Malware Analysis Report

2025-01-02 15:05

Sample ID 201108-41q3g31xv6
Target e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64
SHA256 e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64
Tags
cerber evasion persistence ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64

Threat Level: Known bad

The file e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64 was found to be: Known bad.

Malicious Activity Summary

cerber evasion persistence ransomware

Cerber

Modifies Windows Firewall

Blacklisted process makes network request

Deletes itself

Drops startup file

Enumerates connected drives

Drops file in System32 directory

Sets desktop wallpaper using registry

Modifies service

Drops file in Windows directory

Drops file in Program Files directory

Runs ping.exe

Modifies Internet Explorer settings

Suspicious use of WriteProcessMemory

Modifies system certificate store

Opens file in notepad (likely ransom note)

Suspicious use of AdjustPrivilegeToken

Kills process with taskkill

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2020-11-08 14:32

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2020-11-08 14:31

Reported

2020-11-08 15:59

Platform

win7v20201028

Max time kernel

121s

Max time network

129s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe"

Signatures

Cerber

ransomware cerber

Blacklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A

Modifies Windows Firewall

evasion

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\b: C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened (read-only) \??\i: C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened (read-only) \??\k: C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened (read-only) \??\n: C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened (read-only) \??\o: C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened (read-only) \??\p: C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened (read-only) \??\r: C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened (read-only) \??\a: C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened (read-only) \??\y: C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened (read-only) \??\z: C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened (read-only) \??\w: C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened (read-only) \??\g: C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened (read-only) \??\h: C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened (read-only) \??\t: C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened (read-only) \??\f: C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened (read-only) \??\l: C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened (read-only) \??\s: C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened (read-only) \??\u: C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened (read-only) \??\v: C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened (read-only) \??\x: C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened (read-only) \??\j: C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened (read-only) \??\m: C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened (read-only) \??\q: C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened (read-only) \??\e: C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\powerpoint C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\powerpoint C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\steam C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\the bat! C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\excel C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft sql server C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\excel C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\outlook C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\word C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\outlook C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\outlook C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\steam C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\thunderbird C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\thunderbird C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\bitcoin C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\onenote C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\the bat! C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\word C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\powerpoint C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\word C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\bitcoin C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\excel C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\excel C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\microsoft sql server C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\office C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\outlook C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\onenote C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\powerpoint C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\documents C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft sql server C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\onenote C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\onenote C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\office C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\desktop C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\microsoft sql server C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\office C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\word C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\office C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A

Modifies service

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\LocalConfig C:\Windows\SysWOW64\netsh.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Shas C:\Windows\SysWOW64\netsh.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\UI C:\Windows\SysWOW64\netsh.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\Enroll\HcsGroups C:\Windows\SysWOW64\netsh.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Shas C:\Windows\SysWOW64\netsh.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Qecs C:\Windows\SysWOW64\netsh.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\UI C:\Windows\SysWOW64\netsh.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\LocalConfig C:\Windows\SysWOW64\netsh.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\Enroll\HcsGroups C:\Windows\SysWOW64\netsh.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Qecs C:\Windows\SysWOW64\netsh.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp2B83.bmp" C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification \??\c:\program files (x86)\onenote C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\program files (x86)\outlook C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\program files (x86)\steam C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\program files\ C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\program files (x86)\excel C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft sql server C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\microsoft sql server C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\powerpoint C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\program files (x86)\the bat! C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\program files (x86)\ C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\office C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\program files (x86)\office C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\program files (x86)\powerpoint C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\onenote C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\outlook C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\program files (x86)\thunderbird C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\program files (x86)\word C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\program files (x86)\bitcoin C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\excel C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\word C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\powerpoint C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\thunderbird C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\word C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\bitcoin C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\microsoft sql server C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\powerpoint C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\word C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\office C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\onenote C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\steam C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\documents C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\bitcoin C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\excel C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\outlook C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\office C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\powerpoint C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\excel C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\excel C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\word C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\microsoft sql server C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\microsoft sql server C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\office C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\office C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\office C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\bitcoin C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\excel C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\excel C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\powerpoint C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\word C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\desktop C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\onenote C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\powerpoint C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\word C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\outlook C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\the bat! C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\desktop C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft sql server C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\excel C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\office C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\onenote C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\the bat! C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\thunderbird C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\word C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft sql server C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft sql server C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\onenote C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\thunderbird C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\microsoft sql server C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\office C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\onenote C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\the bat! C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\ C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\bitcoin C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\outlook C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\documents C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\outlook C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\word C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\steam C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\outlook C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\steam C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\steam C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\onenote C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\onenote C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\outlook C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\onenote C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\outlook C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\powerpoint C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\powerpoint C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\the bat! C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft sql server C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\excel C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\office C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\thunderbird C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\word C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\excel C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\outlook C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\powerpoint C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b0b000000010000001600000047006c006f00620061006c005300690067006e0000005300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802020f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 C:\Windows\SysWOW64\mshta.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C C:\Windows\SysWOW64\mshta.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 C:\Windows\SysWOW64\mshta.exe N/A

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\NOTEPAD.EXE N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 308 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe C:\Windows\SysWOW64\netsh.exe
PID 308 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe C:\Windows\SysWOW64\netsh.exe
PID 308 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe C:\Windows\SysWOW64\netsh.exe
PID 308 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe C:\Windows\SysWOW64\netsh.exe
PID 308 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe C:\Windows\SysWOW64\netsh.exe
PID 308 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe C:\Windows\SysWOW64\netsh.exe
PID 308 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe C:\Windows\SysWOW64\netsh.exe
PID 308 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe C:\Windows\SysWOW64\netsh.exe
PID 308 wrote to memory of 396 N/A C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe C:\Windows\SysWOW64\mshta.exe
PID 308 wrote to memory of 396 N/A C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe C:\Windows\SysWOW64\mshta.exe
PID 308 wrote to memory of 396 N/A C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe C:\Windows\SysWOW64\mshta.exe
PID 308 wrote to memory of 396 N/A C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe C:\Windows\SysWOW64\mshta.exe
PID 308 wrote to memory of 332 N/A C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe C:\Windows\SysWOW64\NOTEPAD.EXE
PID 308 wrote to memory of 332 N/A C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe C:\Windows\SysWOW64\NOTEPAD.EXE
PID 308 wrote to memory of 332 N/A C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe C:\Windows\SysWOW64\NOTEPAD.EXE
PID 308 wrote to memory of 332 N/A C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe C:\Windows\SysWOW64\NOTEPAD.EXE
PID 308 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe C:\Windows\SysWOW64\cmd.exe
PID 308 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe C:\Windows\SysWOW64\cmd.exe
PID 308 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe C:\Windows\SysWOW64\cmd.exe
PID 308 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe C:\Windows\SysWOW64\cmd.exe
PID 1636 wrote to memory of 2000 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1636 wrote to memory of 2000 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1636 wrote to memory of 2000 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1636 wrote to memory of 2000 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1636 wrote to memory of 1520 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1636 wrote to memory of 1520 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1636 wrote to memory of 1520 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1636 wrote to memory of 1520 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe

"C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe"

C:\Windows\SysWOW64\netsh.exe

C:\Windows\system32\netsh.exe advfirewall set allprofiles state on

C:\Windows\SysWOW64\netsh.exe

C:\Windows\system32\netsh.exe advfirewall reset

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___AUXF39RL_.hta"

C:\Windows\SysWOW64\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___LQ58_.txt

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /d /c taskkill /f /im "e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe" > NUL && exit

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe"

C:\Windows\SysWOW64\PING.EXE

ping -n 1 127.0.0.1

Network

Country Destination Domain Proto
N/A 77.12.57.0:6893 udp
N/A 77.12.57.1:6893 udp
N/A 77.12.57.2:6893 udp
N/A 77.12.57.3:6893 udp
N/A 77.12.57.4:6893 udp
N/A 77.12.57.5:6893 udp
N/A 77.12.57.6:6893 udp
N/A 77.12.57.7:6893 udp
N/A 77.12.57.8:6893 udp
N/A 77.12.57.9:6893 udp
N/A 77.12.57.10:6893 udp
N/A 77.12.57.11:6893 udp
N/A 77.12.57.12:6893 udp
N/A 77.12.57.13:6893 udp
N/A 77.12.57.14:6893 udp
N/A 77.12.57.15:6893 udp
N/A 77.12.57.16:6893 udp
N/A 77.12.57.17:6893 udp
N/A 77.12.57.18:6893 udp
N/A 77.12.57.19:6893 udp
N/A 77.12.57.20:6893 udp
N/A 77.12.57.21:6893 udp
N/A 77.12.57.22:6893 udp
N/A 77.12.57.23:6893 udp
N/A 77.12.57.24:6893 udp
N/A 77.12.57.25:6893 udp
N/A 77.12.57.26:6893 udp
N/A 77.12.57.27:6893 udp
N/A 77.12.57.28:6893 udp
N/A 77.12.57.29:6893 udp
N/A 77.12.57.30:6893 udp
N/A 77.12.57.31:6893 udp
N/A 19.48.17.0:6893 udp
N/A 19.48.17.1:6893 udp
N/A 19.48.17.2:6893 udp
N/A 19.48.17.3:6893 udp
N/A 19.48.17.4:6893 udp
N/A 19.48.17.5:6893 udp
N/A 19.48.17.6:6893 udp
N/A 19.48.17.7:6893 udp
N/A 19.48.17.8:6893 udp
N/A 19.48.17.9:6893 udp
N/A 19.48.17.10:6893 udp
N/A 19.48.17.11:6893 udp
N/A 19.48.17.12:6893 udp
N/A 19.48.17.13:6893 udp
N/A 19.48.17.14:6893 udp
N/A 19.48.17.15:6893 udp
N/A 19.48.17.16:6893 udp
N/A 19.48.17.17:6893 udp
N/A 19.48.17.18:6893 udp
N/A 19.48.17.19:6893 udp
N/A 19.48.17.20:6893 udp
N/A 19.48.17.21:6893 udp
N/A 19.48.17.22:6893 udp
N/A 19.48.17.23:6893 udp
N/A 19.48.17.24:6893 udp
N/A 19.48.17.25:6893 udp
N/A 19.48.17.26:6893 udp
N/A 19.48.17.27:6893 udp
N/A 19.48.17.28:6893 udp
N/A 19.48.17.29:6893 udp
N/A 19.48.17.30:6893 udp
N/A 19.48.17.31:6893 udp
N/A 87.98.176.0:6893 udp
N/A 87.98.176.1:6893 udp
N/A 87.98.176.2:6893 udp
N/A 87.98.176.3:6893 udp
N/A 87.98.176.4:6893 udp
N/A 87.98.176.5:6893 udp
N/A 87.98.176.6:6893 udp
N/A 87.98.176.7:6893 udp
N/A 87.98.176.8:6893 udp
N/A 87.98.176.9:6893 udp
N/A 87.98.176.10:6893 udp
N/A 87.98.176.11:6893 udp
N/A 87.98.176.12:6893 udp
N/A 87.98.176.13:6893 udp
N/A 87.98.176.14:6893 udp
N/A 87.98.176.15:6893 udp
N/A 87.98.176.16:6893 udp
N/A 87.98.176.17:6893 udp
N/A 87.98.176.18:6893 udp
N/A 87.98.176.19:6893 udp
N/A 87.98.176.20:6893 udp
N/A 87.98.176.21:6893 udp
N/A 87.98.176.22:6893 udp
N/A 87.98.176.23:6893 udp
N/A 87.98.176.24:6893 udp
N/A 87.98.176.25:6893 udp
N/A 87.98.176.26:6893 udp
N/A 87.98.176.27:6893 udp
N/A 87.98.176.28:6893 udp
N/A 87.98.176.29:6893 udp
N/A 87.98.176.30:6893 udp
N/A 87.98.176.31:6893 udp
N/A 87.98.176.32:6893 udp
N/A 87.98.176.33:6893 udp
N/A 87.98.176.34:6893 udp
N/A 87.98.176.35:6893 udp
N/A 87.98.176.36:6893 udp
N/A 87.98.176.37:6893 udp
N/A 87.98.176.38:6893 udp
N/A 87.98.176.39:6893 udp
N/A 87.98.176.40:6893 udp
N/A 87.98.176.41:6893 udp
N/A 87.98.176.42:6893 udp
N/A 87.98.176.43:6893 udp
N/A 87.98.176.44:6893 udp
N/A 87.98.176.45:6893 udp
N/A 87.98.176.46:6893 udp
N/A 87.98.176.47:6893 udp
N/A 87.98.176.48:6893 udp
N/A 87.98.176.49:6893 udp
N/A 87.98.176.50:6893 udp
N/A 87.98.176.51:6893 udp
N/A 87.98.176.52:6893 udp
N/A 87.98.176.53:6893 udp
N/A 87.98.176.54:6893 udp
N/A 87.98.176.55:6893 udp
N/A 87.98.176.56:6893 udp
N/A 87.98.176.57:6893 udp
N/A 87.98.176.58:6893 udp
N/A 87.98.176.59:6893 udp
N/A 87.98.176.60:6893 udp
N/A 87.98.176.61:6893 udp
N/A 87.98.176.62:6893 udp
N/A 87.98.176.63:6893 udp
N/A 87.98.176.64:6893 udp
N/A 87.98.176.65:6893 udp
N/A 87.98.176.66:6893 udp
N/A 87.98.176.67:6893 udp
N/A 87.98.176.68:6893 udp
N/A 87.98.176.69:6893 udp
N/A 87.98.176.70:6893 udp
N/A 87.98.176.71:6893 udp
N/A 87.98.176.72:6893 udp
N/A 87.98.176.73:6893 udp
N/A 87.98.176.74:6893 udp
N/A 87.98.176.75:6893 udp
N/A 87.98.176.76:6893 udp
N/A 87.98.176.77:6893 udp
N/A 87.98.176.78:6893 udp
N/A 87.98.176.79:6893 udp
N/A 87.98.176.80:6893 udp
N/A 87.98.176.81:6893 udp
N/A 87.98.176.82:6893 udp
N/A 87.98.176.83:6893 udp
N/A 87.98.176.84:6893 udp
N/A 87.98.176.85:6893 udp
N/A 87.98.176.86:6893 udp
N/A 87.98.176.87:6893 udp
N/A 87.98.176.88:6893 udp
N/A 87.98.176.89:6893 udp
N/A 87.98.176.90:6893 udp
N/A 87.98.176.91:6893 udp
N/A 87.98.176.92:6893 udp
N/A 87.98.176.93:6893 udp
N/A 87.98.176.94:6893 udp
N/A 87.98.176.95:6893 udp
N/A 87.98.176.96:6893 udp
N/A 87.98.176.97:6893 udp
N/A 87.98.176.98:6893 udp
N/A 87.98.176.99:6893 udp
N/A 87.98.176.100:6893 udp
N/A 87.98.176.101:6893 udp
N/A 87.98.176.102:6893 udp
N/A 87.98.176.103:6893 udp
N/A 87.98.176.104:6893 udp
N/A 87.98.176.105:6893 udp
N/A 87.98.176.106:6893 udp
N/A 87.98.176.107:6893 udp
N/A 87.98.176.108:6893 udp
N/A 87.98.176.109:6893 udp
N/A 87.98.176.110:6893 udp
N/A 87.98.176.111:6893 udp
N/A 87.98.176.112:6893 udp
N/A 87.98.176.113:6893 udp
N/A 87.98.176.114:6893 udp
N/A 87.98.176.115:6893 udp
N/A 87.98.176.116:6893 udp
N/A 87.98.176.117:6893 udp
N/A 87.98.176.118:6893 udp
N/A 87.98.176.119:6893 udp
N/A 87.98.176.120:6893 udp
N/A 87.98.176.121:6893 udp
N/A 87.98.176.122:6893 udp
N/A 87.98.176.123:6893 udp
N/A 87.98.176.124:6893 udp
N/A 87.98.176.125:6893 udp
N/A 87.98.176.126:6893 udp
N/A 87.98.176.127:6893 udp
N/A 87.98.176.128:6893 udp
N/A 87.98.176.129:6893 udp
N/A 87.98.176.130:6893 udp
N/A 87.98.176.131:6893 udp
N/A 87.98.176.132:6893 udp
N/A 87.98.176.133:6893 udp
N/A 87.98.176.134:6893 udp
N/A 87.98.176.135:6893 udp
N/A 87.98.176.136:6893 udp
N/A 87.98.176.137:6893 udp
N/A 87.98.176.138:6893 udp
N/A 87.98.176.139:6893 udp
N/A 87.98.176.140:6893 udp
N/A 87.98.176.141:6893 udp
N/A 87.98.176.142:6893 udp
N/A 87.98.176.143:6893 udp
N/A 87.98.176.144:6893 udp
N/A 87.98.176.145:6893 udp
N/A 87.98.176.146:6893 udp
N/A 87.98.176.147:6893 udp
N/A 87.98.176.148:6893 udp
N/A 87.98.176.149:6893 udp
N/A 87.98.176.150:6893 udp
N/A 87.98.176.151:6893 udp
N/A 87.98.176.152:6893 udp
N/A 87.98.176.153:6893 udp
N/A 87.98.176.154:6893 udp
N/A 87.98.176.155:6893 udp
N/A 87.98.176.156:6893 udp
N/A 87.98.176.157:6893 udp
N/A 87.98.176.158:6893 udp
N/A 87.98.176.159:6893 udp
N/A 87.98.176.160:6893 udp
N/A 87.98.176.161:6893 udp
N/A 87.98.176.162:6893 udp
N/A 87.98.176.163:6893 udp
N/A 87.98.176.164:6893 udp
N/A 87.98.176.165:6893 udp
N/A 87.98.176.166:6893 udp
N/A 87.98.176.167:6893 udp
N/A 87.98.176.168:6893 udp
N/A 87.98.176.169:6893 udp
N/A 87.98.176.170:6893 udp
N/A 87.98.176.171:6893 udp
N/A 87.98.176.172:6893 udp
N/A 87.98.176.173:6893 udp
N/A 87.98.176.174:6893 udp
N/A 87.98.176.175:6893 udp
N/A 87.98.176.176:6893 udp
N/A 87.98.176.177:6893 udp
N/A 87.98.176.178:6893 udp
N/A 87.98.176.179:6893 udp
N/A 87.98.176.180:6893 udp
N/A 87.98.176.181:6893 udp
N/A 87.98.176.182:6893 udp
N/A 87.98.176.183:6893 udp
N/A 87.98.176.184:6893 udp
N/A 87.98.176.185:6893 udp
N/A 87.98.176.186:6893 udp
N/A 87.98.176.187:6893 udp
N/A 87.98.176.188:6893 udp
N/A 87.98.176.189:6893 udp
N/A 87.98.176.190:6893 udp
N/A 87.98.176.191:6893 udp
N/A 87.98.176.192:6893 udp
N/A 87.98.176.193:6893 udp
N/A 87.98.176.194:6893 udp
N/A 87.98.176.195:6893 udp
N/A 87.98.176.196:6893 udp
N/A 87.98.176.197:6893 udp
N/A 87.98.176.198:6893 udp
N/A 87.98.176.199:6893 udp
N/A 87.98.176.200:6893 udp
N/A 87.98.176.201:6893 udp
N/A 87.98.176.202:6893 udp
N/A 87.98.176.203:6893 udp
N/A 87.98.176.204:6893 udp
N/A 87.98.176.205:6893 udp
N/A 87.98.176.206:6893 udp
N/A 87.98.176.207:6893 udp
N/A 87.98.176.208:6893 udp
N/A 87.98.176.209:6893 udp
N/A 87.98.176.210:6893 udp
N/A 87.98.176.211:6893 udp
N/A 87.98.176.212:6893 udp
N/A 87.98.176.213:6893 udp
N/A 87.98.176.214:6893 udp
N/A 87.98.176.215:6893 udp
N/A 87.98.176.216:6893 udp
N/A 87.98.176.217:6893 udp
N/A 87.98.176.218:6893 udp
N/A 87.98.176.219:6893 udp
N/A 87.98.176.220:6893 udp
N/A 87.98.176.221:6893 udp
N/A 87.98.176.222:6893 udp
N/A 87.98.176.223:6893 udp
N/A 87.98.176.224:6893 udp
N/A 87.98.176.225:6893 udp
N/A 87.98.176.226:6893 udp
N/A 87.98.176.227:6893 udp
N/A 87.98.176.228:6893 udp
N/A 87.98.176.229:6893 udp
N/A 87.98.176.230:6893 udp
N/A 87.98.176.231:6893 udp
N/A 87.98.176.232:6893 udp
N/A 87.98.176.233:6893 udp
N/A 87.98.176.234:6893 udp
N/A 87.98.176.235:6893 udp
N/A 87.98.176.236:6893 udp
N/A 87.98.176.237:6893 udp
N/A 87.98.176.238:6893 udp
N/A 87.98.176.239:6893 udp
N/A 87.98.176.240:6893 udp
N/A 87.98.176.241:6893 udp
N/A 87.98.176.242:6893 udp
N/A 87.98.176.243:6893 udp
N/A 87.98.176.244:6893 udp
N/A 87.98.176.245:6893 udp
N/A 87.98.176.246:6893 udp
N/A 87.98.176.247:6893 udp
N/A 87.98.176.248:6893 udp
N/A 87.98.176.249:6893 udp
N/A 87.98.176.250:6893 udp
N/A 87.98.176.251:6893 udp
N/A 87.98.176.252:6893 udp
N/A 87.98.176.253:6893 udp
N/A 87.98.176.254:6893 udp
N/A 87.98.176.255:6893 udp
N/A 87.98.177.0:6893 udp
N/A 87.98.177.1:6893 udp
N/A 87.98.177.2:6893 udp
N/A 87.98.177.3:6893 udp
N/A 87.98.177.4:6893 udp
N/A 87.98.177.5:6893 udp
N/A 87.98.177.6:6893 udp
N/A 87.98.177.7:6893 udp
N/A 87.98.177.8:6893 udp
N/A 87.98.177.9:6893 udp
N/A 87.98.177.10:6893 udp
N/A 87.98.177.11:6893 udp
N/A 87.98.177.12:6893 udp
N/A 87.98.177.13:6893 udp
N/A 87.98.177.14:6893 udp
N/A 87.98.177.15:6893 udp
N/A 87.98.177.16:6893 udp
N/A 87.98.177.17:6893 udp
N/A 87.98.177.18:6893 udp
N/A 87.98.177.19:6893 udp
N/A 87.98.177.20:6893 udp
N/A 87.98.177.21:6893 udp
N/A 87.98.177.22:6893 udp
N/A 87.98.177.23:6893 udp
N/A 87.98.177.24:6893 udp
N/A 87.98.177.25:6893 udp
N/A 87.98.177.26:6893 udp
N/A 87.98.177.27:6893 udp
N/A 87.98.177.28:6893 udp
N/A 87.98.177.29:6893 udp
N/A 87.98.177.30:6893 udp
N/A 87.98.177.31:6893 udp
N/A 87.98.177.32:6893 udp
N/A 87.98.177.33:6893 udp
N/A 87.98.177.34:6893 udp
N/A 87.98.177.35:6893 udp
N/A 87.98.177.36:6893 udp
N/A 87.98.177.37:6893 udp
N/A 87.98.177.38:6893 udp
N/A 87.98.177.39:6893 udp
N/A 87.98.177.40:6893 udp
N/A 87.98.177.41:6893 udp
N/A 87.98.177.42:6893 udp
N/A 87.98.177.43:6893 udp
N/A 87.98.177.44:6893 udp
N/A 87.98.177.45:6893 udp
N/A 87.98.177.46:6893 udp
N/A 87.98.177.47:6893 udp
N/A 87.98.177.48:6893 udp
N/A 87.98.177.49:6893 udp
N/A 87.98.177.50:6893 udp
N/A 87.98.177.51:6893 udp
N/A 87.98.177.52:6893 udp
N/A 87.98.177.53:6893 udp
N/A 87.98.177.54:6893 udp
N/A 87.98.177.55:6893 udp
N/A 87.98.177.56:6893 udp
N/A 87.98.177.57:6893 udp
N/A 87.98.177.58:6893 udp
N/A 87.98.177.59:6893 udp
N/A 87.98.177.60:6893 udp
N/A 87.98.177.61:6893 udp
N/A 87.98.177.62:6893 udp
N/A 87.98.177.63:6893 udp
N/A 87.98.177.64:6893 udp
N/A 87.98.177.65:6893 udp
N/A 87.98.177.66:6893 udp
N/A 87.98.177.67:6893 udp
N/A 87.98.177.68:6893 udp
N/A 87.98.177.69:6893 udp
N/A 87.98.177.70:6893 udp
N/A 87.98.177.71:6893 udp
N/A 87.98.177.72:6893 udp
N/A 87.98.177.73:6893 udp
N/A 87.98.177.74:6893 udp
N/A 87.98.177.75:6893 udp
N/A 87.98.177.76:6893 udp
N/A 87.98.177.77:6893 udp
N/A 87.98.177.78:6893 udp
N/A 87.98.177.79:6893 udp
N/A 87.98.177.80:6893 udp
N/A 87.98.177.81:6893 udp
N/A 87.98.177.82:6893 udp
N/A 87.98.177.83:6893 udp
N/A 87.98.177.84:6893 udp
N/A 87.98.177.85:6893 udp
N/A 87.98.177.86:6893 udp
N/A 87.98.177.87:6893 udp
N/A 87.98.177.88:6893 udp
N/A 87.98.177.89:6893 udp
N/A 87.98.177.90:6893 udp
N/A 87.98.177.91:6893 udp
N/A 87.98.177.92:6893 udp
N/A 87.98.177.93:6893 udp
N/A 87.98.177.94:6893 udp
N/A 87.98.177.95:6893 udp
N/A 87.98.177.96:6893 udp
N/A 87.98.177.97:6893 udp
N/A 87.98.177.98:6893 udp
N/A 87.98.177.99:6893 udp
N/A 87.98.177.100:6893 udp
N/A 87.98.177.101:6893 udp
N/A 87.98.177.102:6893 udp
N/A 87.98.177.103:6893 udp
N/A 87.98.177.104:6893 udp
N/A 87.98.177.105:6893 udp
N/A 87.98.177.106:6893 udp
N/A 87.98.177.107:6893 udp
N/A 87.98.177.108:6893 udp
N/A 87.98.177.109:6893 udp
N/A 87.98.177.110:6893 udp
N/A 87.98.177.111:6893 udp
N/A 87.98.177.112:6893 udp
N/A 87.98.177.113:6893 udp
N/A 87.98.177.114:6893 udp
N/A 87.98.177.115:6893 udp
N/A 87.98.177.116:6893 udp
N/A 87.98.177.117:6893 udp
N/A 87.98.177.118:6893 udp
N/A 87.98.177.119:6893 udp
N/A 87.98.177.120:6893 udp
N/A 87.98.177.121:6893 udp
N/A 87.98.177.122:6893 udp
N/A 87.98.177.123:6893 udp
N/A 87.98.177.124:6893 udp
N/A 87.98.177.125:6893 udp
N/A 87.98.177.126:6893 udp
N/A 87.98.177.127:6893 udp
N/A 87.98.177.128:6893 udp
N/A 87.98.177.129:6893 udp
N/A 87.98.177.130:6893 udp
N/A 87.98.177.131:6893 udp
N/A 87.98.177.132:6893 udp
N/A 87.98.177.133:6893 udp
N/A 87.98.177.134:6893 udp
N/A 87.98.177.135:6893 udp
N/A 87.98.177.136:6893 udp
N/A 87.98.177.137:6893 udp
N/A 87.98.177.138:6893 udp
N/A 87.98.177.139:6893 udp
N/A 87.98.177.140:6893 udp
N/A 87.98.177.141:6893 udp
N/A 87.98.177.142:6893 udp
N/A 87.98.177.143:6893 udp
N/A 87.98.177.144:6893 udp
N/A 87.98.177.145:6893 udp
N/A 87.98.177.146:6893 udp
N/A 87.98.177.147:6893 udp
N/A 87.98.177.148:6893 udp
N/A 87.98.177.149:6893 udp
N/A 87.98.177.150:6893 udp
N/A 87.98.177.151:6893 udp
N/A 87.98.177.152:6893 udp
N/A 87.98.177.153:6893 udp
N/A 87.98.177.154:6893 udp
N/A 87.98.177.155:6893 udp
N/A 87.98.177.156:6893 udp
N/A 87.98.177.157:6893 udp
N/A 87.98.177.158:6893 udp
N/A 87.98.177.159:6893 udp
N/A 87.98.177.160:6893 udp
N/A 87.98.177.161:6893 udp
N/A 87.98.177.162:6893 udp
N/A 87.98.177.163:6893 udp
N/A 87.98.177.164:6893 udp
N/A 87.98.177.165:6893 udp
N/A 87.98.177.166:6893 udp
N/A 87.98.177.167:6893 udp
N/A 87.98.177.168:6893 udp
N/A 87.98.177.169:6893 udp
N/A 87.98.177.170:6893 udp
N/A 87.98.177.171:6893 udp
N/A 87.98.177.172:6893 udp
N/A 87.98.177.173:6893 udp
N/A 87.98.177.174:6893 udp
N/A 87.98.177.175:6893 udp
N/A 87.98.177.176:6893 udp
N/A 87.98.177.177:6893 udp
N/A 87.98.177.178:6893 udp
N/A 87.98.177.179:6893 udp
N/A 87.98.177.180:6893 udp
N/A 87.98.177.181:6893 udp
N/A 87.98.177.182:6893 udp
N/A 87.98.177.183:6893 udp
N/A 87.98.177.184:6893 udp
N/A 87.98.177.185:6893 udp
N/A 87.98.177.186:6893 udp
N/A 87.98.177.187:6893 udp
N/A 87.98.177.188:6893 udp
N/A 87.98.177.189:6893 udp
N/A 87.98.177.190:6893 udp
N/A 87.98.177.191:6893 udp
N/A 87.98.177.192:6893 udp
N/A 87.98.177.193:6893 udp
N/A 87.98.177.194:6893 udp
N/A 87.98.177.195:6893 udp
N/A 87.98.177.196:6893 udp
N/A 87.98.177.197:6893 udp
N/A 87.98.177.198:6893 udp
N/A 87.98.177.199:6893 udp
N/A 87.98.177.200:6893 udp
N/A 87.98.177.201:6893 udp
N/A 87.98.177.202:6893 udp
N/A 87.98.177.203:6893 udp
N/A 87.98.177.204:6893 udp
N/A 87.98.177.205:6893 udp
N/A 87.98.177.206:6893 udp
N/A 87.98.177.207:6893 udp
N/A 87.98.177.208:6893 udp
N/A 87.98.177.209:6893 udp
N/A 87.98.177.210:6893 udp
N/A 87.98.177.211:6893 udp
N/A 87.98.177.212:6893 udp
N/A 87.98.177.213:6893 udp
N/A 87.98.177.214:6893 udp
N/A 87.98.177.215:6893 udp
N/A 87.98.177.216:6893 udp
N/A 87.98.177.217:6893 udp
N/A 87.98.177.218:6893 udp
N/A 87.98.177.219:6893 udp
N/A 87.98.177.220:6893 udp
N/A 87.98.177.221:6893 udp
N/A 87.98.177.222:6893 udp
N/A 87.98.177.223:6893 udp
N/A 87.98.177.224:6893 udp
N/A 87.98.177.225:6893 udp
N/A 87.98.177.226:6893 udp
N/A 87.98.177.227:6893 udp
N/A 87.98.177.228:6893 udp
N/A 87.98.177.229:6893 udp
N/A 87.98.177.230:6893 udp
N/A 87.98.177.231:6893 udp
N/A 87.98.177.232:6893 udp
N/A 87.98.177.233:6893 udp
N/A 87.98.177.234:6893 udp
N/A 87.98.177.235:6893 udp
N/A 87.98.177.236:6893 udp
N/A 87.98.177.237:6893 udp
N/A 87.98.177.238:6893 udp
N/A 87.98.177.239:6893 udp
N/A 87.98.177.240:6893 udp
N/A 87.98.177.241:6893 udp
N/A 87.98.177.242:6893 udp
N/A 87.98.177.243:6893 udp
N/A 87.98.177.244:6893 udp
N/A 87.98.177.245:6893 udp
N/A 87.98.177.246:6893 udp
N/A 87.98.177.247:6893 udp
N/A 87.98.177.248:6893 udp
N/A 87.98.177.249:6893 udp
N/A 87.98.177.250:6893 udp
N/A 87.98.177.251:6893 udp
N/A 87.98.177.252:6893 udp
N/A 87.98.177.253:6893 udp
N/A 87.98.177.254:6893 udp
N/A 87.98.177.255:6893 udp
N/A 87.98.178.0:6893 udp
N/A 87.98.178.1:6893 udp
N/A 87.98.178.2:6893 udp
N/A 87.98.178.3:6893 udp
N/A 87.98.178.4:6893 udp
N/A 87.98.178.5:6893 udp
N/A 87.98.178.6:6893 udp
N/A 87.98.178.7:6893 udp
N/A 87.98.178.8:6893 udp
N/A 87.98.178.9:6893 udp
N/A 87.98.178.10:6893 udp
N/A 87.98.178.11:6893 udp
N/A 87.98.178.12:6893 udp
N/A 87.98.178.13:6893 udp
N/A 87.98.178.14:6893 udp
N/A 87.98.178.15:6893 udp
N/A 87.98.178.16:6893 udp
N/A 87.98.178.17:6893 udp
N/A 87.98.178.18:6893 udp
N/A 87.98.178.19:6893 udp
N/A 87.98.178.20:6893 udp
N/A 87.98.178.21:6893 udp
N/A 87.98.178.22:6893 udp
N/A 87.98.178.23:6893 udp
N/A 87.98.178.24:6893 udp
N/A 87.98.178.25:6893 udp
N/A 87.98.178.26:6893 udp
N/A 87.98.178.27:6893 udp
N/A 87.98.178.28:6893 udp
N/A 87.98.178.29:6893 udp
N/A 87.98.178.30:6893 udp
N/A 87.98.178.31:6893 udp
N/A 87.98.178.32:6893 udp
N/A 87.98.178.33:6893 udp
N/A 87.98.178.34:6893 udp
N/A 87.98.178.35:6893 udp
N/A 87.98.178.36:6893 udp
N/A 87.98.178.37:6893 udp
N/A 87.98.178.38:6893 udp
N/A 87.98.178.39:6893 udp
N/A 87.98.178.40:6893 udp
N/A 87.98.178.41:6893 udp
N/A 87.98.178.42:6893 udp
N/A 87.98.178.43:6893 udp
N/A 87.98.178.44:6893 udp
N/A 87.98.178.45:6893 udp
N/A 87.98.178.46:6893 udp
N/A 87.98.178.47:6893 udp
N/A 87.98.178.48:6893 udp
N/A 87.98.178.49:6893 udp
N/A 87.98.178.50:6893 udp
N/A 87.98.178.51:6893 udp
N/A 87.98.178.52:6893 udp
N/A 87.98.178.53:6893 udp
N/A 87.98.178.54:6893 udp
N/A 87.98.178.55:6893 udp
N/A 87.98.178.56:6893 udp
N/A 87.98.178.57:6893 udp
N/A 87.98.178.58:6893 udp
N/A 87.98.178.59:6893 udp
N/A 87.98.178.60:6893 udp
N/A 87.98.178.61:6893 udp
N/A 87.98.178.62:6893 udp
N/A 87.98.178.63:6893 udp
N/A 87.98.178.64:6893 udp
N/A 87.98.178.65:6893 udp
N/A 87.98.178.66:6893 udp
N/A 87.98.178.67:6893 udp
N/A 87.98.178.68:6893 udp
N/A 87.98.178.69:6893 udp
N/A 87.98.178.70:6893 udp
N/A 87.98.178.71:6893 udp
N/A 87.98.178.72:6893 udp
N/A 87.98.178.73:6893 udp
N/A 87.98.178.74:6893 udp
N/A 87.98.178.75:6893 udp
N/A 87.98.178.76:6893 udp
N/A 87.98.178.77:6893 udp
N/A 87.98.178.78:6893 udp
N/A 87.98.178.79:6893 udp
N/A 87.98.178.80:6893 udp
N/A 87.98.178.81:6893 udp
N/A 87.98.178.82:6893 udp
N/A 87.98.178.83:6893 udp
N/A 87.98.178.84:6893 udp
N/A 87.98.178.85:6893 udp
N/A 87.98.178.86:6893 udp
N/A 87.98.178.87:6893 udp
N/A 87.98.178.88:6893 udp
N/A 87.98.178.89:6893 udp
N/A 87.98.178.90:6893 udp
N/A 87.98.178.91:6893 udp
N/A 87.98.178.92:6893 udp
N/A 87.98.178.93:6893 udp
N/A 87.98.178.94:6893 udp
N/A 87.98.178.95:6893 udp
N/A 87.98.178.96:6893 udp
N/A 87.98.178.97:6893 udp
N/A 87.98.178.98:6893 udp
N/A 87.98.178.99:6893 udp
N/A 87.98.178.100:6893 udp
N/A 87.98.178.101:6893 udp
N/A 87.98.178.102:6893 udp
N/A 87.98.178.103:6893 udp
N/A 87.98.178.104:6893 udp
N/A 87.98.178.105:6893 udp
N/A 87.98.178.106:6893 udp
N/A 87.98.178.107:6893 udp
N/A 87.98.178.108:6893 udp
N/A 87.98.178.109:6893 udp
N/A 87.98.178.110:6893 udp
N/A 87.98.178.111:6893 udp
N/A 87.98.178.112:6893 udp
N/A 87.98.178.113:6893 udp
N/A 87.98.178.114:6893 udp
N/A 87.98.178.115:6893 udp
N/A 87.98.178.116:6893 udp
N/A 87.98.178.117:6893 udp
N/A 87.98.178.118:6893 udp
N/A 87.98.178.119:6893 udp
N/A 87.98.178.120:6893 udp
N/A 87.98.178.121:6893 udp
N/A 87.98.178.122:6893 udp
N/A 87.98.178.123:6893 udp
N/A 87.98.178.124:6893 udp
N/A 87.98.178.125:6893 udp
N/A 87.98.178.126:6893 udp
N/A 87.98.178.127:6893 udp
N/A 87.98.178.128:6893 udp
N/A 87.98.178.129:6893 udp
N/A 87.98.178.130:6893 udp
N/A 87.98.178.131:6893 udp
N/A 87.98.178.132:6893 udp
N/A 87.98.178.133:6893 udp
N/A 87.98.178.134:6893 udp
N/A 87.98.178.135:6893 udp
N/A 87.98.178.136:6893 udp
N/A 87.98.178.137:6893 udp
N/A 87.98.178.138:6893 udp
N/A 87.98.178.139:6893 udp
N/A 87.98.178.140:6893 udp
N/A 87.98.178.141:6893 udp
N/A 87.98.178.142:6893 udp
N/A 87.98.178.143:6893 udp
N/A 87.98.178.144:6893 udp
N/A 87.98.178.145:6893 udp
N/A 87.98.178.146:6893 udp
N/A 87.98.178.147:6893 udp
N/A 87.98.178.148:6893 udp
N/A 87.98.178.149:6893 udp
N/A 87.98.178.150:6893 udp
N/A 87.98.178.151:6893 udp
N/A 87.98.178.152:6893 udp
N/A 87.98.178.153:6893 udp
N/A 87.98.178.154:6893 udp
N/A 87.98.178.155:6893 udp
N/A 87.98.178.156:6893 udp
N/A 87.98.178.157:6893 udp
N/A 87.98.178.158:6893 udp
N/A 87.98.178.159:6893 udp
N/A 87.98.178.160:6893 udp
N/A 87.98.178.161:6893 udp
N/A 87.98.178.162:6893 udp
N/A 87.98.178.163:6893 udp
N/A 87.98.178.164:6893 udp
N/A 87.98.178.165:6893 udp
N/A 87.98.178.166:6893 udp
N/A 87.98.178.167:6893 udp
N/A 87.98.178.168:6893 udp
N/A 87.98.178.169:6893 udp
N/A 87.98.178.170:6893 udp
N/A 87.98.178.171:6893 udp
N/A 87.98.178.172:6893 udp
N/A 87.98.178.173:6893 udp
N/A 87.98.178.174:6893 udp
N/A 87.98.178.175:6893 udp
N/A 87.98.178.176:6893 udp
N/A 87.98.178.177:6893 udp
N/A 87.98.178.178:6893 udp
N/A 87.98.178.179:6893 udp
N/A 87.98.178.180:6893 udp
N/A 87.98.178.181:6893 udp
N/A 87.98.178.182:6893 udp
N/A 87.98.178.183:6893 udp
N/A 87.98.178.184:6893 udp
N/A 87.98.178.185:6893 udp
N/A 87.98.178.186:6893 udp
N/A 87.98.178.187:6893 udp
N/A 87.98.178.188:6893 udp
N/A 87.98.178.189:6893 udp
N/A 87.98.178.190:6893 udp
N/A 87.98.178.191:6893 udp
N/A 87.98.178.192:6893 udp
N/A 87.98.178.193:6893 udp
N/A 87.98.178.194:6893 udp
N/A 87.98.178.195:6893 udp
N/A 87.98.178.196:6893 udp
N/A 87.98.178.197:6893 udp
N/A 87.98.178.198:6893 udp
N/A 87.98.178.199:6893 udp
N/A 87.98.178.200:6893 udp
N/A 87.98.178.201:6893 udp
N/A 87.98.178.202:6893 udp
N/A 87.98.178.203:6893 udp
N/A 87.98.178.204:6893 udp
N/A 87.98.178.205:6893 udp
N/A 87.98.178.206:6893 udp
N/A 87.98.178.207:6893 udp
N/A 87.98.178.208:6893 udp
N/A 87.98.178.209:6893 udp
N/A 87.98.178.210:6893 udp
N/A 87.98.178.211:6893 udp
N/A 87.98.178.212:6893 udp
N/A 87.98.178.213:6893 udp
N/A 87.98.178.214:6893 udp
N/A 87.98.178.215:6893 udp
N/A 87.98.178.216:6893 udp
N/A 87.98.178.217:6893 udp
N/A 87.98.178.218:6893 udp
N/A 87.98.178.219:6893 udp
N/A 87.98.178.220:6893 udp
N/A 87.98.178.221:6893 udp
N/A 87.98.178.222:6893 udp
N/A 87.98.178.223:6893 udp
N/A 87.98.178.224:6893 udp
N/A 87.98.178.225:6893 udp
N/A 87.98.178.226:6893 udp
N/A 87.98.178.227:6893 udp
N/A 87.98.178.228:6893 udp
N/A 87.98.178.229:6893 udp
N/A 87.98.178.230:6893 udp
N/A 87.98.178.231:6893 udp
N/A 87.98.178.232:6893 udp
N/A 87.98.178.233:6893 udp
N/A 87.98.178.234:6893 udp
N/A 87.98.178.235:6893 udp
N/A 87.98.178.236:6893 udp
N/A 87.98.178.237:6893 udp
N/A 87.98.178.238:6893 udp
N/A 87.98.178.239:6893 udp
N/A 87.98.178.240:6893 udp
N/A 87.98.178.241:6893 udp
N/A 87.98.178.242:6893 udp
N/A 87.98.178.243:6893 udp
N/A 87.98.178.244:6893 udp
N/A 87.98.178.245:6893 udp
N/A 87.98.178.246:6893 udp
N/A 87.98.178.247:6893 udp
N/A 87.98.178.248:6893 udp
N/A 87.98.178.249:6893 udp
N/A 87.98.178.250:6893 udp
N/A 87.98.178.251:6893 udp
N/A 87.98.178.252:6893 udp
N/A 87.98.178.253:6893 udp
N/A 87.98.178.254:6893 udp
N/A 87.98.178.255:6893 udp
N/A 87.98.179.0:6893 udp
N/A 87.98.179.1:6893 udp
N/A 87.98.179.2:6893 udp
N/A 87.98.179.3:6893 udp
N/A 87.98.179.4:6893 udp
N/A 87.98.179.5:6893 udp
N/A 87.98.179.6:6893 udp
N/A 87.98.179.7:6893 udp
N/A 87.98.179.8:6893 udp
N/A 87.98.179.9:6893 udp
N/A 87.98.179.10:6893 udp
N/A 87.98.179.11:6893 udp
N/A 87.98.179.12:6893 udp
N/A 87.98.179.13:6893 udp
N/A 87.98.179.14:6893 udp
N/A 87.98.179.15:6893 udp
N/A 87.98.179.16:6893 udp
N/A 87.98.179.17:6893 udp
N/A 87.98.179.18:6893 udp
N/A 87.98.179.19:6893 udp
N/A 87.98.179.20:6893 udp
N/A 87.98.179.21:6893 udp
N/A 87.98.179.22:6893 udp
N/A 87.98.179.23:6893 udp
N/A 87.98.179.24:6893 udp
N/A 87.98.179.25:6893 udp
N/A 87.98.179.26:6893 udp
N/A 87.98.179.27:6893 udp
N/A 87.98.179.28:6893 udp
N/A 87.98.179.29:6893 udp
N/A 87.98.179.30:6893 udp
N/A 87.98.179.31:6893 udp
N/A 87.98.179.32:6893 udp
N/A 87.98.179.33:6893 udp
N/A 87.98.179.34:6893 udp
N/A 87.98.179.35:6893 udp
N/A 87.98.179.36:6893 udp
N/A 87.98.179.37:6893 udp
N/A 87.98.179.38:6893 udp
N/A 87.98.179.39:6893 udp
N/A 87.98.179.40:6893 udp
N/A 87.98.179.41:6893 udp
N/A 87.98.179.42:6893 udp
N/A 87.98.179.43:6893 udp
N/A 87.98.179.44:6893 udp
N/A 87.98.179.45:6893 udp
N/A 87.98.179.46:6893 udp
N/A 87.98.179.47:6893 udp
N/A 87.98.179.48:6893 udp
N/A 87.98.179.49:6893 udp
N/A 87.98.179.50:6893 udp
N/A 87.98.179.51:6893 udp
N/A 87.98.179.52:6893 udp
N/A 87.98.179.53:6893 udp
N/A 87.98.179.54:6893 udp
N/A 87.98.179.55:6893 udp
N/A 87.98.179.56:6893 udp
N/A 87.98.179.57:6893 udp
N/A 87.98.179.58:6893 udp
N/A 87.98.179.59:6893 udp
N/A 87.98.179.60:6893 udp
N/A 87.98.179.61:6893 udp
N/A 87.98.179.62:6893 udp
N/A 87.98.179.63:6893 udp
N/A 87.98.179.64:6893 udp
N/A 87.98.179.65:6893 udp
N/A 87.98.179.66:6893 udp
N/A 87.98.179.67:6893 udp
N/A 87.98.179.68:6893 udp
N/A 87.98.179.69:6893 udp
N/A 87.98.179.70:6893 udp
N/A 87.98.179.71:6893 udp
N/A 87.98.179.72:6893 udp
N/A 87.98.179.73:6893 udp
N/A 87.98.179.74:6893 udp
N/A 87.98.179.75:6893 udp
N/A 87.98.179.76:6893 udp
N/A 87.98.179.77:6893 udp
N/A 87.98.179.78:6893 udp
N/A 87.98.179.79:6893 udp
N/A 87.98.179.80:6893 udp
N/A 87.98.179.81:6893 udp
N/A 87.98.179.82:6893 udp
N/A 87.98.179.83:6893 udp
N/A 87.98.179.84:6893 udp
N/A 87.98.179.85:6893 udp
N/A 87.98.179.86:6893 udp
N/A 87.98.179.87:6893 udp
N/A 87.98.179.88:6893 udp
N/A 87.98.179.89:6893 udp
N/A 87.98.179.90:6893 udp
N/A 87.98.179.91:6893 udp
N/A 87.98.179.92:6893 udp
N/A 87.98.179.93:6893 udp
N/A 87.98.179.94:6893 udp
N/A 87.98.179.95:6893 udp
N/A 87.98.179.96:6893 udp
N/A 87.98.179.97:6893 udp
N/A 87.98.179.98:6893 udp
N/A 87.98.179.99:6893 udp
N/A 87.98.179.100:6893 udp
N/A 87.98.179.101:6893 udp
N/A 87.98.179.102:6893 udp
N/A 87.98.179.103:6893 udp
N/A 87.98.179.104:6893 udp
N/A 87.98.179.105:6893 udp
N/A 87.98.179.106:6893 udp
N/A 87.98.179.107:6893 udp
N/A 87.98.179.108:6893 udp
N/A 87.98.179.109:6893 udp
N/A 87.98.179.110:6893 udp
N/A 87.98.179.111:6893 udp
N/A 87.98.179.112:6893 udp
N/A 87.98.179.113:6893 udp
N/A 87.98.179.114:6893 udp
N/A 87.98.179.115:6893 udp
N/A 87.98.179.116:6893 udp
N/A 87.98.179.117:6893 udp
N/A 87.98.179.118:6893 udp
N/A 87.98.179.119:6893 udp
N/A 87.98.179.120:6893 udp
N/A 87.98.179.121:6893 udp
N/A 87.98.179.122:6893 udp
N/A 87.98.179.123:6893 udp
N/A 87.98.179.124:6893 udp
N/A 87.98.179.125:6893 udp
N/A 87.98.179.126:6893 udp
N/A 87.98.179.127:6893 udp
N/A 87.98.179.128:6893 udp
N/A 87.98.179.129:6893 udp
N/A 87.98.179.130:6893 udp
N/A 87.98.179.131:6893 udp
N/A 87.98.179.132:6893 udp
N/A 87.98.179.133:6893 udp
N/A 87.98.179.134:6893 udp
N/A 87.98.179.135:6893 udp
N/A 87.98.179.136:6893 udp
N/A 87.98.179.137:6893 udp
N/A 87.98.179.138:6893 udp
N/A 87.98.179.139:6893 udp
N/A 87.98.179.140:6893 udp
N/A 87.98.179.141:6893 udp
N/A 87.98.179.142:6893 udp
N/A 87.98.179.143:6893 udp
N/A 87.98.179.144:6893 udp
N/A 87.98.179.145:6893 udp
N/A 87.98.179.146:6893 udp
N/A 87.98.179.147:6893 udp
N/A 87.98.179.148:6893 udp
N/A 87.98.179.149:6893 udp
N/A 87.98.179.150:6893 udp
N/A 87.98.179.151:6893 udp
N/A 87.98.179.152:6893 udp
N/A 87.98.179.153:6893 udp
N/A 87.98.179.154:6893 udp
N/A 87.98.179.155:6893 udp
N/A 87.98.179.156:6893 udp
N/A 87.98.179.157:6893 udp
N/A 87.98.179.158:6893 udp
N/A 87.98.179.159:6893 udp
N/A 87.98.179.160:6893 udp
N/A 87.98.179.161:6893 udp
N/A 87.98.179.162:6893 udp
N/A 87.98.179.163:6893 udp
N/A 87.98.179.164:6893 udp
N/A 87.98.179.165:6893 udp
N/A 87.98.179.166:6893 udp
N/A 87.98.179.167:6893 udp
N/A 87.98.179.168:6893 udp
N/A 87.98.179.169:6893 udp
N/A 87.98.179.170:6893 udp
N/A 87.98.179.171:6893 udp
N/A 87.98.179.172:6893 udp
N/A 87.98.179.173:6893 udp
N/A 87.98.179.174:6893 udp
N/A 87.98.179.175:6893 udp
N/A 87.98.179.176:6893 udp
N/A 87.98.179.177:6893 udp
N/A 87.98.179.178:6893 udp
N/A 87.98.179.179:6893 udp
N/A 87.98.179.180:6893 udp
N/A 87.98.179.181:6893 udp
N/A 87.98.179.182:6893 udp
N/A 87.98.179.183:6893 udp
N/A 87.98.179.184:6893 udp
N/A 87.98.179.185:6893 udp
N/A 87.98.179.186:6893 udp
N/A 87.98.179.187:6893 udp
N/A 87.98.179.188:6893 udp
N/A 87.98.179.189:6893 udp
N/A 87.98.179.190:6893 udp
N/A 87.98.179.191:6893 udp
N/A 87.98.179.192:6893 udp
N/A 87.98.179.193:6893 udp
N/A 87.98.179.194:6893 udp
N/A 87.98.179.195:6893 udp
N/A 87.98.179.196:6893 udp
N/A 87.98.179.197:6893 udp
N/A 87.98.179.198:6893 udp
N/A 87.98.179.199:6893 udp
N/A 87.98.179.200:6893 udp
N/A 87.98.179.201:6893 udp
N/A 87.98.179.202:6893 udp
N/A 87.98.179.203:6893 udp
N/A 87.98.179.204:6893 udp
N/A 87.98.179.205:6893 udp
N/A 87.98.179.206:6893 udp
N/A 87.98.179.207:6893 udp
N/A 87.98.179.208:6893 udp
N/A 87.98.179.209:6893 udp
N/A 87.98.179.210:6893 udp
N/A 87.98.179.211:6893 udp
N/A 87.98.179.212:6893 udp
N/A 87.98.179.213:6893 udp
N/A 87.98.179.214:6893 udp
N/A 87.98.179.215:6893 udp
N/A 87.98.179.216:6893 udp
N/A 87.98.179.217:6893 udp
N/A 87.98.179.218:6893 udp
N/A 87.98.179.219:6893 udp
N/A 87.98.179.220:6893 udp
N/A 87.98.179.221:6893 udp
N/A 87.98.179.222:6893 udp
N/A 87.98.179.223:6893 udp
N/A 87.98.179.224:6893 udp
N/A 87.98.179.225:6893 udp
N/A 87.98.179.226:6893 udp
N/A 87.98.179.227:6893 udp
N/A 87.98.179.228:6893 udp
N/A 87.98.179.229:6893 udp
N/A 87.98.179.230:6893 udp
N/A 87.98.179.231:6893 udp
N/A 87.98.179.232:6893 udp
N/A 87.98.179.233:6893 udp
N/A 87.98.179.234:6893 udp
N/A 87.98.179.235:6893 udp
N/A 87.98.179.236:6893 udp
N/A 87.98.179.237:6893 udp
N/A 87.98.179.238:6893 udp
N/A 87.98.179.239:6893 udp
N/A 87.98.179.240:6893 udp
N/A 87.98.179.241:6893 udp
N/A 87.98.179.242:6893 udp
N/A 87.98.179.243:6893 udp
N/A 87.98.179.244:6893 udp
N/A 87.98.179.245:6893 udp
N/A 87.98.179.246:6893 udp
N/A 87.98.179.247:6893 udp
N/A 87.98.179.248:6893 udp
N/A 87.98.179.249:6893 udp
N/A 87.98.179.250:6893 udp
N/A 87.98.179.251:6893 udp
N/A 87.98.179.252:6893 udp
N/A 87.98.179.253:6893 udp
N/A 87.98.179.254:6893 udp
N/A 87.98.179.255:6893 udp
N/A 77.12.57.0:6893 udp
N/A 77.12.57.1:6893 udp
N/A 77.12.57.2:6893 udp
N/A 77.12.57.3:6893 udp
N/A 77.12.57.4:6893 udp
N/A 77.12.57.5:6893 udp
N/A 77.12.57.6:6893 udp
N/A 77.12.57.7:6893 udp
N/A 77.12.57.8:6893 udp
N/A 77.12.57.9:6893 udp
N/A 77.12.57.10:6893 udp
N/A 77.12.57.11:6893 udp
N/A 77.12.57.12:6893 udp
N/A 77.12.57.13:6893 udp
N/A 77.12.57.14:6893 udp
N/A 77.12.57.15:6893 udp
N/A 77.12.57.16:6893 udp
N/A 77.12.57.17:6893 udp
N/A 77.12.57.18:6893 udp
N/A 77.12.57.19:6893 udp
N/A 77.12.57.20:6893 udp
N/A 77.12.57.21:6893 udp
N/A 77.12.57.22:6893 udp
N/A 77.12.57.23:6893 udp
N/A 77.12.57.24:6893 udp
N/A 77.12.57.25:6893 udp
N/A 77.12.57.26:6893 udp
N/A 77.12.57.27:6893 udp
N/A 77.12.57.28:6893 udp
N/A 77.12.57.29:6893 udp
N/A 77.12.57.30:6893 udp
N/A 77.12.57.31:6893 udp
N/A 19.48.17.0:6893 udp
N/A 19.48.17.1:6893 udp
N/A 19.48.17.2:6893 udp
N/A 19.48.17.3:6893 udp
N/A 19.48.17.4:6893 udp
N/A 19.48.17.5:6893 udp
N/A 19.48.17.6:6893 udp
N/A 19.48.17.7:6893 udp
N/A 19.48.17.8:6893 udp
N/A 19.48.17.9:6893 udp
N/A 19.48.17.10:6893 udp
N/A 19.48.17.11:6893 udp
N/A 19.48.17.12:6893 udp
N/A 19.48.17.13:6893 udp
N/A 19.48.17.14:6893 udp
N/A 19.48.17.15:6893 udp
N/A 19.48.17.16:6893 udp
N/A 19.48.17.17:6893 udp
N/A 19.48.17.18:6893 udp
N/A 19.48.17.19:6893 udp
N/A 19.48.17.20:6893 udp
N/A 19.48.17.21:6893 udp
N/A 19.48.17.22:6893 udp
N/A 19.48.17.23:6893 udp
N/A 19.48.17.24:6893 udp
N/A 19.48.17.25:6893 udp
N/A 19.48.17.26:6893 udp
N/A 19.48.17.27:6893 udp
N/A 19.48.17.28:6893 udp
N/A 19.48.17.29:6893 udp
N/A 19.48.17.30:6893 udp
N/A 19.48.17.31:6893 udp
N/A 87.98.176.0:6893 udp
N/A 87.98.176.1:6893 udp
N/A 87.98.176.2:6893 udp
N/A 87.98.176.3:6893 udp
N/A 87.98.176.4:6893 udp
N/A 87.98.176.5:6893 udp
N/A 87.98.176.6:6893 udp
N/A 87.98.176.7:6893 udp
N/A 87.98.176.8:6893 udp
N/A 87.98.176.9:6893 udp
N/A 87.98.176.10:6893 udp
N/A 87.98.176.11:6893 udp
N/A 87.98.176.12:6893 udp
N/A 87.98.176.13:6893 udp
N/A 87.98.176.14:6893 udp
N/A 87.98.176.15:6893 udp
N/A 87.98.176.16:6893 udp
N/A 87.98.176.17:6893 udp
N/A 87.98.176.18:6893 udp
N/A 87.98.176.19:6893 udp
N/A 87.98.176.20:6893 udp
N/A 87.98.176.21:6893 udp
N/A 87.98.176.22:6893 udp
N/A 87.98.176.23:6893 udp
N/A 87.98.176.24:6893 udp
N/A 87.98.176.25:6893 udp
N/A 87.98.176.26:6893 udp
N/A 87.98.176.27:6893 udp
N/A 87.98.176.28:6893 udp
N/A 87.98.176.29:6893 udp
N/A 87.98.176.30:6893 udp
N/A 87.98.176.31:6893 udp
N/A 87.98.176.32:6893 udp
N/A 87.98.176.33:6893 udp
N/A 87.98.176.34:6893 udp
N/A 87.98.176.35:6893 udp
N/A 87.98.176.36:6893 udp
N/A 87.98.176.37:6893 udp
N/A 87.98.176.38:6893 udp
N/A 87.98.176.39:6893 udp
N/A 87.98.176.40:6893 udp
N/A 87.98.176.41:6893 udp
N/A 87.98.176.42:6893 udp
N/A 87.98.176.43:6893 udp
N/A 87.98.176.44:6893 udp
N/A 87.98.176.45:6893 udp
N/A 87.98.176.46:6893 udp
N/A 87.98.176.47:6893 udp
N/A 87.98.176.48:6893 udp
N/A 87.98.176.49:6893 udp
N/A 87.98.176.50:6893 udp
N/A 87.98.176.51:6893 udp
N/A 87.98.176.52:6893 udp
N/A 87.98.176.53:6893 udp
N/A 87.98.176.54:6893 udp
N/A 87.98.176.55:6893 udp
N/A 87.98.176.56:6893 udp
N/A 87.98.176.57:6893 udp
N/A 87.98.176.58:6893 udp
N/A 87.98.176.59:6893 udp
N/A 87.98.176.60:6893 udp
N/A 87.98.176.61:6893 udp
N/A 87.98.176.62:6893 udp
N/A 87.98.176.63:6893 udp
N/A 87.98.176.64:6893 udp
N/A 87.98.176.65:6893 udp
N/A 87.98.176.66:6893 udp
N/A 87.98.176.67:6893 udp
N/A 87.98.176.68:6893 udp
N/A 87.98.176.69:6893 udp
N/A 87.98.176.70:6893 udp
N/A 87.98.176.71:6893 udp
N/A 87.98.176.72:6893 udp
N/A 87.98.176.73:6893 udp
N/A 87.98.176.74:6893 udp
N/A 87.98.176.75:6893 udp
N/A 87.98.176.76:6893 udp
N/A 87.98.176.77:6893 udp
N/A 87.98.176.78:6893 udp
N/A 87.98.176.79:6893 udp
N/A 87.98.176.80:6893 udp
N/A 87.98.176.81:6893 udp
N/A 87.98.176.82:6893 udp
N/A 87.98.176.83:6893 udp
N/A 87.98.176.84:6893 udp
N/A 87.98.176.85:6893 udp
N/A 87.98.176.86:6893 udp
N/A 87.98.176.87:6893 udp
N/A 87.98.176.88:6893 udp
N/A 87.98.176.89:6893 udp
N/A 87.98.176.90:6893 udp
N/A 87.98.176.91:6893 udp
N/A 87.98.176.92:6893 udp
N/A 87.98.176.93:6893 udp
N/A 87.98.176.94:6893 udp
N/A 87.98.176.95:6893 udp
N/A 87.98.176.96:6893 udp
N/A 87.98.176.97:6893 udp
N/A 87.98.176.98:6893 udp
N/A 87.98.176.99:6893 udp
N/A 87.98.176.100:6893 udp
N/A 87.98.176.101:6893 udp
N/A 87.98.176.102:6893 udp
N/A 87.98.176.103:6893 udp
N/A 87.98.176.104:6893 udp
N/A 87.98.176.105:6893 udp
N/A 87.98.176.106:6893 udp
N/A 87.98.176.107:6893 udp
N/A 87.98.176.108:6893 udp
N/A 87.98.176.109:6893 udp
N/A 87.98.176.110:6893 udp
N/A 87.98.176.111:6893 udp
N/A 87.98.176.112:6893 udp
N/A 87.98.176.113:6893 udp
N/A 87.98.176.114:6893 udp
N/A 87.98.176.115:6893 udp
N/A 87.98.176.116:6893 udp
N/A 87.98.176.117:6893 udp
N/A 87.98.176.118:6893 udp
N/A 87.98.176.119:6893 udp
N/A 87.98.176.120:6893 udp
N/A 87.98.176.121:6893 udp
N/A 87.98.176.122:6893 udp
N/A 87.98.176.123:6893 udp
N/A 87.98.176.124:6893 udp
N/A 87.98.176.125:6893 udp
N/A 87.98.176.126:6893 udp
N/A 87.98.176.127:6893 udp
N/A 87.98.176.128:6893 udp
N/A 87.98.176.129:6893 udp
N/A 87.98.176.130:6893 udp
N/A 87.98.176.131:6893 udp
N/A 87.98.176.132:6893 udp
N/A 87.98.176.133:6893 udp
N/A 87.98.176.134:6893 udp
N/A 87.98.176.135:6893 udp
N/A 87.98.176.136:6893 udp
N/A 87.98.176.137:6893 udp
N/A 87.98.176.138:6893 udp
N/A 87.98.176.139:6893 udp
N/A 87.98.176.140:6893 udp
N/A 87.98.176.141:6893 udp
N/A 87.98.176.142:6893 udp
N/A 87.98.176.143:6893 udp
N/A 87.98.176.144:6893 udp
N/A 87.98.176.145:6893 udp
N/A 87.98.176.146:6893 udp
N/A 87.98.176.147:6893 udp
N/A 87.98.176.148:6893 udp
N/A 87.98.176.149:6893 udp
N/A 87.98.176.150:6893 udp
N/A 87.98.176.151:6893 udp
N/A 87.98.176.152:6893 udp
N/A 87.98.176.153:6893 udp
N/A 87.98.176.154:6893 udp
N/A 87.98.176.155:6893 udp
N/A 87.98.176.156:6893 udp
N/A 87.98.176.157:6893 udp
N/A 87.98.176.158:6893 udp
N/A 87.98.176.159:6893 udp
N/A 87.98.176.160:6893 udp
N/A 87.98.176.161:6893 udp
N/A 87.98.176.162:6893 udp
N/A 87.98.176.163:6893 udp
N/A 87.98.176.164:6893 udp
N/A 87.98.176.165:6893 udp
N/A 87.98.176.166:6893 udp
N/A 87.98.176.167:6893 udp
N/A 87.98.176.168:6893 udp
N/A 87.98.176.169:6893 udp
N/A 87.98.176.170:6893 udp
N/A 87.98.176.171:6893 udp
N/A 87.98.176.172:6893 udp
N/A 87.98.176.173:6893 udp
N/A 87.98.176.174:6893 udp
N/A 87.98.176.175:6893 udp
N/A 87.98.176.176:6893 udp
N/A 87.98.176.177:6893 udp
N/A 87.98.176.178:6893 udp
N/A 87.98.176.179:6893 udp
N/A 87.98.176.180:6893 udp
N/A 87.98.176.181:6893 udp
N/A 87.98.176.182:6893 udp
N/A 87.98.176.183:6893 udp
N/A 87.98.176.184:6893 udp
N/A 87.98.176.185:6893 udp
N/A 87.98.176.186:6893 udp
N/A 87.98.176.187:6893 udp
N/A 87.98.176.188:6893 udp
N/A 87.98.176.189:6893 udp
N/A 87.98.176.190:6893 udp
N/A 87.98.176.191:6893 udp
N/A 87.98.176.192:6893 udp
N/A 87.98.176.193:6893 udp
N/A 87.98.176.194:6893 udp
N/A 87.98.176.195:6893 udp
N/A 87.98.176.196:6893 udp
N/A 87.98.176.197:6893 udp
N/A 87.98.176.198:6893 udp
N/A 87.98.176.199:6893 udp
N/A 87.98.176.200:6893 udp
N/A 87.98.176.201:6893 udp
N/A 87.98.176.202:6893 udp
N/A 87.98.176.203:6893 udp
N/A 87.98.176.204:6893 udp
N/A 87.98.176.205:6893 udp
N/A 87.98.176.206:6893 udp
N/A 87.98.176.207:6893 udp
N/A 87.98.176.208:6893 udp
N/A 87.98.176.209:6893 udp
N/A 87.98.176.210:6893 udp
N/A 87.98.176.211:6893 udp
N/A 87.98.176.212:6893 udp
N/A 87.98.176.213:6893 udp
N/A 87.98.176.214:6893 udp
N/A 87.98.176.215:6893 udp
N/A 87.98.176.216:6893 udp
N/A 87.98.176.217:6893 udp
N/A 87.98.176.218:6893 udp
N/A 87.98.176.219:6893 udp
N/A 87.98.176.220:6893 udp
N/A 87.98.176.221:6893 udp
N/A 87.98.176.222:6893 udp
N/A 87.98.176.223:6893 udp
N/A 87.98.176.224:6893 udp
N/A 87.98.176.225:6893 udp
N/A 87.98.176.226:6893 udp
N/A 87.98.176.227:6893 udp
N/A 87.98.176.228:6893 udp
N/A 87.98.176.229:6893 udp
N/A 87.98.176.230:6893 udp
N/A 87.98.176.231:6893 udp
N/A 87.98.176.232:6893 udp
N/A 87.98.176.233:6893 udp
N/A 87.98.176.234:6893 udp
N/A 87.98.176.235:6893 udp
N/A 87.98.176.236:6893 udp
N/A 87.98.176.237:6893 udp
N/A 87.98.176.238:6893 udp
N/A 87.98.176.239:6893 udp
N/A 87.98.176.240:6893 udp
N/A 87.98.176.241:6893 udp
N/A 87.98.176.242:6893 udp
N/A 87.98.176.243:6893 udp
N/A 87.98.176.244:6893 udp
N/A 87.98.176.245:6893 udp
N/A 87.98.176.246:6893 udp
N/A 87.98.176.247:6893 udp
N/A 87.98.176.248:6893 udp
N/A 87.98.176.249:6893 udp
N/A 87.98.176.250:6893 udp
N/A 87.98.176.251:6893 udp
N/A 87.98.176.252:6893 udp
N/A 87.98.176.253:6893 udp
N/A 87.98.176.254:6893 udp
N/A 87.98.176.255:6893 udp
N/A 87.98.177.0:6893 udp
N/A 87.98.177.1:6893 udp
N/A 87.98.177.2:6893 udp
N/A 87.98.177.3:6893 udp
N/A 87.98.177.4:6893 udp
N/A 87.98.177.5:6893 udp
N/A 87.98.177.6:6893 udp
N/A 87.98.177.7:6893 udp
N/A 87.98.177.8:6893 udp
N/A 87.98.177.9:6893 udp
N/A 87.98.177.10:6893 udp
N/A 87.98.177.11:6893 udp
N/A 87.98.177.12:6893 udp
N/A 87.98.177.13:6893 udp
N/A 87.98.177.14:6893 udp
N/A 87.98.177.15:6893 udp
N/A 87.98.177.16:6893 udp
N/A 87.98.177.17:6893 udp
N/A 87.98.177.18:6893 udp
N/A 87.98.177.19:6893 udp
N/A 87.98.177.20:6893 udp
N/A 87.98.177.21:6893 udp
N/A 87.98.177.22:6893 udp
N/A 87.98.177.23:6893 udp
N/A 87.98.177.24:6893 udp
N/A 87.98.177.25:6893 udp
N/A 87.98.177.26:6893 udp
N/A 87.98.177.27:6893 udp
N/A 87.98.177.28:6893 udp
N/A 87.98.177.29:6893 udp
N/A 87.98.177.30:6893 udp
N/A 87.98.177.31:6893 udp
N/A 87.98.177.32:6893 udp
N/A 87.98.177.33:6893 udp
N/A 87.98.177.34:6893 udp
N/A 87.98.177.35:6893 udp
N/A 87.98.177.36:6893 udp
N/A 87.98.177.37:6893 udp
N/A 87.98.177.38:6893 udp
N/A 87.98.177.39:6893 udp
N/A 87.98.177.40:6893 udp
N/A 87.98.177.41:6893 udp
N/A 87.98.177.42:6893 udp
N/A 87.98.177.43:6893 udp
N/A 87.98.177.44:6893 udp
N/A 87.98.177.45:6893 udp
N/A 87.98.177.46:6893 udp
N/A 87.98.177.47:6893 udp
N/A 87.98.177.48:6893 udp
N/A 87.98.177.49:6893 udp
N/A 87.98.177.50:6893 udp
N/A 87.98.177.51:6893 udp
N/A 87.98.177.52:6893 udp
N/A 87.98.177.53:6893 udp
N/A 87.98.177.54:6893 udp
N/A 87.98.177.55:6893 udp
N/A 87.98.177.56:6893 udp
N/A 87.98.177.57:6893 udp
N/A 87.98.177.58:6893 udp
N/A 87.98.177.59:6893 udp
N/A 87.98.177.60:6893 udp
N/A 87.98.177.61:6893 udp
N/A 87.98.177.62:6893 udp
N/A 87.98.177.63:6893 udp
N/A 87.98.177.64:6893 udp
N/A 87.98.177.65:6893 udp
N/A 87.98.177.66:6893 udp
N/A 87.98.177.67:6893 udp
N/A 87.98.177.68:6893 udp
N/A 87.98.177.69:6893 udp
N/A 87.98.177.70:6893 udp
N/A 87.98.177.71:6893 udp
N/A 87.98.177.72:6893 udp
N/A 87.98.177.73:6893 udp
N/A 87.98.177.74:6893 udp
N/A 87.98.177.75:6893 udp
N/A 87.98.177.76:6893 udp
N/A 87.98.177.77:6893 udp
N/A 87.98.177.78:6893 udp
N/A 87.98.177.79:6893 udp
N/A 87.98.177.80:6893 udp
N/A 87.98.177.81:6893 udp
N/A 87.98.177.82:6893 udp
N/A 87.98.177.83:6893 udp
N/A 87.98.177.84:6893 udp
N/A 87.98.177.85:6893 udp
N/A 87.98.177.86:6893 udp
N/A 87.98.177.87:6893 udp
N/A 87.98.177.88:6893 udp
N/A 87.98.177.89:6893 udp
N/A 87.98.177.90:6893 udp
N/A 87.98.177.91:6893 udp
N/A 87.98.177.92:6893 udp
N/A 87.98.177.93:6893 udp
N/A 87.98.177.94:6893 udp
N/A 87.98.177.95:6893 udp
N/A 87.98.177.96:6893 udp
N/A 87.98.177.97:6893 udp
N/A 87.98.177.98:6893 udp
N/A 87.98.177.99:6893 udp
N/A 87.98.177.100:6893 udp
N/A 87.98.177.101:6893 udp
N/A 87.98.177.102:6893 udp
N/A 87.98.177.103:6893 udp
N/A 87.98.177.104:6893 udp
N/A 87.98.177.105:6893 udp
N/A 87.98.177.106:6893 udp
N/A 87.98.177.107:6893 udp
N/A 87.98.177.108:6893 udp
N/A 87.98.177.109:6893 udp
N/A 87.98.177.110:6893 udp
N/A 87.98.177.111:6893 udp
N/A 87.98.177.112:6893 udp
N/A 87.98.177.113:6893 udp
N/A 87.98.177.114:6893 udp
N/A 87.98.177.115:6893 udp
N/A 87.98.177.116:6893 udp
N/A 87.98.177.117:6893 udp
N/A 87.98.177.118:6893 udp
N/A 87.98.177.119:6893 udp
N/A 87.98.177.120:6893 udp
N/A 87.98.177.121:6893 udp
N/A 87.98.177.122:6893 udp
N/A 87.98.177.123:6893 udp
N/A 87.98.177.124:6893 udp
N/A 87.98.177.125:6893 udp
N/A 87.98.177.126:6893 udp
N/A 87.98.177.127:6893 udp
N/A 87.98.177.128:6893 udp
N/A 87.98.177.129:6893 udp
N/A 87.98.177.130:6893 udp
N/A 87.98.177.131:6893 udp
N/A 87.98.177.132:6893 udp
N/A 87.98.177.133:6893 udp
N/A 87.98.177.134:6893 udp
N/A 87.98.177.135:6893 udp
N/A 87.98.177.136:6893 udp
N/A 87.98.177.137:6893 udp
N/A 87.98.177.138:6893 udp
N/A 87.98.177.139:6893 udp
N/A 87.98.177.140:6893 udp
N/A 87.98.177.141:6893 udp
N/A 87.98.177.142:6893 udp
N/A 87.98.177.143:6893 udp
N/A 87.98.177.144:6893 udp
N/A 87.98.177.145:6893 udp
N/A 87.98.177.146:6893 udp
N/A 87.98.177.147:6893 udp
N/A 87.98.177.148:6893 udp
N/A 87.98.177.149:6893 udp
N/A 87.98.177.150:6893 udp
N/A 87.98.177.151:6893 udp
N/A 87.98.177.152:6893 udp
N/A 87.98.177.153:6893 udp
N/A 87.98.177.154:6893 udp
N/A 87.98.177.155:6893 udp
N/A 87.98.177.156:6893 udp
N/A 87.98.177.157:6893 udp
N/A 87.98.177.158:6893 udp
N/A 87.98.177.159:6893 udp
N/A 87.98.177.160:6893 udp
N/A 87.98.177.161:6893 udp
N/A 87.98.177.162:6893 udp
N/A 87.98.177.163:6893 udp
N/A 87.98.177.164:6893 udp
N/A 87.98.177.165:6893 udp
N/A 87.98.177.166:6893 udp
N/A 87.98.177.167:6893 udp
N/A 87.98.177.168:6893 udp
N/A 87.98.177.169:6893 udp
N/A 87.98.177.170:6893 udp
N/A 87.98.177.171:6893 udp
N/A 87.98.177.172:6893 udp
N/A 87.98.177.173:6893 udp
N/A 87.98.177.174:6893 udp
N/A 87.98.177.175:6893 udp
N/A 87.98.177.176:6893 udp
N/A 87.98.177.177:6893 udp
N/A 87.98.177.178:6893 udp
N/A 87.98.177.179:6893 udp
N/A 87.98.177.180:6893 udp
N/A 87.98.177.181:6893 udp
N/A 87.98.177.182:6893 udp
N/A 87.98.177.183:6893 udp
N/A 87.98.177.184:6893 udp
N/A 87.98.177.185:6893 udp
N/A 87.98.177.186:6893 udp
N/A 87.98.177.187:6893 udp
N/A 87.98.177.188:6893 udp
N/A 87.98.177.189:6893 udp
N/A 87.98.177.190:6893 udp
N/A 87.98.177.191:6893 udp
N/A 87.98.177.192:6893 udp
N/A 87.98.177.193:6893 udp
N/A 87.98.177.194:6893 udp
N/A 87.98.177.195:6893 udp
N/A 87.98.177.196:6893 udp
N/A 87.98.177.197:6893 udp
N/A 87.98.177.198:6893 udp
N/A 87.98.177.199:6893 udp
N/A 87.98.177.200:6893 udp
N/A 87.98.177.201:6893 udp
N/A 87.98.177.202:6893 udp
N/A 87.98.177.203:6893 udp
N/A 87.98.177.204:6893 udp
N/A 87.98.177.205:6893 udp
N/A 87.98.177.206:6893 udp
N/A 87.98.177.207:6893 udp
N/A 87.98.177.208:6893 udp
N/A 87.98.177.209:6893 udp
N/A 87.98.177.210:6893 udp
N/A 87.98.177.211:6893 udp
N/A 87.98.177.212:6893 udp
N/A 87.98.177.213:6893 udp
N/A 87.98.177.214:6893 udp
N/A 87.98.177.215:6893 udp
N/A 87.98.177.216:6893 udp
N/A 87.98.177.217:6893 udp
N/A 87.98.177.218:6893 udp
N/A 87.98.177.219:6893 udp
N/A 87.98.177.220:6893 udp
N/A 87.98.177.221:6893 udp
N/A 87.98.177.222:6893 udp
N/A 87.98.177.223:6893 udp
N/A 87.98.177.224:6893 udp
N/A 87.98.177.225:6893 udp
N/A 87.98.177.226:6893 udp
N/A 87.98.177.227:6893 udp
N/A 87.98.177.228:6893 udp
N/A 87.98.177.229:6893 udp
N/A 87.98.177.230:6893 udp
N/A 87.98.177.231:6893 udp
N/A 87.98.177.232:6893 udp
N/A 87.98.177.233:6893 udp
N/A 87.98.177.234:6893 udp
N/A 87.98.177.235:6893 udp
N/A 87.98.177.236:6893 udp
N/A 87.98.177.237:6893 udp
N/A 87.98.177.238:6893 udp
N/A 87.98.177.239:6893 udp
N/A 87.98.177.240:6893 udp
N/A 87.98.177.241:6893 udp
N/A 87.98.177.242:6893 udp
N/A 87.98.177.243:6893 udp
N/A 87.98.177.244:6893 udp
N/A 87.98.177.245:6893 udp
N/A 87.98.177.246:6893 udp
N/A 87.98.177.247:6893 udp
N/A 87.98.177.248:6893 udp
N/A 87.98.177.249:6893 udp
N/A 87.98.177.250:6893 udp
N/A 87.98.177.251:6893 udp
N/A 87.98.177.252:6893 udp
N/A 87.98.177.253:6893 udp
N/A 87.98.177.254:6893 udp
N/A 87.98.177.255:6893 udp
N/A 87.98.178.0:6893 udp
N/A 87.98.178.1:6893 udp
N/A 87.98.178.2:6893 udp
N/A 87.98.178.3:6893 udp
N/A 87.98.178.4:6893 udp
N/A 87.98.178.5:6893 udp
N/A 87.98.178.6:6893 udp
N/A 87.98.178.7:6893 udp
N/A 87.98.178.8:6893 udp
N/A 87.98.178.9:6893 udp
N/A 87.98.178.10:6893 udp
N/A 87.98.178.11:6893 udp
N/A 87.98.178.12:6893 udp
N/A 87.98.178.13:6893 udp
N/A 87.98.178.14:6893 udp
N/A 87.98.178.15:6893 udp
N/A 87.98.178.16:6893 udp
N/A 87.98.178.17:6893 udp
N/A 87.98.178.18:6893 udp
N/A 87.98.178.19:6893 udp
N/A 87.98.178.20:6893 udp
N/A 87.98.178.21:6893 udp
N/A 87.98.178.22:6893 udp
N/A 87.98.178.23:6893 udp
N/A 87.98.178.24:6893 udp
N/A 87.98.178.25:6893 udp
N/A 87.98.178.26:6893 udp
N/A 87.98.178.27:6893 udp
N/A 87.98.178.28:6893 udp
N/A 87.98.178.29:6893 udp
N/A 87.98.178.30:6893 udp
N/A 87.98.178.31:6893 udp
N/A 87.98.178.32:6893 udp
N/A 87.98.178.33:6893 udp
N/A 87.98.178.34:6893 udp
N/A 87.98.178.35:6893 udp
N/A 87.98.178.36:6893 udp
N/A 87.98.178.37:6893 udp
N/A 87.98.178.38:6893 udp
N/A 87.98.178.39:6893 udp
N/A 87.98.178.40:6893 udp
N/A 87.98.178.41:6893 udp
N/A 87.98.178.42:6893 udp
N/A 87.98.178.43:6893 udp
N/A 87.98.178.44:6893 udp
N/A 87.98.178.45:6893 udp
N/A 87.98.178.46:6893 udp
N/A 87.98.178.47:6893 udp
N/A 87.98.178.48:6893 udp
N/A 87.98.178.49:6893 udp
N/A 87.98.178.50:6893 udp
N/A 87.98.178.51:6893 udp
N/A 87.98.178.52:6893 udp
N/A 87.98.178.53:6893 udp
N/A 87.98.178.54:6893 udp
N/A 87.98.178.55:6893 udp
N/A 87.98.178.56:6893 udp
N/A 87.98.178.57:6893 udp
N/A 87.98.178.58:6893 udp
N/A 87.98.178.59:6893 udp
N/A 87.98.178.60:6893 udp
N/A 87.98.178.61:6893 udp
N/A 87.98.178.62:6893 udp
N/A 87.98.178.63:6893 udp
N/A 87.98.178.64:6893 udp
N/A 87.98.178.65:6893 udp
N/A 87.98.178.66:6893 udp
N/A 87.98.178.67:6893 udp
N/A 87.98.178.68:6893 udp
N/A 87.98.178.69:6893 udp
N/A 87.98.178.70:6893 udp
N/A 87.98.178.71:6893 udp
N/A 87.98.178.72:6893 udp
N/A 87.98.178.73:6893 udp
N/A 87.98.178.74:6893 udp
N/A 87.98.178.75:6893 udp
N/A 87.98.178.76:6893 udp
N/A 87.98.178.77:6893 udp
N/A 87.98.178.78:6893 udp
N/A 87.98.178.79:6893 udp
N/A 87.98.178.80:6893 udp
N/A 87.98.178.81:6893 udp
N/A 87.98.178.82:6893 udp
N/A 87.98.178.83:6893 udp
N/A 87.98.178.84:6893 udp
N/A 87.98.178.85:6893 udp
N/A 87.98.178.86:6893 udp
N/A 87.98.178.87:6893 udp
N/A 87.98.178.88:6893 udp
N/A 87.98.178.89:6893 udp
N/A 87.98.178.90:6893 udp
N/A 87.98.178.91:6893 udp
N/A 87.98.178.92:6893 udp
N/A 87.98.178.93:6893 udp
N/A 87.98.178.94:6893 udp
N/A 87.98.178.95:6893 udp
N/A 87.98.178.96:6893 udp
N/A 87.98.178.97:6893 udp
N/A 87.98.178.98:6893 udp
N/A 87.98.178.99:6893 udp
N/A 87.98.178.100:6893 udp
N/A 87.98.178.101:6893 udp
N/A 87.98.178.102:6893 udp
N/A 87.98.178.103:6893 udp
N/A 87.98.178.104:6893 udp
N/A 87.98.178.105:6893 udp
N/A 87.98.178.106:6893 udp
N/A 87.98.178.107:6893 udp
N/A 87.98.178.108:6893 udp
N/A 87.98.178.109:6893 udp
N/A 87.98.178.110:6893 udp
N/A 87.98.178.111:6893 udp
N/A 87.98.178.112:6893 udp
N/A 87.98.178.113:6893 udp
N/A 87.98.178.114:6893 udp
N/A 87.98.178.115:6893 udp
N/A 87.98.178.116:6893 udp
N/A 87.98.178.117:6893 udp
N/A 87.98.178.118:6893 udp
N/A 87.98.178.119:6893 udp
N/A 87.98.178.120:6893 udp
N/A 87.98.178.121:6893 udp
N/A 87.98.178.122:6893 udp
N/A 87.98.178.123:6893 udp
N/A 87.98.178.124:6893 udp
N/A 87.98.178.125:6893 udp
N/A 87.98.178.126:6893 udp
N/A 87.98.178.127:6893 udp
N/A 87.98.178.128:6893 udp
N/A 87.98.178.129:6893 udp
N/A 87.98.178.130:6893 udp
N/A 87.98.178.131:6893 udp
N/A 87.98.178.132:6893 udp
N/A 87.98.178.133:6893 udp
N/A 87.98.178.134:6893 udp
N/A 87.98.178.135:6893 udp
N/A 87.98.178.136:6893 udp
N/A 87.98.178.137:6893 udp
N/A 87.98.178.138:6893 udp
N/A 87.98.178.139:6893 udp
N/A 87.98.178.140:6893 udp
N/A 87.98.178.141:6893 udp
N/A 87.98.178.142:6893 udp
N/A 87.98.178.143:6893 udp
N/A 87.98.178.144:6893 udp
N/A 87.98.178.145:6893 udp
N/A 87.98.178.146:6893 udp
N/A 87.98.178.147:6893 udp
N/A 87.98.178.148:6893 udp
N/A 87.98.178.149:6893 udp
N/A 87.98.178.150:6893 udp
N/A 87.98.178.151:6893 udp
N/A 87.98.178.152:6893 udp
N/A 87.98.178.153:6893 udp
N/A 87.98.178.154:6893 udp
N/A 87.98.178.155:6893 udp
N/A 87.98.178.156:6893 udp
N/A 87.98.178.157:6893 udp
N/A 87.98.178.158:6893 udp
N/A 87.98.178.159:6893 udp
N/A 87.98.178.160:6893 udp
N/A 87.98.178.161:6893 udp
N/A 87.98.178.162:6893 udp
N/A 87.98.178.163:6893 udp
N/A 87.98.178.164:6893 udp
N/A 87.98.178.165:6893 udp
N/A 87.98.178.166:6893 udp
N/A 87.98.178.167:6893 udp
N/A 87.98.178.168:6893 udp
N/A 87.98.178.169:6893 udp
N/A 87.98.178.170:6893 udp
N/A 87.98.178.171:6893 udp
N/A 87.98.178.172:6893 udp
N/A 87.98.178.173:6893 udp
N/A 87.98.178.174:6893 udp
N/A 87.98.178.175:6893 udp
N/A 87.98.178.176:6893 udp
N/A 87.98.178.177:6893 udp
N/A 87.98.178.178:6893 udp
N/A 87.98.178.179:6893 udp
N/A 87.98.178.180:6893 udp
N/A 87.98.178.181:6893 udp
N/A 87.98.178.182:6893 udp
N/A 87.98.178.183:6893 udp
N/A 87.98.178.184:6893 udp
N/A 87.98.178.185:6893 udp
N/A 87.98.178.186:6893 udp
N/A 87.98.178.187:6893 udp
N/A 87.98.178.188:6893 udp
N/A 87.98.178.189:6893 udp
N/A 87.98.178.190:6893 udp
N/A 87.98.178.191:6893 udp
N/A 87.98.178.192:6893 udp
N/A 87.98.178.193:6893 udp
N/A 87.98.178.194:6893 udp
N/A 87.98.178.195:6893 udp
N/A 87.98.178.196:6893 udp
N/A 87.98.178.197:6893 udp
N/A 87.98.178.198:6893 udp
N/A 87.98.178.199:6893 udp
N/A 87.98.178.200:6893 udp
N/A 87.98.178.201:6893 udp
N/A 87.98.178.202:6893 udp
N/A 87.98.178.203:6893 udp
N/A 87.98.178.204:6893 udp
N/A 87.98.178.205:6893 udp
N/A 87.98.178.206:6893 udp
N/A 87.98.178.207:6893 udp
N/A 87.98.178.208:6893 udp
N/A 87.98.178.209:6893 udp
N/A 87.98.178.210:6893 udp
N/A 87.98.178.211:6893 udp
N/A 87.98.178.212:6893 udp
N/A 87.98.178.213:6893 udp
N/A 87.98.178.214:6893 udp
N/A 87.98.178.215:6893 udp
N/A 87.98.178.216:6893 udp
N/A 87.98.178.217:6893 udp
N/A 87.98.178.218:6893 udp
N/A 87.98.178.219:6893 udp
N/A 87.98.178.220:6893 udp
N/A 87.98.178.221:6893 udp
N/A 87.98.178.222:6893 udp
N/A 87.98.178.223:6893 udp
N/A 87.98.178.224:6893 udp
N/A 87.98.178.225:6893 udp
N/A 87.98.178.226:6893 udp
N/A 87.98.178.227:6893 udp
N/A 87.98.178.228:6893 udp
N/A 87.98.178.229:6893 udp
N/A 87.98.178.230:6893 udp
N/A 87.98.178.231:6893 udp
N/A 87.98.178.232:6893 udp
N/A 87.98.178.233:6893 udp
N/A 87.98.178.234:6893 udp
N/A 87.98.178.235:6893 udp
N/A 87.98.178.236:6893 udp
N/A 87.98.178.237:6893 udp
N/A 87.98.178.238:6893 udp
N/A 87.98.178.239:6893 udp
N/A 87.98.178.240:6893 udp
N/A 87.98.178.241:6893 udp
N/A 87.98.178.242:6893 udp
N/A 87.98.178.243:6893 udp
N/A 87.98.178.244:6893 udp
N/A 87.98.178.245:6893 udp
N/A 87.98.178.246:6893 udp
N/A 87.98.178.247:6893 udp
N/A 87.98.178.248:6893 udp
N/A 87.98.178.249:6893 udp
N/A 87.98.178.250:6893 udp
N/A 87.98.178.251:6893 udp
N/A 87.98.178.252:6893 udp
N/A 87.98.178.253:6893 udp
N/A 87.98.178.254:6893 udp
N/A 87.98.178.255:6893 udp
N/A 87.98.179.0:6893 udp
N/A 87.98.179.1:6893 udp
N/A 87.98.179.2:6893 udp
N/A 87.98.179.3:6893 udp
N/A 87.98.179.4:6893 udp
N/A 87.98.179.5:6893 udp
N/A 87.98.179.6:6893 udp
N/A 87.98.179.7:6893 udp
N/A 87.98.179.8:6893 udp
N/A 87.98.179.9:6893 udp
N/A 87.98.179.10:6893 udp
N/A 87.98.179.11:6893 udp
N/A 87.98.179.12:6893 udp
N/A 87.98.179.13:6893 udp
N/A 87.98.179.14:6893 udp
N/A 87.98.179.15:6893 udp
N/A 87.98.179.16:6893 udp
N/A 87.98.179.17:6893 udp
N/A 87.98.179.18:6893 udp
N/A 87.98.179.19:6893 udp
N/A 87.98.179.20:6893 udp
N/A 87.98.179.21:6893 udp
N/A 87.98.179.22:6893 udp
N/A 87.98.179.23:6893 udp
N/A 87.98.179.24:6893 udp
N/A 87.98.179.25:6893 udp
N/A 87.98.179.26:6893 udp
N/A 87.98.179.27:6893 udp
N/A 87.98.179.28:6893 udp
N/A 87.98.179.29:6893 udp
N/A 87.98.179.30:6893 udp
N/A 87.98.179.31:6893 udp
N/A 87.98.179.32:6893 udp
N/A 87.98.179.33:6893 udp
N/A 87.98.179.34:6893 udp
N/A 87.98.179.35:6893 udp
N/A 87.98.179.36:6893 udp
N/A 87.98.179.37:6893 udp
N/A 87.98.179.38:6893 udp
N/A 87.98.179.39:6893 udp
N/A 87.98.179.40:6893 udp
N/A 87.98.179.41:6893 udp
N/A 87.98.179.42:6893 udp
N/A 87.98.179.43:6893 udp
N/A 87.98.179.44:6893 udp
N/A 87.98.179.45:6893 udp
N/A 87.98.179.46:6893 udp
N/A 87.98.179.47:6893 udp
N/A 87.98.179.48:6893 udp
N/A 87.98.179.49:6893 udp
N/A 87.98.179.50:6893 udp
N/A 87.98.179.51:6893 udp
N/A 87.98.179.52:6893 udp
N/A 87.98.179.53:6893 udp
N/A 87.98.179.54:6893 udp
N/A 87.98.179.55:6893 udp
N/A 87.98.179.56:6893 udp
N/A 87.98.179.57:6893 udp
N/A 87.98.179.58:6893 udp
N/A 87.98.179.59:6893 udp
N/A 87.98.179.60:6893 udp
N/A 87.98.179.61:6893 udp
N/A 87.98.179.62:6893 udp
N/A 87.98.179.63:6893 udp
N/A 87.98.179.64:6893 udp
N/A 87.98.179.65:6893 udp
N/A 87.98.179.66:6893 udp
N/A 87.98.179.67:6893 udp
N/A 87.98.179.68:6893 udp
N/A 87.98.179.69:6893 udp
N/A 87.98.179.70:6893 udp
N/A 87.98.179.71:6893 udp
N/A 87.98.179.72:6893 udp
N/A 87.98.179.73:6893 udp
N/A 87.98.179.74:6893 udp
N/A 87.98.179.75:6893 udp
N/A 87.98.179.76:6893 udp
N/A 87.98.179.77:6893 udp
N/A 87.98.179.78:6893 udp
N/A 87.98.179.79:6893 udp
N/A 87.98.179.80:6893 udp
N/A 87.98.179.81:6893 udp
N/A 87.98.179.82:6893 udp
N/A 87.98.179.83:6893 udp
N/A 87.98.179.84:6893 udp
N/A 87.98.179.85:6893 udp
N/A 87.98.179.86:6893 udp
N/A 87.98.179.87:6893 udp
N/A 87.98.179.88:6893 udp
N/A 87.98.179.89:6893 udp
N/A 87.98.179.90:6893 udp
N/A 87.98.179.91:6893 udp
N/A 87.98.179.92:6893 udp
N/A 87.98.179.93:6893 udp
N/A 87.98.179.94:6893 udp
N/A 87.98.179.95:6893 udp
N/A 87.98.179.96:6893 udp
N/A 87.98.179.97:6893 udp
N/A 87.98.179.98:6893 udp
N/A 87.98.179.99:6893 udp
N/A 87.98.179.100:6893 udp
N/A 87.98.179.101:6893 udp
N/A 87.98.179.102:6893 udp
N/A 87.98.179.103:6893 udp
N/A 87.98.179.104:6893 udp
N/A 87.98.179.105:6893 udp
N/A 87.98.179.106:6893 udp
N/A 87.98.179.107:6893 udp
N/A 87.98.179.108:6893 udp
N/A 87.98.179.109:6893 udp
N/A 87.98.179.110:6893 udp
N/A 87.98.179.111:6893 udp
N/A 87.98.179.112:6893 udp
N/A 87.98.179.113:6893 udp
N/A 87.98.179.114:6893 udp
N/A 87.98.179.115:6893 udp
N/A 87.98.179.116:6893 udp
N/A 87.98.179.117:6893 udp
N/A 87.98.179.118:6893 udp
N/A 87.98.179.119:6893 udp
N/A 87.98.179.120:6893 udp
N/A 87.98.179.121:6893 udp
N/A 87.98.179.122:6893 udp
N/A 87.98.179.123:6893 udp
N/A 87.98.179.124:6893 udp
N/A 87.98.179.125:6893 udp
N/A 87.98.179.126:6893 udp
N/A 87.98.179.127:6893 udp
N/A 87.98.179.128:6893 udp
N/A 87.98.179.129:6893 udp
N/A 87.98.179.130:6893 udp
N/A 87.98.179.131:6893 udp
N/A 87.98.179.132:6893 udp
N/A 87.98.179.133:6893 udp
N/A 87.98.179.134:6893 udp
N/A 87.98.179.135:6893 udp
N/A 87.98.179.136:6893 udp
N/A 87.98.179.137:6893 udp
N/A 87.98.179.138:6893 udp
N/A 87.98.179.139:6893 udp
N/A 87.98.179.140:6893 udp
N/A 87.98.179.141:6893 udp
N/A 87.98.179.142:6893 udp
N/A 87.98.179.143:6893 udp
N/A 87.98.179.144:6893 udp
N/A 87.98.179.145:6893 udp
N/A 87.98.179.146:6893 udp
N/A 87.98.179.147:6893 udp
N/A 87.98.179.148:6893 udp
N/A 87.98.179.149:6893 udp
N/A 87.98.179.150:6893 udp
N/A 87.98.179.151:6893 udp
N/A 87.98.179.152:6893 udp
N/A 87.98.179.153:6893 udp
N/A 87.98.179.154:6893 udp
N/A 87.98.179.155:6893 udp
N/A 87.98.179.156:6893 udp
N/A 87.98.179.157:6893 udp
N/A 87.98.179.158:6893 udp
N/A 87.98.179.159:6893 udp
N/A 87.98.179.160:6893 udp
N/A 87.98.179.161:6893 udp
N/A 87.98.179.162:6893 udp
N/A 87.98.179.163:6893 udp
N/A 87.98.179.164:6893 udp
N/A 87.98.179.165:6893 udp
N/A 87.98.179.166:6893 udp
N/A 87.98.179.167:6893 udp
N/A 87.98.179.168:6893 udp
N/A 87.98.179.169:6893 udp
N/A 87.98.179.170:6893 udp
N/A 87.98.179.171:6893 udp
N/A 87.98.179.172:6893 udp
N/A 87.98.179.173:6893 udp
N/A 87.98.179.174:6893 udp
N/A 87.98.179.175:6893 udp
N/A 87.98.179.176:6893 udp
N/A 87.98.179.177:6893 udp
N/A 87.98.179.178:6893 udp
N/A 87.98.179.179:6893 udp
N/A 87.98.179.180:6893 udp
N/A 87.98.179.181:6893 udp
N/A 87.98.179.182:6893 udp
N/A 87.98.179.183:6893 udp
N/A 87.98.179.184:6893 udp
N/A 87.98.179.185:6893 udp
N/A 87.98.179.186:6893 udp
N/A 87.98.179.187:6893 udp
N/A 87.98.179.188:6893 udp
N/A 87.98.179.189:6893 udp
N/A 87.98.179.190:6893 udp
N/A 87.98.179.191:6893 udp
N/A 87.98.179.192:6893 udp
N/A 87.98.179.193:6893 udp
N/A 87.98.179.194:6893 udp
N/A 87.98.179.195:6893 udp
N/A 87.98.179.196:6893 udp
N/A 87.98.179.197:6893 udp
N/A 87.98.179.198:6893 udp
N/A 87.98.179.199:6893 udp
N/A 87.98.179.200:6893 udp
N/A 87.98.179.201:6893 udp
N/A 87.98.179.202:6893 udp
N/A 87.98.179.203:6893 udp
N/A 87.98.179.204:6893 udp
N/A 87.98.179.205:6893 udp
N/A 87.98.179.206:6893 udp
N/A 87.98.179.207:6893 udp
N/A 87.98.179.208:6893 udp
N/A 87.98.179.209:6893 udp
N/A 87.98.179.210:6893 udp
N/A 87.98.179.211:6893 udp
N/A 87.98.179.212:6893 udp
N/A 87.98.179.213:6893 udp
N/A 87.98.179.214:6893 udp
N/A 87.98.179.215:6893 udp
N/A 87.98.179.216:6893 udp
N/A 87.98.179.217:6893 udp
N/A 87.98.179.218:6893 udp
N/A 87.98.179.219:6893 udp
N/A 87.98.179.220:6893 udp
N/A 87.98.179.221:6893 udp
N/A 87.98.179.222:6893 udp
N/A 87.98.179.223:6893 udp
N/A 87.98.179.224:6893 udp
N/A 87.98.179.225:6893 udp
N/A 87.98.179.226:6893 udp
N/A 87.98.179.227:6893 udp
N/A 87.98.179.228:6893 udp
N/A 87.98.179.229:6893 udp
N/A 87.98.179.230:6893 udp
N/A 87.98.179.231:6893 udp
N/A 87.98.179.232:6893 udp
N/A 87.98.179.233:6893 udp
N/A 87.98.179.234:6893 udp
N/A 87.98.179.235:6893 udp
N/A 87.98.179.236:6893 udp
N/A 87.98.179.237:6893 udp
N/A 87.98.179.238:6893 udp
N/A 87.98.179.239:6893 udp
N/A 87.98.179.240:6893 udp
N/A 87.98.179.241:6893 udp
N/A 87.98.179.242:6893 udp
N/A 87.98.179.243:6893 udp
N/A 87.98.179.244:6893 udp
N/A 87.98.179.245:6893 udp
N/A 87.98.179.246:6893 udp
N/A 87.98.179.247:6893 udp
N/A 87.98.179.248:6893 udp
N/A 87.98.179.249:6893 udp
N/A 87.98.179.250:6893 udp
N/A 87.98.179.251:6893 udp
N/A 87.98.179.252:6893 udp
N/A 87.98.179.253:6893 udp
N/A 87.98.179.254:6893 udp
N/A 87.98.179.255:6893 udp
N/A 8.8.8.8:53 api.blockcypher.com udp
N/A 104.20.21.251:80 api.blockcypher.com tcp
N/A 8.8.8.8:53 btc.blockr.io udp
N/A 8.8.8.8:53 bitaps.com udp
N/A 178.128.255.179:443 bitaps.com tcp
N/A 8.8.8.8:53 www.download.windowsupdate.com udp
N/A 8.8.8.8:53 chain.so udp
N/A 104.24.104.254:443 chain.so tcp
N/A 8.8.8.8:53 crl.verisign.com udp

Files

memory/1192-0-0x0000000000000000-mapping.dmp

memory/1396-1-0x0000000000000000-mapping.dmp

memory/396-2-0x0000000000000000-mapping.dmp

memory/332-3-0x0000000000000000-mapping.dmp

C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___LQ58_.txt

MD5 9bab3f28dd6cc3f719cf20891eb258d5
SHA1 150f27009ff612797f6cf220d1e0889ed02431b9
SHA256 a65f86ed02d4619d97e492ddd6d8ba4e3a6de11e36b939355289a0530fd4dc7f
SHA512 6914eefe98fc4769a5cca5d3bc62124bd4e69bd53982a4497d78a1674fb2fb83ed4a425efa39f0da25dc368d6877caa4d303da4bccb9e857808d3dd1ac7fe716

C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___AUXF39RL_.hta

MD5 a3a20bb13bf345b802f7a7a8c252eadc
SHA1 cdd1c77f07afeaf73a105a6838b7740177245194
SHA256 f918f1090f1574005ab19b3a859d6dcdd2d29fce97df6788e682a6d5362674df
SHA512 88c340892468ce8281a5d49922dc620dd2ef75e0cf671a26c53ff6b2cd893ed78e48019827281549a70b741d8e0fab504bce493224d980da35048f139faa956c

memory/736-6-0x000007FEF7040000-0x000007FEF72BA000-memory.dmp

memory/1636-15-0x0000000000000000-mapping.dmp

memory/2000-16-0x0000000000000000-mapping.dmp

memory/1520-17-0x0000000000000000-mapping.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2020-11-08 14:31

Reported

2020-11-08 15:59

Platform

win10v20201028

Max time kernel

117s

Max time network

117s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe"

Signatures

Cerber

ransomware cerber

Blacklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A

Modifies Windows Firewall

evasion

Drops startup file

Description Indicator Process Target
File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\word\startup\ C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\a: C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened (read-only) \??\t: C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened (read-only) \??\u: C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened (read-only) \??\w: C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened (read-only) \??\l: C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened (read-only) \??\s: C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened (read-only) \??\z: C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened (read-only) \??\e: C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened (read-only) \??\g: C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened (read-only) \??\i: C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened (read-only) \??\k: C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened (read-only) \??\y: C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened (read-only) \??\f: C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened (read-only) \??\n: C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened (read-only) \??\q: C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened (read-only) \??\v: C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened (read-only) \??\o: C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened (read-only) \??\p: C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened (read-only) \??\r: C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened (read-only) \??\x: C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened (read-only) \??\b: C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened (read-only) \??\h: C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened (read-only) \??\j: C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened (read-only) \??\m: C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\powerpoint C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\the bat! C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\bitcoin C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\microsoft sql server C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\onenote C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\onenote C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\outlook C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft sql server C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\outlook C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\word C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\office C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\outlook C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\thunderbird C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\powerpoint C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\steam C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\word C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\excel C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\office C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\outlook C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\office C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\thunderbird C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\bitcoin C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\excel C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\onenote C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\word C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\documents C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\excel C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\excel C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\microsoft sql server C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\onenote C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\steam C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\the bat! C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\desktop C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft sql server C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\office C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\powerpoint C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\word C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\powerpoint C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp2471.bmp" C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification \??\c:\program files (x86)\excel C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\microsoft sql server C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\onenote C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\program files (x86)\onenote C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\program files (x86)\thunderbird C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft sql server C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\word C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\program files (x86)\office C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\program files (x86)\steam C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\program files\ C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\office C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\powerpoint C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\program files (x86)\powerpoint C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\program files (x86)\the bat! C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\program files (x86)\word C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\program files (x86)\ C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\program files (x86)\bitcoin C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\excel C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\outlook C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\program files (x86)\outlook C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\onenote C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\documents C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\bitcoin C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\excel C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\microsoft sql server C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\office C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\outlook C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\onenote C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\word C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\ C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\excel C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\office C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\powerpoint C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\outlook C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\outlook C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft sql server C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\office C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\onenote C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\office C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\thunderbird C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\word C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\excel C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\office C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\the bat! C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\the bat! C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\word C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft sql server C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\outlook C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\steam C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\thunderbird C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\excel C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\office C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\office C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\bitcoin C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\onenote C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\word C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\microsoft sql server C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\powerpoint C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\steam C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft sql server C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\outlook C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\powerpoint C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\powerpoint C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\desktop C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\bitcoin C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\onenote C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\word C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\office C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\onenote C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\onenote C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\word C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\word C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\the bat! C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\thunderbird C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\documents C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\bitcoin C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft sql server C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\excel C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\powerpoint C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\excel C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\microsoft sql server C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\onenote C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\word C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\excel C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\outlook C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\powerpoint C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\steam C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\excel C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\outlook C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\steam C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\the bat! C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\desktop C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\microsoft sql server C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\powerpoint C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\outlook C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\powerpoint C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\thunderbird C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\NOTEPAD.EXE N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1020 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe C:\Windows\SysWOW64\netsh.exe
PID 1020 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe C:\Windows\SysWOW64\netsh.exe
PID 1020 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe C:\Windows\SysWOW64\netsh.exe
PID 1020 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe C:\Windows\SysWOW64\netsh.exe
PID 1020 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe C:\Windows\SysWOW64\netsh.exe
PID 1020 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe C:\Windows\SysWOW64\netsh.exe
PID 1020 wrote to memory of 3668 N/A C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe C:\Windows\SysWOW64\mshta.exe
PID 1020 wrote to memory of 3668 N/A C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe C:\Windows\SysWOW64\mshta.exe
PID 1020 wrote to memory of 3668 N/A C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe C:\Windows\SysWOW64\mshta.exe
PID 1020 wrote to memory of 3232 N/A C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe C:\Windows\SysWOW64\NOTEPAD.EXE
PID 1020 wrote to memory of 3232 N/A C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe C:\Windows\SysWOW64\NOTEPAD.EXE
PID 1020 wrote to memory of 3232 N/A C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe C:\Windows\SysWOW64\NOTEPAD.EXE
PID 1020 wrote to memory of 212 N/A C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe C:\Windows\SysWOW64\cmd.exe
PID 1020 wrote to memory of 212 N/A C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe C:\Windows\SysWOW64\cmd.exe
PID 1020 wrote to memory of 212 N/A C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe C:\Windows\SysWOW64\cmd.exe
PID 212 wrote to memory of 1600 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 212 wrote to memory of 1600 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 212 wrote to memory of 1600 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 212 wrote to memory of 2968 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 212 wrote to memory of 2968 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 212 wrote to memory of 2968 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe

"C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe"

C:\Windows\SysWOW64\netsh.exe

C:\Windows\system32\netsh.exe advfirewall set allprofiles state on

C:\Windows\SysWOW64\netsh.exe

C:\Windows\system32\netsh.exe advfirewall reset

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___8GRBUW_.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___66ZATB_.txt

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /d /c taskkill /f /im "e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe" > NUL && exit

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "e5348cbab8d7d3b245db81c6db8bdf6102db8afd231a8b6836d985d3d0878e64.exe"

C:\Windows\SysWOW64\PING.EXE

ping -n 1 127.0.0.1

Network

Country Destination Domain Proto
N/A 77.12.57.0:6893 udp
N/A 77.12.57.1:6893 udp
N/A 77.12.57.2:6893 udp
N/A 77.12.57.3:6893 udp
N/A 77.12.57.4:6893 udp
N/A 77.12.57.5:6893 udp
N/A 77.12.57.6:6893 udp
N/A 77.12.57.7:6893 udp
N/A 77.12.57.8:6893 udp
N/A 77.12.57.9:6893 udp
N/A 77.12.57.10:6893 udp
N/A 77.12.57.11:6893 udp
N/A 77.12.57.12:6893 udp
N/A 77.12.57.13:6893 udp
N/A 77.12.57.14:6893 udp
N/A 77.12.57.15:6893 udp
N/A 77.12.57.16:6893 udp
N/A 77.12.57.17:6893 udp
N/A 77.12.57.18:6893 udp
N/A 77.12.57.19:6893 udp
N/A 77.12.57.20:6893 udp
N/A 77.12.57.21:6893 udp
N/A 77.12.57.22:6893 udp
N/A 77.12.57.23:6893 udp
N/A 77.12.57.24:6893 udp
N/A 77.12.57.25:6893 udp
N/A 77.12.57.26:6893 udp
N/A 77.12.57.27:6893 udp
N/A 77.12.57.28:6893 udp
N/A 77.12.57.29:6893 udp
N/A 77.12.57.30:6893 udp
N/A 77.12.57.31:6893 udp
N/A 19.48.17.0:6893 udp
N/A 19.48.17.1:6893 udp
N/A 19.48.17.2:6893 udp
N/A 19.48.17.3:6893 udp
N/A 19.48.17.4:6893 udp
N/A 19.48.17.5:6893 udp
N/A 19.48.17.6:6893 udp
N/A 19.48.17.7:6893 udp
N/A 19.48.17.8:6893 udp
N/A 19.48.17.9:6893 udp
N/A 19.48.17.10:6893 udp
N/A 19.48.17.11:6893 udp
N/A 19.48.17.12:6893 udp
N/A 19.48.17.13:6893 udp
N/A 19.48.17.14:6893 udp
N/A 19.48.17.15:6893 udp
N/A 19.48.17.16:6893 udp
N/A 19.48.17.17:6893 udp
N/A 19.48.17.18:6893 udp
N/A 19.48.17.19:6893 udp
N/A 19.48.17.20:6893 udp
N/A 19.48.17.21:6893 udp
N/A 19.48.17.22:6893 udp
N/A 19.48.17.23:6893 udp
N/A 19.48.17.24:6893 udp
N/A 19.48.17.25:6893 udp
N/A 19.48.17.26:6893 udp
N/A 19.48.17.27:6893 udp
N/A 19.48.17.28:6893 udp
N/A 19.48.17.29:6893 udp
N/A 19.48.17.30:6893 udp
N/A 19.48.17.31:6893 udp
N/A 87.98.176.0:6893 udp
N/A 87.98.176.1:6893 udp
N/A 87.98.176.2:6893 udp
N/A 87.98.176.3:6893 udp
N/A 87.98.176.4:6893 udp
N/A 87.98.176.5:6893 udp
N/A 87.98.176.6:6893 udp
N/A 87.98.176.7:6893 udp
N/A 87.98.176.8:6893 udp
N/A 87.98.176.9:6893 udp
N/A 87.98.176.10:6893 udp
N/A 87.98.176.11:6893 udp
N/A 87.98.176.12:6893 udp
N/A 87.98.176.13:6893 udp
N/A 87.98.176.14:6893 udp
N/A 87.98.176.15:6893 udp
N/A 87.98.176.16:6893 udp
N/A 87.98.176.17:6893 udp
N/A 87.98.176.18:6893 udp
N/A 87.98.176.19:6893 udp
N/A 87.98.176.20:6893 udp
N/A 87.98.176.21:6893 udp
N/A 87.98.176.22:6893 udp
N/A 87.98.176.23:6893 udp
N/A 87.98.176.24:6893 udp
N/A 87.98.176.25:6893 udp
N/A 87.98.176.26:6893 udp
N/A 87.98.176.27:6893 udp
N/A 87.98.176.28:6893 udp
N/A 87.98.176.29:6893 udp
N/A 87.98.176.30:6893 udp
N/A 87.98.176.31:6893 udp
N/A 87.98.176.32:6893 udp
N/A 87.98.176.33:6893 udp
N/A 87.98.176.34:6893 udp
N/A 87.98.176.35:6893 udp
N/A 87.98.176.36:6893 udp
N/A 87.98.176.37:6893 udp
N/A 87.98.176.38:6893 udp
N/A 87.98.176.39:6893 udp
N/A 87.98.176.40:6893 udp
N/A 87.98.176.41:6893 udp
N/A 87.98.176.42:6893 udp
N/A 87.98.176.43:6893 udp
N/A 87.98.176.44:6893 udp
N/A 87.98.176.45:6893 udp
N/A 87.98.176.46:6893 udp
N/A 87.98.176.47:6893 udp
N/A 87.98.176.48:6893 udp
N/A 87.98.176.49:6893 udp
N/A 87.98.176.50:6893 udp
N/A 87.98.176.51:6893 udp
N/A 87.98.176.52:6893 udp
N/A 87.98.176.53:6893 udp
N/A 87.98.176.54:6893 udp
N/A 87.98.176.55:6893 udp
N/A 87.98.176.56:6893 udp
N/A 87.98.176.57:6893 udp
N/A 87.98.176.58:6893 udp
N/A 87.98.176.59:6893 udp
N/A 87.98.176.60:6893 udp
N/A 87.98.176.61:6893 udp
N/A 87.98.176.62:6893 udp
N/A 87.98.176.63:6893 udp
N/A 87.98.176.64:6893 udp
N/A 87.98.176.65:6893 udp
N/A 87.98.176.66:6893 udp
N/A 87.98.176.67:6893 udp
N/A 87.98.176.68:6893 udp
N/A 87.98.176.69:6893 udp
N/A 87.98.176.70:6893 udp
N/A 87.98.176.71:6893 udp
N/A 87.98.176.72:6893 udp
N/A 87.98.176.73:6893 udp
N/A 87.98.176.74:6893 udp
N/A 87.98.176.75:6893 udp
N/A 87.98.176.76:6893 udp
N/A 87.98.176.77:6893 udp
N/A 87.98.176.78:6893 udp
N/A 87.98.176.79:6893 udp
N/A 87.98.176.80:6893 udp
N/A 87.98.176.81:6893 udp
N/A 87.98.176.82:6893 udp
N/A 87.98.176.83:6893 udp
N/A 87.98.176.84:6893 udp
N/A 87.98.176.85:6893 udp
N/A 87.98.176.86:6893 udp
N/A 87.98.176.87:6893 udp
N/A 87.98.176.88:6893 udp
N/A 87.98.176.89:6893 udp
N/A 87.98.176.90:6893 udp
N/A 87.98.176.91:6893 udp
N/A 87.98.176.92:6893 udp
N/A 87.98.176.93:6893 udp
N/A 87.98.176.94:6893 udp
N/A 87.98.176.95:6893 udp
N/A 87.98.176.96:6893 udp
N/A 87.98.176.97:6893 udp
N/A 87.98.176.98:6893 udp
N/A 87.98.176.99:6893 udp
N/A 87.98.176.100:6893 udp
N/A 87.98.176.101:6893 udp
N/A 87.98.176.102:6893 udp
N/A 87.98.176.103:6893 udp
N/A 87.98.176.104:6893 udp
N/A 87.98.176.105:6893 udp
N/A 87.98.176.106:6893 udp
N/A 87.98.176.107:6893 udp
N/A 87.98.176.108:6893 udp
N/A 87.98.176.109:6893 udp
N/A 87.98.176.110:6893 udp
N/A 87.98.176.111:6893 udp
N/A 87.98.176.112:6893 udp
N/A 87.98.176.113:6893 udp
N/A 87.98.176.114:6893 udp
N/A 87.98.176.115:6893 udp
N/A 87.98.176.116:6893 udp
N/A 87.98.176.117:6893 udp
N/A 87.98.176.118:6893 udp
N/A 87.98.176.119:6893 udp
N/A 87.98.176.120:6893 udp
N/A 87.98.176.121:6893 udp
N/A 87.98.176.122:6893 udp
N/A 87.98.176.123:6893 udp
N/A 87.98.176.124:6893 udp
N/A 87.98.176.125:6893 udp
N/A 87.98.176.126:6893 udp
N/A 87.98.176.127:6893 udp
N/A 87.98.176.128:6893 udp
N/A 87.98.176.129:6893 udp
N/A 87.98.176.130:6893 udp
N/A 87.98.176.131:6893 udp
N/A 87.98.176.132:6893 udp
N/A 87.98.176.133:6893 udp
N/A 87.98.176.134:6893 udp
N/A 87.98.176.135:6893 udp
N/A 87.98.176.136:6893 udp
N/A 87.98.176.137:6893 udp
N/A 87.98.176.138:6893 udp
N/A 87.98.176.139:6893 udp
N/A 87.98.176.140:6893 udp
N/A 87.98.176.141:6893 udp
N/A 87.98.176.142:6893 udp
N/A 87.98.176.143:6893 udp
N/A 87.98.176.144:6893 udp
N/A 87.98.176.145:6893 udp
N/A 87.98.176.146:6893 udp
N/A 87.98.176.147:6893 udp
N/A 87.98.176.148:6893 udp
N/A 87.98.176.149:6893 udp
N/A 87.98.176.150:6893 udp
N/A 87.98.176.151:6893 udp
N/A 87.98.176.152:6893 udp
N/A 87.98.176.153:6893 udp
N/A 87.98.176.154:6893 udp
N/A 87.98.176.155:6893 udp
N/A 87.98.176.156:6893 udp
N/A 87.98.176.157:6893 udp
N/A 87.98.176.158:6893 udp
N/A 87.98.176.159:6893 udp
N/A 87.98.176.160:6893 udp
N/A 87.98.176.161:6893 udp
N/A 87.98.176.162:6893 udp
N/A 87.98.176.163:6893 udp
N/A 87.98.176.164:6893 udp
N/A 87.98.176.165:6893 udp
N/A 87.98.176.166:6893 udp
N/A 87.98.176.167:6893 udp
N/A 87.98.176.168:6893 udp
N/A 87.98.176.169:6893 udp
N/A 87.98.176.170:6893 udp
N/A 87.98.176.171:6893 udp
N/A 87.98.176.172:6893 udp
N/A 87.98.176.173:6893 udp
N/A 87.98.176.174:6893 udp
N/A 87.98.176.175:6893 udp
N/A 87.98.176.176:6893 udp
N/A 87.98.176.177:6893 udp
N/A 87.98.176.178:6893 udp
N/A 87.98.176.179:6893 udp
N/A 87.98.176.180:6893 udp
N/A 87.98.176.181:6893 udp
N/A 87.98.176.182:6893 udp
N/A 87.98.176.183:6893 udp
N/A 87.98.176.184:6893 udp
N/A 87.98.176.185:6893 udp
N/A 87.98.176.186:6893 udp
N/A 87.98.176.187:6893 udp
N/A 87.98.176.188:6893 udp
N/A 87.98.176.189:6893 udp
N/A 87.98.176.190:6893 udp
N/A 87.98.176.191:6893 udp
N/A 87.98.176.192:6893 udp
N/A 87.98.176.193:6893 udp
N/A 87.98.176.194:6893 udp
N/A 87.98.176.195:6893 udp
N/A 87.98.176.196:6893 udp
N/A 87.98.176.197:6893 udp
N/A 87.98.176.198:6893 udp
N/A 87.98.176.199:6893 udp
N/A 87.98.176.200:6893 udp
N/A 87.98.176.201:6893 udp
N/A 87.98.176.202:6893 udp
N/A 87.98.176.203:6893 udp
N/A 87.98.176.204:6893 udp
N/A 87.98.176.205:6893 udp
N/A 87.98.176.206:6893 udp
N/A 87.98.176.207:6893 udp
N/A 87.98.176.208:6893 udp
N/A 87.98.176.209:6893 udp
N/A 87.98.176.210:6893 udp
N/A 87.98.176.211:6893 udp
N/A 87.98.176.212:6893 udp
N/A 87.98.176.213:6893 udp
N/A 87.98.176.214:6893 udp
N/A 87.98.176.215:6893 udp
N/A 87.98.176.216:6893 udp
N/A 87.98.176.217:6893 udp
N/A 87.98.176.218:6893 udp
N/A 87.98.176.219:6893 udp
N/A 87.98.176.220:6893 udp
N/A 87.98.176.221:6893 udp
N/A 87.98.176.222:6893 udp
N/A 87.98.176.223:6893 udp
N/A 87.98.176.224:6893 udp
N/A 87.98.176.225:6893 udp
N/A 87.98.176.226:6893 udp
N/A 87.98.176.227:6893 udp
N/A 87.98.176.228:6893 udp
N/A 87.98.176.229:6893 udp
N/A 87.98.176.230:6893 udp
N/A 87.98.176.231:6893 udp
N/A 87.98.176.232:6893 udp
N/A 87.98.176.233:6893 udp
N/A 87.98.176.234:6893 udp
N/A 87.98.176.235:6893 udp
N/A 87.98.176.236:6893 udp
N/A 87.98.176.237:6893 udp
N/A 87.98.176.238:6893 udp
N/A 87.98.176.239:6893 udp
N/A 87.98.176.240:6893 udp
N/A 87.98.176.241:6893 udp
N/A 87.98.176.242:6893 udp
N/A 87.98.176.243:6893 udp
N/A 87.98.176.244:6893 udp
N/A 87.98.176.245:6893 udp
N/A 87.98.176.246:6893 udp
N/A 87.98.176.247:6893 udp
N/A 87.98.176.248:6893 udp
N/A 87.98.176.249:6893 udp
N/A 87.98.176.250:6893 udp
N/A 87.98.176.251:6893 udp
N/A 87.98.176.252:6893 udp
N/A 87.98.176.253:6893 udp
N/A 87.98.176.254:6893 udp
N/A 87.98.176.255:6893 udp
N/A 87.98.177.0:6893 udp
N/A 87.98.177.1:6893 udp
N/A 87.98.177.2:6893 udp
N/A 87.98.177.3:6893 udp
N/A 87.98.177.4:6893 udp
N/A 87.98.177.5:6893 udp
N/A 87.98.177.6:6893 udp
N/A 87.98.177.7:6893 udp
N/A 87.98.177.8:6893 udp
N/A 87.98.177.9:6893 udp
N/A 87.98.177.10:6893 udp
N/A 87.98.177.11:6893 udp
N/A 87.98.177.12:6893 udp
N/A 87.98.177.13:6893 udp
N/A 87.98.177.14:6893 udp
N/A 87.98.177.15:6893 udp
N/A 87.98.177.16:6893 udp
N/A 87.98.177.17:6893 udp
N/A 87.98.177.18:6893 udp
N/A 87.98.177.19:6893 udp
N/A 87.98.177.20:6893 udp
N/A 87.98.177.21:6893 udp
N/A 87.98.177.22:6893 udp
N/A 87.98.177.23:6893 udp
N/A 87.98.177.24:6893 udp
N/A 87.98.177.25:6893 udp
N/A 87.98.177.26:6893 udp
N/A 87.98.177.27:6893 udp
N/A 87.98.177.28:6893 udp
N/A 87.98.177.29:6893 udp
N/A 87.98.177.30:6893 udp
N/A 87.98.177.31:6893 udp
N/A 87.98.177.32:6893 udp
N/A 87.98.177.33:6893 udp
N/A 87.98.177.34:6893 udp
N/A 87.98.177.35:6893 udp
N/A 87.98.177.36:6893 udp
N/A 87.98.177.37:6893 udp
N/A 87.98.177.38:6893 udp
N/A 87.98.177.39:6893 udp
N/A 87.98.177.40:6893 udp
N/A 87.98.177.41:6893 udp
N/A 87.98.177.42:6893 udp
N/A 87.98.177.43:6893 udp
N/A 87.98.177.44:6893 udp
N/A 87.98.177.45:6893 udp
N/A 87.98.177.46:6893 udp
N/A 87.98.177.47:6893 udp
N/A 87.98.177.48:6893 udp
N/A 87.98.177.49:6893 udp
N/A 87.98.177.50:6893 udp
N/A 87.98.177.51:6893 udp
N/A 87.98.177.52:6893 udp
N/A 87.98.177.53:6893 udp
N/A 87.98.177.54:6893 udp
N/A 87.98.177.55:6893 udp
N/A 87.98.177.56:6893 udp
N/A 87.98.177.57:6893 udp
N/A 87.98.177.58:6893 udp
N/A 87.98.177.59:6893 udp
N/A 87.98.177.60:6893 udp
N/A 87.98.177.61:6893 udp
N/A 87.98.177.62:6893 udp
N/A 87.98.177.63:6893 udp
N/A 87.98.177.64:6893 udp
N/A 87.98.177.65:6893 udp
N/A 87.98.177.66:6893 udp
N/A 87.98.177.67:6893 udp
N/A 87.98.177.68:6893 udp
N/A 87.98.177.69:6893 udp
N/A 87.98.177.70:6893 udp
N/A 87.98.177.71:6893 udp
N/A 87.98.177.72:6893 udp
N/A 87.98.177.73:6893 udp
N/A 87.98.177.74:6893 udp
N/A 87.98.177.75:6893 udp
N/A 87.98.177.76:6893 udp
N/A 87.98.177.77:6893 udp
N/A 87.98.177.78:6893 udp
N/A 87.98.177.79:6893 udp
N/A 87.98.177.80:6893 udp
N/A 87.98.177.81:6893 udp
N/A 87.98.177.82:6893 udp
N/A 87.98.177.83:6893 udp
N/A 87.98.177.84:6893 udp
N/A 87.98.177.85:6893 udp
N/A 87.98.177.86:6893 udp
N/A 87.98.177.87:6893 udp
N/A 87.98.177.88:6893 udp
N/A 87.98.177.89:6893 udp
N/A 87.98.177.90:6893 udp
N/A 87.98.177.91:6893 udp
N/A 87.98.177.92:6893 udp
N/A 87.98.177.93:6893 udp
N/A 87.98.177.94:6893 udp
N/A 87.98.177.95:6893 udp
N/A 87.98.177.96:6893 udp
N/A 87.98.177.97:6893 udp
N/A 87.98.177.98:6893 udp
N/A 87.98.177.99:6893 udp
N/A 87.98.177.100:6893 udp
N/A 87.98.177.101:6893 udp
N/A 87.98.177.102:6893 udp
N/A 87.98.177.103:6893 udp
N/A 87.98.177.104:6893 udp
N/A 87.98.177.105:6893 udp
N/A 87.98.177.106:6893 udp
N/A 87.98.177.107:6893 udp
N/A 87.98.177.108:6893 udp
N/A 87.98.177.109:6893 udp
N/A 87.98.177.110:6893 udp
N/A 87.98.177.111:6893 udp
N/A 87.98.177.112:6893 udp
N/A 87.98.177.113:6893 udp
N/A 87.98.177.114:6893 udp
N/A 87.98.177.115:6893 udp
N/A 87.98.177.116:6893 udp
N/A 87.98.177.117:6893 udp
N/A 87.98.177.118:6893 udp
N/A 87.98.177.119:6893 udp
N/A 87.98.177.120:6893 udp
N/A 87.98.177.121:6893 udp
N/A 87.98.177.122:6893 udp
N/A 87.98.177.123:6893 udp
N/A 87.98.177.124:6893 udp
N/A 87.98.177.125:6893 udp
N/A 87.98.177.126:6893 udp
N/A 87.98.177.127:6893 udp
N/A 87.98.177.128:6893 udp
N/A 87.98.177.129:6893 udp
N/A 87.98.177.130:6893 udp
N/A 87.98.177.131:6893 udp
N/A 87.98.177.132:6893 udp
N/A 87.98.177.133:6893 udp
N/A 87.98.177.134:6893 udp
N/A 87.98.177.135:6893 udp
N/A 87.98.177.136:6893 udp
N/A 87.98.177.137:6893 udp
N/A 87.98.177.138:6893 udp
N/A 87.98.177.139:6893 udp
N/A 87.98.177.140:6893 udp
N/A 87.98.177.141:6893 udp
N/A 87.98.177.142:6893 udp
N/A 87.98.177.143:6893 udp
N/A 87.98.177.144:6893 udp
N/A 87.98.177.145:6893 udp
N/A 87.98.177.146:6893 udp
N/A 87.98.177.147:6893 udp
N/A 87.98.177.148:6893 udp
N/A 87.98.177.149:6893 udp
N/A 87.98.177.150:6893 udp
N/A 87.98.177.151:6893 udp
N/A 87.98.177.152:6893 udp
N/A 87.98.177.153:6893 udp
N/A 87.98.177.154:6893 udp
N/A 87.98.177.155:6893 udp
N/A 87.98.177.156:6893 udp
N/A 87.98.177.157:6893 udp
N/A 87.98.177.158:6893 udp
N/A 87.98.177.159:6893 udp
N/A 87.98.177.160:6893 udp
N/A 87.98.177.161:6893 udp
N/A 87.98.177.162:6893 udp
N/A 87.98.177.163:6893 udp
N/A 87.98.177.164:6893 udp
N/A 87.98.177.165:6893 udp
N/A 87.98.177.166:6893 udp
N/A 87.98.177.167:6893 udp
N/A 87.98.177.168:6893 udp
N/A 87.98.177.169:6893 udp
N/A 87.98.177.170:6893 udp
N/A 87.98.177.171:6893 udp
N/A 87.98.177.172:6893 udp
N/A 87.98.177.173:6893 udp
N/A 87.98.177.174:6893 udp
N/A 87.98.177.175:6893 udp
N/A 87.98.177.176:6893 udp
N/A 87.98.177.177:6893 udp
N/A 87.98.177.178:6893 udp
N/A 87.98.177.179:6893 udp
N/A 87.98.177.180:6893 udp
N/A 87.98.177.181:6893 udp
N/A 87.98.177.182:6893 udp
N/A 87.98.177.183:6893 udp
N/A 87.98.177.184:6893 udp
N/A 87.98.177.185:6893 udp
N/A 87.98.177.186:6893 udp
N/A 87.98.177.187:6893 udp
N/A 87.98.177.188:6893 udp
N/A 87.98.177.189:6893 udp
N/A 87.98.177.190:6893 udp
N/A 87.98.177.191:6893 udp
N/A 87.98.177.192:6893 udp
N/A 87.98.177.193:6893 udp
N/A 87.98.177.194:6893 udp
N/A 87.98.177.195:6893 udp
N/A 87.98.177.196:6893 udp
N/A 87.98.177.197:6893 udp
N/A 87.98.177.198:6893 udp
N/A 87.98.177.199:6893 udp
N/A 87.98.177.200:6893 udp
N/A 87.98.177.201:6893 udp
N/A 87.98.177.202:6893 udp
N/A 87.98.177.203:6893 udp
N/A 87.98.177.204:6893 udp
N/A 87.98.177.205:6893 udp
N/A 87.98.177.206:6893 udp
N/A 87.98.177.207:6893 udp
N/A 87.98.177.208:6893 udp
N/A 87.98.177.209:6893 udp
N/A 87.98.177.210:6893 udp
N/A 87.98.177.211:6893 udp
N/A 87.98.177.212:6893 udp
N/A 87.98.177.213:6893 udp
N/A 87.98.177.214:6893 udp
N/A 87.98.177.215:6893 udp
N/A 87.98.177.216:6893 udp
N/A 87.98.177.217:6893 udp
N/A 87.98.177.218:6893 udp
N/A 87.98.177.219:6893 udp
N/A 87.98.177.220:6893 udp
N/A 87.98.177.221:6893 udp
N/A 87.98.177.222:6893 udp
N/A 87.98.177.223:6893 udp
N/A 87.98.177.224:6893 udp
N/A 87.98.177.225:6893 udp
N/A 87.98.177.226:6893 udp
N/A 87.98.177.227:6893 udp
N/A 87.98.177.228:6893 udp
N/A 87.98.177.229:6893 udp
N/A 87.98.177.230:6893 udp
N/A 87.98.177.231:6893 udp
N/A 87.98.177.232:6893 udp
N/A 87.98.177.233:6893 udp
N/A 87.98.177.234:6893 udp
N/A 87.98.177.235:6893 udp
N/A 87.98.177.236:6893 udp
N/A 87.98.177.237:6893 udp
N/A 87.98.177.238:6893 udp
N/A 87.98.177.239:6893 udp
N/A 87.98.177.240:6893 udp
N/A 87.98.177.241:6893 udp
N/A 87.98.177.242:6893 udp
N/A 87.98.177.243:6893 udp
N/A 87.98.177.244:6893 udp
N/A 87.98.177.245:6893 udp
N/A 87.98.177.246:6893 udp
N/A 87.98.177.247:6893 udp
N/A 87.98.177.248:6893 udp
N/A 87.98.177.249:6893 udp
N/A 87.98.177.250:6893 udp
N/A 87.98.177.251:6893 udp
N/A 87.98.177.252:6893 udp
N/A 87.98.177.253:6893 udp
N/A 87.98.177.254:6893 udp
N/A 87.98.177.255:6893 udp
N/A 87.98.178.0:6893 udp
N/A 87.98.178.1:6893 udp
N/A 87.98.178.2:6893 udp
N/A 87.98.178.3:6893 udp
N/A 87.98.178.4:6893 udp
N/A 87.98.178.5:6893 udp
N/A 87.98.178.6:6893 udp
N/A 87.98.178.7:6893 udp
N/A 87.98.178.8:6893 udp
N/A 87.98.178.9:6893 udp
N/A 87.98.178.10:6893 udp
N/A 87.98.178.11:6893 udp
N/A 87.98.178.12:6893 udp
N/A 87.98.178.13:6893 udp
N/A 87.98.178.14:6893 udp
N/A 87.98.178.15:6893 udp
N/A 87.98.178.16:6893 udp
N/A 87.98.178.17:6893 udp
N/A 87.98.178.18:6893 udp
N/A 87.98.178.19:6893 udp
N/A 87.98.178.20:6893 udp
N/A 87.98.178.21:6893 udp
N/A 87.98.178.22:6893 udp
N/A 87.98.178.23:6893 udp
N/A 87.98.178.24:6893 udp
N/A 87.98.178.25:6893 udp
N/A 87.98.178.26:6893 udp
N/A 87.98.178.27:6893 udp
N/A 87.98.178.28:6893 udp
N/A 87.98.178.29:6893 udp
N/A 87.98.178.30:6893 udp
N/A 87.98.178.31:6893 udp
N/A 87.98.178.32:6893 udp
N/A 87.98.178.33:6893 udp
N/A 87.98.178.34:6893 udp
N/A 87.98.178.35:6893 udp
N/A 87.98.178.36:6893 udp
N/A 87.98.178.37:6893 udp
N/A 87.98.178.38:6893 udp
N/A 87.98.178.39:6893 udp
N/A 87.98.178.40:6893 udp
N/A 87.98.178.41:6893 udp
N/A 87.98.178.42:6893 udp
N/A 87.98.178.43:6893 udp
N/A 87.98.178.44:6893 udp
N/A 87.98.178.45:6893 udp
N/A 87.98.178.46:6893 udp
N/A 87.98.178.47:6893 udp
N/A 87.98.178.48:6893 udp
N/A 87.98.178.49:6893 udp
N/A 87.98.178.50:6893 udp
N/A 87.98.178.51:6893 udp
N/A 87.98.178.52:6893 udp
N/A 87.98.178.53:6893 udp
N/A 87.98.178.54:6893 udp
N/A 87.98.178.55:6893 udp
N/A 87.98.178.56:6893 udp
N/A 87.98.178.57:6893 udp
N/A 87.98.178.58:6893 udp
N/A 87.98.178.59:6893 udp
N/A 87.98.178.60:6893 udp
N/A 87.98.178.61:6893 udp
N/A 87.98.178.62:6893 udp
N/A 87.98.178.63:6893 udp
N/A 87.98.178.64:6893 udp
N/A 87.98.178.65:6893 udp
N/A 87.98.178.66:6893 udp
N/A 87.98.178.67:6893 udp
N/A 87.98.178.68:6893 udp
N/A 87.98.178.69:6893 udp
N/A 87.98.178.70:6893 udp
N/A 87.98.178.71:6893 udp
N/A 87.98.178.72:6893 udp
N/A 87.98.178.73:6893 udp
N/A 87.98.178.74:6893 udp
N/A 87.98.178.75:6893 udp
N/A 87.98.178.76:6893 udp
N/A 87.98.178.77:6893 udp
N/A 87.98.178.78:6893 udp
N/A 87.98.178.79:6893 udp
N/A 87.98.178.80:6893 udp
N/A 87.98.178.81:6893 udp
N/A 87.98.178.82:6893 udp
N/A 87.98.178.83:6893 udp
N/A 87.98.178.84:6893 udp
N/A 87.98.178.85:6893 udp
N/A 87.98.178.86:6893 udp
N/A 87.98.178.87:6893 udp
N/A 87.98.178.88:6893 udp
N/A 87.98.178.89:6893 udp
N/A 87.98.178.90:6893 udp
N/A 87.98.178.91:6893 udp
N/A 87.98.178.92:6893 udp
N/A 87.98.178.93:6893 udp
N/A 87.98.178.94:6893 udp
N/A 87.98.178.95:6893 udp
N/A 87.98.178.96:6893 udp
N/A 87.98.178.97:6893 udp
N/A 87.98.178.98:6893 udp
N/A 87.98.178.99:6893 udp
N/A 87.98.178.100:6893 udp
N/A 87.98.178.101:6893 udp
N/A 87.98.178.102:6893 udp
N/A 87.98.178.103:6893 udp
N/A 87.98.178.104:6893 udp
N/A 87.98.178.105:6893 udp
N/A 87.98.178.106:6893 udp
N/A 87.98.178.107:6893 udp
N/A 87.98.178.108:6893 udp
N/A 87.98.178.109:6893 udp
N/A 87.98.178.110:6893 udp
N/A 87.98.178.111:6893 udp
N/A 87.98.178.112:6893 udp
N/A 87.98.178.113:6893 udp
N/A 87.98.178.114:6893 udp
N/A 87.98.178.115:6893 udp
N/A 87.98.178.116:6893 udp
N/A 87.98.178.117:6893 udp
N/A 87.98.178.118:6893 udp
N/A 87.98.178.119:6893 udp
N/A 87.98.178.120:6893 udp
N/A 87.98.178.121:6893 udp
N/A 87.98.178.122:6893 udp
N/A 87.98.178.123:6893 udp
N/A 87.98.178.124:6893 udp
N/A 87.98.178.125:6893 udp
N/A 87.98.178.126:6893 udp
N/A 87.98.178.127:6893 udp
N/A 87.98.178.128:6893 udp
N/A 87.98.178.129:6893 udp
N/A 87.98.178.130:6893 udp
N/A 87.98.178.131:6893 udp
N/A 87.98.178.132:6893 udp
N/A 87.98.178.133:6893 udp
N/A 87.98.178.134:6893 udp
N/A 87.98.178.135:6893 udp
N/A 87.98.178.136:6893 udp
N/A 87.98.178.137:6893 udp
N/A 87.98.178.138:6893 udp
N/A 87.98.178.139:6893 udp
N/A 87.98.178.140:6893 udp
N/A 87.98.178.141:6893 udp
N/A 87.98.178.142:6893 udp
N/A 87.98.178.143:6893 udp
N/A 87.98.178.144:6893 udp
N/A 87.98.178.145:6893 udp
N/A 87.98.178.146:6893 udp
N/A 87.98.178.147:6893 udp
N/A 87.98.178.148:6893 udp
N/A 87.98.178.149:6893 udp
N/A 87.98.178.150:6893 udp
N/A 87.98.178.151:6893 udp
N/A 87.98.178.152:6893 udp
N/A 87.98.178.153:6893 udp
N/A 87.98.178.154:6893 udp
N/A 87.98.178.155:6893 udp
N/A 87.98.178.156:6893 udp
N/A 87.98.178.157:6893 udp
N/A 87.98.178.158:6893 udp
N/A 87.98.178.159:6893 udp
N/A 87.98.178.160:6893 udp
N/A 87.98.178.161:6893 udp
N/A 87.98.178.162:6893 udp
N/A 87.98.178.163:6893 udp
N/A 87.98.178.164:6893 udp
N/A 87.98.178.165:6893 udp
N/A 87.98.178.166:6893 udp
N/A 87.98.178.167:6893 udp
N/A 87.98.178.168:6893 udp
N/A 87.98.178.169:6893 udp
N/A 87.98.178.170:6893 udp
N/A 87.98.178.171:6893 udp
N/A 87.98.178.172:6893 udp
N/A 87.98.178.173:6893 udp
N/A 87.98.178.174:6893 udp
N/A 87.98.178.175:6893 udp
N/A 87.98.178.176:6893 udp
N/A 87.98.178.177:6893 udp
N/A 87.98.178.178:6893 udp
N/A 87.98.178.179:6893 udp
N/A 87.98.178.180:6893 udp
N/A 87.98.178.181:6893 udp
N/A 87.98.178.182:6893 udp
N/A 87.98.178.183:6893 udp
N/A 87.98.178.184:6893 udp
N/A 87.98.178.185:6893 udp
N/A 87.98.178.186:6893 udp
N/A 87.98.178.187:6893 udp
N/A 87.98.178.188:6893 udp
N/A 87.98.178.189:6893 udp
N/A 87.98.178.190:6893 udp
N/A 87.98.178.191:6893 udp
N/A 87.98.178.192:6893 udp
N/A 87.98.178.193:6893 udp
N/A 87.98.178.194:6893 udp
N/A 87.98.178.195:6893 udp
N/A 87.98.178.196:6893 udp
N/A 87.98.178.197:6893 udp
N/A 87.98.178.198:6893 udp
N/A 87.98.178.199:6893 udp
N/A 87.98.178.200:6893 udp
N/A 87.98.178.201:6893 udp
N/A 87.98.178.202:6893 udp
N/A 87.98.178.203:6893 udp
N/A 87.98.178.204:6893 udp
N/A 87.98.178.205:6893 udp
N/A 87.98.178.206:6893 udp
N/A 87.98.178.207:6893 udp
N/A 87.98.178.208:6893 udp
N/A 87.98.178.209:6893 udp
N/A 87.98.178.210:6893 udp
N/A 87.98.178.211:6893 udp
N/A 87.98.178.212:6893 udp
N/A 87.98.178.213:6893 udp
N/A 87.98.178.214:6893 udp
N/A 87.98.178.215:6893 udp
N/A 87.98.178.216:6893 udp
N/A 87.98.178.217:6893 udp
N/A 87.98.178.218:6893 udp
N/A 87.98.178.219:6893 udp
N/A 87.98.178.220:6893 udp
N/A 87.98.178.221:6893 udp
N/A 87.98.178.222:6893 udp
N/A 87.98.178.223:6893 udp
N/A 87.98.178.224:6893 udp
N/A 87.98.178.225:6893 udp
N/A 87.98.178.226:6893 udp
N/A 87.98.178.227:6893 udp
N/A 87.98.178.228:6893 udp
N/A 87.98.178.229:6893 udp
N/A 87.98.178.230:6893 udp
N/A 87.98.178.231:6893 udp
N/A 87.98.178.232:6893 udp
N/A 87.98.178.233:6893 udp
N/A 87.98.178.234:6893 udp
N/A 87.98.178.235:6893 udp
N/A 87.98.178.236:6893 udp
N/A 87.98.178.237:6893 udp
N/A 87.98.178.238:6893 udp
N/A 87.98.178.239:6893 udp
N/A 87.98.178.240:6893 udp
N/A 87.98.178.241:6893 udp
N/A 87.98.178.242:6893 udp
N/A 87.98.178.243:6893 udp
N/A 87.98.178.244:6893 udp
N/A 87.98.178.245:6893 udp
N/A 87.98.178.246:6893 udp
N/A 87.98.178.247:6893 udp
N/A 87.98.178.248:6893 udp
N/A 87.98.178.249:6893 udp
N/A 87.98.178.250:6893 udp
N/A 87.98.178.251:6893 udp
N/A 87.98.178.252:6893 udp
N/A 87.98.178.253:6893 udp
N/A 87.98.178.254:6893 udp
N/A 87.98.178.255:6893 udp
N/A 87.98.179.0:6893 udp
N/A 87.98.179.1:6893 udp
N/A 87.98.179.2:6893 udp
N/A 87.98.179.3:6893 udp
N/A 87.98.179.4:6893 udp
N/A 87.98.179.5:6893 udp
N/A 87.98.179.6:6893 udp
N/A 87.98.179.7:6893 udp
N/A 87.98.179.8:6893 udp
N/A 87.98.179.9:6893 udp
N/A 87.98.179.10:6893 udp
N/A 87.98.179.11:6893 udp
N/A 87.98.179.12:6893 udp
N/A 87.98.179.13:6893 udp
N/A 87.98.179.14:6893 udp
N/A 87.98.179.15:6893 udp
N/A 87.98.179.16:6893 udp
N/A 87.98.179.17:6893 udp
N/A 87.98.179.18:6893 udp
N/A 87.98.179.19:6893 udp
N/A 87.98.179.20:6893 udp
N/A 87.98.179.21:6893 udp
N/A 87.98.179.22:6893 udp
N/A 87.98.179.23:6893 udp
N/A 87.98.179.24:6893 udp
N/A 87.98.179.25:6893 udp
N/A 87.98.179.26:6893 udp
N/A 87.98.179.27:6893 udp
N/A 87.98.179.28:6893 udp
N/A 87.98.179.29:6893 udp
N/A 87.98.179.30:6893 udp
N/A 87.98.179.31:6893 udp
N/A 87.98.179.32:6893 udp
N/A 87.98.179.33:6893 udp
N/A 87.98.179.34:6893 udp
N/A 87.98.179.35:6893 udp
N/A 87.98.179.36:6893 udp
N/A 87.98.179.37:6893 udp
N/A 87.98.179.38:6893 udp
N/A 87.98.179.39:6893 udp
N/A 87.98.179.40:6893 udp
N/A 87.98.179.41:6893 udp
N/A 87.98.179.42:6893 udp
N/A 87.98.179.43:6893 udp
N/A 87.98.179.44:6893 udp
N/A 87.98.179.45:6893 udp
N/A 87.98.179.46:6893 udp
N/A 87.98.179.47:6893 udp
N/A 87.98.179.48:6893 udp
N/A 87.98.179.49:6893 udp
N/A 87.98.179.50:6893 udp
N/A 87.98.179.51:6893 udp
N/A 87.98.179.52:6893 udp
N/A 87.98.179.53:6893 udp
N/A 87.98.179.54:6893 udp
N/A 87.98.179.55:6893 udp
N/A 87.98.179.56:6893 udp
N/A 87.98.179.57:6893 udp
N/A 87.98.179.58:6893 udp
N/A 87.98.179.59:6893 udp
N/A 87.98.179.60:6893 udp
N/A 87.98.179.61:6893 udp
N/A 87.98.179.62:6893 udp
N/A 87.98.179.63:6893 udp
N/A 87.98.179.64:6893 udp
N/A 87.98.179.65:6893 udp
N/A 87.98.179.66:6893 udp
N/A 87.98.179.67:6893 udp
N/A 87.98.179.68:6893 udp
N/A 87.98.179.69:6893 udp
N/A 87.98.179.70:6893 udp
N/A 87.98.179.71:6893 udp
N/A 87.98.179.72:6893 udp
N/A 87.98.179.73:6893 udp
N/A 87.98.179.74:6893 udp
N/A 87.98.179.75:6893 udp
N/A 87.98.179.76:6893 udp
N/A 87.98.179.77:6893 udp
N/A 87.98.179.78:6893 udp
N/A 87.98.179.79:6893 udp
N/A 87.98.179.80:6893 udp
N/A 87.98.179.81:6893 udp
N/A 87.98.179.82:6893 udp
N/A 87.98.179.83:6893 udp
N/A 87.98.179.84:6893 udp
N/A 87.98.179.85:6893 udp
N/A 87.98.179.86:6893 udp
N/A 87.98.179.87:6893 udp
N/A 87.98.179.88:6893 udp
N/A 87.98.179.89:6893 udp
N/A 87.98.179.90:6893 udp
N/A 87.98.179.91:6893 udp
N/A 87.98.179.92:6893 udp
N/A 87.98.179.93:6893 udp
N/A 87.98.179.94:6893 udp
N/A 87.98.179.95:6893 udp
N/A 87.98.179.96:6893 udp
N/A 87.98.179.97:6893 udp
N/A 87.98.179.98:6893 udp
N/A 87.98.179.99:6893 udp
N/A 87.98.179.100:6893 udp
N/A 87.98.179.101:6893 udp
N/A 87.98.179.102:6893 udp
N/A 87.98.179.103:6893 udp
N/A 87.98.179.104:6893 udp
N/A 87.98.179.105:6893 udp
N/A 87.98.179.106:6893 udp
N/A 87.98.179.107:6893 udp
N/A 87.98.179.108:6893 udp
N/A 87.98.179.109:6893 udp
N/A 87.98.179.110:6893 udp
N/A 87.98.179.111:6893 udp
N/A 87.98.179.112:6893 udp
N/A 87.98.179.113:6893 udp
N/A 87.98.179.114:6893 udp
N/A 87.98.179.115:6893 udp
N/A 87.98.179.116:6893 udp
N/A 87.98.179.117:6893 udp
N/A 87.98.179.118:6893 udp
N/A 87.98.179.119:6893 udp
N/A 87.98.179.120:6893 udp
N/A 87.98.179.121:6893 udp
N/A 87.98.179.122:6893 udp
N/A 87.98.179.123:6893 udp
N/A 87.98.179.124:6893 udp
N/A 87.98.179.125:6893 udp
N/A 87.98.179.126:6893 udp
N/A 87.98.179.127:6893 udp
N/A 87.98.179.128:6893 udp
N/A 87.98.179.129:6893 udp
N/A 87.98.179.130:6893 udp
N/A 87.98.179.131:6893 udp
N/A 87.98.179.132:6893 udp
N/A 87.98.179.133:6893 udp
N/A 87.98.179.134:6893 udp
N/A 87.98.179.135:6893 udp
N/A 87.98.179.136:6893 udp
N/A 87.98.179.137:6893 udp
N/A 87.98.179.138:6893 udp
N/A 87.98.179.139:6893 udp
N/A 87.98.179.140:6893 udp
N/A 87.98.179.141:6893 udp
N/A 87.98.179.142:6893 udp
N/A 87.98.179.143:6893 udp
N/A 87.98.179.144:6893 udp
N/A 87.98.179.145:6893 udp
N/A 87.98.179.146:6893 udp
N/A 87.98.179.147:6893 udp
N/A 87.98.179.148:6893 udp
N/A 87.98.179.149:6893 udp
N/A 87.98.179.150:6893 udp
N/A 87.98.179.151:6893 udp
N/A 87.98.179.152:6893 udp
N/A 87.98.179.153:6893 udp
N/A 87.98.179.154:6893 udp
N/A 87.98.179.155:6893 udp
N/A 87.98.179.156:6893 udp
N/A 87.98.179.157:6893 udp
N/A 87.98.179.158:6893 udp
N/A 87.98.179.159:6893 udp
N/A 87.98.179.160:6893 udp
N/A 87.98.179.161:6893 udp
N/A 87.98.179.162:6893 udp
N/A 87.98.179.163:6893 udp
N/A 87.98.179.164:6893 udp
N/A 87.98.179.165:6893 udp
N/A 87.98.179.166:6893 udp
N/A 87.98.179.167:6893 udp
N/A 87.98.179.168:6893 udp
N/A 87.98.179.169:6893 udp
N/A 87.98.179.170:6893 udp
N/A 87.98.179.171:6893 udp
N/A 87.98.179.172:6893 udp
N/A 87.98.179.173:6893 udp
N/A 87.98.179.174:6893 udp
N/A 87.98.179.175:6893 udp
N/A 87.98.179.176:6893 udp
N/A 87.98.179.177:6893 udp
N/A 87.98.179.178:6893 udp
N/A 87.98.179.179:6893 udp
N/A 87.98.179.180:6893 udp
N/A 87.98.179.181:6893 udp
N/A 87.98.179.182:6893 udp
N/A 87.98.179.183:6893 udp
N/A 87.98.179.184:6893 udp
N/A 87.98.179.185:6893 udp
N/A 87.98.179.186:6893 udp
N/A 87.98.179.187:6893 udp
N/A 87.98.179.188:6893 udp
N/A 87.98.179.189:6893 udp
N/A 87.98.179.190:6893 udp
N/A 87.98.179.191:6893 udp
N/A 87.98.179.192:6893 udp
N/A 87.98.179.193:6893 udp
N/A 87.98.179.194:6893 udp
N/A 87.98.179.195:6893 udp
N/A 87.98.179.196:6893 udp
N/A 87.98.179.197:6893 udp
N/A 87.98.179.198:6893 udp
N/A 87.98.179.199:6893 udp
N/A 87.98.179.200:6893 udp
N/A 87.98.179.201:6893 udp
N/A 87.98.179.202:6893 udp
N/A 87.98.179.203:6893 udp
N/A 87.98.179.204:6893 udp
N/A 87.98.179.205:6893 udp
N/A 87.98.179.206:6893 udp
N/A 87.98.179.207:6893 udp
N/A 87.98.179.208:6893 udp
N/A 87.98.179.209:6893 udp
N/A 87.98.179.210:6893 udp
N/A 87.98.179.211:6893 udp
N/A 87.98.179.212:6893 udp
N/A 87.98.179.213:6893 udp
N/A 87.98.179.214:6893 udp
N/A 87.98.179.215:6893 udp
N/A 87.98.179.216:6893 udp
N/A 87.98.179.217:6893 udp
N/A 87.98.179.218:6893 udp
N/A 87.98.179.219:6893 udp
N/A 87.98.179.220:6893 udp
N/A 87.98.179.221:6893 udp
N/A 87.98.179.222:6893 udp
N/A 87.98.179.223:6893 udp
N/A 87.98.179.224:6893 udp
N/A 87.98.179.225:6893 udp
N/A 87.98.179.226:6893 udp
N/A 87.98.179.227:6893 udp
N/A 87.98.179.228:6893 udp
N/A 87.98.179.229:6893 udp
N/A 87.98.179.230:6893 udp
N/A 87.98.179.231:6893 udp
N/A 87.98.179.232:6893 udp
N/A 87.98.179.233:6893 udp
N/A 87.98.179.234:6893 udp
N/A 87.98.179.235:6893 udp
N/A 87.98.179.236:6893 udp
N/A 87.98.179.237:6893 udp
N/A 87.98.179.238:6893 udp
N/A 87.98.179.239:6893 udp
N/A 87.98.179.240:6893 udp
N/A 87.98.179.241:6893 udp
N/A 87.98.179.242:6893 udp
N/A 87.98.179.243:6893 udp
N/A 87.98.179.244:6893 udp
N/A 87.98.179.245:6893 udp
N/A 87.98.179.246:6893 udp
N/A 87.98.179.247:6893 udp
N/A 87.98.179.248:6893 udp
N/A 87.98.179.249:6893 udp
N/A 87.98.179.250:6893 udp
N/A 87.98.179.251:6893 udp
N/A 87.98.179.252:6893 udp
N/A 87.98.179.253:6893 udp
N/A 87.98.179.254:6893 udp
N/A 87.98.179.255:6893 udp
N/A 77.12.57.0:6893 udp
N/A 77.12.57.1:6893 udp
N/A 77.12.57.2:6893 udp
N/A 77.12.57.3:6893 udp
N/A 77.12.57.4:6893 udp
N/A 77.12.57.5:6893 udp
N/A 77.12.57.6:6893 udp
N/A 77.12.57.7:6893 udp
N/A 77.12.57.8:6893 udp
N/A 77.12.57.9:6893 udp
N/A 77.12.57.10:6893 udp
N/A 77.12.57.11:6893 udp
N/A 77.12.57.12:6893 udp
N/A 77.12.57.13:6893 udp
N/A 77.12.57.14:6893 udp
N/A 77.12.57.15:6893 udp
N/A 77.12.57.16:6893 udp
N/A 77.12.57.17:6893 udp
N/A 77.12.57.18:6893 udp
N/A 77.12.57.19:6893 udp
N/A 77.12.57.20:6893 udp
N/A 77.12.57.21:6893 udp
N/A 77.12.57.22:6893 udp
N/A 77.12.57.23:6893 udp
N/A 77.12.57.24:6893 udp
N/A 77.12.57.25:6893 udp
N/A 77.12.57.26:6893 udp
N/A 77.12.57.27:6893 udp
N/A 77.12.57.28:6893 udp
N/A 77.12.57.29:6893 udp
N/A 77.12.57.30:6893 udp
N/A 77.12.57.31:6893 udp
N/A 19.48.17.0:6893 udp
N/A 19.48.17.1:6893 udp
N/A 19.48.17.2:6893 udp
N/A 19.48.17.3:6893 udp
N/A 19.48.17.4:6893 udp
N/A 19.48.17.5:6893 udp
N/A 19.48.17.6:6893 udp
N/A 19.48.17.7:6893 udp
N/A 19.48.17.8:6893 udp
N/A 19.48.17.9:6893 udp
N/A 19.48.17.10:6893 udp
N/A 19.48.17.11:6893 udp
N/A 19.48.17.12:6893 udp
N/A 19.48.17.13:6893 udp
N/A 19.48.17.14:6893 udp
N/A 19.48.17.15:6893 udp
N/A 19.48.17.16:6893 udp
N/A 19.48.17.17:6893 udp
N/A 19.48.17.18:6893 udp
N/A 19.48.17.19:6893 udp
N/A 19.48.17.20:6893 udp
N/A 19.48.17.21:6893 udp
N/A 19.48.17.22:6893 udp
N/A 19.48.17.23:6893 udp
N/A 19.48.17.24:6893 udp
N/A 19.48.17.25:6893 udp
N/A 19.48.17.26:6893 udp
N/A 19.48.17.27:6893 udp
N/A 19.48.17.28:6893 udp
N/A 19.48.17.29:6893 udp
N/A 19.48.17.30:6893 udp
N/A 19.48.17.31:6893 udp
N/A 87.98.176.0:6893 udp
N/A 87.98.176.1:6893 udp
N/A 87.98.176.2:6893 udp
N/A 87.98.176.3:6893 udp
N/A 87.98.176.4:6893 udp
N/A 87.98.176.5:6893 udp
N/A 87.98.176.6:6893 udp
N/A 87.98.176.7:6893 udp
N/A 87.98.176.8:6893 udp
N/A 87.98.176.9:6893 udp
N/A 87.98.176.10:6893 udp
N/A 87.98.176.11:6893 udp
N/A 87.98.176.12:6893 udp
N/A 87.98.176.13:6893 udp
N/A 87.98.176.14:6893 udp
N/A 87.98.176.15:6893 udp
N/A 87.98.176.16:6893 udp
N/A 87.98.176.17:6893 udp
N/A 87.98.176.18:6893 udp
N/A 87.98.176.19:6893 udp
N/A 87.98.176.20:6893 udp
N/A 87.98.176.21:6893 udp
N/A 87.98.176.22:6893 udp
N/A 87.98.176.23:6893 udp
N/A 87.98.176.24:6893 udp
N/A 87.98.176.25:6893 udp
N/A 87.98.176.26:6893 udp
N/A 87.98.176.27:6893 udp
N/A 87.98.176.28:6893 udp
N/A 87.98.176.29:6893 udp
N/A 87.98.176.30:6893 udp
N/A 87.98.176.31:6893 udp
N/A 87.98.176.32:6893 udp
N/A 87.98.176.33:6893 udp
N/A 87.98.176.34:6893 udp
N/A 87.98.176.35:6893 udp
N/A 87.98.176.36:6893 udp
N/A 87.98.176.37:6893 udp
N/A 87.98.176.38:6893 udp
N/A 87.98.176.39:6893 udp
N/A 87.98.176.40:6893 udp
N/A 87.98.176.41:6893 udp
N/A 87.98.176.42:6893 udp
N/A 87.98.176.43:6893 udp
N/A 87.98.176.44:6893 udp
N/A 87.98.176.45:6893 udp
N/A 87.98.176.46:6893 udp
N/A 87.98.176.47:6893 udp
N/A 87.98.176.48:6893 udp
N/A 87.98.176.49:6893 udp
N/A 87.98.176.50:6893 udp
N/A 87.98.176.51:6893 udp
N/A 87.98.176.52:6893 udp
N/A 87.98.176.53:6893 udp
N/A 87.98.176.54:6893 udp
N/A 87.98.176.55:6893 udp
N/A 87.98.176.56:6893 udp
N/A 87.98.176.57:6893 udp
N/A 87.98.176.58:6893 udp
N/A 87.98.176.59:6893 udp
N/A 87.98.176.60:6893 udp
N/A 87.98.176.61:6893 udp
N/A 87.98.176.62:6893 udp
N/A 87.98.176.63:6893 udp
N/A 87.98.176.64:6893 udp
N/A 87.98.176.65:6893 udp
N/A 87.98.176.66:6893 udp
N/A 87.98.176.67:6893 udp
N/A 87.98.176.68:6893 udp
N/A 87.98.176.69:6893 udp
N/A 87.98.176.70:6893 udp
N/A 87.98.176.71:6893 udp
N/A 87.98.176.72:6893 udp
N/A 87.98.176.73:6893 udp
N/A 87.98.176.74:6893 udp
N/A 87.98.176.75:6893 udp
N/A 87.98.176.76:6893 udp
N/A 87.98.176.77:6893 udp
N/A 87.98.176.78:6893 udp
N/A 87.98.176.79:6893 udp
N/A 87.98.176.80:6893 udp
N/A 87.98.176.81:6893 udp
N/A 87.98.176.82:6893 udp
N/A 87.98.176.83:6893 udp
N/A 87.98.176.84:6893 udp
N/A 87.98.176.85:6893 udp
N/A 87.98.176.86:6893 udp
N/A 87.98.176.87:6893 udp
N/A 87.98.176.88:6893 udp
N/A 87.98.176.89:6893 udp
N/A 87.98.176.90:6893 udp
N/A 87.98.176.91:6893 udp
N/A 87.98.176.92:6893 udp
N/A 87.98.176.93:6893 udp
N/A 87.98.176.94:6893 udp
N/A 87.98.176.95:6893 udp
N/A 87.98.176.96:6893 udp
N/A 87.98.176.97:6893 udp
N/A 87.98.176.98:6893 udp
N/A 87.98.176.99:6893 udp
N/A 87.98.176.100:6893 udp
N/A 87.98.176.101:6893 udp
N/A 87.98.176.102:6893 udp
N/A 87.98.176.103:6893 udp
N/A 87.98.176.104:6893 udp
N/A 87.98.176.105:6893 udp
N/A 87.98.176.106:6893 udp
N/A 87.98.176.107:6893 udp
N/A 87.98.176.108:6893 udp
N/A 87.98.176.109:6893 udp
N/A 87.98.176.110:6893 udp
N/A 87.98.176.111:6893 udp
N/A 87.98.176.112:6893 udp
N/A 87.98.176.113:6893 udp
N/A 87.98.176.114:6893 udp
N/A 87.98.176.115:6893 udp
N/A 87.98.176.116:6893 udp
N/A 87.98.176.117:6893 udp
N/A 87.98.176.118:6893 udp
N/A 87.98.176.119:6893 udp
N/A 87.98.176.120:6893 udp
N/A 87.98.176.121:6893 udp
N/A 87.98.176.122:6893 udp
N/A 87.98.176.123:6893 udp
N/A 87.98.176.124:6893 udp
N/A 87.98.176.125:6893 udp
N/A 87.98.176.126:6893 udp
N/A 87.98.176.127:6893 udp
N/A 87.98.176.128:6893 udp
N/A 87.98.176.129:6893 udp
N/A 87.98.176.130:6893 udp
N/A 87.98.176.131:6893 udp
N/A 87.98.176.132:6893 udp
N/A 87.98.176.133:6893 udp
N/A 87.98.176.134:6893 udp
N/A 87.98.176.135:6893 udp
N/A 87.98.176.136:6893 udp
N/A 87.98.176.137:6893 udp
N/A 87.98.176.138:6893 udp
N/A 87.98.176.139:6893 udp
N/A 87.98.176.140:6893 udp
N/A 87.98.176.141:6893 udp
N/A 87.98.176.142:6893 udp
N/A 87.98.176.143:6893 udp
N/A 87.98.176.144:6893 udp
N/A 87.98.176.145:6893 udp
N/A 87.98.176.146:6893 udp
N/A 87.98.176.147:6893 udp
N/A 87.98.176.148:6893 udp
N/A 87.98.176.149:6893 udp
N/A 87.98.176.150:6893 udp
N/A 87.98.176.151:6893 udp
N/A 87.98.176.152:6893 udp
N/A 87.98.176.153:6893 udp
N/A 87.98.176.154:6893 udp
N/A 87.98.176.155:6893 udp
N/A 87.98.176.156:6893 udp
N/A 87.98.176.157:6893 udp
N/A 87.98.176.158:6893 udp
N/A 87.98.176.159:6893 udp
N/A 87.98.176.160:6893 udp
N/A 87.98.176.161:6893 udp
N/A 87.98.176.162:6893 udp
N/A 87.98.176.163:6893 udp
N/A 87.98.176.164:6893 udp
N/A 87.98.176.165:6893 udp
N/A 87.98.176.166:6893 udp
N/A 87.98.176.167:6893 udp
N/A 87.98.176.168:6893 udp
N/A 87.98.176.169:6893 udp
N/A 87.98.176.170:6893 udp
N/A 87.98.176.171:6893 udp
N/A 87.98.176.172:6893 udp
N/A 87.98.176.173:6893 udp
N/A 87.98.176.174:6893 udp
N/A 87.98.176.175:6893 udp
N/A 87.98.176.176:6893 udp
N/A 87.98.176.177:6893 udp
N/A 87.98.176.178:6893 udp
N/A 87.98.176.179:6893 udp
N/A 87.98.176.180:6893 udp
N/A 87.98.176.181:6893 udp
N/A 87.98.176.182:6893 udp
N/A 87.98.176.183:6893 udp
N/A 87.98.176.184:6893 udp
N/A 87.98.176.185:6893 udp
N/A 87.98.176.186:6893 udp
N/A 87.98.176.187:6893 udp
N/A 87.98.176.188:6893 udp
N/A 87.98.176.189:6893 udp
N/A 87.98.176.190:6893 udp
N/A 87.98.176.191:6893 udp
N/A 87.98.176.192:6893 udp
N/A 87.98.176.193:6893 udp
N/A 87.98.176.194:6893 udp
N/A 87.98.176.195:6893 udp
N/A 87.98.176.196:6893 udp
N/A 87.98.176.197:6893 udp
N/A 87.98.176.198:6893 udp
N/A 87.98.176.199:6893 udp
N/A 87.98.176.200:6893 udp
N/A 87.98.176.201:6893 udp
N/A 87.98.176.202:6893 udp
N/A 87.98.176.203:6893 udp
N/A 87.98.176.204:6893 udp
N/A 87.98.176.205:6893 udp
N/A 87.98.176.206:6893 udp
N/A 87.98.176.207:6893 udp
N/A 87.98.176.208:6893 udp
N/A 87.98.176.209:6893 udp
N/A 87.98.176.210:6893 udp
N/A 87.98.176.211:6893 udp
N/A 87.98.176.212:6893 udp
N/A 87.98.176.213:6893 udp
N/A 87.98.176.214:6893 udp
N/A 87.98.176.215:6893 udp
N/A 87.98.176.216:6893 udp
N/A 87.98.176.217:6893 udp
N/A 87.98.176.218:6893 udp
N/A 87.98.176.219:6893 udp
N/A 87.98.176.220:6893 udp
N/A 87.98.176.221:6893 udp
N/A 87.98.176.222:6893 udp
N/A 87.98.176.223:6893 udp
N/A 87.98.176.224:6893 udp
N/A 87.98.176.225:6893 udp
N/A 87.98.176.226:6893 udp
N/A 87.98.176.227:6893 udp
N/A 87.98.176.228:6893 udp
N/A 87.98.176.229:6893 udp
N/A 87.98.176.230:6893 udp
N/A 87.98.176.231:6893 udp
N/A 87.98.176.232:6893 udp
N/A 87.98.176.233:6893 udp
N/A 87.98.176.234:6893 udp
N/A 87.98.176.235:6893 udp
N/A 87.98.176.236:6893 udp
N/A 87.98.176.237:6893 udp
N/A 87.98.176.238:6893 udp
N/A 87.98.176.239:6893 udp
N/A 87.98.176.240:6893 udp
N/A 87.98.176.241:6893 udp
N/A 87.98.176.242:6893 udp
N/A 87.98.176.243:6893 udp
N/A 87.98.176.244:6893 udp
N/A 87.98.176.245:6893 udp
N/A 87.98.176.246:6893 udp
N/A 87.98.176.247:6893 udp
N/A 87.98.176.248:6893 udp
N/A 87.98.176.249:6893 udp
N/A 87.98.176.250:6893 udp
N/A 87.98.176.251:6893 udp
N/A 87.98.176.252:6893 udp
N/A 87.98.176.253:6893 udp
N/A 87.98.176.254:6893 udp
N/A 87.98.176.255:6893 udp
N/A 87.98.177.0:6893 udp
N/A 87.98.177.1:6893 udp
N/A 87.98.177.2:6893 udp
N/A 87.98.177.3:6893 udp
N/A 87.98.177.4:6893 udp
N/A 87.98.177.5:6893 udp
N/A 87.98.177.6:6893 udp
N/A 87.98.177.7:6893 udp
N/A 87.98.177.8:6893 udp
N/A 87.98.177.9:6893 udp
N/A 87.98.177.10:6893 udp
N/A 87.98.177.11:6893 udp
N/A 87.98.177.12:6893 udp
N/A 87.98.177.13:6893 udp
N/A 87.98.177.14:6893 udp
N/A 87.98.177.15:6893 udp
N/A 87.98.177.16:6893 udp
N/A 87.98.177.17:6893 udp
N/A 87.98.177.18:6893 udp
N/A 87.98.177.19:6893 udp
N/A 87.98.177.20:6893 udp
N/A 87.98.177.21:6893 udp
N/A 87.98.177.22:6893 udp
N/A 87.98.177.23:6893 udp
N/A 87.98.177.24:6893 udp
N/A 87.98.177.25:6893 udp
N/A 87.98.177.26:6893 udp
N/A 87.98.177.27:6893 udp
N/A 87.98.177.28:6893 udp
N/A 87.98.177.29:6893 udp
N/A 87.98.177.30:6893 udp
N/A 87.98.177.31:6893 udp
N/A 87.98.177.32:6893 udp
N/A 87.98.177.33:6893 udp
N/A 87.98.177.34:6893 udp
N/A 87.98.177.35:6893 udp
N/A 87.98.177.36:6893 udp
N/A 87.98.177.37:6893 udp
N/A 87.98.177.38:6893 udp
N/A 87.98.177.39:6893 udp
N/A 87.98.177.40:6893 udp
N/A 87.98.177.41:6893 udp
N/A 87.98.177.42:6893 udp
N/A 87.98.177.43:6893 udp
N/A 87.98.177.44:6893 udp
N/A 87.98.177.45:6893 udp
N/A 87.98.177.46:6893 udp
N/A 87.98.177.47:6893 udp
N/A 87.98.177.48:6893 udp
N/A 87.98.177.49:6893 udp
N/A 87.98.177.50:6893 udp
N/A 87.98.177.51:6893 udp
N/A 87.98.177.52:6893 udp
N/A 87.98.177.53:6893 udp
N/A 87.98.177.54:6893 udp
N/A 87.98.177.55:6893 udp
N/A 87.98.177.56:6893 udp
N/A 87.98.177.57:6893 udp
N/A 87.98.177.58:6893 udp
N/A 87.98.177.59:6893 udp
N/A 87.98.177.60:6893 udp
N/A 87.98.177.61:6893 udp
N/A 87.98.177.62:6893 udp
N/A 87.98.177.63:6893 udp
N/A 87.98.177.64:6893 udp
N/A 87.98.177.65:6893 udp
N/A 87.98.177.66:6893 udp
N/A 87.98.177.67:6893 udp
N/A 87.98.177.68:6893 udp
N/A 87.98.177.69:6893 udp
N/A 87.98.177.70:6893 udp
N/A 87.98.177.71:6893 udp
N/A 87.98.177.72:6893 udp
N/A 87.98.177.73:6893 udp
N/A 87.98.177.74:6893 udp
N/A 87.98.177.75:6893 udp
N/A 87.98.177.76:6893 udp
N/A 87.98.177.77:6893 udp
N/A 87.98.177.78:6893 udp
N/A 87.98.177.79:6893 udp
N/A 87.98.177.80:6893 udp
N/A 87.98.177.81:6893 udp
N/A 87.98.177.82:6893 udp
N/A 87.98.177.83:6893 udp
N/A 87.98.177.84:6893 udp
N/A 87.98.177.85:6893 udp
N/A 87.98.177.86:6893 udp
N/A 87.98.177.87:6893 udp
N/A 87.98.177.88:6893 udp
N/A 87.98.177.89:6893 udp
N/A 87.98.177.90:6893 udp
N/A 87.98.177.91:6893 udp
N/A 87.98.177.92:6893 udp
N/A 87.98.177.93:6893 udp
N/A 87.98.177.94:6893 udp
N/A 87.98.177.95:6893 udp
N/A 87.98.177.96:6893 udp
N/A 87.98.177.97:6893 udp
N/A 87.98.177.98:6893 udp
N/A 87.98.177.99:6893 udp
N/A 87.98.177.100:6893 udp
N/A 87.98.177.101:6893 udp
N/A 87.98.177.102:6893 udp
N/A 87.98.177.103:6893 udp
N/A 87.98.177.104:6893 udp
N/A 87.98.177.105:6893 udp
N/A 87.98.177.106:6893 udp
N/A 87.98.177.107:6893 udp
N/A 87.98.177.108:6893 udp
N/A 87.98.177.109:6893 udp
N/A 87.98.177.110:6893 udp
N/A 87.98.177.111:6893 udp
N/A 87.98.177.112:6893 udp
N/A 87.98.177.113:6893 udp
N/A 87.98.177.114:6893 udp
N/A 87.98.177.115:6893 udp
N/A 87.98.177.116:6893 udp
N/A 87.98.177.117:6893 udp
N/A 87.98.177.118:6893 udp
N/A 87.98.177.119:6893 udp
N/A 87.98.177.120:6893 udp
N/A 87.98.177.121:6893 udp
N/A 87.98.177.122:6893 udp
N/A 87.98.177.123:6893 udp
N/A 87.98.177.124:6893 udp
N/A 87.98.177.125:6893 udp
N/A 87.98.177.126:6893 udp
N/A 87.98.177.127:6893 udp
N/A 87.98.177.128:6893 udp
N/A 87.98.177.129:6893 udp
N/A 87.98.177.130:6893 udp
N/A 87.98.177.131:6893 udp
N/A 87.98.177.132:6893 udp
N/A 87.98.177.133:6893 udp
N/A 87.98.177.134:6893 udp
N/A 87.98.177.135:6893 udp
N/A 87.98.177.136:6893 udp
N/A 87.98.177.137:6893 udp
N/A 87.98.177.138:6893 udp
N/A 87.98.177.139:6893 udp
N/A 87.98.177.140:6893 udp
N/A 87.98.177.141:6893 udp
N/A 87.98.177.142:6893 udp
N/A 87.98.177.143:6893 udp
N/A 87.98.177.144:6893 udp
N/A 87.98.177.145:6893 udp
N/A 87.98.177.146:6893 udp
N/A 87.98.177.147:6893 udp
N/A 87.98.177.148:6893 udp
N/A 87.98.177.149:6893 udp
N/A 87.98.177.150:6893 udp
N/A 87.98.177.151:6893 udp
N/A 87.98.177.152:6893 udp
N/A 87.98.177.153:6893 udp
N/A 87.98.177.154:6893 udp
N/A 87.98.177.155:6893 udp
N/A 87.98.177.156:6893 udp
N/A 87.98.177.157:6893 udp
N/A 87.98.177.158:6893 udp
N/A 87.98.177.159:6893 udp
N/A 87.98.177.160:6893 udp
N/A 87.98.177.161:6893 udp
N/A 87.98.177.162:6893 udp
N/A 87.98.177.163:6893 udp
N/A 87.98.177.164:6893 udp
N/A 87.98.177.165:6893 udp
N/A 87.98.177.166:6893 udp
N/A 87.98.177.167:6893 udp
N/A 87.98.177.168:6893 udp
N/A 87.98.177.169:6893 udp
N/A 87.98.177.170:6893 udp
N/A 87.98.177.171:6893 udp
N/A 87.98.177.172:6893 udp
N/A 87.98.177.173:6893 udp
N/A 87.98.177.174:6893 udp
N/A 87.98.177.175:6893 udp
N/A 87.98.177.176:6893 udp
N/A 87.98.177.177:6893 udp
N/A 87.98.177.178:6893 udp
N/A 87.98.177.179:6893 udp
N/A 87.98.177.180:6893 udp
N/A 87.98.177.181:6893 udp
N/A 87.98.177.182:6893 udp
N/A 87.98.177.183:6893 udp
N/A 87.98.177.184:6893 udp
N/A 87.98.177.185:6893 udp
N/A 87.98.177.186:6893 udp
N/A 87.98.177.187:6893 udp
N/A 87.98.177.188:6893 udp
N/A 87.98.177.189:6893 udp
N/A 87.98.177.190:6893 udp
N/A 87.98.177.191:6893 udp
N/A 87.98.177.192:6893 udp
N/A 87.98.177.193:6893 udp
N/A 87.98.177.194:6893 udp
N/A 87.98.177.195:6893 udp
N/A 87.98.177.196:6893 udp
N/A 87.98.177.197:6893 udp
N/A 87.98.177.198:6893 udp
N/A 87.98.177.199:6893 udp
N/A 87.98.177.200:6893 udp
N/A 87.98.177.201:6893 udp
N/A 87.98.177.202:6893 udp
N/A 87.98.177.203:6893 udp
N/A 87.98.177.204:6893 udp
N/A 87.98.177.205:6893 udp
N/A 87.98.177.206:6893 udp
N/A 87.98.177.207:6893 udp
N/A 87.98.177.208:6893 udp
N/A 87.98.177.209:6893 udp
N/A 87.98.177.210:6893 udp
N/A 87.98.177.211:6893 udp
N/A 87.98.177.212:6893 udp
N/A 87.98.177.213:6893 udp
N/A 87.98.177.214:6893 udp
N/A 87.98.177.215:6893 udp
N/A 87.98.177.216:6893 udp
N/A 87.98.177.217:6893 udp
N/A 87.98.177.218:6893 udp
N/A 87.98.177.219:6893 udp
N/A 87.98.177.220:6893 udp
N/A 87.98.177.221:6893 udp
N/A 87.98.177.222:6893 udp
N/A 87.98.177.223:6893 udp
N/A 87.98.177.224:6893 udp
N/A 87.98.177.225:6893 udp
N/A 87.98.177.226:6893 udp
N/A 87.98.177.227:6893 udp
N/A 87.98.177.228:6893 udp
N/A 87.98.177.229:6893 udp
N/A 87.98.177.230:6893 udp
N/A 87.98.177.231:6893 udp
N/A 87.98.177.232:6893 udp
N/A 87.98.177.233:6893 udp
N/A 87.98.177.234:6893 udp
N/A 87.98.177.235:6893 udp
N/A 87.98.177.236:6893 udp
N/A 87.98.177.237:6893 udp
N/A 87.98.177.238:6893 udp
N/A 87.98.177.239:6893 udp
N/A 87.98.177.240:6893 udp
N/A 87.98.177.241:6893 udp
N/A 87.98.177.242:6893 udp
N/A 87.98.177.243:6893 udp
N/A 87.98.177.244:6893 udp
N/A 87.98.177.245:6893 udp
N/A 87.98.177.246:6893 udp
N/A 87.98.177.247:6893 udp
N/A 87.98.177.248:6893 udp
N/A 87.98.177.249:6893 udp
N/A 87.98.177.250:6893 udp
N/A 87.98.177.251:6893 udp
N/A 87.98.177.252:6893 udp
N/A 87.98.177.253:6893 udp
N/A 87.98.177.254:6893 udp
N/A 87.98.177.255:6893 udp
N/A 87.98.178.0:6893 udp
N/A 87.98.178.1:6893 udp
N/A 87.98.178.2:6893 udp
N/A 87.98.178.3:6893 udp
N/A 87.98.178.4:6893 udp
N/A 87.98.178.5:6893 udp
N/A 87.98.178.6:6893 udp
N/A 87.98.178.7:6893 udp
N/A 87.98.178.8:6893 udp
N/A 87.98.178.9:6893 udp
N/A 87.98.178.10:6893 udp
N/A 87.98.178.11:6893 udp
N/A 87.98.178.12:6893 udp
N/A 87.98.178.13:6893 udp
N/A 87.98.178.14:6893 udp
N/A 87.98.178.15:6893 udp
N/A 87.98.178.16:6893 udp
N/A 87.98.178.17:6893 udp
N/A 87.98.178.18:6893 udp
N/A 87.98.178.19:6893 udp
N/A 87.98.178.20:6893 udp
N/A 87.98.178.21:6893 udp
N/A 87.98.178.22:6893 udp
N/A 87.98.178.23:6893 udp
N/A 87.98.178.24:6893 udp
N/A 87.98.178.25:6893 udp
N/A 87.98.178.26:6893 udp
N/A 87.98.178.27:6893 udp
N/A 87.98.178.28:6893 udp
N/A 87.98.178.29:6893 udp
N/A 87.98.178.30:6893 udp
N/A 87.98.178.31:6893 udp
N/A 87.98.178.32:6893 udp
N/A 87.98.178.33:6893 udp
N/A 87.98.178.34:6893 udp
N/A 87.98.178.35:6893 udp
N/A 87.98.178.36:6893 udp
N/A 87.98.178.37:6893 udp
N/A 87.98.178.38:6893 udp
N/A 87.98.178.39:6893 udp
N/A 87.98.178.40:6893 udp
N/A 87.98.178.41:6893 udp
N/A 87.98.178.42:6893 udp
N/A 87.98.178.43:6893 udp
N/A 87.98.178.44:6893 udp
N/A 87.98.178.45:6893 udp
N/A 87.98.178.46:6893 udp
N/A 87.98.178.47:6893 udp
N/A 87.98.178.48:6893 udp
N/A 87.98.178.49:6893 udp
N/A 87.98.178.50:6893 udp
N/A 87.98.178.51:6893 udp
N/A 87.98.178.52:6893 udp
N/A 87.98.178.53:6893 udp
N/A 87.98.178.54:6893 udp
N/A 87.98.178.55:6893 udp
N/A 87.98.178.56:6893 udp
N/A 87.98.178.57:6893 udp
N/A 87.98.178.58:6893 udp
N/A 87.98.178.59:6893 udp
N/A 87.98.178.60:6893 udp
N/A 87.98.178.61:6893 udp
N/A 87.98.178.62:6893 udp
N/A 87.98.178.63:6893 udp
N/A 87.98.178.64:6893 udp
N/A 87.98.178.65:6893 udp
N/A 87.98.178.66:6893 udp
N/A 87.98.178.67:6893 udp
N/A 87.98.178.68:6893 udp
N/A 87.98.178.69:6893 udp
N/A 87.98.178.70:6893 udp
N/A 87.98.178.71:6893 udp
N/A 87.98.178.72:6893 udp
N/A 87.98.178.73:6893 udp
N/A 87.98.178.74:6893 udp
N/A 87.98.178.75:6893 udp
N/A 87.98.178.76:6893 udp
N/A 87.98.178.77:6893 udp
N/A 87.98.178.78:6893 udp
N/A 87.98.178.79:6893 udp
N/A 87.98.178.80:6893 udp
N/A 87.98.178.81:6893 udp
N/A 87.98.178.82:6893 udp
N/A 87.98.178.83:6893 udp
N/A 87.98.178.84:6893 udp
N/A 87.98.178.85:6893 udp
N/A 87.98.178.86:6893 udp
N/A 87.98.178.87:6893 udp
N/A 87.98.178.88:6893 udp
N/A 87.98.178.89:6893 udp
N/A 87.98.178.90:6893 udp
N/A 87.98.178.91:6893 udp
N/A 87.98.178.92:6893 udp
N/A 87.98.178.93:6893 udp
N/A 87.98.178.94:6893 udp
N/A 87.98.178.95:6893 udp
N/A 87.98.178.96:6893 udp
N/A 87.98.178.97:6893 udp
N/A 87.98.178.98:6893 udp
N/A 87.98.178.99:6893 udp
N/A 87.98.178.100:6893 udp
N/A 87.98.178.101:6893 udp
N/A 87.98.178.102:6893 udp
N/A 87.98.178.103:6893 udp
N/A 87.98.178.104:6893 udp
N/A 87.98.178.105:6893 udp
N/A 87.98.178.106:6893 udp
N/A 87.98.178.107:6893 udp
N/A 87.98.178.108:6893 udp
N/A 87.98.178.109:6893 udp
N/A 87.98.178.110:6893 udp
N/A 87.98.178.111:6893 udp
N/A 87.98.178.112:6893 udp
N/A 87.98.178.113:6893 udp
N/A 87.98.178.114:6893 udp
N/A 87.98.178.115:6893 udp
N/A 87.98.178.116:6893 udp
N/A 87.98.178.117:6893 udp
N/A 87.98.178.118:6893 udp
N/A 87.98.178.119:6893 udp
N/A 87.98.178.120:6893 udp
N/A 87.98.178.121:6893 udp
N/A 87.98.178.122:6893 udp
N/A 87.98.178.123:6893 udp
N/A 87.98.178.124:6893 udp
N/A 87.98.178.125:6893 udp
N/A 87.98.178.126:6893 udp
N/A 87.98.178.127:6893 udp
N/A 87.98.178.128:6893 udp
N/A 87.98.178.129:6893 udp
N/A 87.98.178.130:6893 udp
N/A 87.98.178.131:6893 udp
N/A 87.98.178.132:6893 udp
N/A 87.98.178.133:6893 udp
N/A 87.98.178.134:6893 udp
N/A 87.98.178.135:6893 udp
N/A 87.98.178.136:6893 udp
N/A 87.98.178.137:6893 udp
N/A 87.98.178.138:6893 udp
N/A 87.98.178.139:6893 udp
N/A 87.98.178.140:6893 udp
N/A 87.98.178.141:6893 udp
N/A 87.98.178.142:6893 udp
N/A 87.98.178.143:6893 udp
N/A 87.98.178.144:6893 udp
N/A 87.98.178.145:6893 udp
N/A 87.98.178.146:6893 udp
N/A 87.98.178.147:6893 udp
N/A 87.98.178.148:6893 udp
N/A 87.98.178.149:6893 udp
N/A 87.98.178.150:6893 udp
N/A 87.98.178.151:6893 udp
N/A 87.98.178.152:6893 udp
N/A 87.98.178.153:6893 udp
N/A 87.98.178.154:6893 udp
N/A 87.98.178.155:6893 udp
N/A 87.98.178.156:6893 udp
N/A 87.98.178.157:6893 udp
N/A 87.98.178.158:6893 udp
N/A 87.98.178.159:6893 udp
N/A 87.98.178.160:6893 udp
N/A 87.98.178.161:6893 udp
N/A 87.98.178.162:6893 udp
N/A 87.98.178.163:6893 udp
N/A 87.98.178.164:6893 udp
N/A 87.98.178.165:6893 udp
N/A 87.98.178.166:6893 udp
N/A 87.98.178.167:6893 udp
N/A 87.98.178.168:6893 udp
N/A 87.98.178.169:6893 udp
N/A 87.98.178.170:6893 udp
N/A 87.98.178.171:6893 udp
N/A 87.98.178.172:6893 udp
N/A 87.98.178.173:6893 udp
N/A 87.98.178.174:6893 udp
N/A 87.98.178.175:6893 udp
N/A 87.98.178.176:6893 udp
N/A 87.98.178.177:6893 udp
N/A 87.98.178.178:6893 udp
N/A 87.98.178.179:6893 udp
N/A 87.98.178.180:6893 udp
N/A 87.98.178.181:6893 udp
N/A 87.98.178.182:6893 udp
N/A 87.98.178.183:6893 udp
N/A 87.98.178.184:6893 udp
N/A 87.98.178.185:6893 udp
N/A 87.98.178.186:6893 udp
N/A 87.98.178.187:6893 udp
N/A 87.98.178.188:6893 udp
N/A 87.98.178.189:6893 udp
N/A 87.98.178.190:6893 udp
N/A 87.98.178.191:6893 udp
N/A 87.98.178.192:6893 udp
N/A 87.98.178.193:6893 udp
N/A 87.98.178.194:6893 udp
N/A 87.98.178.195:6893 udp
N/A 87.98.178.196:6893 udp
N/A 87.98.178.197:6893 udp
N/A 87.98.178.198:6893 udp
N/A 87.98.178.199:6893 udp
N/A 87.98.178.200:6893 udp
N/A 87.98.178.201:6893 udp
N/A 87.98.178.202:6893 udp
N/A 87.98.178.203:6893 udp
N/A 87.98.178.204:6893 udp
N/A 87.98.178.205:6893 udp
N/A 87.98.178.206:6893 udp
N/A 87.98.178.207:6893 udp
N/A 87.98.178.208:6893 udp
N/A 87.98.178.209:6893 udp
N/A 87.98.178.210:6893 udp
N/A 87.98.178.211:6893 udp
N/A 87.98.178.212:6893 udp
N/A 87.98.178.213:6893 udp
N/A 87.98.178.214:6893 udp
N/A 87.98.178.215:6893 udp
N/A 87.98.178.216:6893 udp
N/A 87.98.178.217:6893 udp
N/A 87.98.178.218:6893 udp
N/A 87.98.178.219:6893 udp
N/A 87.98.178.220:6893 udp
N/A 87.98.178.221:6893 udp
N/A 87.98.178.222:6893 udp
N/A 87.98.178.223:6893 udp
N/A 87.98.178.224:6893 udp
N/A 87.98.178.225:6893 udp
N/A 87.98.178.226:6893 udp
N/A 87.98.178.227:6893 udp
N/A 87.98.178.228:6893 udp
N/A 87.98.178.229:6893 udp
N/A 87.98.178.230:6893 udp
N/A 87.98.178.231:6893 udp
N/A 87.98.178.232:6893 udp
N/A 87.98.178.233:6893 udp
N/A 87.98.178.234:6893 udp
N/A 87.98.178.235:6893 udp
N/A 87.98.178.236:6893 udp
N/A 87.98.178.237:6893 udp
N/A 87.98.178.238:6893 udp
N/A 87.98.178.239:6893 udp
N/A 87.98.178.240:6893 udp
N/A 87.98.178.241:6893 udp
N/A 87.98.178.242:6893 udp
N/A 87.98.178.243:6893 udp
N/A 87.98.178.244:6893 udp
N/A 87.98.178.245:6893 udp
N/A 87.98.178.246:6893 udp
N/A 87.98.178.247:6893 udp
N/A 87.98.178.248:6893 udp
N/A 87.98.178.249:6893 udp
N/A 87.98.178.250:6893 udp
N/A 87.98.178.251:6893 udp
N/A 87.98.178.252:6893 udp
N/A 87.98.178.253:6893 udp
N/A 87.98.178.254:6893 udp
N/A 87.98.178.255:6893 udp
N/A 87.98.179.0:6893 udp
N/A 87.98.179.1:6893 udp
N/A 87.98.179.2:6893 udp
N/A 87.98.179.3:6893 udp
N/A 87.98.179.4:6893 udp
N/A 87.98.179.5:6893 udp
N/A 87.98.179.6:6893 udp
N/A 87.98.179.7:6893 udp
N/A 87.98.179.8:6893 udp
N/A 87.98.179.9:6893 udp
N/A 87.98.179.10:6893 udp
N/A 87.98.179.11:6893 udp
N/A 87.98.179.12:6893 udp
N/A 87.98.179.13:6893 udp
N/A 87.98.179.14:6893 udp
N/A 87.98.179.15:6893 udp
N/A 87.98.179.16:6893 udp
N/A 87.98.179.17:6893 udp
N/A 87.98.179.18:6893 udp
N/A 87.98.179.19:6893 udp
N/A 87.98.179.20:6893 udp
N/A 87.98.179.21:6893 udp
N/A 87.98.179.22:6893 udp
N/A 87.98.179.23:6893 udp
N/A 87.98.179.24:6893 udp
N/A 87.98.179.25:6893 udp
N/A 87.98.179.26:6893 udp
N/A 87.98.179.27:6893 udp
N/A 87.98.179.28:6893 udp
N/A 87.98.179.29:6893 udp
N/A 87.98.179.30:6893 udp
N/A 87.98.179.31:6893 udp
N/A 87.98.179.32:6893 udp
N/A 87.98.179.33:6893 udp
N/A 87.98.179.34:6893 udp
N/A 87.98.179.35:6893 udp
N/A 87.98.179.36:6893 udp
N/A 87.98.179.37:6893 udp
N/A 87.98.179.38:6893 udp
N/A 87.98.179.39:6893 udp
N/A 87.98.179.40:6893 udp
N/A 87.98.179.41:6893 udp
N/A 87.98.179.42:6893 udp
N/A 87.98.179.43:6893 udp
N/A 87.98.179.44:6893 udp
N/A 87.98.179.45:6893 udp
N/A 87.98.179.46:6893 udp
N/A 87.98.179.47:6893 udp
N/A 87.98.179.48:6893 udp
N/A 87.98.179.49:6893 udp
N/A 87.98.179.50:6893 udp
N/A 87.98.179.51:6893 udp
N/A 87.98.179.52:6893 udp
N/A 87.98.179.53:6893 udp
N/A 87.98.179.54:6893 udp
N/A 87.98.179.55:6893 udp
N/A 87.98.179.56:6893 udp
N/A 87.98.179.57:6893 udp
N/A 87.98.179.58:6893 udp
N/A 87.98.179.59:6893 udp
N/A 87.98.179.60:6893 udp
N/A 87.98.179.61:6893 udp
N/A 87.98.179.62:6893 udp
N/A 87.98.179.63:6893 udp
N/A 87.98.179.64:6893 udp
N/A 87.98.179.65:6893 udp
N/A 87.98.179.66:6893 udp
N/A 87.98.179.67:6893 udp
N/A 87.98.179.68:6893 udp
N/A 87.98.179.69:6893 udp
N/A 87.98.179.70:6893 udp
N/A 87.98.179.71:6893 udp
N/A 87.98.179.72:6893 udp
N/A 87.98.179.73:6893 udp
N/A 87.98.179.74:6893 udp
N/A 87.98.179.75:6893 udp
N/A 87.98.179.76:6893 udp
N/A 87.98.179.77:6893 udp
N/A 87.98.179.78:6893 udp
N/A 87.98.179.79:6893 udp
N/A 87.98.179.80:6893 udp
N/A 87.98.179.81:6893 udp
N/A 87.98.179.82:6893 udp
N/A 87.98.179.83:6893 udp
N/A 87.98.179.84:6893 udp
N/A 87.98.179.85:6893 udp
N/A 87.98.179.86:6893 udp
N/A 87.98.179.87:6893 udp
N/A 87.98.179.88:6893 udp
N/A 87.98.179.89:6893 udp
N/A 87.98.179.90:6893 udp
N/A 87.98.179.91:6893 udp
N/A 87.98.179.92:6893 udp
N/A 87.98.179.93:6893 udp
N/A 87.98.179.94:6893 udp
N/A 87.98.179.95:6893 udp
N/A 87.98.179.96:6893 udp
N/A 87.98.179.97:6893 udp
N/A 87.98.179.98:6893 udp
N/A 87.98.179.99:6893 udp
N/A 87.98.179.100:6893 udp
N/A 87.98.179.101:6893 udp
N/A 87.98.179.102:6893 udp
N/A 87.98.179.103:6893 udp
N/A 87.98.179.104:6893 udp
N/A 87.98.179.105:6893 udp
N/A 87.98.179.106:6893 udp
N/A 87.98.179.107:6893 udp
N/A 87.98.179.108:6893 udp
N/A 87.98.179.109:6893 udp
N/A 87.98.179.110:6893 udp
N/A 87.98.179.111:6893 udp
N/A 87.98.179.112:6893 udp
N/A 87.98.179.113:6893 udp
N/A 87.98.179.114:6893 udp
N/A 87.98.179.115:6893 udp
N/A 87.98.179.116:6893 udp
N/A 87.98.179.117:6893 udp
N/A 87.98.179.118:6893 udp
N/A 87.98.179.119:6893 udp
N/A 87.98.179.120:6893 udp
N/A 87.98.179.121:6893 udp
N/A 87.98.179.122:6893 udp
N/A 87.98.179.123:6893 udp
N/A 87.98.179.124:6893 udp
N/A 87.98.179.125:6893 udp
N/A 87.98.179.126:6893 udp
N/A 87.98.179.127:6893 udp
N/A 87.98.179.128:6893 udp
N/A 87.98.179.129:6893 udp
N/A 87.98.179.130:6893 udp
N/A 87.98.179.131:6893 udp
N/A 87.98.179.132:6893 udp
N/A 87.98.179.133:6893 udp
N/A 87.98.179.134:6893 udp
N/A 87.98.179.135:6893 udp
N/A 87.98.179.136:6893 udp
N/A 87.98.179.137:6893 udp
N/A 87.98.179.138:6893 udp
N/A 87.98.179.139:6893 udp
N/A 87.98.179.140:6893 udp
N/A 87.98.179.141:6893 udp
N/A 87.98.179.142:6893 udp
N/A 87.98.179.143:6893 udp
N/A 87.98.179.144:6893 udp
N/A 87.98.179.145:6893 udp
N/A 87.98.179.146:6893 udp
N/A 87.98.179.147:6893 udp
N/A 87.98.179.148:6893 udp
N/A 87.98.179.149:6893 udp
N/A 87.98.179.150:6893 udp
N/A 87.98.179.151:6893 udp
N/A 87.98.179.152:6893 udp
N/A 87.98.179.153:6893 udp
N/A 87.98.179.154:6893 udp
N/A 87.98.179.155:6893 udp
N/A 87.98.179.156:6893 udp
N/A 87.98.179.157:6893 udp
N/A 87.98.179.158:6893 udp
N/A 87.98.179.159:6893 udp
N/A 87.98.179.160:6893 udp
N/A 87.98.179.161:6893 udp
N/A 87.98.179.162:6893 udp
N/A 87.98.179.163:6893 udp
N/A 87.98.179.164:6893 udp
N/A 87.98.179.165:6893 udp
N/A 87.98.179.166:6893 udp
N/A 87.98.179.167:6893 udp
N/A 87.98.179.168:6893 udp
N/A 87.98.179.169:6893 udp
N/A 87.98.179.170:6893 udp
N/A 87.98.179.171:6893 udp
N/A 87.98.179.172:6893 udp
N/A 87.98.179.173:6893 udp
N/A 87.98.179.174:6893 udp
N/A 87.98.179.175:6893 udp
N/A 87.98.179.176:6893 udp
N/A 87.98.179.177:6893 udp
N/A 87.98.179.178:6893 udp
N/A 87.98.179.179:6893 udp
N/A 87.98.179.180:6893 udp
N/A 87.98.179.181:6893 udp
N/A 87.98.179.182:6893 udp
N/A 87.98.179.183:6893 udp
N/A 87.98.179.184:6893 udp
N/A 87.98.179.185:6893 udp
N/A 87.98.179.186:6893 udp
N/A 87.98.179.187:6893 udp
N/A 87.98.179.188:6893 udp
N/A 87.98.179.189:6893 udp
N/A 87.98.179.190:6893 udp
N/A 87.98.179.191:6893 udp
N/A 87.98.179.192:6893 udp
N/A 87.98.179.193:6893 udp
N/A 87.98.179.194:6893 udp
N/A 87.98.179.195:6893 udp
N/A 87.98.179.196:6893 udp
N/A 87.98.179.197:6893 udp
N/A 87.98.179.198:6893 udp
N/A 87.98.179.199:6893 udp
N/A 87.98.179.200:6893 udp
N/A 87.98.179.201:6893 udp
N/A 87.98.179.202:6893 udp
N/A 87.98.179.203:6893 udp
N/A 87.98.179.204:6893 udp
N/A 87.98.179.205:6893 udp
N/A 87.98.179.206:6893 udp
N/A 87.98.179.207:6893 udp
N/A 87.98.179.208:6893 udp
N/A 87.98.179.209:6893 udp
N/A 87.98.179.210:6893 udp
N/A 87.98.179.211:6893 udp
N/A 87.98.179.212:6893 udp
N/A 87.98.179.213:6893 udp
N/A 87.98.179.214:6893 udp
N/A 87.98.179.215:6893 udp
N/A 87.98.179.216:6893 udp
N/A 87.98.179.217:6893 udp
N/A 87.98.179.218:6893 udp
N/A 87.98.179.219:6893 udp
N/A 87.98.179.220:6893 udp
N/A 87.98.179.221:6893 udp
N/A 87.98.179.222:6893 udp
N/A 87.98.179.223:6893 udp
N/A 87.98.179.224:6893 udp
N/A 87.98.179.225:6893 udp
N/A 87.98.179.226:6893 udp
N/A 87.98.179.227:6893 udp
N/A 87.98.179.228:6893 udp
N/A 87.98.179.229:6893 udp
N/A 87.98.179.230:6893 udp
N/A 87.98.179.231:6893 udp
N/A 87.98.179.232:6893 udp
N/A 87.98.179.233:6893 udp
N/A 87.98.179.234:6893 udp
N/A 87.98.179.235:6893 udp
N/A 87.98.179.236:6893 udp
N/A 87.98.179.237:6893 udp
N/A 87.98.179.238:6893 udp
N/A 87.98.179.239:6893 udp
N/A 87.98.179.240:6893 udp
N/A 87.98.179.241:6893 udp
N/A 87.98.179.242:6893 udp
N/A 87.98.179.243:6893 udp
N/A 87.98.179.244:6893 udp
N/A 87.98.179.245:6893 udp
N/A 87.98.179.246:6893 udp
N/A 87.98.179.247:6893 udp
N/A 87.98.179.248:6893 udp
N/A 87.98.179.249:6893 udp
N/A 87.98.179.250:6893 udp
N/A 87.98.179.251:6893 udp
N/A 87.98.179.252:6893 udp
N/A 87.98.179.253:6893 udp
N/A 87.98.179.254:6893 udp
N/A 87.98.179.255:6893 udp
N/A 8.8.8.8:53 api.blockcypher.com udp
N/A 104.20.21.251:80 api.blockcypher.com tcp
N/A 8.8.8.8:53 btc.blockr.io udp
N/A 8.8.8.8:53 bitaps.com udp
N/A 178.128.255.179:443 bitaps.com tcp
N/A 8.8.8.8:53 chain.so udp
N/A 104.24.104.254:443 chain.so tcp
N/A 8.8.8.8:53 sochain.com udp
N/A 104.26.15.247:443 sochain.com tcp
N/A 8.8.8.8:53 xpcx6erilkjced3j.14pxvn.top udp

Files

memory/1996-0-0x0000000000000000-mapping.dmp

memory/560-1-0x0000000000000000-mapping.dmp

memory/3668-2-0x0000000000000000-mapping.dmp

memory/3232-3-0x0000000000000000-mapping.dmp

memory/212-4-0x0000000000000000-mapping.dmp

C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___8GRBUW_.hta

MD5 be132d032639f4ba8294f9c5345141f5
SHA1 c634cba07c21656a2fac7b23a93e488b46a7e843
SHA256 206362b6e5337ebb708fd692f911e98e70fa45704d7ad7376e76ec360fe8f0b0
SHA512 2dbb003f8d17a095f1be4e67b077b06ebd35e58fccfd9e67031671cd29c582681c942c79492993ca7968622d446841dee167431b617dc5d786959b44773bb016

memory/1600-6-0x0000000000000000-mapping.dmp

C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___66ZATB_.txt

MD5 732befbfd8d66617d7780ac191d3915d
SHA1 e00cf89cf61abbf9c1b16b5a1c526ac24adffd97
SHA256 990243976c833896e302f3604bccbab65a44554bc996e732bd788ab61b2898cf
SHA512 061dddc0e5404a38a876cb4d10f4256cce557639181f079adf5ac8df964bc62fa7be5390aafa2fc77bf0dd7426db6a4bcade02168ea3ee706afe00fa0599aa10

memory/2968-8-0x0000000000000000-mapping.dmp