.27:6892 udp
N/A 91.239.25.28:6892 udp
N/A 91.239.25.29:6892 udp
N/A 91.239.25.30:6892 udp
N/A 91.239.25.31:6892 udp
N/A 91.239.25.32:6892 udp
N/A 91.239.25.33:6892 udp
N/A 91.239.25.34:6892 udp
N/A 91.239.25.35:6892 udp
N/A 91.239.25.36:6892 udp
N/A 91.239.25.37:6892 udp
N/A 91.239.25.38:6892 udp
N/A 91.239.25.39:6892 udp
N/A 91.239.25.40:6892 udp
N/A 91.239.25.41:6892 udp
N/A 91.239.25.42:6892 udp
N/A 91.239.25.43:6892 udp
N/A 91.239.25.44:6892 udp
N/A 91.239.25.45:6892 udp
N/A 91.239.25.46:6892 udp
N/A 91.239.25.47:6892 udp
N/A 91.239.25.48:6892 udp
N/A 91.239.25.49:6892 udp
N/A 91.239.25.50:6892 udp
N/A 91.239.25.51:6892 udp
N/A 91.239.25.52:6892 udp
N/A 91.239.25.53:6892 udp
N/A 91.239.25.54:6892 udp
N/A 91.239.25.55:6892 udp
N/A 91.239.25.56:6892 udp
N/A 91.239.25.57:6892 udp
N/A 91.239.25.58:6892 udp
N/A 91.239.25.59:6892 udp
N/A 91.239.25.60:6892 udp
N/A 91.239.25.61:6892 udp
N/A 91.239.25.62:6892 udp
N/A 91.239.25.63:6892 udp
N/A 91.239.25.64:6892 udp
N/A 91.239.25.65:6892 udp
N/A 91.239.25.66:6892 udp
N/A 91.239.25.67:6892 udp
N/A 91.239.25.68:6892 udp
N/A 91.239.25.69:6892 udp
N/A 91.239.25.70:6892 udp
N/A 91.239.25.71:6892 udp
N/A 91.239.25.72:6892 udp
N/A 91.239.25.73:6892 udp
N/A 91.239.25.74:6892 udp
N/A 91.239.25.75:6892 udp
N/A 91.239.25.76:6892 udp
N/A 91.239.25.77:6892 udp
N/A 91.239.25.78:6892 udp
N/A 91.239.25.79:6892 udp
N/A 91.239.25.80:6892 udp
N/A 91.239.25.81:6892 udp
N/A 91.239.25.82:6892 udp
N/A 91.239.25.83:6892 udp
N/A 91.239.25.84:6892 udp
N/A 91.239.25.85:6892 udp
N/A 91.239.25.86:6892 udp
N/A 91.239.25.87:6892 udp
N/A 91.239.25.88:6892 udp
N/A 91.239.25.89:6892 udp
N/A 91.239.25.90:6892 udp
N/A 91.239.25.91:6892 udp
N/A 91.239.25.92:6892 udp
N/A 91.239.25.93:6892 udp
N/A 91.239.25.94:6892 udp
N/A 91.239.25.95:6892 udp
N/A 91.239.25.96:6892 udp
N/A 91.239.25.97:6892 udp
N/A 91.239.25.98:6892 udp
N/A 91.239.25.99:6892 udp
N/A 91.239.25.100:6892 udp
N/A 91.239.25.101:6892 udp
N/A 91.239.25.102:6892 udp
N/A 91.239.25.103:6892 udp
N/A 91.239.25.104:6892 udp
N/A 91.239.25.105:6892 udp
N/A 91.239.25.106:6892 udp
N/A 91.239.25.107:6892 udp
N/A 91.239.25.108:6892 udp
N/A 91.239.25.109:6892 udp
N/A 91.239.25.110:6892 udp
N/A 91.239.25.111:6892 udp
N/A 91.239.25.112:6892 udp
N/A 91.239.25.113:6892 udp
N/A 91.239.25.114:6892 udp
N/A 91.239.25.115:6892 udp
N/A 91.239.25.116:6892 udp
N/A 91.239.25.117:6892 udp
N/A 91.239.25.118:6892 udp
N/A 91.239.25.119:6892 udp
N/A 91.239.25.120:6892 udp
N/A 91.239.25.121:6892 udp
N/A 91.239.25.122:6892 udp
N/A 91.239.25.123:6892 udp
N/A 91.239.25.124:6892 udp
N/A 91.239.25.125:6892 udp
N/A 91.239.25.126:6892 udp
N/A 91.239.25.127:6892 udp
N/A 91.239.25.128:6892 udp
N/A 91.239.25.129:6892 udp
N/A 91.239.25.130:6892 udp
N/A 91.239.25.131:6892 udp
N/A 91.239.25.132:6892 udp
N/A 91.239.25.133:6892 udp
N/A 91.239.25.134:6892 udp
N/A 91.239.25.135:6892 udp
N/A 91.239.25.136:6892 udp
N/A 91.239.25.137:6892 udp
N/A 91.239.25.138:6892 udp
N/A 91.239.25.139:6892 udp
N/A 91.239.25.140:6892 udp
N/A 91.239.25.141:6892 udp
N/A 91.239.25.142:6892 udp
N/A 91.239.25.143:6892 udp
N/A 91.239.25.144:6892 udp
N/A 91.239.25.145:6892 udp
N/A 91.239.25.146:6892 udp
N/A 91.239.25.147:6892 udp
N/A 91.239.25.148:6892 udp
N/A 91.239.25.149:6892 udp
N/A 91.239.25.150:6892 udp
N/A 91.239.25.151:6892 udp
N/A 91.239.25.152:6892 udp
N/A 91.239.25.153:6892 udp
N/A 91.239.25.154:6892 udp
N/A 91.239.25.155:6892 udp
N/A 91.239.25.156:6892 udp
N/A 91.239.25.157:6892 udp
N/A 91.239.25.158:6892 udp
N/A 91.239.25.159:6892 udp
N/A 91.239.25.160:6892 udp
N/A 91.239.25.161:6892 udp
N/A 91.239.25.162:6892 udp
N/A 91.239.25.163:6892 udp
N/A 91.239.25.164:6892 udp
N/A 91.239.25.165:6892 udp
N/A 91.239.25.166:6892 udp
N/A 91.239.25.167:6892 udp
N/A 91.239.25.168:6892 udp
N/A 91.239.25.169:6892 udp
N/A 91.239.25.170:6892 udp
N/A 91.239.25.171:6892 udp
N/A 91.239.25.172:6892 udp
N/A 91.239.25.173:6892 udp
N/A 91.239.25.174:6892 udp
N/A 91.239.25.175:6892 udp
N/A 91.239.25.176:6892 udp
N/A 91.239.25.177:6892 udp
N/A 91.239.25.178:6892 udp
N/A 91.239.25.179:6892 udp
N/A 91.239.25.180:6892 udp
N/A 91.239.25.181:6892 udp
N/A 91.239.25.182:6892 udp
N/A 91.239.25.183:6892 udp
N/A 91.239.25.184:6892 udp
N/A 91.239.25.185:6892 udp
N/A 91.239.25.186:6892 udp
N/A 91.239.25.187:6892 udp
N/A 91.239.25.188:6892 udp
N/A 91.239.25.189:6892 udp
N/A 91.239.25.190:6892 udp
N/A 91.239.25.191:6892 udp
N/A 91.239.25.192:6892 udp
N/A 91.239.25.193:6892 udp
N/A 91.239.25.194:6892 udp
N/A 91.239.25.195:6892 udp
N/A 91.239.25.196:6892 udp
N/A 91.239.25.197:6892 udp
N/A 91.239.25.198:6892 udp
N/A 91.239.25.199:6892 udp
N/A 91.239.25.200:6892 udp
N/A 91.239.25.201:6892 udp
N/A 91.239.25.202:6892 udp
N/A 91.239.25.203:6892 udp
N/A 91.239.25.204:6892 udp
N/A 91.239.25.205:6892 udp
N/A 91.239.25.206:6892 udp
N/A 91.239.25.207:6892 udp
N/A 91.239.25.208:6892 udp
N/A 91.239.25.209:6892 udp
N/A 91.239.25.210:6892 udp
N/A 91.239.25.211:6892 udp
N/A 91.239.25.212:6892 udp
N/A 91.239.25.213:6892 udp
N/A 91.239.25.214:6892 udp
N/A 91.239.25.215:6892 udp
N/A 91.239.25.216:6892 udp
N/A 91.239.25.217:6892 udp
N/A 91.239.25.218:6892 udp
N/A 91.239.25.219:6892 udp
N/A 91.239.25.220:6892 udp
N/A 91.239.25.221:6892 udp
N/A 91.239.25.222:6892 udp
N/A 91.239.25.223:6892 udp
N/A 91.239.25.224:6892 udp
N/A 91.239.25.225:6892 udp
N/A 91.239.25.226:6892 udp
N/A 91.239.25.227:6892 udp
N/A 91.239.25.228:6892 udp
N/A 91.239.25.229:6892 udp
N/A 91.239.25.230:6892 udp
N/A 91.239.25.231:6892 udp
N/A 91.239.25.232:6892 udp
N/A 91.239.25.233:6892 udp
N/A 91.239.25.234:6892 udp
N/A 91.239.25.235:6892 udp
N/A 91.239.25.236:6892 udp
N/A 91.239.25.237:6892 udp
N/A 91.239.25.238:6892 udp
N/A 91.239.25.239:6892 udp
N/A 91.239.25.240:6892 udp
N/A 91.239.25.241:6892 udp
N/A 91.239.25.242:6892 udp
N/A 91.239.25.243:6892 udp
N/A 91.239.25.244:6892 udp
N/A 91.239.25.245:6892 udp
N/A 91.239.25.246:6892 udp
N/A 91.239.25.247:6892 udp
N/A 91.239.25.248:6892 udp
N/A 91.239.25.249:6892 udp
N/A 91.239.25.250:6892 udp
N/A 91.239.25.251:6892 udp
N/A 91.239.25.252:6892 udp
N/A 91.239.25.253:6892 udp
N/A 91.239.25.254:6892 udp
N/A 91.239.25.255:6892 udp

Files

\Users\Admin\AppData\Local\Temp\nsi2869.tmp\System.dll

MD5 ca332bb753b0775d5e806e236ddcec55
SHA1 f35ef76592f20850baef2ebbd3c9a2cfb5ad8d8f
SHA256 df5ae79fa558dc7af244ec6e53939563b966e7dbd8867e114e928678dbd56e5d
SHA512 2de0956a1ad58ad7086e427e89b819089f2a7f1e4133ed2a0a736adc0614e8588ebe2d97f1b59ab8886d662aeb40e0b4838c6a65fbfc652253e3a45664a03a00

memory/108-1-0x0000000000400000-0x0000000000441000-memory.dmp

memory/1280-2-0x0000000000400000-0x0000000000437000-memory.dmp

memory/1280-3-0x0000000000403854-mapping.dmp

memory/1280-4-0x0000000000400000-0x0000000000437000-memory.dmp

memory/1604-5-0x0000000000000000-mapping.dmp

C:\Users\Admin\Desktop\_HELP_HELP_HELP_6OU0FY.hta

MD5 4fee1602b3a87cccf51ea7a566b806cc
SHA1 4948d24c0d88264bcff22989da4b2db8ee4a217a
SHA256 5d427633221a4568c8bbcb7be3a1f3eed10225f42661b18f6949da563c76afdd
SHA512 34d7a21e1ff064f0abdd8c71ac99cc664515cb0605af42055a96abe2b1a15a137abfe79aecff569493461db20d7fc866b624151638103878b647a894c010d020

memory/340-7-0x000007FEF7EB0000-0x000007FEF812A000-memory.dmp

C:\Users\Admin\Desktop\_HELP_HELP_HELP_6OU0FY.jpg

MD5 cc0c5e4101d6cca3a5fd3b1733fb9c18
SHA1 df1ec45bbc1cdf07521e04ed1ad3bb202bc4bd60
SHA256 a08440800539f932938a8c5b20701415720fa4d6a5fa89ccdeab4b97167e3710
SHA512 acec0e72ff1dacb82e4b945cff13801b49b481f7260cf795c865a045716ed250346aca3fa6a1dab8f742e7216e04726e55d54ce16e16da2a3535c4086fc32ed7

memory/1572-15-0x0000000000000000-mapping.dmp

memory/1496-16-0x0000000000000000-mapping.dmp

memory/1260-17-0x0000000000000000-mapping.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2020-10-26 08:02

Reported

2020-10-26 08:11

Platform

win10

Max time kernel

86s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe"

Signatures

Cerber

ransomware cerber

Blacklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A

Drops startup file

Description Indicator Process Target
File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\word\startup\ C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp6AB6.bmp" C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2092 set thread context of 1832 N/A C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification \??\c:\program files\ C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe N/A
File opened for modification \??\c:\program files (x86)\bitcoin C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe N/A
File opened for modification \??\c:\program files (x86)\excel C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe N/A
File opened for modification \??\c:\program files (x86)\steam C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe N/A
File opened for modification \??\c:\program files (x86)\thunderbird C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft sql server C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\outlook C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\word C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe N/A
File opened for modification \??\c:\program files (x86)\onenote C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\excel C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\office C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\onenote C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\powerpoint C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe N/A
File opened for modification \??\c:\program files (x86)\office C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe N/A
File opened for modification \??\c:\program files (x86)\outlook C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe N/A
File opened for modification \??\c:\program files (x86)\ C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\microsoft sql server C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe N/A
File opened for modification \??\c:\program files (x86)\powerpoint C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe N/A
File opened for modification \??\c:\program files (x86)\the bat! C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe N/A
File opened for modification \??\c:\program files (x86)\word C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification \??\c:\windows\ C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\taskkill.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2092 wrote to memory of 1832 N/A C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe
PID 2092 wrote to memory of 1832 N/A C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe
PID 2092 wrote to memory of 1832 N/A C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe
PID 2092 wrote to memory of 1832 N/A C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe
PID 1832 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe C:\Windows\SysWOW64\mshta.exe
PID 1832 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe C:\Windows\SysWOW64\mshta.exe
PID 1832 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe C:\Windows\SysWOW64\mshta.exe
PID 1832 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe C:\Windows\system32\cmd.exe
PID 1832 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe C:\Windows\system32\cmd.exe
PID 2664 wrote to memory of 3684 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2664 wrote to memory of 3684 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2664 wrote to memory of 2032 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\PING.EXE
PID 2664 wrote to memory of 2032 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\PING.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe

"C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe"

C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe

"C:\Users\Admin\AppData\Local\Temp\dcadc504c887859715283b1ae4077d5e.exe"

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_HELP_HELP_HELP_513AH.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\taskkill.exe

taskkill /f /im "dcadc504c887859715283b1ae4077d5e.exe"

C:\Windows\system32\PING.EXE

ping -n 1 127.0.0.1

Network

Country Destination Domain Proto
N/A 90.2.1.0:6892 udp
N/A 90.2.1.1:6892 udp
N/A 90.2.1.2:6892 udp
N/A 90.2.1.3:6892 udp
N/A 90.2.1.4:6892 udp
N/A 90.2.1.5:6892 udp
N/A 90.2.1.6:6892 udp
N/A 90.2.1.7:6892 udp
N/A 90.2.1.8:6892 udp
N/A 90.2.1.9:6892 udp
N/A 90.2.1.10:6892 udp
N/A 90.2.1.11:6892 udp
N/A 90.2.1.12:6892 udp
N/A 90.2.1.13:6892 udp
N/A 90.2.1.14:6892 udp
N/A 90.2.1.15:6892 udp
N/A 90.2.1.16:6892 udp
N/A 90.2.1.17:6892 udp
N/A 90.2.1.18:6892 udp
N/A 90.2.1.19:6892 udp
N/A 90.2.1.20:6892 udp
N/A 90.2.1.21:6892 udp
N/A 90.2.1.22:6892 udp
N/A 90.2.1.23:6892 udp
N/A 90.2.1.24:6892 udp
N/A 90.2.1.25:6892 udp
N/A 90.2.1.26:6892 udp
N/A 90.2.1.27:6892 udp
N/A 90.2.1.28:6892 udp
N/A 90.2.1.29:6892 udp
N/A 90.2.1.30:6892 udp
N/A 90.2.1.31:6892 udp
N/A 90.3.1.0:6892 udp
N/A 90.3.1.1:6892 udp
N/A 90.3.1.2:6892 udp
N/A 90.3.1.3:6892 udp
N/A 90.3.1.4:6892 udp
N/A 90.3.1.5:6892 udp
N/A 90.3.1.6:6892 udp
N/A 90.3.1.7:6892 udp
N/A 90.3.1.8:6892 udp
N/A 90.3.1.9:6892 udp
N/A 90.3.1.10:6892 udp
N/A 90.3.1.11:6892 udp
N/A 90.3.1.12:6892 udp
N/A 90.3.1.13:6892 udp
N/A 90.3.1.14:6892 udp
N/A 90.3.1.15:6892 udp
N/A 90.3.1.16:6892 udp
N/A 90.3.1.17:6892 udp
N/A 90.3.1.18:6892 udp
N/A 90.3.1.19:6892 udp
N/A 90.3.1.20:6892 udp
N/A 90.3.1.21:6892 udp
N/A 90.3.1.22:6892 udp
N/A 90.3.1.23:6892 udp
N/A 90.3.1.24:6892 udp
N/A 90.3.1.25:6892 udp
N/A 90.3.1.26:6892 udp
N/A 90.3.1.27:6892 udp
N/A 90.3.1.28:6892 udp
N/A 90.3.1.29:6892 udp
N/A 90.3.1.30:6892 udp
N/A 90.3.1.31:6892 udp
N/A 91.239.24.0:6892 udp
N/A 91.239.24.1:6892 udp
N/A 91.239.24.2:6892 udp
N/A 91.239.24.3:6892 udp
N/A 91.239.24.4:6892 udp
N/A 91.239.24.5:6892 udp
N/A 91.239.24.6:6892 udp
N/A 91.239.24.7:6892 udp
N/A 91.239.24.8:6892 udp
N/A 91.239.24.9:6892 udp
N/A 91.239.24.10:6892 udp
N/A 91.239.24.11:6892 udp
N/A 91.239.24.12:6892 udp
N/A 91.239.24.13:6892 udp
N/A 91.239.24.14:6892 udp
N/A 91.239.24.15:6892 udp
N/A 91.239.24.16:6892 udp
N/A 91.239.24.17:6892 udp
N/A 91.239.24.18:6892 udp
N/A 91.239.24.19:6892 udp
N/A 91.239.24.20:6892 udp
N/A 91.239.24.21:6892 udp
N/A 91.239.24.22:6892 udp
N/A 91.239.24.23:6892 udp
N/A 91.239.24.24:6892 udp
N/A 91.239.24.25:6892 udp
N/A 91.239.24.26:6892 udp
N/A 91.239.24.27:6892 udp
N/A 91.239.24.28:6892 udp
N/A 91.239.24.29:6892 udp
N/A 91.239.24.30:6892 udp
N/A 91.239.24.31:6892 udp
N/A 91.239.24.32:6892 udp
N/A 91.239.24.33:6892 udp
N/A 91.239.24.34:6892 udp
N/A 91.239.24.35:6892 udp
N/A 91.239.24.36:6892 udp
N/A 91.239.24.37:6892 udp
N/A 91.239.24.38:6892 udp
N/A 91.239.24.39:6892 udp
N/A 91.239.24.40:6892 udp
N/A 91.239.24.41:6892 udp
N/A 91.239.24.42:6892 udp
N/A 91.239.24.43:6892 udp
N/A 91.239.24.44:6892 udp
N/A 91.239.24.45:6892 udp
N/A 91.239.24.46:6892 udp
N/A 91.239.24.47:6892 udp
N/A 91.239.24.48:6892 udp
N/A 91.239.24.49:6892 udp
N/A 91.239.24.50:6892 udp
N/A 91.239.24.51:6892 udp
N/A 91.239.24.52:6892 udp
N/A 91.239.24.53:6892 udp
N/A 91.239.24.54:6892 udp
N/A 91.239.24.55:6892 udp
N/A 91.239.24.56:6892 udp
N/A 91.239.24.57:6892 udp
N/A 91.239.24.58:6892 udp
N/A 91.239.24.59:6892 udp
N/A 91.239.24.60:6892 udp
N/A 91.239.24.61:6892 udp
N/A 91.239.24.62:6892 udp
N/A 91.239.24.63:6892 udp
N/A 91.239.24.64:6892 udp
N/A 91.239.24.65:6892 udp
N/A 91.239.24.66:6892 udp
N/A 91.239.24.67:6892 udp
N/A 91.239.24.68:6892 udp
N/A 91.239.24.69:6892 udp
N/A 91.239.24.70:6892 udp
N/A 91.239.24.71:6892 udp
N/A 91.239.24.72:6892 udp
N/A 91.239.24.73:6892 udp
N/A 91.239.24.74:6892 udp
N/A 91.239.24.75:6892 udp
N/A 91.239.24.76:6892 udp
N/A 91.239.24.77:6892 udp
N/A 91.239.24.78:6892 udp
N/A 91.239.24.79:6892 udp
N/A 91.239.24.80:6892 udp
N/A 91.239.24.81:6892 udp
N/A 91.239.24.82:6892 udp
N/A 91.239.24.83:6892 udp
N/A 91.239.24.84:6892 udp
N/A 91.239.24.85:6892 udp
N/A 91.239.24.86:6892 udp
N/A 91.239.24.87:6892 udp
N/A 91.239.24.88:6892 udp
N/A 91.239.24.89:6892 udp
N/A 91.239.24.90:6892 udp
N/A 91.239.24.91:6892 udp
N/A 91.239.24.92:6892 udp
N/A 91.239.24.93:6892 udp
N/A 91.239.24.94:6892 udp
N/A 91.239.24.95:6892 udp
N/A 91.239.24.96:6892 udp
N/A 91.239.24.97:6892 udp
N/A 91.239.24.98:6892 udp
N/A 91.239.24.99:6892 udp
N/A 91.239.24.100:6892 udp
N/A 91.239.24.101:6892 udp
N/A 91.239.24.102:6892 udp
N/A 91.239.24.103:6892 udp
N/A 91.239.24.104:6892 udp
N/A 91.239.24.105:6892 udp
N/A 91.239.24.106:6892 udp
N/A 91.239.24.107:6892 udp
N/A 91.239.24.108:6892 udp
N/A 91.239.24.109:6892 udp
N/A 91.239.24.110:6892 udp
N/A 91.239.24.111:6892 udp
N/A 91.239.24.112:6892 udp
N/A 91.239.24.113:6892 udp
N/A 91.239.24.114:6892 udp
N/A 91.239.24.115:6892 udp
N/A 91.239.24.116:6892 udp
N/A 91.239.24.117:6892 udp
N/A 91.239.24.118:6892 udp
N/A 91.239.24.119:6892 udp
N/A 91.239.24.120:6892 udp
N/A 91.239.24.121:6892 udp
N/A 91.239.24.122:6892 udp
N/A 91.239.24.123:6892 udp
N/A 91.239.24.124:6892 udp
N/A 91.239.24.125:6892 udp
N/A 91.239.24.126:6892 udp
N/A 91.239.24.127:6892 udp
N/A 91.239.24.128:6892 udp
N/A 91.239.24.129:6892 udp
N/A 91.239.24.130:6892 udp
N/A 91.239.24.131:6892 udp
N/A 91.239.24.132:6892 udp
N/A 91.239.24.133:6892 udp
N/A 91.239.24.134:6892 udp
N/A 91.239.24.135:6892 udp
N/A 91.239.24.136:6892 udp
N/A 91.239.24.137:6892 udp
N/A 91.239.24.138:6892 udp
N/A 91.239.24.139:6892 udp
N/A 91.239.24.140:6892 udp
N/A 91.239.24.141:6892 udp
N/A 91.239.24.142:6892 udp
N/A 91.239.24.143:6892 udp
N/A 91.239.24.144:6892 udp
N/A 91.239.24.145:6892 udp
N/A 91.239.24.146:6892 udp
N/A 91.239.24.147:6892 udp
N/A 91.239.24.148:6892 udp
N/A 91.239.24.149:6892 udp
N/A 91.239.24.150:6892 udp
N/A 91.239.24.151:6892 udp
N/A 91.239.24.152:6892 udp
N/A 91.239.24.153:6892 udp
N/A 91.239.24.154:6892 udp
N/A 91.239.24.155:6892 udp
N/A 91.239.24.156:6892 udp
N/A 91.239.24.157:6892 udp
N/A 91.239.24.158:6892 udp
N/A 91.239.24.159:6892 udp
N/A 91.239.24.160:6892 udp
N/A 91.239.24.161:6892 udp
N/A 91.239.24.162:6892 udp
N/A 91.239.24.163:6892 udp
N/A 91.239.24.164:6892 udp
N/A 91.239.24.165:6892 udp
N/A 91.239.24.166:6892 udp
N/A 91.239.24.167:6892 udp
N/A 91.239.24.168:6892 udp
N/A 91.239.24.169:6892 udp
N/A 91.239.24.170:6892 udp
N/A 91.239.24.171:6892 udp
N/A 91.239.24.172:6892 udp
N/A 91.239.24.173:6892 udp
N/A 91.239.24.174:6892 udp
N/A 91.239.24.175:6892 udp
N/A 91.239.24.176:6892 udp
N/A 91.239.24.177:6892 udp
N/A 91.239.24.178:6892 udp
N/A 91.239.24.179:6892 udp
N/A 91.239.24.180:6892 udp
N/A 91.239.24.181:6892 udp
N/A 91.239.24.182:6892 udp
N/A 91.239.24.183:6892 udp
N/A 91.239.24.184:6892 udp
N/A 91.239.24.185:6892 udp
N/A 91.239.24.186:6892 udp
N/A 91.239.24.187:6892 udp
N/A 91.239.24.188:6892 udp
N/A 91.239.24.189:6892 udp
N/A 91.239.24.190:6892 udp
N/A 91.239.24.191:6892 udp
N/A 91.239.24.192:6892 udp
N/A 91.239.24.193:6892 udp
N/A 91.239.24.194:6892 udp
N/A 91.239.24.195:6892 udp
N/A 91.239.24.196:6892 udp
N/A 91.239.24.197:6892 udp
N/A 91.239.24.198:6892 udp
N/A 91.239.24.199:6892 udp
N/A 91.239.24.200:6892 udp
N/A 91.239.24.201:6892 udp
N/A 91.239.24.202:6892 udp
N/A 91.239.24.203:6892 udp
N/A 91.239.24.204:6892 udp
N/A 91.239.24.205:6892 udp
N/A 91.239.24.206:6892 udp
N/A 91.239.24.207:6892 udp
N/A 91.239.24.208:6892 udp
N/A 91.239.24.209:6892 udp
N/A 91.239.24.210:6892 udp
N/A 91.239.24.211:6892 udp
N/A 91.239.24.212:6892 udp
N/A 91.239.24.213:6892 udp
N/A 91.239.24.214:6892 udp
N/A 91.239.24.215:6892 udp
N/A 91.239.24.216:6892 udp
N/A 91.239.24.217:6892 udp
N/A 91.239.24.218:6892 udp
N/A 91.239.24.219:6892 udp
N/A 91.239.24.220:6892 udp
N/A 91.239.24.221:6892 udp
N/A 91.239.24.222:6892 udp
N/A 91.239.24.223:6892 udp
N/A 91.239.24.224:6892 udp
N/A 91.239.24.225:6892 udp
N/A 91.239.24.226:6892 udp
N/A 91.239.24.227:6892 udp
N/A 91.239.24.228:6892 udp
N/A 91.239.24.229:6892 udp
N/A 91.239.24.230:6892 udp
N/A 91.239.24.231:6892 udp
N/A 91.239.24.232:6892 udp
N/A 91.239.24.233:6892 udp
N/A 91.239.24.234:6892 udp
N/A 91.239.24.235:6892 udp
N/A 91.239.24.236:6892 udp
N/A 91.239.24.237:6892 udp
N/A 91.239.24.238:6892 udp
N/A 91.239.24.239:6892 udp
N/A 91.239.24.240:6892 udp
N/A 91.239.24.241:6892 udp
N/A 91.239.24.242:6892 udp
N/A 91.239.24.243:6892 udp
N/A 91.239.24.244:6892 udp
N/A 91.239.24.245:6892 udp
N/A 91.239.24.246:6892 udp
N/A 91.239.24.247:6892 udp
N/A 91.239.24.248:6892 udp
N/A 91.239.24.249:6892 udp
N/A 91.239.24.250:6892 udp
N/A 91.239.24.251:6892 udp
N/A 91.239.24.252:6892 udp
N/A 91.239.24.253:6892 udp
N/A 91.239.24.254:6892 udp
N/A 91.239.24.255:6892 udp
N/A 91.239.25.0:6892 udp
N/A 91.239.25.1:6892 udp
N/A 91.239.25.2:6892 udp
N/A 91.239.25.3:6892 udp
N/A 91.239.25.4:6892 udp
N/A 91.239.25.5:6892 udp
N/A 91.239.25.6:6892 udp
N/A 91.239.25.7:6892 udp
N/A 91.239.25.8:6892 udp
N/A 91.239.25.9:6892 udp
N/A 91.239.25.10:6892 udp
N/A 91.239.25.11:6892 udp
N/A 91.239.25.12:6892 udp
N/A 91.239.25.13:6892 udp
N/A 91.239.25.14:6892 udp
N/A 91.239.25.15:6892 udp
N/A 91.239.25.16:6892 udp
N/A 91.239.25.17:6892 udp
N/A 91.239.25.18:6892 udp
N/A 91.239.25.19:6892 udp
N/A 91.239.25.20:6892 udp
N/A 91.239.25.21:6892 udp
N/A 91.239.25.22:6892 udp
N/A 91.239.25.23:6892 udp
N/A 91.239.25.24:6892 udp
N/A 91.239.25.25:6892 udp
N/A 91.239.25.26:6892 udp
N/A 91.239.25.27:6892 udp
N/A 91.239.25.28:6892 udp
N/A 91.239.25.29:6892 udp
N/A 91.239.25.30:6892 udp
N/A 91.239.25.31:6892 udp
N/A 91.239.25.32:6892 udp
N/A 91.239.25.33:6892 udp
N/A 91.239.25.34:6892 udp
N/A 91.239.25.35:6892 udp
N/A 91.239.25.36:6892 udp
N/A 91.239.25.37:6892 udp
N/A 91.239.25.38:6892 udp
N/A 91.239.25.39:6892 udp
N/A 91.239.25.40:6892 udp
N/A 91.239.25.41:6892 udp
N/A 91.239.25.42:6892 udp
N/A 91.239.25.43:6892 udp
N/A 91.239.25.44:6892 udp
N/A 91.239.25.45:6892 udp
N/A 91.239.25.46:6892 udp
N/A 91.239.25.47:6892 udp
N/A 91.239.25.48:6892 udp
N/A 91.239.25.49:6892 udp
N/A 91.239.25.50:6892 udp
N/A 91.239.25.51:6892 udp
N/A 91.239.25.52:6892 udp
N/A 91.239.25.53:6892 udp
N/A 91.239.25.54:6892 udp
N/A 91.239.25.55:6892 udp
N/A 91.239.25.56:6892 udp
N/A 91.239.25.57:6892 udp
N/A 91.239.25.58:6892 udp
N/A 91.239.25.59:6892 udp
N/A 91.239.25.60:6892 udp
N/A 91.239.25.61:6892 udp
N/A 91.239.25.62:6892 udp
N/A 91.239.25.63:6892 udp
N/A 91.239.25.64:6892 udp
N/A 91.239.25.65:6892 udp
N/A 91.239.25.66:6892 udp
N/A 91.239.25.67:6892 udp
N/A 91.239.25.68:6892 udp
N/A 91.239.25.69:6892 udp
N/A 91.239.25.70:6892 udp
N/A 91.239.25.71:6892 udp
N/A 91.239.25.72:6892 udp
N/A 91.239.25.73:6892 udp
N/A 91.239.25.74:6892 udp
N/A 91.239.25.75:6892 udp
N/A 91.239.25.76:6892 udp
N/A 91.239.25.77:6892 udp
N/A 91.239.25.78:6892 udp
N/A 91.239.25.79:6892 udp
N/A 91.239.25.80:6892 udp
N/A 91.239.25.81:6892 udp
N/A 91.239.25.82:6892 udp
N/A 91.239.25.83:6892 udp
N/A 91.239.25.84:6892 udp
N/A 91.239.25.85:6892 udp
N/A 91.239.25.86:6892 udp
N/A 91.239.25.87:6892 udp
N/A 91.239.25.88:6892 udp
N/A 91.239.25.89:6892 udp
N/A 91.239.25.90:6892 udp
N/A 91.239.25.91:6892 udp
N/A 91.239.25.92:6892 udp
N/A 91.239.25.93:6892 udp
N/A 91.239.25.94:6892 udp
N/A 91.239.25.95:6892 udp
N/A 91.239.25.96:6892 udp
N/A 91.239.25.97:6892 udp
N/A 91.239.25.98:6892 udp
N/A 91.239.25.99:6892 udp
N/A 91.239.25.100:6892 udp
N/A 91.239.25.101:6892 udp
N/A 91.239.25.102:6892 udp
N/A 91.239.25.103:6892 udp
N/A 91.239.25.104:6892 udp
N/A 91.239.25.105:6892 udp
N/A 91.239.25.106:6892 udp
N/A 91.239.25.107:6892 udp
N/A 91.239.25.108:6892 udp
N/A 91.239.25.109:6892 udp
N/A 91.239.25.110:6892 udp
N/A 91.239.25.111:6892 udp
N/A 91.239.25.112:6892 udp
N/A 91.239.25.113:6892 udp
N/A 91.239.25.114:6892 udp
N/A 91.239.25.115:6892 udp
N/A 91.239.25.116:6892 udp
N/A 91.239.25.117:6892 udp
N/A 91.239.25.118:6892 udp
N/A 91.239.25.119:6892 udp
N/A 91.239.25.120:6892 udp
N/A 91.239.25.121:6892 udp
N/A 91.239.25.122:6892 udp
N/A 91.239.25.123:6892 udp
N/A 91.239.25.124:6892 udp
N/A 91.239.25.125:6892 udp
N/A 91.239.25.126:6892 udp
N/A 91.239.25.127:6892 udp
N/A 91.239.25.128:6892 udp
N/A 91.239.25.129:6892 udp
N/A 91.239.25.130:6892 udp
N/A 91.239.25.131:6892 udp
N/A 91.239.25.132:6892 udp
N/A 91.239.25.133:6892 udp
N/A 91.239.25.134:6892 udp
N/A 91.239.25.135:6892 udp
N/A 91.239.25.136:6892 udp
N/A 91.239.25.137:6892 udp
N/A 91.239.25.138:6892 udp
N/A 91.239.25.139:6892 udp
N/A 91.239.25.140:6892 udp
N/A 91.239.25.141:6892 udp
N/A 91.239.25.142:6892 udp
N/A 91.239.25.143:6892 udp
N/A 91.239.25.144:6892 udp
N/A 91.239.25.145:6892 udp
N/A 91.239.25.146:6892 udp
N/A 91.239.25.147:6892 udp
N/A 91.239.25.148:6892 udp
N/A 91.239.25.149:6892 udp
N/A 91.239.25.150:6892 udp
N/A 91.239.25.151:6892 udp
N/A 91.239.25.152:6892 udp
N/A 91.239.25.153:6892 udp
N/A 91.239.25.154:6892 udp
N/A 91.239.25.155:6892 udp
N/A 91.239.25.156:6892 udp
N/A 91.239.25.157:6892 udp
N/A 91.239.25.158:6892 udp
N/A 91.239.25.159:6892 udp
N/A 91.239.25.160:6892 udp
N/A 91.239.25.161:6892 udp
N/A 91.239.25.162:6892 udp
N/A 91.239.25.163:6892 udp
N/A 91.239.25.164:6892 udp
N/A 91.239.25.165:6892 udp
N/A 91.239.25.166:6892 udp
N/A 91.239.25.167:6892 udp
N/A 91.239.25.168:6892 udp
N/A 91.239.25.169:6892 udp
N/A 91.239.25.170:6892 udp
N/A 91.239.25.171:6892 udp
N/A 91.239.25.172:6892 udp
N/A 91.239.25.173:6892 udp
N/A 91.239.25.174:6892 udp
N/A 91.239.25.175:6892 udp
N/A 91.239.25.176:6892 udp
N/A 91.239.25.177:6892 udp
N/A 91.239.25.178:6892 udp
N/A 91.239.25.179:6892 udp
N/A 91.239.25.180:6892 udp
N/A 91.239.25.181:6892 udp
N/A 91.239.25.182:6892 udp
N/A 91.239.25.183:6892 udp
N/A 91.239.25.184:6892 udp
N/A 91.239.25.185:6892 udp
N/A 91.239.25.186:6892 udp
N/A 91.239.25.187:6892 udp
N/A 91.239.25.188:6892 udp
N/A 91.239.25.189:6892 udp
N/A 91.239.25.190:6892 udp
N/A 91.239.25.191:6892 udp
N/A 91.239.25.192:6892 udp
N/A 91.239.25.193:6892 udp
N/A 91.239.25.194:6892 udp
N/A 91.239.25.195:6892 udp
N/A 91.239.25.196:6892 udp
N/A 91.239.25.197:6892 udp
N/A 91.239.25.198:6892 udp
N/A 91.239.25.199:6892 udp
N/A 91.239.25.200:6892 udp
N/A 91.239.25.201:6892 udp
N/A 91.239.25.202:6892 udp
N/A 91.239.25.203:6892 udp
N/A 91.239.25.204:6892 udp
N/A 91.239.25.205:6892 udp
N/A 91.239.25.206:6892 udp
N/A 91.239.25.207:6892 udp
N/A 91.239.25.208:6892 udp
N/A 91.239.25.209:6892 udp
N/A 91.239.25.210:6892 udp
N/A 91.239.25.211:6892 udp
N/A 91.239.25.212:6892 udp
N/A 91.239.25.213:6892 udp
N/A 91.239.25.214:6892 udp
N/A 91.239.25.215:6892 udp
N/A 91.239.25.216:6892 udp
N/A 91.239.25.217:6892 udp
N/A 91.239.25.218:6892 udp
N/A 91.239.25.219:6892 udp
N/A 91.239.25.220:6892 udp
N/A 91.239.25.221:6892 udp
N/A 91.239.25.222:6892 udp
N/A 91.239.25.223:6892 udp
N/A 91.239.25.224:6892 udp
N/A 91.239.25.225:6892 udp
N/A 91.239.25.226:6892 udp
N/A 91.239.25.227:6892 udp
N/A 91.239.25.228:6892 udp
N/A 91.239.25.229:6892 udp
N/A 91.239.25.230:6892 udp
N/A 91.239.25.231:6892 udp
N/A 91.239.25.232:6892 udp
N/A 91.239.25.233:6892 udp
N/A 91.239.25.234:6892 udp
N/A 91.239.25.235:6892 udp
N/A 91.239.25.236:6892 udp
N/A 91.239.25.237:6892 udp
N/A 91.239.25.238:6892 udp
N/A 91.239.25.239:6892 udp
N/A 91.239.25.240:6892 udp
N/A 91.239.25.241:6892 udp
N/A 91.239.25.242:6892 udp
N/A 91.239.25.243:6892 udp
N/A 91.239.25.244:6892 udp
N/A 91.239.25.245:6892 udp
N/A 91.239.25.246:6892 udp
N/A 91.239.25.247:6892 udp
N/A 91.239.25.248:6892 udp
N/A 91.239.25.249:6892 udp
N/A 91.239.25.250:6892 udp
N/A 91.239.25.251:6892 udp
N/A 91.239.25.252:6892 udp
N/A 91.239.25.253:6892 udp
N/A 91.239.25.254:6892 udp
N/A 91.239.25.255:6892 udp
N/A 90.2.1.0:6892 udp
N/A 90.2.1.1:6892 udp
N/A 90.2.1.2:6892 udp
N/A 90.2.1.3:6892 udp
N/A 90.2.1.4:6892 udp
N/A 90.2.1.5:6892 udp
N/A 90.2.1.6:6892 udp
N/A 90.2.1.7:6892 udp
N/A 90.2.1.8:6892 udp
N/A 90.2.1.9:6892 udp
N/A 90.2.1.10:6892 udp
N/A 90.2.1.11:6892 udp
N/A 90.2.1.12:6892 udp
N/A 90.2.1.13:6892 udp
N/A 90.2.1.14:6892 udp
N/A 90.2.1.15:6892 udp
N/A 90.2.1.16:6892 udp
N/A 90.2.1.17:6892 udp
N/A 90.2.1.18:6892 udp
N/A 90.2.1.19:6892 udp
N/A 90.2.1.20:6892 udp
N/A 90.2.1.21:6892 udp
N/A 90.2.1.22:6892 udp
N/A 90.2.1.23:6892 udp
N/A 90.2.1.24:6892 udp
N/A 90.2.1.25:6892 udp
N/A 90.2.1.26:6892 udp
N/A 90.2.1.27:6892 udp
N/A 90.2.1.28:6892 udp
N/A 90.2.1.29:6892 udp
N/A 90.2.1.30:6892 udp
N/A 90.2.1.31:6892 udp
N/A 90.3.1.0:6892 udp
N/A 90.3.1.1:6892 udp
N/A 90.3.1.2:6892 udp
N/A 90.3.1.3:6892 udp
N/A 90.3.1.4:6892 udp
N/A 90.3.1.5:6892 udp
N/A 90.3.1.6:6892 udp
N/A 90.3.1.7:6892 udp
N/A 90.3.1.8:6892 udp
N/A 90.3.1.9:6892 udp
N/A 90.3.1.10:6892 udp
N/A 90.3.1.11:6892 udp
N/A 90.3.1.12:6892 udp
N/A 90.3.1.13:6892 udp
N/A 90.3.1.14:6892 udp
N/A 90.3.1.15:6892 udp
N/A 90.3.1.16:6892 udp
N/A 90.3.1.17:6892 udp
N/A 90.3.1.18:6892 udp
N/A 90.3.1.19:6892 udp
N/A 90.3.1.20:6892 udp
N/A 90.3.1.21:6892 udp
N/A 90.3.1.22:6892 udp
N/A 90.3.1.23:6892 udp
N/A 90.3.1.24:6892 udp
N/A 90.3.1.25:6892 udp
N/A 90.3.1.26:6892 udp
N/A 90.3.1.27:6892 udp
N/A 90.3.1.28:6892 udp
N/A 90.3.1.29:6892 udp
N/A 90.3.1.30:6892 udp
N/A 90.3.1.31:6892 udp
N/A 91.239.24.0:6892 udp
N/A 91.239.24.1:6892 udp
N/A 91.239.24.2:6892 udp
N/A 91.239.24.3:6892 udp
N/A 91.239.24.4:6892 udp
N/A 91.239.24.5:6892 udp
N/A 91.239.24.6:6892 udp
N/A 91.239.24.7:6892 udp
N/A 91.239.24.8:6892 udp
N/A 91.239.24.9:6892 udp
N/A 91.239.24.10:6892 udp
N/A 91.239.24.11:6892 udp
N/A 91.239.24.12:6892 udp
N/A 91.239.24.13:6892 udp
N/A 91.239.24.14:6892 udp
N/A 91.239.24.15:6892 udp
N/A 91.239.24.16:6892 udp
N/A 91.239.24.17:6892 udp
N/A 91.239.24.18:6892 udp
N/A 91.239.24.19:6892 udp
N/A 91.239.24.20:6892 udp
N/A 91.239.24.21:6892 udp
N/A 91.239.24.22:6892 udp
N/A 91.239.24.23:6892 udp
N/A 91.239.24.24:6892 udp
N/A 91.239.24.25:6892 udp
N/A 91.239.24.26:6892 udp
N/A 91.239.24.27:6892 udp
N/A 91.239.24.28:6892 udp
N/A 91.239.24.29:6892 udp
N/A 91.239.24.30:6892 udp
N/A 91.239.24.31:6892 udp
N/A 91.239.24.32:6892 udp
N/A 91.239.24.33:6892 udp
N/A 91.239.24.34:6892 udp
N/A 91.239.24.35:6892 udp
N/A 91.239.24.36:6892 udp
N/A 91.239.24.37:6892 udp
N/A 91.239.24.38:6892 udp
N/A 91.239.24.39:6892 udp
N/A 91.239.24.40:6892 udp
N/A 91.239.24.41:6892 udp
N/A 91.239.24.42:6892 udp
N/A 91.239.24.43:6892 udp
N/A 91.239.24.44:6892 udp
N/A 91.239.24.45:6892 udp
N/A 91.239.24.46:6892 udp
N/A 91.239.24.47:6892 udp
N/A 91.239.24.48:6892 udp
N/A 91.239.24.49:6892 udp
N/A 91.239.24.50:6892 udp
N/A 91.239.24.51:6892 udp
N/A 91.239.24.52:6892 udp
N/A 91.239.24.53:6892 udp
N/A 91.239.24.54:6892 udp
N/A 91.239.24.55:6892 udp
N/A 91.239.24.56:6892 udp
N/A 91.239.24.57:6892 udp
N/A 91.239.24.58:6892 udp
N/A 91.239.24.59:6892 udp
N/A 91.239.24.60:6892 udp
N/A 91.239.24.61:6892 udp
N/A 91.239.24.62:6892 udp
N/A 91.239.24.63:6892 udp
N/A 91.239.24.64:6892 udp
N/A 91.239.24.65:6892 udp
N/A 91.239.24.66:6892 udp
N/A 91.239.24.67:6892 udp
N/A 91.239.24.68:6892 udp
N/A 91.239.24.69:6892 udp
N/A 91.239.24.70:6892 udp
N/A 91.239.24.71:6892 udp
N/A 91.239.24.72:6892 udp
N/A 91.239.24.73:6892 udp
N/A 91.239.24.74:6892 udp
N/A 91.239.24.75:6892 udp
N/A 91.239.24.76:6892 udp
N/A 91.239.24.77:6892 udp
N/A 91.239.24.78:6892 udp
N/A 91.239.24.79:6892 udp
N/A 91.239.24.80:6892 udp
N/A 91.239.24.81:6892 udp
N/A 91.239.24.82:6892 udp
N/A 91.239.24.83:6892 udp
N/A 91.239.24.84:6892 udp
N/A 91.239.24.85:6892 udp
N/A 91.239.24.86:6892 udp
N/A 91.239.24.87:6892 udp
N/A 91.239.24.88:6892 udp
N/A 91.239.24.89:6892 udp
N/A 91.239.24.90:6892 udp
N/A 91.239.24.91:6892 udp
N/A 91.239.24.92:6892 udp
N/A 91.239.24.93:6892 udp
N/A 91.239.24.94:6892 udp
N/A 91.239.24.95:6892 udp
N/A 91.239.24.96:6892 udp
N/A 91.239.24.97:6892 udp
N/A 91.239.24.98:6892 udp
N/A 91.239.24.99:6892 udp
N/A 91.239.24.100:6892 udp
N/A 91.239.24.101:6892 udp
N/A 91.239.24.102:6892 udp
N/A 91.239.24.103:6892 udp
N/A 91.239.24.104:6892 udp
N/A 91.239.24.105:6892 udp
N/A 91.239.24.106:6892 udp
N/A 91.239.24.107:6892 udp
N/A 91.239.24.108:6892 udp
N/A 91.239.24.109:6892 udp
N/A 91.239.24.110:6892 udp
N/A 91.239.24.111:6892 udp
N/A 91.239.24.112:6892 udp
N/A 91.239.24.113:6892 udp
N/A 91.239.24.114:6892 udp
N/A 91.239.24.115:6892 udp
N/A 91.239.24.116:6892 udp
N/A 91.239.24.117:6892 udp
N/A 91.239.24.118:6892 udp
N/A 91.239.24.119:6892 udp
N/A 91.239.24.120:6892 udp
N/A 91.239.24.121:6892 udp
N/A 91.239.24.122:6892 udp
N/A 91.239.24.123:6892 udp
N/A 91.239.24.124:6892 udp
N/A 91.239.24.125:6892 udp
N/A 91.239.24.126:6892 udp
N/A 91.239.24.127:6892 udp
N/A 91.239.24.128:6892 udp
N/A 91.239.24.129:6892 udp
N/A 91.239.24.130:6892 udp
N/A 91.239.24.131:6892 udp
N/A 91.239.24.132:6892 udp
N/A 91.239.24.133:6892 udp
N/A 91.239.24.134:6892 udp
N/A 91.239.24.135:6892 udp
N/A 91.239.24.136:6892 udp
N/A 91.239.24.137:6892 udp
N/A 91.239.24.138:6892 udp
N/A 91.239.24.139:6892 udp
N/A 91.239.24.140:6892 udp
N/A 91.239.24.141:6892 udp
N/A 91.239.24.142:6892 udp
N/A 91.239.24.143:6892 udp
N/A 91.239.24.144:6892 udp
N/A 91.239.24.145:6892 udp
N/A 91.239.24.146:6892 udp
N/A 91.239.24.147:6892 udp
N/A 91.239.24.148:6892 udp
N/A 91.239.24.149:6892 udp
N/A 91.239.24.150:6892 udp
N/A 91.239.24.151:6892 udp
N/A 91.239.24.152:6892 udp
N/A 91.239.24.153:6892 udp
N/A 91.239.24.154:6892 udp
N/A 91.239.24.155:6892 udp
N/A 91.239.24.156:6892 udp
N/A 91.239.24.157:6892 udp
N/A 91.239.24.158:6892 udp
N/A 91.239.24.159:6892 udp
N/A 91.239.24.160:6892 udp
N/A 91.239.24.161:6892 udp
N/A 91.239.24.162:6892 udp
N/A 91.239.24.163:6892 udp
N/A 91.239.24.164:6892 udp
N/A 91.239.24.165:6892 udp
N/A 91.239.24.166:6892 udp
N/A 91.239.24.167:6892 udp
N/A 91.239.24.168:6892 udp
N/A 91.239.24.169:6892 udp
N/A 91.239.24.170:6892 udp
N/A 91.239.24.171:6892 udp
N/A 91.239.24.172:6892 udp
N/A 91.239.24.173:6892 udp
N/A 91.239.24.174:6892 udp
N/A 91.239.24.175:6892 udp
N/A 91.239.24.176:6892 udp
N/A 91.239.24.177:6892 udp
N/A 91.239.24.178:6892 udp
N/A 91.239.24.179:6892 udp
N/A 91.239.24.180:6892 udp
N/A 91.239.24.181:6892 udp
N/A 91.239.24.182:6892 udp
N/A 91.239.24.183:6892 udp
N/A 91.239.24.184:6892 udp
N/A 91.239.24.185:6892 udp
N/A 91.239.24.186:6892 udp
N/A 91.239.24.187:6892 udp
N/A 91.239.24.188:6892 udp
N/A 91.239.24.189:6892 udp
N/A 91.239.24.190:6892 udp
N/A 91.239.24.191:6892 udp
N/A 91.239.24.192:6892 udp
N/A 91.239.24.193:6892 udp
N/A 91.239.24.194:6892 udp
N/A 91.239.24.195:6892 udp
N/A 91.239.24.196:6892 udp
N/A 91.239.24.197:6892 udp
N/A 91.239.24.198:6892 udp
N/A 91.239.24.199:6892 udp
N/A 91.239.24.200:6892 udp
N/A 91.239.24.201:6892 udp
N/A 91.239.24.202:6892 udp
N/A 91.239.24.203:6892 udp
N/A 91.239.24.204:6892 udp
N/A 91.239.24.205:6892 udp
N/A 91.239.24.206:6892 udp
N/A 91.239.24.207:6892 udp
N/A 91.239.24.208:6892 udp
N/A 91.239.24.209:6892 udp
N/A 91.239.24.210:6892 udp
N/A 91.239.24.211:6892 udp
N/A 91.239.24.212:6892 udp
N/A 91.239.24.213:6892 udp
N/A 91.239.24.214:6892 udp
N/A 91.239.24.215:6892 udp
N/A 91.239.24.216:6892 udp
N/A 91.239.24.217:6892 udp
N/A 91.239.24.218:6892 udp
N/A 91.239.24.219:6892 udp
N/A 91.239.24.220:6892 udp
N/A 91.239.24.221:6892 udp
N/A 91.239.24.222:6892 udp
N/A 91.239.24.223:6892 udp
N/A 91.239.24.224:6892 udp
N/A 91.239.24.225:6892 udp
N/A 91.239.24.226:6892 udp
N/A 91.239.24.227:6892 udp
N/A 91.239.24.228:6892 udp
N/A 91.239.24.229:6892 udp
N/A 91.239.24.230:6892 udp
N/A 91.239.24.231:6892 udp
N/A 91.239.24.232:6892 udp
N/A 91.239.24.233:6892 udp
N/A 91.239.24.234:6892 udp
N/A 91.239.24.235:6892 udp
N/A 91.239.24.236:6892 udp
N/A 91.239.24.237:6892 udp
N/A 91.239.24.238:6892 udp
N/A 91.239.24.239:6892 udp
N/A 91.239.24.240:6892 udp
N/A 91.239.24.241:6892 udp
N/A 91.239.24.242:6892 udp
N/A 91.239.24.243:6892 udp
N/A 91.239.24.244:6892 udp
N/A 91.239.24.245:6892 udp
N/A 91.239.24.246:6892 udp
N/A 91.239.24.247:6892 udp
N/A 91.239.24.248:6892 udp
N/A 91.239.24.249:6892 udp
N/A 91.239.24.250:6892 udp
N/A 91.239.24.251:6892 udp
N/A 91.239.24.252:6892 udp
N/A 91.239.24.253:6892 udp
N/A 91.239.24.254:6892 udp
N/A 91.239.24.255:6892 udp
N/A 91.239.25.0:6892 udp
N/A 91.239.25.1:6892 udp
N/A 91.239.25.2:6892 udp
N/A 91.239.25.3:6892 udp
N/A 91.239.25.4:6892 udp
N/A 91.239.25.5:6892 udp
N/A 91.239.25.6:6892 udp
N/A 91.239.25.7:6892 udp
N/A 91.239.25.8:6892 udp
N/A 91.239.25.9:6892 udp
N/A 91.239.25.10:6892 udp
N/A 91.239.25.11:6892 udp
N/A 91.239.25.12:6892 udp
N/A 91.239.25.13:6892 udp
N/A 91.239.25.14:6892 udp
N/A 91.239.25.15:6892 udp
N/A 91.239.25.16:6892 udp
N/A 91.239.25.17:6892 udp
N/A 91.239.25.18:6892 udp
N/A 91.239.25.19:6892 udp
N/A 91.239.25.20:6892 udp
N/A 91.239.25.21:6892 udp
N/A 91.239.25.22:6892 udp
N/A 91.239.25.23:6892 udp
N/A 91.239.25.24:6892 udp
N/A 91.239.25.25:6892 udp
N/A 91.239.25.26:6892 udp
N/A 91.239.25.27:6892 udp
N/A 91.239.25.28:6892 udp
N/A 91.239.25.29:6892 udp
N/A 91.239.25.30:6892 udp
N/A 91.239.25.31:6892 udp
N/A 91.239.25.32:6892 udp
N/A 91.239.25.33:6892 udp
N/A 91.239.25.34:6892 udp
N/A 91.239.25.35:6892 udp
N/A 91.239.25.36:6892 udp
N/A 91.239.25.37:6892 udp
N/A 91.239.25.38:6892 udp
N/A 91.239.25.39:6892 udp
N/A 91.239.25.40:6892 udp
N/A 91.239.25.41:6892 udp
N/A 91.239.25.42:6892 udp
N/A 91.239.25.43:6892 udp
N/A 91.239.25.44:6892 udp
N/A 91.239.25.45:6892 udp
N/A 91.239.25.46:6892 udp
N/A 91.239.25.47:6892 udp
N/A 91.239.25.48:6892 udp
N/A 91.239.25.49:6892 udp
N/A 91.239.25.50:6892 udp
N/A 91.239.25.51:6892 udp
N/A 91.239.25.52:6892 udp
N/A 91.239.25.53:6892 udp
N/A 91.239.25.54:6892 udp
N/A 91.239.25.55:6892 udp
N/A 91.239.25.56:6892 udp
N/A 91.239.25.57:6892 udp
N/A 91.239.25.58:6892 udp
N/A 91.239.25.59:6892 udp
N/A 91.239.25.60:6892 udp
N/A 91.239.25.61:6892 udp
N/A 91.239.25.62:6892 udp
N/A 91.239.25.63:6892 udp
N/A 91.239.25.64:6892 udp
N/A 91.239.25.65:6892 udp
N/A 91.239.25.66:6892 udp
N/A 91.239.25.67:6892 udp
N/A 91.239.25.68:6892 udp
N/A 91.239.25.69:6892 udp
N/A 91.239.25.70:6892 udp
N/A 91.239.25.71:6892 udp
N/A 91.239.25.72:6892 udp
N/A 91.239.25.73:6892 udp
N/A 91.239.25.74:6892 udp
N/A 91.239.25.75:6892 udp
N/A 91.239.25.76:6892 udp
N/A 91.239.25.77:6892 udp
N/A 91.239.25.78:6892 udp
N/A 91.239.25.79:6892 udp
N/A 91.239.25.80:6892 udp
N/A 91.239.25.81:6892 udp
N/A 91.239.25.82:6892 udp
N/A 91.239.25.83:6892 udp
N/A 91.239.25.84:6892 udp
N/A 91.239.25.85:6892 udp
N/A 91.239.25.86:6892 udp
N/A 91.239.25.87:6892 udp
N/A 91.239.25.88:6892 udp
N/A 91.239.25.89:6892 udp
N/A 91.239.25.90:6892 udp
N/A 91.239.25.91:6892 udp
N/A 91.239.25.92:6892 udp
N/A 91.239.25.93:6892 udp
N/A 91.239.25.94:6892 udp
N/A 91.239.25.95:6892 udp
N/A 91.239.25.96:6892 udp
N/A 91.239.25.97:6892 udp
N/A 91.239.25.98:6892 udp
N/A 91.239.25.99:6892 udp
N/A 91.239.25.100:6892 udp
N/A 91.239.25.101:6892 udp
N/A 91.239.25.102:6892 udp
N/A 91.239.25.103:6892 udp
N/A 91.239.25.104:6892 udp
N/A 91.239.25.105:6892 udp
N/A 91.239.25.106:6892 udp
N/A 91.239.25.107:6892 udp
N/A 91.239.25.108:6892 udp
N/A 91.239.25.109:6892 udp
N/A 91.239.25.110:6892 udp
N/A 91.239.25.111:6892 udp
N/A 91.239.25.112:6892 udp
N/A 91.239.25.113:6892 udp
N/A 91.239.25.114:6892 udp
N/A 91.239.25.115:6892 udp
N/A 91.239.25.116:6892 udp
N/A 91.239.25.117:6892 udp
N/A 91.239.25.118:6892 udp
N/A 91.239.25.119:6892 udp
N/A 91.239.25.120:6892 udp
N/A 91.239.25.121:6892 udp
N/A 91.239.25.122:6892 udp
N/A 91.239.25.123:6892 udp
N/A 91.239.25.124:6892 udp
N/A 91.239.25.125:6892 udp
N/A 91.239.25.126:6892 udp
N/A 91.239.25.127:6892 udp
N/A 91.239.25.128:6892 udp
N/A 91.239.25.129:6892 udp
N/A 91.239.25.130:6892 udp
N/A 91.239.25.131:6892 udp
N/A 91.239.25.132:6892 udp
N/A 91.239.25.133:6892 udp
N/A 91.239.25.134:6892 udp
N/A 91.239.25.135:6892 udp
N/A 91.239.25.136:6892 udp
N/A 91.239.25.137:6892 udp
N/A 91.239.25.138:6892 udp
N/A 91.239.25.139:6892 udp
N/A 91.239.25.140:6892 udp
N/A 91.239.25.141:6892 udp
N/A 91.239.25.142:6892 udp
N/A 91.239.25.143:6892 udp
N/A 91.239.25.144:6892 udp
N/A 91.239.25.145:6892 udp
N/A 91.239.25.146:6892 udp
N/A 91.239.25.147:6892 udp
N/A 91.239.25.148:6892 udp
N/A 91.239.25.149:6892 udp
N/A 91.239.25.150:6892 udp
N/A 91.239.25.151:6892 udp
N/A 91.239.25.152:6892 udp
N/A 91.239.25.153:6892 udp
N/A 91.239.25.154:6892 udp
N/A 91.239.25.155:6892 udp
N/A 91.239.25.156:6892 udp
N/A 91.239.25.157:6892 udp
N/A 91.239.25.158:6892 udp
N/A 91.239.25.159:6892 udp
N/A 91.239.25.160:6892 udp
N/A 91.239.25.161:6892 udp
N/A 91.239.25.162:6892 udp
N/A 91.239.25.163:6892 udp
N/A 91.239.25.164:6892 udp
N/A 91.239.25.165:6892 udp
N/A 91.239.25.166:6892 udp
N/A 91.239.25.167:6892 udp
N/A 91.239.25.168:6892 udp
N/A 91.239.25.169:6892 udp
N/A 91.239.25.170:6892 udp
N/A 91.239.25.171:6892 udp
N/A 91.239.25.172:6892 udp
N/A 91.239.25.173:6892 udp
N/A 91.239.25.174:6892 udp
N/A 91.239.25.175:6892 udp
N/A 91.239.25.176:6892 udp
N/A 91.239.25.177:6892 udp
N/A 91.239.25.178:6892 udp
N/A 91.239.25.179:6892 udp
N/A 91.239.25.180:6892 udp
N/A 91.239.25.181:6892 udp
N/A 91.239.25.182:6892 udp
N/A 91.239.25.183:6892 udp
N/A 91.239.25.184:6892 udp
N/A 91.239.25.185:6892 udp
N/A 91.239.25.186:6892 udp
N/A 91.239.25.187:6892 udp
N/A 91.239.25.188:6892 udp
N/A 91.239.25.189:6892 udp
N/A 91.239.25.190:6892 udp
N/A 91.239.25.191:6892 udp
N/A 91.239.25.192:6892 udp
N/A 91.239.25.193:6892 udp
N/A 91.239.25.194:6892 udp
N/A 91.239.25.195:6892 udp
N/A 91.239.25.196:6892 udp
N/A 91.239.25.197:6892 udp
N/A 91.239.25.198:6892 udp
N/A 91.239.25.199:6892 udp
N/A 91.239.25.200:6892 udp
N/A 91.239.25.201:6892 udp
N/A 91.239.25.202:6892 udp
N/A 91.239.25.203:6892 udp
N/A 91.239.25.204:6892 udp
N/A 91.239.25.205:6892 udp
N/A 91.239.25.206:6892 udp
N/A 91.239.25.207:6892 udp
N/A 91.239.25.208:6892 udp
N/A 91.239.25.209:6892 udp
N/A 91.239.25.210:6892 udp
N/A 91.239.25.211:6892 udp
N/A 91.239.25.212:6892 udp
N/A 91.239.25.213:6892 udp
N/A 91.239.25.214:6892 udp
N/A 91.239.25.215:6892 udp
N/A 91.239.25.216:6892 udp
N/A 91.239.25.217:6892 udp
N/A 91.239.25.218:6892 udp
N/A 91.239.25.219:6892 udp
N/A 91.239.25.220:6892 udp
N/A 91.239.25.221:6892 udp
N/A 91.239.25.222:6892 udp
N/A 91.239.25.223:6892 udp
N/A 91.239.25.224:6892 udp
N/A 91.239.25.225:6892 udp
N/A 91.239.25.226:6892 udp
N/A 91.239.25.227:6892 udp
N/A 91.239.25.228:6892 udp
N/A 91.239.25.229:6892 udp
N/A 91.239.25.230:6892 udp
N/A 91.239.25.231:6892 udp
N/A 91.239.25.232:6892 udp
N/A 91.239.25.233:6892 udp
N/A 91.239.25.234:6892 udp
N/A 91.239.25.235:6892 udp
N/A 91.239.25.236:6892 udp
N/A 91.239.25.237:6892 udp
N/A 91.239.25.238:6892 udp
N/A 91.239.25.239:6892 udp
N/A 91.239.25.240:6892 udp
N/A 91.239.25.241:6892 udp
N/A 91.239.25.242:6892 udp
N/A 91.239.25.243:6892 udp
N/A 91.239.25.244:6892 udp
N/A 91.239.25.245:6892 udp
N/A 91.239.25.246:6892 udp
N/A 91.239.25.247:6892 udp
N/A 91.239.25.248:6892 udp
N/A 91.239.25.249:6892 udp
N/A 91.239.25.250:6892 udp
N/A 91.239.25.251:6892 udp
N/A 91.239.25.252:6892 udp
N/A 91.239.25.253:6892 udp
N/A 91.239.25.254:6892 udp
N/A 91.239.25.255:6892 udp
N/A 8.8.8.8:53 api.blockcypher.com udp
N/A 104.20.20.251:80 api.blockcypher.com tcp
N/A 8.8.8.8:53 btc.blockr.io udp
N/A 8.8.8.8:53 bitaps.com udp
N/A 178.128.255.179:443 bitaps.com tcp
N/A 95.101.78.82:80 ctldl.windowsupdate.com tcp
N/A 104.18.20.226:80 ocsp.globalsign.com tcp
N/A 104.18.20.226:80 ocsp2.globalsign.com tcp
N/A 8.8.8.8:53 chain.so udp
N/A 172.67.157.138:443 chain.so tcp
N/A 93.184.220.29:80 ocsp.digicert.com tcp
N/A 8.8.8.8:53 sochain.com udp
N/A 104.26.15.247:443 sochain.com tcp
N/A 8.8.8.8:53 p27dokhpz2n7nvgr.1lseoi.top udp

Files

\Users\Admin\AppData\Local\Temp\nsc1A45.tmp\System.dll

MD5 ca332bb753b0775d5e806e236ddcec55
SHA1 f35ef76592f20850baef2ebbd3c9a2cfb5ad8d8f
SHA256 df5ae79fa558dc7af244ec6e53939563b966e7dbd8867e114e928678dbd56e5d
SHA512 2de0956a1ad58ad7086e427e89b819089f2a7f1e4133ed2a0a736adc0614e8588ebe2d97f1b59ab8886d662aeb40e0b4838c6a65fbfc652253e3a45664a03a00

memory/1832-1-0x0000000000400000-0x0000000000437000-memory.dmp

memory/1832-2-0x0000000000403854-mapping.dmp

memory/2092-3-0x0000000002F80000-0x0000000002FB7000-memory.dmp

memory/1832-4-0x0000000000400000-0x0000000000437000-memory.dmp

memory/2948-5-0x0000000000000000-mapping.dmp

C:\Users\Admin\Desktop\_HELP_HELP_HELP_513AH.hta

MD5 e6adddc5bcf75b46204834387d46630c
SHA1 752df5399b655a3622cbd49c7c30f2f2d40e2f4b
SHA256 439dea2a9549b6c7749a5e6cb6d421920f2fc4760c952424eaf785aa739a546e
SHA512 7d662305029c253e64a66577c828ff4ae52a8a1a650f4fb461ba104010e236dc43bcabeb3909590fdf1801a2c03583cf19cae4394418043f0e25ef7670f75be9

memory/2664-11-0x0000000000000000-mapping.dmp

memory/3684-12-0x0000000000000000-mapping.dmp

memory/2032-13-0x0000000000000000-mapping.dmp