Malware Analysis Report

2025-01-02 15:04

Sample ID 201108-kl7vne2d9a
Target 871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90
SHA256 871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90
Tags
upx cerber evasion persistence ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90

Threat Level: Known bad

The file 871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90 was found to be: Known bad.

Malicious Activity Summary

upx cerber evasion persistence ransomware

Cerber

Modifies Windows Firewall

Blacklisted process makes network request

UPX packed file

Drops startup file

Deletes itself

Enumerates connected drives

Drops file in System32 directory

Modifies service

Sets desktop wallpaper using registry

Drops file in Windows directory

Drops file in Program Files directory

Modifies registry class

Runs ping.exe

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Opens file in notepad (likely ransom note)

Modifies system certificate store

Kills process with taskkill

Modifies Internet Explorer settings

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2020-11-08 14:23

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2020-11-08 14:22

Reported

2020-11-08 15:27

Platform

win7v20201028

Max time kernel

126s

Max time network

128s

Command Line

"C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe"

Signatures

Cerber

ransomware cerber

Blacklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A

Modifies Windows Firewall

evasion

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\j: C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened (read-only) \??\o: C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened (read-only) \??\w: C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened (read-only) \??\x: C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened (read-only) \??\y: C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened (read-only) \??\b: C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened (read-only) \??\f: C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened (read-only) \??\h: C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened (read-only) \??\p: C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened (read-only) \??\u: C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened (read-only) \??\z: C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened (read-only) \??\q: C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened (read-only) \??\t: C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened (read-only) \??\a: C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened (read-only) \??\g: C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened (read-only) \??\k: C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened (read-only) \??\l: C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened (read-only) \??\m: C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened (read-only) \??\v: C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened (read-only) \??\e: C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened (read-only) \??\i: C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened (read-only) \??\n: C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened (read-only) \??\r: C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened (read-only) \??\s: C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\powerpoint C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\word C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\steam C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\documents C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\onenote C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft sql server C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\onenote C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\outlook C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\bitcoin C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\office C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\word C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\office C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\onenote C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\excel C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\excel C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\office C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\powerpoint C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\the bat! C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft sql server C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\excel C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\onenote C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\excel C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\outlook C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\powerpoint C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\outlook C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\powerpoint C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\steam C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\the bat! C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\thunderbird C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\microsoft sql server C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\microsoft sql server C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\office C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\outlook C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\thunderbird C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\word C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\word C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\desktop C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\bitcoin C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A

Modifies service

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Shas C:\Windows\SysWOW64\netsh.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Qecs C:\Windows\SysWOW64\netsh.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\UI C:\Windows\SysWOW64\netsh.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\LocalConfig C:\Windows\SysWOW64\netsh.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\UI C:\Windows\SysWOW64\netsh.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\LocalConfig C:\Windows\SysWOW64\netsh.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\Enroll\HcsGroups C:\Windows\SysWOW64\netsh.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Shas C:\Windows\SysWOW64\netsh.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Qecs C:\Windows\SysWOW64\netsh.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\Enroll\HcsGroups C:\Windows\SysWOW64\netsh.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpBD27.bmp" C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification \??\c:\program files\ C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\program files (x86)\bitcoin C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\program files (x86)\onenote C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft sql server C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\powerpoint C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\program files (x86)\steam C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\program files (x86)\thunderbird C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\word C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\program files (x86)\outlook C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\program files (x86)\powerpoint C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\program files (x86)\the bat! C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\program files (x86)\ C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\program files (x86)\excel C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\excel C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\office C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\program files (x86)\word C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\microsoft sql server C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\onenote C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\outlook C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\program files (x86)\office C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\outlook C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\excel C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\microsoft sql server C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\onenote C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\steam C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\desktop C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\bitcoin C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\excel C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\microsoft sql server C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\office C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\office C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\powerpoint C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\steam C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\steam C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\thunderbird C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\word C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\ C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\microsoft sql server C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\microsoft sql server C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\powerpoint C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\word C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\word C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\bitcoin C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\outlook C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\powerpoint C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\powerpoint C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\outlook C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\powerpoint C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft sql server C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft sql server C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\office C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\onenote C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\outlook C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\outlook C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\office C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\documents C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft sql server C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\office C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\onenote C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\powerpoint C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\onenote C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\thunderbird C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\excel C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\excel C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\office C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\office C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\outlook C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\thunderbird C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\thunderbird C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\documents C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\bitcoin C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft sql server C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\outlook C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\word C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\word C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\excel C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\onenote C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\outlook C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\powerpoint C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\the bat! C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\bitcoin C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\word C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\excel C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\word C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\office C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\the bat! C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\excel C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\word C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\powerpoint C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\steam C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\desktop C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\the bat! C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\excel C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\onenote C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\onenote C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\onenote C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\the bat! C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b0b000000010000001600000047006c006f00620061006c005300690067006e0000005300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802020f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 C:\Windows\SysWOW64\mshta.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C C:\Windows\SysWOW64\mshta.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 C:\Windows\SysWOW64\mshta.exe N/A

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\NOTEPAD.EXE N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 536 wrote to memory of 1700 N/A C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe C:\Windows\SysWOW64\netsh.exe
PID 536 wrote to memory of 1700 N/A C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe C:\Windows\SysWOW64\netsh.exe
PID 536 wrote to memory of 1700 N/A C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe C:\Windows\SysWOW64\netsh.exe
PID 536 wrote to memory of 1700 N/A C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe C:\Windows\SysWOW64\netsh.exe
PID 536 wrote to memory of 1672 N/A C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe C:\Windows\SysWOW64\netsh.exe
PID 536 wrote to memory of 1672 N/A C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe C:\Windows\SysWOW64\netsh.exe
PID 536 wrote to memory of 1672 N/A C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe C:\Windows\SysWOW64\netsh.exe
PID 536 wrote to memory of 1672 N/A C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe C:\Windows\SysWOW64\netsh.exe
PID 536 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe C:\Windows\SysWOW64\mshta.exe
PID 536 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe C:\Windows\SysWOW64\mshta.exe
PID 536 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe C:\Windows\SysWOW64\mshta.exe
PID 536 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe C:\Windows\SysWOW64\mshta.exe
PID 536 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe C:\Windows\SysWOW64\NOTEPAD.EXE
PID 536 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe C:\Windows\SysWOW64\NOTEPAD.EXE
PID 536 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe C:\Windows\SysWOW64\NOTEPAD.EXE
PID 536 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe C:\Windows\SysWOW64\NOTEPAD.EXE
PID 536 wrote to memory of 1532 N/A C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe C:\Windows\SysWOW64\cmd.exe
PID 536 wrote to memory of 1532 N/A C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe C:\Windows\SysWOW64\cmd.exe
PID 536 wrote to memory of 1532 N/A C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe C:\Windows\SysWOW64\cmd.exe
PID 536 wrote to memory of 1532 N/A C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe C:\Windows\SysWOW64\cmd.exe
PID 1532 wrote to memory of 1632 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1532 wrote to memory of 1632 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1532 wrote to memory of 1632 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1532 wrote to memory of 1632 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1532 wrote to memory of 960 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1532 wrote to memory of 960 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1532 wrote to memory of 960 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1532 wrote to memory of 960 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe

"C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe"

C:\Windows\SysWOW64\netsh.exe

C:\Windows\system32\netsh.exe advfirewall set allprofiles state on

C:\Windows\SysWOW64\netsh.exe

C:\Windows\system32\netsh.exe advfirewall reset

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___5870WTA_.hta"

C:\Windows\SysWOW64\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___5MXVFOR3_.txt

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /d /c taskkill /f /im "871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe" > NUL && exit

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe"

C:\Windows\SysWOW64\PING.EXE

ping -n 1 127.0.0.1

Network

Country Destination Domain Proto
N/A 77.12.57.0:6893 udp
N/A 77.12.57.1:6893 udp
N/A 77.12.57.2:6893 udp
N/A 77.12.57.3:6893 udp
N/A 77.12.57.4:6893 udp
N/A 77.12.57.5:6893 udp
N/A 77.12.57.6:6893 udp
N/A 77.12.57.7:6893 udp
N/A 77.12.57.8:6893 udp
N/A 77.12.57.9:6893 udp
N/A 77.12.57.10:6893 udp
N/A 77.12.57.11:6893 udp
N/A 77.12.57.12:6893 udp
N/A 77.12.57.13:6893 udp
N/A 77.12.57.14:6893 udp
N/A 77.12.57.15:6893 udp
N/A 77.12.57.16:6893 udp
N/A 77.12.57.17:6893 udp
N/A 77.12.57.18:6893 udp
N/A 77.12.57.19:6893 udp
N/A 77.12.57.20:6893 udp
N/A 77.12.57.21:6893 udp
N/A 77.12.57.22:6893 udp
N/A 77.12.57.23:6893 udp
N/A 77.12.57.24:6893 udp
N/A 77.12.57.25:6893 udp
N/A 77.12.57.26:6893 udp
N/A 77.12.57.27:6893 udp
N/A 77.12.57.28:6893 udp
N/A 77.12.57.29:6893 udp
N/A 77.12.57.30:6893 udp
N/A 77.12.57.31:6893 udp
N/A 19.48.17.0:6893 udp
N/A 19.48.17.1:6893 udp
N/A 19.48.17.2:6893 udp
N/A 19.48.17.3:6893 udp
N/A 19.48.17.4:6893 udp
N/A 19.48.17.5:6893 udp
N/A 19.48.17.6:6893 udp
N/A 19.48.17.7:6893 udp
N/A 19.48.17.8:6893 udp
N/A 19.48.17.9:6893 udp
N/A 19.48.17.10:6893 udp
N/A 19.48.17.11:6893 udp
N/A 19.48.17.12:6893 udp
N/A 19.48.17.13:6893 udp
N/A 19.48.17.14:6893 udp
N/A 19.48.17.15:6893 udp
N/A 19.48.17.16:6893 udp
N/A 19.48.17.17:6893 udp
N/A 19.48.17.18:6893 udp
N/A 19.48.17.19:6893 udp
N/A 19.48.17.20:6893 udp
N/A 19.48.17.21:6893 udp
N/A 19.48.17.22:6893 udp
N/A 19.48.17.23:6893 udp
N/A 19.48.17.24:6893 udp
N/A 19.48.17.25:6893 udp
N/A 19.48.17.26:6893 udp
N/A 19.48.17.27:6893 udp
N/A 19.48.17.28:6893 udp
N/A 19.48.17.29:6893 udp
N/A 19.48.17.30:6893 udp
N/A 19.48.17.31:6893 udp
N/A 87.98.176.0:6893 udp
N/A 87.98.176.1:6893 udp
N/A 87.98.176.2:6893 udp
N/A 87.98.176.3:6893 udp
N/A 87.98.176.4:6893 udp
N/A 87.98.176.5:6893 udp
N/A 87.98.176.6:6893 udp
N/A 87.98.176.7:6893 udp
N/A 87.98.176.8:6893 udp
N/A 87.98.176.9:6893 udp
N/A 87.98.176.10:6893 udp
N/A 87.98.176.11:6893 udp
N/A 87.98.176.12:6893 udp
N/A 87.98.176.13:6893 udp
N/A 87.98.176.14:6893 udp
N/A 87.98.176.15:6893 udp
N/A 87.98.176.16:6893 udp
N/A 87.98.176.17:6893 udp
N/A 87.98.176.18:6893 udp
N/A 87.98.176.19:6893 udp
N/A 87.98.176.20:6893 udp
N/A 87.98.176.21:6893 udp
N/A 87.98.176.22:6893 udp
N/A 87.98.176.23:6893 udp
N/A 87.98.176.24:6893 udp
N/A 87.98.176.25:6893 udp
N/A 87.98.176.26:6893 udp
N/A 87.98.176.27:6893 udp
N/A 87.98.176.28:6893 udp
N/A 87.98.176.29:6893 udp
N/A 87.98.176.30:6893 udp
N/A 87.98.176.31:6893 udp
N/A 87.98.176.32:6893 udp
N/A 87.98.176.33:6893 udp
N/A 87.98.176.34:6893 udp
N/A 87.98.176.35:6893 udp
N/A 87.98.176.36:6893 udp
N/A 87.98.176.37:6893 udp
N/A 87.98.176.38:6893 udp
N/A 87.98.176.39:6893 udp
N/A 87.98.176.40:6893 udp
N/A 87.98.176.41:6893 udp
N/A 87.98.176.42:6893 udp
N/A 87.98.176.43:6893 udp
N/A 87.98.176.44:6893 udp
N/A 87.98.176.45:6893 udp
N/A 87.98.176.46:6893 udp
N/A 87.98.176.47:6893 udp
N/A 87.98.176.48:6893 udp
N/A 87.98.176.49:6893 udp
N/A 87.98.176.50:6893 udp
N/A 87.98.176.51:6893 udp
N/A 87.98.176.52:6893 udp
N/A 87.98.176.53:6893 udp
N/A 87.98.176.54:6893 udp
N/A 87.98.176.55:6893 udp
N/A 87.98.176.56:6893 udp
N/A 87.98.176.57:6893 udp
N/A 87.98.176.58:6893 udp
N/A 87.98.176.59:6893 udp
N/A 87.98.176.60:6893 udp
N/A 87.98.176.61:6893 udp
N/A 87.98.176.62:6893 udp
N/A 87.98.176.63:6893 udp
N/A 87.98.176.64:6893 udp
N/A 87.98.176.65:6893 udp
N/A 87.98.176.66:6893 udp
N/A 87.98.176.67:6893 udp
N/A 87.98.176.68:6893 udp
N/A 87.98.176.69:6893 udp
N/A 87.98.176.70:6893 udp
N/A 87.98.176.71:6893 udp
N/A 87.98.176.72:6893 udp
N/A 87.98.176.73:6893 udp
N/A 87.98.176.74:6893 udp
N/A 87.98.176.75:6893 udp
N/A 87.98.176.76:6893 udp
N/A 87.98.176.77:6893 udp
N/A 87.98.176.78:6893 udp
N/A 87.98.176.79:6893 udp
N/A 87.98.176.80:6893 udp
N/A 87.98.176.81:6893 udp
N/A 87.98.176.82:6893 udp
N/A 87.98.176.83:6893 udp
N/A 87.98.176.84:6893 udp
N/A 87.98.176.85:6893 udp
N/A 87.98.176.86:6893 udp
N/A 87.98.176.87:6893 udp
N/A 87.98.176.88:6893 udp
N/A 87.98.176.89:6893 udp
N/A 87.98.176.90:6893 udp
N/A 87.98.176.91:6893 udp
N/A 87.98.176.92:6893 udp
N/A 87.98.176.93:6893 udp
N/A 87.98.176.94:6893 udp
N/A 87.98.176.95:6893 udp
N/A 87.98.176.96:6893 udp
N/A 87.98.176.97:6893 udp
N/A 87.98.176.98:6893 udp
N/A 87.98.176.99:6893 udp
N/A 87.98.176.100:6893 udp
N/A 87.98.176.101:6893 udp
N/A 87.98.176.102:6893 udp
N/A 87.98.176.103:6893 udp
N/A 87.98.176.104:6893 udp
N/A 87.98.176.105:6893 udp
N/A 87.98.176.106:6893 udp
N/A 87.98.176.107:6893 udp
N/A 87.98.176.108:6893 udp
N/A 87.98.176.109:6893 udp
N/A 87.98.176.110:6893 udp
N/A 87.98.176.111:6893 udp
N/A 87.98.176.112:6893 udp
N/A 87.98.176.113:6893 udp
N/A 87.98.176.114:6893 udp
N/A 87.98.176.115:6893 udp
N/A 87.98.176.116:6893 udp
N/A 87.98.176.117:6893 udp
N/A 87.98.176.118:6893 udp
N/A 87.98.176.119:6893 udp
N/A 87.98.176.120:6893 udp
N/A 87.98.176.121:6893 udp
N/A 87.98.176.122:6893 udp
N/A 87.98.176.123:6893 udp
N/A 87.98.176.124:6893 udp
N/A 87.98.176.125:6893 udp
N/A 87.98.176.126:6893 udp
N/A 87.98.176.127:6893 udp
N/A 87.98.176.128:6893 udp
N/A 87.98.176.129:6893 udp
N/A 87.98.176.130:6893 udp
N/A 87.98.176.131:6893 udp
N/A 87.98.176.132:6893 udp
N/A 87.98.176.133:6893 udp
N/A 87.98.176.134:6893 udp
N/A 87.98.176.135:6893 udp
N/A 87.98.176.136:6893 udp
N/A 87.98.176.137:6893 udp
N/A 87.98.176.138:6893 udp
N/A 87.98.176.139:6893 udp
N/A 87.98.176.140:6893 udp
N/A 87.98.176.141:6893 udp
N/A 87.98.176.142:6893 udp
N/A 87.98.176.143:6893 udp
N/A 87.98.176.144:6893 udp
N/A 87.98.176.145:6893 udp
N/A 87.98.176.146:6893 udp
N/A 87.98.176.147:6893 udp
N/A 87.98.176.148:6893 udp
N/A 87.98.176.149:6893 udp
N/A 87.98.176.150:6893 udp
N/A 87.98.176.151:6893 udp
N/A 87.98.176.152:6893 udp
N/A 87.98.176.153:6893 udp
N/A 87.98.176.154:6893 udp
N/A 87.98.176.155:6893 udp
N/A 87.98.176.156:6893 udp
N/A 87.98.176.157:6893 udp
N/A 87.98.176.158:6893 udp
N/A 87.98.176.159:6893 udp
N/A 87.98.176.160:6893 udp
N/A 87.98.176.161:6893 udp
N/A 87.98.176.162:6893 udp
N/A 87.98.176.163:6893 udp
N/A 87.98.176.164:6893 udp
N/A 87.98.176.165:6893 udp
N/A 87.98.176.166:6893 udp
N/A 87.98.176.167:6893 udp
N/A 87.98.176.168:6893 udp
N/A 87.98.176.169:6893 udp
N/A 87.98.176.170:6893 udp
N/A 87.98.176.171:6893 udp
N/A 87.98.176.172:6893 udp
N/A 87.98.176.173:6893 udp
N/A 87.98.176.174:6893 udp
N/A 87.98.176.175:6893 udp
N/A 87.98.176.176:6893 udp
N/A 87.98.176.177:6893 udp
N/A 87.98.176.178:6893 udp
N/A 87.98.176.179:6893 udp
N/A 87.98.176.180:6893 udp
N/A 87.98.176.181:6893 udp
N/A 87.98.176.182:6893 udp
N/A 87.98.176.183:6893 udp
N/A 87.98.176.184:6893 udp
N/A 87.98.176.185:6893 udp
N/A 87.98.176.186:6893 udp
N/A 87.98.176.187:6893 udp
N/A 87.98.176.188:6893 udp
N/A 87.98.176.189:6893 udp
N/A 87.98.176.190:6893 udp
N/A 87.98.176.191:6893 udp
N/A 87.98.176.192:6893 udp
N/A 87.98.176.193:6893 udp
N/A 87.98.176.194:6893 udp
N/A 87.98.176.195:6893 udp
N/A 87.98.176.196:6893 udp
N/A 87.98.176.197:6893 udp
N/A 87.98.176.198:6893 udp
N/A 87.98.176.199:6893 udp
N/A 87.98.176.200:6893 udp
N/A 87.98.176.201:6893 udp
N/A 87.98.176.202:6893 udp
N/A 87.98.176.203:6893 udp
N/A 87.98.176.204:6893 udp
N/A 87.98.176.205:6893 udp
N/A 87.98.176.206:6893 udp
N/A 87.98.176.207:6893 udp
N/A 87.98.176.208:6893 udp
N/A 87.98.176.209:6893 udp
N/A 87.98.176.210:6893 udp
N/A 87.98.176.211:6893 udp
N/A 87.98.176.212:6893 udp
N/A 87.98.176.213:6893 udp
N/A 87.98.176.214:6893 udp
N/A 87.98.176.215:6893 udp
N/A 87.98.176.216:6893 udp
N/A 87.98.176.217:6893 udp
N/A 87.98.176.218:6893 udp
N/A 87.98.176.219:6893 udp
N/A 87.98.176.220:6893 udp
N/A 87.98.176.221:6893 udp
N/A 87.98.176.222:6893 udp
N/A 87.98.176.223:6893 udp
N/A 87.98.176.224:6893 udp
N/A 87.98.176.225:6893 udp
N/A 87.98.176.226:6893 udp
N/A 87.98.176.227:6893 udp
N/A 87.98.176.228:6893 udp
N/A 87.98.176.229:6893 udp
N/A 87.98.176.230:6893 udp
N/A 87.98.176.231:6893 udp
N/A 87.98.176.232:6893 udp
N/A 87.98.176.233:6893 udp
N/A 87.98.176.234:6893 udp
N/A 87.98.176.235:6893 udp
N/A 87.98.176.236:6893 udp
N/A 87.98.176.237:6893 udp
N/A 87.98.176.238:6893 udp
N/A 87.98.176.239:6893 udp
N/A 87.98.176.240:6893 udp
N/A 87.98.176.241:6893 udp
N/A 87.98.176.242:6893 udp
N/A 87.98.176.243:6893 udp
N/A 87.98.176.244:6893 udp
N/A 87.98.176.245:6893 udp
N/A 87.98.176.246:6893 udp
N/A 87.98.176.247:6893 udp
N/A 87.98.176.248:6893 udp
N/A 87.98.176.249:6893 udp
N/A 87.98.176.250:6893 udp
N/A 87.98.176.251:6893 udp
N/A 87.98.176.252:6893 udp
N/A 87.98.176.253:6893 udp
N/A 87.98.176.254:6893 udp
N/A 87.98.176.255:6893 udp
N/A 87.98.177.0:6893 udp
N/A 87.98.177.1:6893 udp
N/A 87.98.177.2:6893 udp
N/A 87.98.177.3:6893 udp
N/A 87.98.177.4:6893 udp
N/A 87.98.177.5:6893 udp
N/A 87.98.177.6:6893 udp
N/A 87.98.177.7:6893 udp
N/A 87.98.177.8:6893 udp
N/A 87.98.177.9:6893 udp
N/A 87.98.177.10:6893 udp
N/A 87.98.177.11:6893 udp
N/A 87.98.177.12:6893 udp
N/A 87.98.177.13:6893 udp
N/A 87.98.177.14:6893 udp
N/A 87.98.177.15:6893 udp
N/A 87.98.177.16:6893 udp
N/A 87.98.177.17:6893 udp
N/A 87.98.177.18:6893 udp
N/A 87.98.177.19:6893 udp
N/A 87.98.177.20:6893 udp
N/A 87.98.177.21:6893 udp
N/A 87.98.177.22:6893 udp
N/A 87.98.177.23:6893 udp
N/A 87.98.177.24:6893 udp
N/A 87.98.177.25:6893 udp
N/A 87.98.177.26:6893 udp
N/A 87.98.177.27:6893 udp
N/A 87.98.177.28:6893 udp
N/A 87.98.177.29:6893 udp
N/A 87.98.177.30:6893 udp
N/A 87.98.177.31:6893 udp
N/A 87.98.177.32:6893 udp
N/A 87.98.177.33:6893 udp
N/A 87.98.177.34:6893 udp
N/A 87.98.177.35:6893 udp
N/A 87.98.177.36:6893 udp
N/A 87.98.177.37:6893 udp
N/A 87.98.177.38:6893 udp
N/A 87.98.177.39:6893 udp
N/A 87.98.177.40:6893 udp
N/A 87.98.177.41:6893 udp
N/A 87.98.177.42:6893 udp
N/A 87.98.177.43:6893 udp
N/A 87.98.177.44:6893 udp
N/A 87.98.177.45:6893 udp
N/A 87.98.177.46:6893 udp
N/A 87.98.177.47:6893 udp
N/A 87.98.177.48:6893 udp
N/A 87.98.177.49:6893 udp
N/A 87.98.177.50:6893 udp
N/A 87.98.177.51:6893 udp
N/A 87.98.177.52:6893 udp
N/A 87.98.177.53:6893 udp
N/A 87.98.177.54:6893 udp
N/A 87.98.177.55:6893 udp
N/A 87.98.177.56:6893 udp
N/A 87.98.177.57:6893 udp
N/A 87.98.177.58:6893 udp
N/A 87.98.177.59:6893 udp
N/A 87.98.177.60:6893 udp
N/A 87.98.177.61:6893 udp
N/A 87.98.177.62:6893 udp
N/A 87.98.177.63:6893 udp
N/A 87.98.177.64:6893 udp
N/A 87.98.177.65:6893 udp
N/A 87.98.177.66:6893 udp
N/A 87.98.177.67:6893 udp
N/A 87.98.177.68:6893 udp
N/A 87.98.177.69:6893 udp
N/A 87.98.177.70:6893 udp
N/A 87.98.177.71:6893 udp
N/A 87.98.177.72:6893 udp
N/A 87.98.177.73:6893 udp
N/A 87.98.177.74:6893 udp
N/A 87.98.177.75:6893 udp
N/A 87.98.177.76:6893 udp
N/A 87.98.177.77:6893 udp
N/A 87.98.177.78:6893 udp
N/A 87.98.177.79:6893 udp
N/A 87.98.177.80:6893 udp
N/A 87.98.177.81:6893 udp
N/A 87.98.177.82:6893 udp
N/A 87.98.177.83:6893 udp
N/A 87.98.177.84:6893 udp
N/A 87.98.177.85:6893 udp
N/A 87.98.177.86:6893 udp
N/A 87.98.177.87:6893 udp
N/A 87.98.177.88:6893 udp
N/A 87.98.177.89:6893 udp
N/A 87.98.177.90:6893 udp
N/A 87.98.177.91:6893 udp
N/A 87.98.177.92:6893 udp
N/A 87.98.177.93:6893 udp
N/A 87.98.177.94:6893 udp
N/A 87.98.177.95:6893 udp
N/A 87.98.177.96:6893 udp
N/A 87.98.177.97:6893 udp
N/A 87.98.177.98:6893 udp
N/A 87.98.177.99:6893 udp
N/A 87.98.177.100:6893 udp
N/A 87.98.177.101:6893 udp
N/A 87.98.177.102:6893 udp
N/A 87.98.177.103:6893 udp
N/A 87.98.177.104:6893 udp
N/A 87.98.177.105:6893 udp
N/A 87.98.177.106:6893 udp
N/A 87.98.177.107:6893 udp
N/A 87.98.177.108:6893 udp
N/A 87.98.177.109:6893 udp
N/A 87.98.177.110:6893 udp
N/A 87.98.177.111:6893 udp
N/A 87.98.177.112:6893 udp
N/A 87.98.177.113:6893 udp
N/A 87.98.177.114:6893 udp
N/A 87.98.177.115:6893 udp
N/A 87.98.177.116:6893 udp
N/A 87.98.177.117:6893 udp
N/A 87.98.177.118:6893 udp
N/A 87.98.177.119:6893 udp
N/A 87.98.177.120:6893 udp
N/A 87.98.177.121:6893 udp
N/A 87.98.177.122:6893 udp
N/A 87.98.177.123:6893 udp
N/A 87.98.177.124:6893 udp
N/A 87.98.177.125:6893 udp
N/A 87.98.177.126:6893 udp
N/A 87.98.177.127:6893 udp
N/A 87.98.177.128:6893 udp
N/A 87.98.177.129:6893 udp
N/A 87.98.177.130:6893 udp
N/A 87.98.177.131:6893 udp
N/A 87.98.177.132:6893 udp
N/A 87.98.177.133:6893 udp
N/A 87.98.177.134:6893 udp
N/A 87.98.177.135:6893 udp
N/A 87.98.177.136:6893 udp
N/A 87.98.177.137:6893 udp
N/A 87.98.177.138:6893 udp
N/A 87.98.177.139:6893 udp
N/A 87.98.177.140:6893 udp
N/A 87.98.177.141:6893 udp
N/A 87.98.177.142:6893 udp
N/A 87.98.177.143:6893 udp
N/A 87.98.177.144:6893 udp
N/A 87.98.177.145:6893 udp
N/A 87.98.177.146:6893 udp
N/A 87.98.177.147:6893 udp
N/A 87.98.177.148:6893 udp
N/A 87.98.177.149:6893 udp
N/A 87.98.177.150:6893 udp
N/A 87.98.177.151:6893 udp
N/A 87.98.177.152:6893 udp
N/A 87.98.177.153:6893 udp
N/A 87.98.177.154:6893 udp
N/A 87.98.177.155:6893 udp
N/A 87.98.177.156:6893 udp
N/A 87.98.177.157:6893 udp
N/A 87.98.177.158:6893 udp
N/A 87.98.177.159:6893 udp
N/A 87.98.177.160:6893 udp
N/A 87.98.177.161:6893 udp
N/A 87.98.177.162:6893 udp
N/A 87.98.177.163:6893 udp
N/A 87.98.177.164:6893 udp
N/A 87.98.177.165:6893 udp
N/A 87.98.177.166:6893 udp
N/A 87.98.177.167:6893 udp
N/A 87.98.177.168:6893 udp
N/A 87.98.177.169:6893 udp
N/A 87.98.177.170:6893 udp
N/A 87.98.177.171:6893 udp
N/A 87.98.177.172:6893 udp
N/A 87.98.177.173:6893 udp
N/A 87.98.177.174:6893 udp
N/A 87.98.177.175:6893 udp
N/A 87.98.177.176:6893 udp
N/A 87.98.177.177:6893 udp
N/A 87.98.177.178:6893 udp
N/A 87.98.177.179:6893 udp
N/A 87.98.177.180:6893 udp
N/A 87.98.177.181:6893 udp
N/A 87.98.177.182:6893 udp
N/A 87.98.177.183:6893 udp
N/A 87.98.177.184:6893 udp
N/A 87.98.177.185:6893 udp
N/A 87.98.177.186:6893 udp
N/A 87.98.177.187:6893 udp
N/A 87.98.177.188:6893 udp
N/A 87.98.177.189:6893 udp
N/A 87.98.177.190:6893 udp
N/A 87.98.177.191:6893 udp
N/A 87.98.177.192:6893 udp
N/A 87.98.177.193:6893 udp
N/A 87.98.177.194:6893 udp
N/A 87.98.177.195:6893 udp
N/A 87.98.177.196:6893 udp
N/A 87.98.177.197:6893 udp
N/A 87.98.177.198:6893 udp
N/A 87.98.177.199:6893 udp
N/A 87.98.177.200:6893 udp
N/A 87.98.177.201:6893 udp
N/A 87.98.177.202:6893 udp
N/A 87.98.177.203:6893 udp
N/A 87.98.177.204:6893 udp
N/A 87.98.177.205:6893 udp
N/A 87.98.177.206:6893 udp
N/A 87.98.177.207:6893 udp
N/A 87.98.177.208:6893 udp
N/A 87.98.177.209:6893 udp
N/A 87.98.177.210:6893 udp
N/A 87.98.177.211:6893 udp
N/A 87.98.177.212:6893 udp
N/A 87.98.177.213:6893 udp
N/A 87.98.177.214:6893 udp
N/A 87.98.177.215:6893 udp
N/A 87.98.177.216:6893 udp
N/A 87.98.177.217:6893 udp
N/A 87.98.177.218:6893 udp
N/A 87.98.177.219:6893 udp
N/A 87.98.177.220:6893 udp
N/A 87.98.177.221:6893 udp
N/A 87.98.177.222:6893 udp
N/A 87.98.177.223:6893 udp
N/A 87.98.177.224:6893 udp
N/A 87.98.177.225:6893 udp
N/A 87.98.177.226:6893 udp
N/A 87.98.177.227:6893 udp
N/A 87.98.177.228:6893 udp
N/A 87.98.177.229:6893 udp
N/A 87.98.177.230:6893 udp
N/A 87.98.177.231:6893 udp
N/A 87.98.177.232:6893 udp
N/A 87.98.177.233:6893 udp
N/A 87.98.177.234:6893 udp
N/A 87.98.177.235:6893 udp
N/A 87.98.177.236:6893 udp
N/A 87.98.177.237:6893 udp
N/A 87.98.177.238:6893 udp
N/A 87.98.177.239:6893 udp
N/A 87.98.177.240:6893 udp
N/A 87.98.177.241:6893 udp
N/A 87.98.177.242:6893 udp
N/A 87.98.177.243:6893 udp
N/A 87.98.177.244:6893 udp
N/A 87.98.177.245:6893 udp
N/A 87.98.177.246:6893 udp
N/A 87.98.177.247:6893 udp
N/A 87.98.177.248:6893 udp
N/A 87.98.177.249:6893 udp
N/A 87.98.177.250:6893 udp
N/A 87.98.177.251:6893 udp
N/A 87.98.177.252:6893 udp
N/A 87.98.177.253:6893 udp
N/A 87.98.177.254:6893 udp
N/A 87.98.177.255:6893 udp
N/A 87.98.178.0:6893 udp
N/A 87.98.178.1:6893 udp
N/A 87.98.178.2:6893 udp
N/A 87.98.178.3:6893 udp
N/A 87.98.178.4:6893 udp
N/A 87.98.178.5:6893 udp
N/A 87.98.178.6:6893 udp
N/A 87.98.178.7:6893 udp
N/A 87.98.178.8:6893 udp
N/A 87.98.178.9:6893 udp
N/A 87.98.178.10:6893 udp
N/A 87.98.178.11:6893 udp
N/A 87.98.178.12:6893 udp
N/A 87.98.178.13:6893 udp
N/A 87.98.178.14:6893 udp
N/A 87.98.178.15:6893 udp
N/A 87.98.178.16:6893 udp
N/A 87.98.178.17:6893 udp
N/A 87.98.178.18:6893 udp
N/A 87.98.178.19:6893 udp
N/A 87.98.178.20:6893 udp
N/A 87.98.178.21:6893 udp
N/A 87.98.178.22:6893 udp
N/A 87.98.178.23:6893 udp
N/A 87.98.178.24:6893 udp
N/A 87.98.178.25:6893 udp
N/A 87.98.178.26:6893 udp
N/A 87.98.178.27:6893 udp
N/A 87.98.178.28:6893 udp
N/A 87.98.178.29:6893 udp
N/A 87.98.178.30:6893 udp
N/A 87.98.178.31:6893 udp
N/A 87.98.178.32:6893 udp
N/A 87.98.178.33:6893 udp
N/A 87.98.178.34:6893 udp
N/A 87.98.178.35:6893 udp
N/A 87.98.178.36:6893 udp
N/A 87.98.178.37:6893 udp
N/A 87.98.178.38:6893 udp
N/A 87.98.178.39:6893 udp
N/A 87.98.178.40:6893 udp
N/A 87.98.178.41:6893 udp
N/A 87.98.178.42:6893 udp
N/A 87.98.178.43:6893 udp
N/A 87.98.178.44:6893 udp
N/A 87.98.178.45:6893 udp
N/A 87.98.178.46:6893 udp
N/A 87.98.178.47:6893 udp
N/A 87.98.178.48:6893 udp
N/A 87.98.178.49:6893 udp
N/A 87.98.178.50:6893 udp
N/A 87.98.178.51:6893 udp
N/A 87.98.178.52:6893 udp
N/A 87.98.178.53:6893 udp
N/A 87.98.178.54:6893 udp
N/A 87.98.178.55:6893 udp
N/A 87.98.178.56:6893 udp
N/A 87.98.178.57:6893 udp
N/A 87.98.178.58:6893 udp
N/A 87.98.178.59:6893 udp
N/A 87.98.178.60:6893 udp
N/A 87.98.178.61:6893 udp
N/A 87.98.178.62:6893 udp
N/A 87.98.178.63:6893 udp
N/A 87.98.178.64:6893 udp
N/A 87.98.178.65:6893 udp
N/A 87.98.178.66:6893 udp
N/A 87.98.178.67:6893 udp
N/A 87.98.178.68:6893 udp
N/A 87.98.178.69:6893 udp
N/A 87.98.178.70:6893 udp
N/A 87.98.178.71:6893 udp
N/A 87.98.178.72:6893 udp
N/A 87.98.178.73:6893 udp
N/A 87.98.178.74:6893 udp
N/A 87.98.178.75:6893 udp
N/A 87.98.178.76:6893 udp
N/A 87.98.178.77:6893 udp
N/A 87.98.178.78:6893 udp
N/A 87.98.178.79:6893 udp
N/A 87.98.178.80:6893 udp
N/A 87.98.178.81:6893 udp
N/A 87.98.178.82:6893 udp
N/A 87.98.178.83:6893 udp
N/A 87.98.178.84:6893 udp
N/A 87.98.178.85:6893 udp
N/A 87.98.178.86:6893 udp
N/A 87.98.178.87:6893 udp
N/A 87.98.178.88:6893 udp
N/A 87.98.178.89:6893 udp
N/A 87.98.178.90:6893 udp
N/A 87.98.178.91:6893 udp
N/A 87.98.178.92:6893 udp
N/A 87.98.178.93:6893 udp
N/A 87.98.178.94:6893 udp
N/A 87.98.178.95:6893 udp
N/A 87.98.178.96:6893 udp
N/A 87.98.178.97:6893 udp
N/A 87.98.178.98:6893 udp
N/A 87.98.178.99:6893 udp
N/A 87.98.178.100:6893 udp
N/A 87.98.178.101:6893 udp
N/A 87.98.178.102:6893 udp
N/A 87.98.178.103:6893 udp
N/A 87.98.178.104:6893 udp
N/A 87.98.178.105:6893 udp
N/A 87.98.178.106:6893 udp
N/A 87.98.178.107:6893 udp
N/A 87.98.178.108:6893 udp
N/A 87.98.178.109:6893 udp
N/A 87.98.178.110:6893 udp
N/A 87.98.178.111:6893 udp
N/A 87.98.178.112:6893 udp
N/A 87.98.178.113:6893 udp
N/A 87.98.178.114:6893 udp
N/A 87.98.178.115:6893 udp
N/A 87.98.178.116:6893 udp
N/A 87.98.178.117:6893 udp
N/A 87.98.178.118:6893 udp
N/A 87.98.178.119:6893 udp
N/A 87.98.178.120:6893 udp
N/A 87.98.178.121:6893 udp
N/A 87.98.178.122:6893 udp
N/A 87.98.178.123:6893 udp
N/A 87.98.178.124:6893 udp
N/A 87.98.178.125:6893 udp
N/A 87.98.178.126:6893 udp
N/A 87.98.178.127:6893 udp
N/A 87.98.178.128:6893 udp
N/A 87.98.178.129:6893 udp
N/A 87.98.178.130:6893 udp
N/A 87.98.178.131:6893 udp
N/A 87.98.178.132:6893 udp
N/A 87.98.178.133:6893 udp
N/A 87.98.178.134:6893 udp
N/A 87.98.178.135:6893 udp
N/A 87.98.178.136:6893 udp
N/A 87.98.178.137:6893 udp
N/A 87.98.178.138:6893 udp
N/A 87.98.178.139:6893 udp
N/A 87.98.178.140:6893 udp
N/A 87.98.178.141:6893 udp
N/A 87.98.178.142:6893 udp
N/A 87.98.178.143:6893 udp
N/A 87.98.178.144:6893 udp
N/A 87.98.178.145:6893 udp
N/A 87.98.178.146:6893 udp
N/A 87.98.178.147:6893 udp
N/A 87.98.178.148:6893 udp
N/A 87.98.178.149:6893 udp
N/A 87.98.178.150:6893 udp
N/A 87.98.178.151:6893 udp
N/A 87.98.178.152:6893 udp
N/A 87.98.178.153:6893 udp
N/A 87.98.178.154:6893 udp
N/A 87.98.178.155:6893 udp
N/A 87.98.178.156:6893 udp
N/A 87.98.178.157:6893 udp
N/A 87.98.178.158:6893 udp
N/A 87.98.178.159:6893 udp
N/A 87.98.178.160:6893 udp
N/A 87.98.178.161:6893 udp
N/A 87.98.178.162:6893 udp
N/A 87.98.178.163:6893 udp
N/A 87.98.178.164:6893 udp
N/A 87.98.178.165:6893 udp
N/A 87.98.178.166:6893 udp
N/A 87.98.178.167:6893 udp
N/A 87.98.178.168:6893 udp
N/A 87.98.178.169:6893 udp
N/A 87.98.178.170:6893 udp
N/A 87.98.178.171:6893 udp
N/A 87.98.178.172:6893 udp
N/A 87.98.178.173:6893 udp
N/A 87.98.178.174:6893 udp
N/A 87.98.178.175:6893 udp
N/A 87.98.178.176:6893 udp
N/A 87.98.178.177:6893 udp
N/A 87.98.178.178:6893 udp
N/A 87.98.178.179:6893 udp
N/A 87.98.178.180:6893 udp
N/A 87.98.178.181:6893 udp
N/A 87.98.178.182:6893 udp
N/A 87.98.178.183:6893 udp
N/A 87.98.178.184:6893 udp
N/A 87.98.178.185:6893 udp
N/A 87.98.178.186:6893 udp
N/A 87.98.178.187:6893 udp
N/A 87.98.178.188:6893 udp
N/A 87.98.178.189:6893 udp
N/A 87.98.178.190:6893 udp
N/A 87.98.178.191:6893 udp
N/A 87.98.178.192:6893 udp
N/A 87.98.178.193:6893 udp
N/A 87.98.178.194:6893 udp
N/A 87.98.178.195:6893 udp
N/A 87.98.178.196:6893 udp
N/A 87.98.178.197:6893 udp
N/A 87.98.178.198:6893 udp
N/A 87.98.178.199:6893 udp
N/A 87.98.178.200:6893 udp
N/A 87.98.178.201:6893 udp
N/A 87.98.178.202:6893 udp
N/A 87.98.178.203:6893 udp
N/A 87.98.178.204:6893 udp
N/A 87.98.178.205:6893 udp
N/A 87.98.178.206:6893 udp
N/A 87.98.178.207:6893 udp
N/A 87.98.178.208:6893 udp
N/A 87.98.178.209:6893 udp
N/A 87.98.178.210:6893 udp
N/A 87.98.178.211:6893 udp
N/A 87.98.178.212:6893 udp
N/A 87.98.178.213:6893 udp
N/A 87.98.178.214:6893 udp
N/A 87.98.178.215:6893 udp
N/A 87.98.178.216:6893 udp
N/A 87.98.178.217:6893 udp
N/A 87.98.178.218:6893 udp
N/A 87.98.178.219:6893 udp
N/A 87.98.178.220:6893 udp
N/A 87.98.178.221:6893 udp
N/A 87.98.178.222:6893 udp
N/A 87.98.178.223:6893 udp
N/A 87.98.178.224:6893 udp
N/A 87.98.178.225:6893 udp
N/A 87.98.178.226:6893 udp
N/A 87.98.178.227:6893 udp
N/A 87.98.178.228:6893 udp
N/A 87.98.178.229:6893 udp
N/A 87.98.178.230:6893 udp
N/A 87.98.178.231:6893 udp
N/A 87.98.178.232:6893 udp
N/A 87.98.178.233:6893 udp
N/A 87.98.178.234:6893 udp
N/A 87.98.178.235:6893 udp
N/A 87.98.178.236:6893 udp
N/A 87.98.178.237:6893 udp
N/A 87.98.178.238:6893 udp
N/A 87.98.178.239:6893 udp
N/A 87.98.178.240:6893 udp
N/A 87.98.178.241:6893 udp
N/A 87.98.178.242:6893 udp
N/A 87.98.178.243:6893 udp
N/A 87.98.178.244:6893 udp
N/A 87.98.178.245:6893 udp
N/A 87.98.178.246:6893 udp
N/A 87.98.178.247:6893 udp
N/A 87.98.178.248:6893 udp
N/A 87.98.178.249:6893 udp
N/A 87.98.178.250:6893 udp
N/A 87.98.178.251:6893 udp
N/A 87.98.178.252:6893 udp
N/A 87.98.178.253:6893 udp
N/A 87.98.178.254:6893 udp
N/A 87.98.178.255:6893 udp
N/A 87.98.179.0:6893 udp
N/A 87.98.179.1:6893 udp
N/A 87.98.179.2:6893 udp
N/A 87.98.179.3:6893 udp
N/A 87.98.179.4:6893 udp
N/A 87.98.179.5:6893 udp
N/A 87.98.179.6:6893 udp
N/A 87.98.179.7:6893 udp
N/A 87.98.179.8:6893 udp
N/A 87.98.179.9:6893 udp
N/A 87.98.179.10:6893 udp
N/A 87.98.179.11:6893 udp
N/A 87.98.179.12:6893 udp
N/A 87.98.179.13:6893 udp
N/A 87.98.179.14:6893 udp
N/A 87.98.179.15:6893 udp
N/A 87.98.179.16:6893 udp
N/A 87.98.179.17:6893 udp
N/A 87.98.179.18:6893 udp
N/A 87.98.179.19:6893 udp
N/A 87.98.179.20:6893 udp
N/A 87.98.179.21:6893 udp
N/A 87.98.179.22:6893 udp
N/A 87.98.179.23:6893 udp
N/A 87.98.179.24:6893 udp
N/A 87.98.179.25:6893 udp
N/A 87.98.179.26:6893 udp
N/A 87.98.179.27:6893 udp
N/A 87.98.179.28:6893 udp
N/A 87.98.179.29:6893 udp
N/A 87.98.179.30:6893 udp
N/A 87.98.179.31:6893 udp
N/A 87.98.179.32:6893 udp
N/A 87.98.179.33:6893 udp
N/A 87.98.179.34:6893 udp
N/A 87.98.179.35:6893 udp
N/A 87.98.179.36:6893 udp
N/A 87.98.179.37:6893 udp
N/A 87.98.179.38:6893 udp
N/A 87.98.179.39:6893 udp
N/A 87.98.179.40:6893 udp
N/A 87.98.179.41:6893 udp
N/A 87.98.179.42:6893 udp
N/A 87.98.179.43:6893 udp
N/A 87.98.179.44:6893 udp
N/A 87.98.179.45:6893 udp
N/A 87.98.179.46:6893 udp
N/A 87.98.179.47:6893 udp
N/A 87.98.179.48:6893 udp
N/A 87.98.179.49:6893 udp
N/A 87.98.179.50:6893 udp
N/A 87.98.179.51:6893 udp
N/A 87.98.179.52:6893 udp
N/A 87.98.179.53:6893 udp
N/A 87.98.179.54:6893 udp
N/A 87.98.179.55:6893 udp
N/A 87.98.179.56:6893 udp
N/A 87.98.179.57:6893 udp
N/A 87.98.179.58:6893 udp
N/A 87.98.179.59:6893 udp
N/A 87.98.179.60:6893 udp
N/A 87.98.179.61:6893 udp
N/A 87.98.179.62:6893 udp
N/A 87.98.179.63:6893 udp
N/A 87.98.179.64:6893 udp
N/A 87.98.179.65:6893 udp
N/A 87.98.179.66:6893 udp
N/A 87.98.179.67:6893 udp
N/A 87.98.179.68:6893 udp
N/A 87.98.179.69:6893 udp
N/A 87.98.179.70:6893 udp
N/A 87.98.179.71:6893 udp
N/A 87.98.179.72:6893 udp
N/A 87.98.179.73:6893 udp
N/A 87.98.179.74:6893 udp
N/A 87.98.179.75:6893 udp
N/A 87.98.179.76:6893 udp
N/A 87.98.179.77:6893 udp
N/A 87.98.179.78:6893 udp
N/A 87.98.179.79:6893 udp
N/A 87.98.179.80:6893 udp
N/A 87.98.179.81:6893 udp
N/A 87.98.179.82:6893 udp
N/A 87.98.179.83:6893 udp
N/A 87.98.179.84:6893 udp
N/A 87.98.179.85:6893 udp
N/A 87.98.179.86:6893 udp
N/A 87.98.179.87:6893 udp
N/A 87.98.179.88:6893 udp
N/A 87.98.179.89:6893 udp
N/A 87.98.179.90:6893 udp
N/A 87.98.179.91:6893 udp
N/A 87.98.179.92:6893 udp
N/A 87.98.179.93:6893 udp
N/A 87.98.179.94:6893 udp
N/A 87.98.179.95:6893 udp
N/A 87.98.179.96:6893 udp
N/A 87.98.179.97:6893 udp
N/A 87.98.179.98:6893 udp
N/A 87.98.179.99:6893 udp
N/A 87.98.179.100:6893 udp
N/A 87.98.179.101:6893 udp
N/A 87.98.179.102:6893 udp
N/A 87.98.179.103:6893 udp
N/A 87.98.179.104:6893 udp
N/A 87.98.179.105:6893 udp
N/A 87.98.179.106:6893 udp
N/A 87.98.179.107:6893 udp
N/A 87.98.179.108:6893 udp
N/A 87.98.179.109:6893 udp
N/A 87.98.179.110:6893 udp
N/A 87.98.179.111:6893 udp
N/A 87.98.179.112:6893 udp
N/A 87.98.179.113:6893 udp
N/A 87.98.179.114:6893 udp
N/A 87.98.179.115:6893 udp
N/A 87.98.179.116:6893 udp
N/A 87.98.179.117:6893 udp
N/A 87.98.179.118:6893 udp
N/A 87.98.179.119:6893 udp
N/A 87.98.179.120:6893 udp
N/A 87.98.179.121:6893 udp
N/A 87.98.179.122:6893 udp
N/A 87.98.179.123:6893 udp
N/A 87.98.179.124:6893 udp
N/A 87.98.179.125:6893 udp
N/A 87.98.179.126:6893 udp
N/A 87.98.179.127:6893 udp
N/A 87.98.179.128:6893 udp
N/A 87.98.179.129:6893 udp
N/A 87.98.179.130:6893 udp
N/A 87.98.179.131:6893 udp
N/A 87.98.179.132:6893 udp
N/A 87.98.179.133:6893 udp
N/A 87.98.179.134:6893 udp
N/A 87.98.179.135:6893 udp
N/A 87.98.179.136:6893 udp
N/A 87.98.179.137:6893 udp
N/A 87.98.179.138:6893 udp
N/A 87.98.179.139:6893 udp
N/A 87.98.179.140:6893 udp
N/A 87.98.179.141:6893 udp
N/A 87.98.179.142:6893 udp
N/A 87.98.179.143:6893 udp
N/A 87.98.179.144:6893 udp
N/A 87.98.179.145:6893 udp
N/A 87.98.179.146:6893 udp
N/A 87.98.179.147:6893 udp
N/A 87.98.179.148:6893 udp
N/A 87.98.179.149:6893 udp
N/A 87.98.179.150:6893 udp
N/A 87.98.179.151:6893 udp
N/A 87.98.179.152:6893 udp
N/A 87.98.179.153:6893 udp
N/A 87.98.179.154:6893 udp
N/A 87.98.179.155:6893 udp
N/A 87.98.179.156:6893 udp
N/A 87.98.179.157:6893 udp
N/A 87.98.179.158:6893 udp
N/A 87.98.179.159:6893 udp
N/A 87.98.179.160:6893 udp
N/A 87.98.179.161:6893 udp
N/A 87.98.179.162:6893 udp
N/A 87.98.179.163:6893 udp
N/A 87.98.179.164:6893 udp
N/A 87.98.179.165:6893 udp
N/A 87.98.179.166:6893 udp
N/A 87.98.179.167:6893 udp
N/A 87.98.179.168:6893 udp
N/A 87.98.179.169:6893 udp
N/A 87.98.179.170:6893 udp
N/A 87.98.179.171:6893 udp
N/A 87.98.179.172:6893 udp
N/A 87.98.179.173:6893 udp
N/A 87.98.179.174:6893 udp
N/A 87.98.179.175:6893 udp
N/A 87.98.179.176:6893 udp
N/A 87.98.179.177:6893 udp
N/A 87.98.179.178:6893 udp
N/A 87.98.179.179:6893 udp
N/A 87.98.179.180:6893 udp
N/A 87.98.179.181:6893 udp
N/A 87.98.179.182:6893 udp
N/A 87.98.179.183:6893 udp
N/A 87.98.179.184:6893 udp
N/A 87.98.179.185:6893 udp
N/A 87.98.179.186:6893 udp
N/A 87.98.179.187:6893 udp
N/A 87.98.179.188:6893 udp
N/A 87.98.179.189:6893 udp
N/A 87.98.179.190:6893 udp
N/A 87.98.179.191:6893 udp
N/A 87.98.179.192:6893 udp
N/A 87.98.179.193:6893 udp
N/A 87.98.179.194:6893 udp
N/A 87.98.179.195:6893 udp
N/A 87.98.179.196:6893 udp
N/A 87.98.179.197:6893 udp
N/A 87.98.179.198:6893 udp
N/A 87.98.179.199:6893 udp
N/A 87.98.179.200:6893 udp
N/A 87.98.179.201:6893 udp
N/A 87.98.179.202:6893 udp
N/A 87.98.179.203:6893 udp
N/A 87.98.179.204:6893 udp
N/A 87.98.179.205:6893 udp
N/A 87.98.179.206:6893 udp
N/A 87.98.179.207:6893 udp
N/A 87.98.179.208:6893 udp
N/A 87.98.179.209:6893 udp
N/A 87.98.179.210:6893 udp
N/A 87.98.179.211:6893 udp
N/A 87.98.179.212:6893 udp
N/A 87.98.179.213:6893 udp
N/A 87.98.179.214:6893 udp
N/A 87.98.179.215:6893 udp
N/A 87.98.179.216:6893 udp
N/A 87.98.179.217:6893 udp
N/A 87.98.179.218:6893 udp
N/A 87.98.179.219:6893 udp
N/A 87.98.179.220:6893 udp
N/A 87.98.179.221:6893 udp
N/A 87.98.179.222:6893 udp
N/A 87.98.179.223:6893 udp
N/A 87.98.179.224:6893 udp
N/A 87.98.179.225:6893 udp
N/A 87.98.179.226:6893 udp
N/A 87.98.179.227:6893 udp
N/A 87.98.179.228:6893 udp
N/A 87.98.179.229:6893 udp
N/A 87.98.179.230:6893 udp
N/A 87.98.179.231:6893 udp
N/A 87.98.179.232:6893 udp
N/A 87.98.179.233:6893 udp
N/A 87.98.179.234:6893 udp
N/A 87.98.179.235:6893 udp
N/A 87.98.179.236:6893 udp
N/A 87.98.179.237:6893 udp
N/A 87.98.179.238:6893 udp
N/A 87.98.179.239:6893 udp
N/A 87.98.179.240:6893 udp
N/A 87.98.179.241:6893 udp
N/A 87.98.179.242:6893 udp
N/A 87.98.179.243:6893 udp
N/A 87.98.179.244:6893 udp
N/A 87.98.179.245:6893 udp
N/A 87.98.179.246:6893 udp
N/A 87.98.179.247:6893 udp
N/A 87.98.179.248:6893 udp
N/A 87.98.179.249:6893 udp
N/A 87.98.179.250:6893 udp
N/A 87.98.179.251:6893 udp
N/A 87.98.179.252:6893 udp
N/A 87.98.179.253:6893 udp
N/A 87.98.179.254:6893 udp
N/A 87.98.179.255:6893 udp
N/A 77.12.57.0:6893 udp
N/A 77.12.57.1:6893 udp
N/A 77.12.57.2:6893 udp
N/A 77.12.57.3:6893 udp
N/A 77.12.57.4:6893 udp
N/A 77.12.57.5:6893 udp
N/A 77.12.57.6:6893 udp
N/A 77.12.57.7:6893 udp
N/A 77.12.57.8:6893 udp
N/A 77.12.57.9:6893 udp
N/A 77.12.57.10:6893 udp
N/A 77.12.57.11:6893 udp
N/A 77.12.57.12:6893 udp
N/A 77.12.57.13:6893 udp
N/A 77.12.57.14:6893 udp
N/A 77.12.57.15:6893 udp
N/A 77.12.57.16:6893 udp
N/A 77.12.57.17:6893 udp
N/A 77.12.57.18:6893 udp
N/A 77.12.57.19:6893 udp
N/A 77.12.57.20:6893 udp
N/A 77.12.57.21:6893 udp
N/A 77.12.57.22:6893 udp
N/A 77.12.57.23:6893 udp
N/A 77.12.57.24:6893 udp
N/A 77.12.57.25:6893 udp
N/A 77.12.57.26:6893 udp
N/A 77.12.57.27:6893 udp
N/A 77.12.57.28:6893 udp
N/A 77.12.57.29:6893 udp
N/A 77.12.57.30:6893 udp
N/A 77.12.57.31:6893 udp
N/A 19.48.17.0:6893 udp
N/A 19.48.17.1:6893 udp
N/A 19.48.17.2:6893 udp
N/A 19.48.17.3:6893 udp
N/A 19.48.17.4:6893 udp
N/A 19.48.17.5:6893 udp
N/A 19.48.17.6:6893 udp
N/A 19.48.17.7:6893 udp
N/A 19.48.17.8:6893 udp
N/A 19.48.17.9:6893 udp
N/A 19.48.17.10:6893 udp
N/A 19.48.17.11:6893 udp
N/A 19.48.17.12:6893 udp
N/A 19.48.17.13:6893 udp
N/A 19.48.17.14:6893 udp
N/A 19.48.17.15:6893 udp
N/A 19.48.17.16:6893 udp
N/A 19.48.17.17:6893 udp
N/A 19.48.17.18:6893 udp
N/A 19.48.17.19:6893 udp
N/A 19.48.17.20:6893 udp
N/A 19.48.17.21:6893 udp
N/A 19.48.17.22:6893 udp
N/A 19.48.17.23:6893 udp
N/A 19.48.17.24:6893 udp
N/A 19.48.17.25:6893 udp
N/A 19.48.17.26:6893 udp
N/A 19.48.17.27:6893 udp
N/A 19.48.17.28:6893 udp
N/A 19.48.17.29:6893 udp
N/A 19.48.17.30:6893 udp
N/A 19.48.17.31:6893 udp
N/A 87.98.176.0:6893 udp
N/A 87.98.176.1:6893 udp
N/A 87.98.176.2:6893 udp
N/A 87.98.176.3:6893 udp
N/A 87.98.176.4:6893 udp
N/A 87.98.176.5:6893 udp
N/A 87.98.176.6:6893 udp
N/A 87.98.176.7:6893 udp
N/A 87.98.176.8:6893 udp
N/A 87.98.176.9:6893 udp
N/A 87.98.176.10:6893 udp
N/A 87.98.176.11:6893 udp
N/A 87.98.176.12:6893 udp
N/A 87.98.176.13:6893 udp
N/A 87.98.176.14:6893 udp
N/A 87.98.176.15:6893 udp
N/A 87.98.176.16:6893 udp
N/A 87.98.176.17:6893 udp
N/A 87.98.176.18:6893 udp
N/A 87.98.176.19:6893 udp
N/A 87.98.176.20:6893 udp
N/A 87.98.176.21:6893 udp
N/A 87.98.176.22:6893 udp
N/A 87.98.176.23:6893 udp
N/A 87.98.176.24:6893 udp
N/A 87.98.176.25:6893 udp
N/A 87.98.176.26:6893 udp
N/A 87.98.176.27:6893 udp
N/A 87.98.176.28:6893 udp
N/A 87.98.176.29:6893 udp
N/A 87.98.176.30:6893 udp
N/A 87.98.176.31:6893 udp
N/A 87.98.176.32:6893 udp
N/A 87.98.176.33:6893 udp
N/A 87.98.176.34:6893 udp
N/A 87.98.176.35:6893 udp
N/A 87.98.176.36:6893 udp
N/A 87.98.176.37:6893 udp
N/A 87.98.176.38:6893 udp
N/A 87.98.176.39:6893 udp
N/A 87.98.176.40:6893 udp
N/A 87.98.176.41:6893 udp
N/A 87.98.176.42:6893 udp
N/A 87.98.176.43:6893 udp
N/A 87.98.176.44:6893 udp
N/A 87.98.176.45:6893 udp
N/A 87.98.176.46:6893 udp
N/A 87.98.176.47:6893 udp
N/A 87.98.176.48:6893 udp
N/A 87.98.176.49:6893 udp
N/A 87.98.176.50:6893 udp
N/A 87.98.176.51:6893 udp
N/A 87.98.176.52:6893 udp
N/A 87.98.176.53:6893 udp
N/A 87.98.176.54:6893 udp
N/A 87.98.176.55:6893 udp
N/A 87.98.176.56:6893 udp
N/A 87.98.176.57:6893 udp
N/A 87.98.176.58:6893 udp
N/A 87.98.176.59:6893 udp
N/A 87.98.176.60:6893 udp
N/A 87.98.176.61:6893 udp
N/A 87.98.176.62:6893 udp
N/A 87.98.176.63:6893 udp
N/A 87.98.176.64:6893 udp
N/A 87.98.176.65:6893 udp
N/A 87.98.176.66:6893 udp
N/A 87.98.176.67:6893 udp
N/A 87.98.176.68:6893 udp
N/A 87.98.176.69:6893 udp
N/A 87.98.176.70:6893 udp
N/A 87.98.176.71:6893 udp
N/A 87.98.176.72:6893 udp
N/A 87.98.176.73:6893 udp
N/A 87.98.176.74:6893 udp
N/A 87.98.176.75:6893 udp
N/A 87.98.176.76:6893 udp
N/A 87.98.176.77:6893 udp
N/A 87.98.176.78:6893 udp
N/A 87.98.176.79:6893 udp
N/A 87.98.176.80:6893 udp
N/A 87.98.176.81:6893 udp
N/A 87.98.176.82:6893 udp
N/A 87.98.176.83:6893 udp
N/A 87.98.176.84:6893 udp
N/A 87.98.176.85:6893 udp
N/A 87.98.176.86:6893 udp
N/A 87.98.176.87:6893 udp
N/A 87.98.176.88:6893 udp
N/A 87.98.176.89:6893 udp
N/A 87.98.176.90:6893 udp
N/A 87.98.176.91:6893 udp
N/A 87.98.176.92:6893 udp
N/A 87.98.176.93:6893 udp
N/A 87.98.176.94:6893 udp
N/A 87.98.176.95:6893 udp
N/A 87.98.176.96:6893 udp
N/A 87.98.176.97:6893 udp
N/A 87.98.176.98:6893 udp
N/A 87.98.176.99:6893 udp
N/A 87.98.176.100:6893 udp
N/A 87.98.176.101:6893 udp
N/A 87.98.176.102:6893 udp
N/A 87.98.176.103:6893 udp
N/A 87.98.176.104:6893 udp
N/A 87.98.176.105:6893 udp
N/A 87.98.176.106:6893 udp
N/A 87.98.176.107:6893 udp
N/A 87.98.176.108:6893 udp
N/A 87.98.176.109:6893 udp
N/A 87.98.176.110:6893 udp
N/A 87.98.176.111:6893 udp
N/A 87.98.176.112:6893 udp
N/A 87.98.176.113:6893 udp
N/A 87.98.176.114:6893 udp
N/A 87.98.176.115:6893 udp
N/A 87.98.176.116:6893 udp
N/A 87.98.176.117:6893 udp
N/A 87.98.176.118:6893 udp
N/A 87.98.176.119:6893 udp
N/A 87.98.176.120:6893 udp
N/A 87.98.176.121:6893 udp
N/A 87.98.176.122:6893 udp
N/A 87.98.176.123:6893 udp
N/A 87.98.176.124:6893 udp
N/A 87.98.176.125:6893 udp
N/A 87.98.176.126:6893 udp
N/A 87.98.176.127:6893 udp
N/A 87.98.176.128:6893 udp
N/A 87.98.176.129:6893 udp
N/A 87.98.176.130:6893 udp
N/A 87.98.176.131:6893 udp
N/A 87.98.176.132:6893 udp
N/A 87.98.176.133:6893 udp
N/A 87.98.176.134:6893 udp
N/A 87.98.176.135:6893 udp
N/A 87.98.176.136:6893 udp
N/A 87.98.176.137:6893 udp
N/A 87.98.176.138:6893 udp
N/A 87.98.176.139:6893 udp
N/A 87.98.176.140:6893 udp
N/A 87.98.176.141:6893 udp
N/A 87.98.176.142:6893 udp
N/A 87.98.176.143:6893 udp
N/A 87.98.176.144:6893 udp
N/A 87.98.176.145:6893 udp
N/A 87.98.176.146:6893 udp
N/A 87.98.176.147:6893 udp
N/A 87.98.176.148:6893 udp
N/A 87.98.176.149:6893 udp
N/A 87.98.176.150:6893 udp
N/A 87.98.176.151:6893 udp
N/A 87.98.176.152:6893 udp
N/A 87.98.176.153:6893 udp
N/A 87.98.176.154:6893 udp
N/A 87.98.176.155:6893 udp
N/A 87.98.176.156:6893 udp
N/A 87.98.176.157:6893 udp
N/A 87.98.176.158:6893 udp
N/A 87.98.176.159:6893 udp
N/A 87.98.176.160:6893 udp
N/A 87.98.176.161:6893 udp
N/A 87.98.176.162:6893 udp
N/A 87.98.176.163:6893 udp
N/A 87.98.176.164:6893 udp
N/A 87.98.176.165:6893 udp
N/A 87.98.176.166:6893 udp
N/A 87.98.176.167:6893 udp
N/A 87.98.176.168:6893 udp
N/A 87.98.176.169:6893 udp
N/A 87.98.176.170:6893 udp
N/A 87.98.176.171:6893 udp
N/A 87.98.176.172:6893 udp
N/A 87.98.176.173:6893 udp
N/A 87.98.176.174:6893 udp
N/A 87.98.176.175:6893 udp
N/A 87.98.176.176:6893 udp
N/A 87.98.176.177:6893 udp
N/A 87.98.176.178:6893 udp
N/A 87.98.176.179:6893 udp
N/A 87.98.176.180:6893 udp
N/A 87.98.176.181:6893 udp
N/A 87.98.176.182:6893 udp
N/A 87.98.176.183:6893 udp
N/A 87.98.176.184:6893 udp
N/A 87.98.176.185:6893 udp
N/A 87.98.176.186:6893 udp
N/A 87.98.176.187:6893 udp
N/A 87.98.176.188:6893 udp
N/A 87.98.176.189:6893 udp
N/A 87.98.176.190:6893 udp
N/A 87.98.176.191:6893 udp
N/A 87.98.176.192:6893 udp
N/A 87.98.176.193:6893 udp
N/A 87.98.176.194:6893 udp
N/A 87.98.176.195:6893 udp
N/A 87.98.176.196:6893 udp
N/A 87.98.176.197:6893 udp
N/A 87.98.176.198:6893 udp
N/A 87.98.176.199:6893 udp
N/A 87.98.176.200:6893 udp
N/A 87.98.176.201:6893 udp
N/A 87.98.176.202:6893 udp
N/A 87.98.176.203:6893 udp
N/A 87.98.176.204:6893 udp
N/A 87.98.176.205:6893 udp
N/A 87.98.176.206:6893 udp
N/A 87.98.176.207:6893 udp
N/A 87.98.176.208:6893 udp
N/A 87.98.176.209:6893 udp
N/A 87.98.176.210:6893 udp
N/A 87.98.176.211:6893 udp
N/A 87.98.176.212:6893 udp
N/A 87.98.176.213:6893 udp
N/A 87.98.176.214:6893 udp
N/A 87.98.176.215:6893 udp
N/A 87.98.176.216:6893 udp
N/A 87.98.176.217:6893 udp
N/A 87.98.176.218:6893 udp
N/A 87.98.176.219:6893 udp
N/A 87.98.176.220:6893 udp
N/A 87.98.176.221:6893 udp
N/A 87.98.176.222:6893 udp
N/A 87.98.176.223:6893 udp
N/A 87.98.176.224:6893 udp
N/A 87.98.176.225:6893 udp
N/A 87.98.176.226:6893 udp
N/A 87.98.176.227:6893 udp
N/A 87.98.176.228:6893 udp
N/A 87.98.176.229:6893 udp
N/A 87.98.176.230:6893 udp
N/A 87.98.176.231:6893 udp
N/A 87.98.176.232:6893 udp
N/A 87.98.176.233:6893 udp
N/A 87.98.176.234:6893 udp
N/A 87.98.176.235:6893 udp
N/A 87.98.176.236:6893 udp
N/A 87.98.176.237:6893 udp
N/A 87.98.176.238:6893 udp
N/A 87.98.176.239:6893 udp
N/A 87.98.176.240:6893 udp
N/A 87.98.176.241:6893 udp
N/A 87.98.176.242:6893 udp
N/A 87.98.176.243:6893 udp
N/A 87.98.176.244:6893 udp
N/A 87.98.176.245:6893 udp
N/A 87.98.176.246:6893 udp
N/A 87.98.176.247:6893 udp
N/A 87.98.176.248:6893 udp
N/A 87.98.176.249:6893 udp
N/A 87.98.176.250:6893 udp
N/A 87.98.176.251:6893 udp
N/A 87.98.176.252:6893 udp
N/A 87.98.176.253:6893 udp
N/A 87.98.176.254:6893 udp
N/A 87.98.176.255:6893 udp
N/A 87.98.177.0:6893 udp
N/A 87.98.177.1:6893 udp
N/A 87.98.177.2:6893 udp
N/A 87.98.177.3:6893 udp
N/A 87.98.177.4:6893 udp
N/A 87.98.177.5:6893 udp
N/A 87.98.177.6:6893 udp
N/A 87.98.177.7:6893 udp
N/A 87.98.177.8:6893 udp
N/A 87.98.177.9:6893 udp
N/A 87.98.177.10:6893 udp
N/A 87.98.177.11:6893 udp
N/A 87.98.177.12:6893 udp
N/A 87.98.177.13:6893 udp
N/A 87.98.177.14:6893 udp
N/A 87.98.177.15:6893 udp
N/A 87.98.177.16:6893 udp
N/A 87.98.177.17:6893 udp
N/A 87.98.177.18:6893 udp
N/A 87.98.177.19:6893 udp
N/A 87.98.177.20:6893 udp
N/A 87.98.177.21:6893 udp
N/A 87.98.177.22:6893 udp
N/A 87.98.177.23:6893 udp
N/A 87.98.177.24:6893 udp
N/A 87.98.177.25:6893 udp
N/A 87.98.177.26:6893 udp
N/A 87.98.177.27:6893 udp
N/A 87.98.177.28:6893 udp
N/A 87.98.177.29:6893 udp
N/A 87.98.177.30:6893 udp
N/A 87.98.177.31:6893 udp
N/A 87.98.177.32:6893 udp
N/A 87.98.177.33:6893 udp
N/A 87.98.177.34:6893 udp
N/A 87.98.177.35:6893 udp
N/A 87.98.177.36:6893 udp
N/A 87.98.177.37:6893 udp
N/A 87.98.177.38:6893 udp
N/A 87.98.177.39:6893 udp
N/A 87.98.177.40:6893 udp
N/A 87.98.177.41:6893 udp
N/A 87.98.177.42:6893 udp
N/A 87.98.177.43:6893 udp
N/A 87.98.177.44:6893 udp
N/A 87.98.177.45:6893 udp
N/A 87.98.177.46:6893 udp
N/A 87.98.177.47:6893 udp
N/A 87.98.177.48:6893 udp
N/A 87.98.177.49:6893 udp
N/A 87.98.177.50:6893 udp
N/A 87.98.177.51:6893 udp
N/A 87.98.177.52:6893 udp
N/A 87.98.177.53:6893 udp
N/A 87.98.177.54:6893 udp
N/A 87.98.177.55:6893 udp
N/A 87.98.177.56:6893 udp
N/A 87.98.177.57:6893 udp
N/A 87.98.177.58:6893 udp
N/A 87.98.177.59:6893 udp
N/A 87.98.177.60:6893 udp
N/A 87.98.177.61:6893 udp
N/A 87.98.177.62:6893 udp
N/A 87.98.177.63:6893 udp
N/A 87.98.177.64:6893 udp
N/A 87.98.177.65:6893 udp
N/A 87.98.177.66:6893 udp
N/A 87.98.177.67:6893 udp
N/A 87.98.177.68:6893 udp
N/A 87.98.177.69:6893 udp
N/A 87.98.177.70:6893 udp
N/A 87.98.177.71:6893 udp
N/A 87.98.177.72:6893 udp
N/A 87.98.177.73:6893 udp
N/A 87.98.177.74:6893 udp
N/A 87.98.177.75:6893 udp
N/A 87.98.177.76:6893 udp
N/A 87.98.177.77:6893 udp
N/A 87.98.177.78:6893 udp
N/A 87.98.177.79:6893 udp
N/A 87.98.177.80:6893 udp
N/A 87.98.177.81:6893 udp
N/A 87.98.177.82:6893 udp
N/A 87.98.177.83:6893 udp
N/A 87.98.177.84:6893 udp
N/A 87.98.177.85:6893 udp
N/A 87.98.177.86:6893 udp
N/A 87.98.177.87:6893 udp
N/A 87.98.177.88:6893 udp
N/A 87.98.177.89:6893 udp
N/A 87.98.177.90:6893 udp
N/A 87.98.177.91:6893 udp
N/A 87.98.177.92:6893 udp
N/A 87.98.177.93:6893 udp
N/A 87.98.177.94:6893 udp
N/A 87.98.177.95:6893 udp
N/A 87.98.177.96:6893 udp
N/A 87.98.177.97:6893 udp
N/A 87.98.177.98:6893 udp
N/A 87.98.177.99:6893 udp
N/A 87.98.177.100:6893 udp
N/A 87.98.177.101:6893 udp
N/A 87.98.177.102:6893 udp
N/A 87.98.177.103:6893 udp
N/A 87.98.177.104:6893 udp
N/A 87.98.177.105:6893 udp
N/A 87.98.177.106:6893 udp
N/A 87.98.177.107:6893 udp
N/A 87.98.177.108:6893 udp
N/A 87.98.177.109:6893 udp
N/A 87.98.177.110:6893 udp
N/A 87.98.177.111:6893 udp
N/A 87.98.177.112:6893 udp
N/A 87.98.177.113:6893 udp
N/A 87.98.177.114:6893 udp
N/A 87.98.177.115:6893 udp
N/A 87.98.177.116:6893 udp
N/A 87.98.177.117:6893 udp
N/A 87.98.177.118:6893 udp
N/A 87.98.177.119:6893 udp
N/A 87.98.177.120:6893 udp
N/A 87.98.177.121:6893 udp
N/A 87.98.177.122:6893 udp
N/A 87.98.177.123:6893 udp
N/A 87.98.177.124:6893 udp
N/A 87.98.177.125:6893 udp
N/A 87.98.177.126:6893 udp
N/A 87.98.177.127:6893 udp
N/A 87.98.177.128:6893 udp
N/A 87.98.177.129:6893 udp
N/A 87.98.177.130:6893 udp
N/A 87.98.177.131:6893 udp
N/A 87.98.177.132:6893 udp
N/A 87.98.177.133:6893 udp
N/A 87.98.177.134:6893 udp
N/A 87.98.177.135:6893 udp
N/A 87.98.177.136:6893 udp
N/A 87.98.177.137:6893 udp
N/A 87.98.177.138:6893 udp
N/A 87.98.177.139:6893 udp
N/A 87.98.177.140:6893 udp
N/A 87.98.177.141:6893 udp
N/A 87.98.177.142:6893 udp
N/A 87.98.177.143:6893 udp
N/A 87.98.177.144:6893 udp
N/A 87.98.177.145:6893 udp
N/A 87.98.177.146:6893 udp
N/A 87.98.177.147:6893 udp
N/A 87.98.177.148:6893 udp
N/A 87.98.177.149:6893 udp
N/A 87.98.177.150:6893 udp
N/A 87.98.177.151:6893 udp
N/A 87.98.177.152:6893 udp
N/A 87.98.177.153:6893 udp
N/A 87.98.177.154:6893 udp
N/A 87.98.177.155:6893 udp
N/A 87.98.177.156:6893 udp
N/A 87.98.177.157:6893 udp
N/A 87.98.177.158:6893 udp
N/A 87.98.177.159:6893 udp
N/A 87.98.177.160:6893 udp
N/A 87.98.177.161:6893 udp
N/A 87.98.177.162:6893 udp
N/A 87.98.177.163:6893 udp
N/A 87.98.177.164:6893 udp
N/A 87.98.177.165:6893 udp
N/A 87.98.177.166:6893 udp
N/A 87.98.177.167:6893 udp
N/A 87.98.177.168:6893 udp
N/A 87.98.177.169:6893 udp
N/A 87.98.177.170:6893 udp
N/A 87.98.177.171:6893 udp
N/A 87.98.177.172:6893 udp
N/A 87.98.177.173:6893 udp
N/A 87.98.177.174:6893 udp
N/A 87.98.177.175:6893 udp
N/A 87.98.177.176:6893 udp
N/A 87.98.177.177:6893 udp
N/A 87.98.177.178:6893 udp
N/A 87.98.177.179:6893 udp
N/A 87.98.177.180:6893 udp
N/A 87.98.177.181:6893 udp
N/A 87.98.177.182:6893 udp
N/A 87.98.177.183:6893 udp
N/A 87.98.177.184:6893 udp
N/A 87.98.177.185:6893 udp
N/A 87.98.177.186:6893 udp
N/A 87.98.177.187:6893 udp
N/A 87.98.177.188:6893 udp
N/A 87.98.177.189:6893 udp
N/A 87.98.177.190:6893 udp
N/A 87.98.177.191:6893 udp
N/A 87.98.177.192:6893 udp
N/A 87.98.177.193:6893 udp
N/A 87.98.177.194:6893 udp
N/A 87.98.177.195:6893 udp
N/A 87.98.177.196:6893 udp
N/A 87.98.177.197:6893 udp
N/A 87.98.177.198:6893 udp
N/A 87.98.177.199:6893 udp
N/A 87.98.177.200:6893 udp
N/A 87.98.177.201:6893 udp
N/A 87.98.177.202:6893 udp
N/A 87.98.177.203:6893 udp
N/A 87.98.177.204:6893 udp
N/A 87.98.177.205:6893 udp
N/A 87.98.177.206:6893 udp
N/A 87.98.177.207:6893 udp
N/A 87.98.177.208:6893 udp
N/A 87.98.177.209:6893 udp
N/A 87.98.177.210:6893 udp
N/A 87.98.177.211:6893 udp
N/A 87.98.177.212:6893 udp
N/A 87.98.177.213:6893 udp
N/A 87.98.177.214:6893 udp
N/A 87.98.177.215:6893 udp
N/A 87.98.177.216:6893 udp
N/A 87.98.177.217:6893 udp
N/A 87.98.177.218:6893 udp
N/A 87.98.177.219:6893 udp
N/A 87.98.177.220:6893 udp
N/A 87.98.177.221:6893 udp
N/A 87.98.177.222:6893 udp
N/A 87.98.177.223:6893 udp
N/A 87.98.177.224:6893 udp
N/A 87.98.177.225:6893 udp
N/A 87.98.177.226:6893 udp
N/A 87.98.177.227:6893 udp
N/A 87.98.177.228:6893 udp
N/A 87.98.177.229:6893 udp
N/A 87.98.177.230:6893 udp
N/A 87.98.177.231:6893 udp
N/A 87.98.177.232:6893 udp
N/A 87.98.177.233:6893 udp
N/A 87.98.177.234:6893 udp
N/A 87.98.177.235:6893 udp
N/A 87.98.177.236:6893 udp
N/A 87.98.177.237:6893 udp
N/A 87.98.177.238:6893 udp
N/A 87.98.177.239:6893 udp
N/A 87.98.177.240:6893 udp
N/A 87.98.177.241:6893 udp
N/A 87.98.177.242:6893 udp
N/A 87.98.177.243:6893 udp
N/A 87.98.177.244:6893 udp
N/A 87.98.177.245:6893 udp
N/A 87.98.177.246:6893 udp
N/A 87.98.177.247:6893 udp
N/A 87.98.177.248:6893 udp
N/A 87.98.177.249:6893 udp
N/A 87.98.177.250:6893 udp
N/A 87.98.177.251:6893 udp
N/A 87.98.177.252:6893 udp
N/A 87.98.177.253:6893 udp
N/A 87.98.177.254:6893 udp
N/A 87.98.177.255:6893 udp
N/A 87.98.178.0:6893 udp
N/A 87.98.178.1:6893 udp
N/A 87.98.178.2:6893 udp
N/A 87.98.178.3:6893 udp
N/A 87.98.178.4:6893 udp
N/A 87.98.178.5:6893 udp
N/A 87.98.178.6:6893 udp
N/A 87.98.178.7:6893 udp
N/A 87.98.178.8:6893 udp
N/A 87.98.178.9:6893 udp
N/A 87.98.178.10:6893 udp
N/A 87.98.178.11:6893 udp
N/A 87.98.178.12:6893 udp
N/A 87.98.178.13:6893 udp
N/A 87.98.178.14:6893 udp
N/A 87.98.178.15:6893 udp
N/A 87.98.178.16:6893 udp
N/A 87.98.178.17:6893 udp
N/A 87.98.178.18:6893 udp
N/A 87.98.178.19:6893 udp
N/A 87.98.178.20:6893 udp
N/A 87.98.178.21:6893 udp
N/A 87.98.178.22:6893 udp
N/A 87.98.178.23:6893 udp
N/A 87.98.178.24:6893 udp
N/A 87.98.178.25:6893 udp
N/A 87.98.178.26:6893 udp
N/A 87.98.178.27:6893 udp
N/A 87.98.178.28:6893 udp
N/A 87.98.178.29:6893 udp
N/A 87.98.178.30:6893 udp
N/A 87.98.178.31:6893 udp
N/A 87.98.178.32:6893 udp
N/A 87.98.178.33:6893 udp
N/A 87.98.178.34:6893 udp
N/A 87.98.178.35:6893 udp
N/A 87.98.178.36:6893 udp
N/A 87.98.178.37:6893 udp
N/A 87.98.178.38:6893 udp
N/A 87.98.178.39:6893 udp
N/A 87.98.178.40:6893 udp
N/A 87.98.178.41:6893 udp
N/A 87.98.178.42:6893 udp
N/A 87.98.178.43:6893 udp
N/A 87.98.178.44:6893 udp
N/A 87.98.178.45:6893 udp
N/A 87.98.178.46:6893 udp
N/A 87.98.178.47:6893 udp
N/A 87.98.178.48:6893 udp
N/A 87.98.178.49:6893 udp
N/A 87.98.178.50:6893 udp
N/A 87.98.178.51:6893 udp
N/A 87.98.178.52:6893 udp
N/A 87.98.178.53:6893 udp
N/A 87.98.178.54:6893 udp
N/A 87.98.178.55:6893 udp
N/A 87.98.178.56:6893 udp
N/A 87.98.178.57:6893 udp
N/A 87.98.178.58:6893 udp
N/A 87.98.178.59:6893 udp
N/A 87.98.178.60:6893 udp
N/A 87.98.178.61:6893 udp
N/A 87.98.178.62:6893 udp
N/A 87.98.178.63:6893 udp
N/A 87.98.178.64:6893 udp
N/A 87.98.178.65:6893 udp
N/A 87.98.178.66:6893 udp
N/A 87.98.178.67:6893 udp
N/A 87.98.178.68:6893 udp
N/A 87.98.178.69:6893 udp
N/A 87.98.178.70:6893 udp
N/A 87.98.178.71:6893 udp
N/A 87.98.178.72:6893 udp
N/A 87.98.178.73:6893 udp
N/A 87.98.178.74:6893 udp
N/A 87.98.178.75:6893 udp
N/A 87.98.178.76:6893 udp
N/A 87.98.178.77:6893 udp
N/A 87.98.178.78:6893 udp
N/A 87.98.178.79:6893 udp
N/A 87.98.178.80:6893 udp
N/A 87.98.178.81:6893 udp
N/A 87.98.178.82:6893 udp
N/A 87.98.178.83:6893 udp
N/A 87.98.178.84:6893 udp
N/A 87.98.178.85:6893 udp
N/A 87.98.178.86:6893 udp
N/A 87.98.178.87:6893 udp
N/A 87.98.178.88:6893 udp
N/A 87.98.178.89:6893 udp
N/A 87.98.178.90:6893 udp
N/A 87.98.178.91:6893 udp
N/A 87.98.178.92:6893 udp
N/A 87.98.178.93:6893 udp
N/A 87.98.178.94:6893 udp
N/A 87.98.178.95:6893 udp
N/A 87.98.178.96:6893 udp
N/A 87.98.178.97:6893 udp
N/A 87.98.178.98:6893 udp
N/A 87.98.178.99:6893 udp
N/A 87.98.178.100:6893 udp
N/A 87.98.178.101:6893 udp
N/A 87.98.178.102:6893 udp
N/A 87.98.178.103:6893 udp
N/A 87.98.178.104:6893 udp
N/A 87.98.178.105:6893 udp
N/A 87.98.178.106:6893 udp
N/A 87.98.178.107:6893 udp
N/A 87.98.178.108:6893 udp
N/A 87.98.178.109:6893 udp
N/A 87.98.178.110:6893 udp
N/A 87.98.178.111:6893 udp
N/A 87.98.178.112:6893 udp
N/A 87.98.178.113:6893 udp
N/A 87.98.178.114:6893 udp
N/A 87.98.178.115:6893 udp
N/A 87.98.178.116:6893 udp
N/A 87.98.178.117:6893 udp
N/A 87.98.178.118:6893 udp
N/A 87.98.178.119:6893 udp
N/A 87.98.178.120:6893 udp
N/A 87.98.178.121:6893 udp
N/A 87.98.178.122:6893 udp
N/A 87.98.178.123:6893 udp
N/A 87.98.178.124:6893 udp
N/A 87.98.178.125:6893 udp
N/A 87.98.178.126:6893 udp
N/A 87.98.178.127:6893 udp
N/A 87.98.178.128:6893 udp
N/A 87.98.178.129:6893 udp
N/A 87.98.178.130:6893 udp
N/A 87.98.178.131:6893 udp
N/A 87.98.178.132:6893 udp
N/A 87.98.178.133:6893 udp
N/A 87.98.178.134:6893 udp
N/A 87.98.178.135:6893 udp
N/A 87.98.178.136:6893 udp
N/A 87.98.178.137:6893 udp
N/A 87.98.178.138:6893 udp
N/A 87.98.178.139:6893 udp
N/A 87.98.178.140:6893 udp
N/A 87.98.178.141:6893 udp
N/A 87.98.178.142:6893 udp
N/A 87.98.178.143:6893 udp
N/A 87.98.178.144:6893 udp
N/A 87.98.178.145:6893 udp
N/A 87.98.178.146:6893 udp
N/A 87.98.178.147:6893 udp
N/A 87.98.178.148:6893 udp
N/A 87.98.178.149:6893 udp
N/A 87.98.178.150:6893 udp
N/A 87.98.178.151:6893 udp
N/A 87.98.178.152:6893 udp
N/A 87.98.178.153:6893 udp
N/A 87.98.178.154:6893 udp
N/A 87.98.178.155:6893 udp
N/A 87.98.178.156:6893 udp
N/A 87.98.178.157:6893 udp
N/A 87.98.178.158:6893 udp
N/A 87.98.178.159:6893 udp
N/A 87.98.178.160:6893 udp
N/A 87.98.178.161:6893 udp
N/A 87.98.178.162:6893 udp
N/A 87.98.178.163:6893 udp
N/A 87.98.178.164:6893 udp
N/A 87.98.178.165:6893 udp
N/A 87.98.178.166:6893 udp
N/A 87.98.178.167:6893 udp
N/A 87.98.178.168:6893 udp
N/A 87.98.178.169:6893 udp
N/A 87.98.178.170:6893 udp
N/A 87.98.178.171:6893 udp
N/A 87.98.178.172:6893 udp
N/A 87.98.178.173:6893 udp
N/A 87.98.178.174:6893 udp
N/A 87.98.178.175:6893 udp
N/A 87.98.178.176:6893 udp
N/A 87.98.178.177:6893 udp
N/A 87.98.178.178:6893 udp
N/A 87.98.178.179:6893 udp
N/A 87.98.178.180:6893 udp
N/A 87.98.178.181:6893 udp
N/A 87.98.178.182:6893 udp
N/A 87.98.178.183:6893 udp
N/A 87.98.178.184:6893 udp
N/A 87.98.178.185:6893 udp
N/A 87.98.178.186:6893 udp
N/A 87.98.178.187:6893 udp
N/A 87.98.178.188:6893 udp
N/A 87.98.178.189:6893 udp
N/A 87.98.178.190:6893 udp
N/A 87.98.178.191:6893 udp
N/A 87.98.178.192:6893 udp
N/A 87.98.178.193:6893 udp
N/A 87.98.178.194:6893 udp
N/A 87.98.178.195:6893 udp
N/A 87.98.178.196:6893 udp
N/A 87.98.178.197:6893 udp
N/A 87.98.178.198:6893 udp
N/A 87.98.178.199:6893 udp
N/A 87.98.178.200:6893 udp
N/A 87.98.178.201:6893 udp
N/A 87.98.178.202:6893 udp
N/A 87.98.178.203:6893 udp
N/A 87.98.178.204:6893 udp
N/A 87.98.178.205:6893 udp
N/A 87.98.178.206:6893 udp
N/A 87.98.178.207:6893 udp
N/A 87.98.178.208:6893 udp
N/A 87.98.178.209:6893 udp
N/A 87.98.178.210:6893 udp
N/A 87.98.178.211:6893 udp
N/A 87.98.178.212:6893 udp
N/A 87.98.178.213:6893 udp
N/A 87.98.178.214:6893 udp
N/A 87.98.178.215:6893 udp
N/A 87.98.178.216:6893 udp
N/A 87.98.178.217:6893 udp
N/A 87.98.178.218:6893 udp
N/A 87.98.178.219:6893 udp
N/A 87.98.178.220:6893 udp
N/A 87.98.178.221:6893 udp
N/A 87.98.178.222:6893 udp
N/A 87.98.178.223:6893 udp
N/A 87.98.178.224:6893 udp
N/A 87.98.178.225:6893 udp
N/A 87.98.178.226:6893 udp
N/A 87.98.178.227:6893 udp
N/A 87.98.178.228:6893 udp
N/A 87.98.178.229:6893 udp
N/A 87.98.178.230:6893 udp
N/A 87.98.178.231:6893 udp
N/A 87.98.178.232:6893 udp
N/A 87.98.178.233:6893 udp
N/A 87.98.178.234:6893 udp
N/A 87.98.178.235:6893 udp
N/A 87.98.178.236:6893 udp
N/A 87.98.178.237:6893 udp
N/A 87.98.178.238:6893 udp
N/A 87.98.178.239:6893 udp
N/A 87.98.178.240:6893 udp
N/A 87.98.178.241:6893 udp
N/A 87.98.178.242:6893 udp
N/A 87.98.178.243:6893 udp
N/A 87.98.178.244:6893 udp
N/A 87.98.178.245:6893 udp
N/A 87.98.178.246:6893 udp
N/A 87.98.178.247:6893 udp
N/A 87.98.178.248:6893 udp
N/A 87.98.178.249:6893 udp
N/A 87.98.178.250:6893 udp
N/A 87.98.178.251:6893 udp
N/A 87.98.178.252:6893 udp
N/A 87.98.178.253:6893 udp
N/A 87.98.178.254:6893 udp
N/A 87.98.178.255:6893 udp
N/A 87.98.179.0:6893 udp
N/A 87.98.179.1:6893 udp
N/A 87.98.179.2:6893 udp
N/A 87.98.179.3:6893 udp
N/A 87.98.179.4:6893 udp
N/A 87.98.179.5:6893 udp
N/A 87.98.179.6:6893 udp
N/A 87.98.179.7:6893 udp
N/A 87.98.179.8:6893 udp
N/A 87.98.179.9:6893 udp
N/A 87.98.179.10:6893 udp
N/A 87.98.179.11:6893 udp
N/A 87.98.179.12:6893 udp
N/A 87.98.179.13:6893 udp
N/A 87.98.179.14:6893 udp
N/A 87.98.179.15:6893 udp
N/A 87.98.179.16:6893 udp
N/A 87.98.179.17:6893 udp
N/A 87.98.179.18:6893 udp
N/A 87.98.179.19:6893 udp
N/A 87.98.179.20:6893 udp
N/A 87.98.179.21:6893 udp
N/A 87.98.179.22:6893 udp
N/A 87.98.179.23:6893 udp
N/A 87.98.179.24:6893 udp
N/A 87.98.179.25:6893 udp
N/A 87.98.179.26:6893 udp
N/A 87.98.179.27:6893 udp
N/A 87.98.179.28:6893 udp
N/A 87.98.179.29:6893 udp
N/A 87.98.179.30:6893 udp
N/A 87.98.179.31:6893 udp
N/A 87.98.179.32:6893 udp
N/A 87.98.179.33:6893 udp
N/A 87.98.179.34:6893 udp
N/A 87.98.179.35:6893 udp
N/A 87.98.179.36:6893 udp
N/A 87.98.179.37:6893 udp
N/A 87.98.179.38:6893 udp
N/A 87.98.179.39:6893 udp
N/A 87.98.179.40:6893 udp
N/A 87.98.179.41:6893 udp
N/A 87.98.179.42:6893 udp
N/A 87.98.179.43:6893 udp
N/A 87.98.179.44:6893 udp
N/A 87.98.179.45:6893 udp
N/A 87.98.179.46:6893 udp
N/A 87.98.179.47:6893 udp
N/A 87.98.179.48:6893 udp
N/A 87.98.179.49:6893 udp
N/A 87.98.179.50:6893 udp
N/A 87.98.179.51:6893 udp
N/A 87.98.179.52:6893 udp
N/A 87.98.179.53:6893 udp
N/A 87.98.179.54:6893 udp
N/A 87.98.179.55:6893 udp
N/A 87.98.179.56:6893 udp
N/A 87.98.179.57:6893 udp
N/A 87.98.179.58:6893 udp
N/A 87.98.179.59:6893 udp
N/A 87.98.179.60:6893 udp
N/A 87.98.179.61:6893 udp
N/A 87.98.179.62:6893 udp
N/A 87.98.179.63:6893 udp
N/A 87.98.179.64:6893 udp
N/A 87.98.179.65:6893 udp
N/A 87.98.179.66:6893 udp
N/A 87.98.179.67:6893 udp
N/A 87.98.179.68:6893 udp
N/A 87.98.179.69:6893 udp
N/A 87.98.179.70:6893 udp
N/A 87.98.179.71:6893 udp
N/A 87.98.179.72:6893 udp
N/A 87.98.179.73:6893 udp
N/A 87.98.179.74:6893 udp
N/A 87.98.179.75:6893 udp
N/A 87.98.179.76:6893 udp
N/A 87.98.179.77:6893 udp
N/A 87.98.179.78:6893 udp
N/A 87.98.179.79:6893 udp
N/A 87.98.179.80:6893 udp
N/A 87.98.179.81:6893 udp
N/A 87.98.179.82:6893 udp
N/A 87.98.179.83:6893 udp
N/A 87.98.179.84:6893 udp
N/A 87.98.179.85:6893 udp
N/A 87.98.179.86:6893 udp
N/A 87.98.179.87:6893 udp
N/A 87.98.179.88:6893 udp
N/A 87.98.179.89:6893 udp
N/A 87.98.179.90:6893 udp
N/A 87.98.179.91:6893 udp
N/A 87.98.179.92:6893 udp
N/A 87.98.179.93:6893 udp
N/A 87.98.179.94:6893 udp
N/A 87.98.179.95:6893 udp
N/A 87.98.179.96:6893 udp
N/A 87.98.179.97:6893 udp
N/A 87.98.179.98:6893 udp
N/A 87.98.179.99:6893 udp
N/A 87.98.179.100:6893 udp
N/A 87.98.179.101:6893 udp
N/A 87.98.179.102:6893 udp
N/A 87.98.179.103:6893 udp
N/A 87.98.179.104:6893 udp
N/A 87.98.179.105:6893 udp
N/A 87.98.179.106:6893 udp
N/A 87.98.179.107:6893 udp
N/A 87.98.179.108:6893 udp
N/A 87.98.179.109:6893 udp
N/A 87.98.179.110:6893 udp
N/A 87.98.179.111:6893 udp
N/A 87.98.179.112:6893 udp
N/A 87.98.179.113:6893 udp
N/A 87.98.179.114:6893 udp
N/A 87.98.179.115:6893 udp
N/A 87.98.179.116:6893 udp
N/A 87.98.179.117:6893 udp
N/A 87.98.179.118:6893 udp
N/A 87.98.179.119:6893 udp
N/A 87.98.179.120:6893 udp
N/A 87.98.179.121:6893 udp
N/A 87.98.179.122:6893 udp
N/A 87.98.179.123:6893 udp
N/A 87.98.179.124:6893 udp
N/A 87.98.179.125:6893 udp
N/A 87.98.179.126:6893 udp
N/A 87.98.179.127:6893 udp
N/A 87.98.179.128:6893 udp
N/A 87.98.179.129:6893 udp
N/A 87.98.179.130:6893 udp
N/A 87.98.179.131:6893 udp
N/A 87.98.179.132:6893 udp
N/A 87.98.179.133:6893 udp
N/A 87.98.179.134:6893 udp
N/A 87.98.179.135:6893 udp
N/A 87.98.179.136:6893 udp
N/A 87.98.179.137:6893 udp
N/A 87.98.179.138:6893 udp
N/A 87.98.179.139:6893 udp
N/A 87.98.179.140:6893 udp
N/A 87.98.179.141:6893 udp
N/A 87.98.179.142:6893 udp
N/A 87.98.179.143:6893 udp
N/A 87.98.179.144:6893 udp
N/A 87.98.179.145:6893 udp
N/A 87.98.179.146:6893 udp
N/A 87.98.179.147:6893 udp
N/A 87.98.179.148:6893 udp
N/A 87.98.179.149:6893 udp
N/A 87.98.179.150:6893 udp
N/A 87.98.179.151:6893 udp
N/A 87.98.179.152:6893 udp
N/A 87.98.179.153:6893 udp
N/A 87.98.179.154:6893 udp
N/A 87.98.179.155:6893 udp
N/A 87.98.179.156:6893 udp
N/A 87.98.179.157:6893 udp
N/A 87.98.179.158:6893 udp
N/A 87.98.179.159:6893 udp
N/A 87.98.179.160:6893 udp
N/A 87.98.179.161:6893 udp
N/A 87.98.179.162:6893 udp
N/A 87.98.179.163:6893 udp
N/A 87.98.179.164:6893 udp
N/A 87.98.179.165:6893 udp
N/A 87.98.179.166:6893 udp
N/A 87.98.179.167:6893 udp
N/A 87.98.179.168:6893 udp
N/A 87.98.179.169:6893 udp
N/A 87.98.179.170:6893 udp
N/A 87.98.179.171:6893 udp
N/A 87.98.179.172:6893 udp
N/A 87.98.179.173:6893 udp
N/A 87.98.179.174:6893 udp
N/A 87.98.179.175:6893 udp
N/A 87.98.179.176:6893 udp
N/A 87.98.179.177:6893 udp
N/A 87.98.179.178:6893 udp
N/A 87.98.179.179:6893 udp
N/A 87.98.179.180:6893 udp
N/A 87.98.179.181:6893 udp
N/A 87.98.179.182:6893 udp
N/A 87.98.179.183:6893 udp
N/A 87.98.179.184:6893 udp
N/A 87.98.179.185:6893 udp
N/A 87.98.179.186:6893 udp
N/A 87.98.179.187:6893 udp
N/A 87.98.179.188:6893 udp
N/A 87.98.179.189:6893 udp
N/A 87.98.179.190:6893 udp
N/A 87.98.179.191:6893 udp
N/A 87.98.179.192:6893 udp
N/A 87.98.179.193:6893 udp
N/A 87.98.179.194:6893 udp
N/A 87.98.179.195:6893 udp
N/A 87.98.179.196:6893 udp
N/A 87.98.179.197:6893 udp
N/A 87.98.179.198:6893 udp
N/A 87.98.179.199:6893 udp
N/A 87.98.179.200:6893 udp
N/A 87.98.179.201:6893 udp
N/A 87.98.179.202:6893 udp
N/A 87.98.179.203:6893 udp
N/A 87.98.179.204:6893 udp
N/A 87.98.179.205:6893 udp
N/A 87.98.179.206:6893 udp
N/A 87.98.179.207:6893 udp
N/A 87.98.179.208:6893 udp
N/A 87.98.179.209:6893 udp
N/A 87.98.179.210:6893 udp
N/A 87.98.179.211:6893 udp
N/A 87.98.179.212:6893 udp
N/A 87.98.179.213:6893 udp
N/A 87.98.179.214:6893 udp
N/A 87.98.179.215:6893 udp
N/A 87.98.179.216:6893 udp
N/A 87.98.179.217:6893 udp
N/A 87.98.179.218:6893 udp
N/A 87.98.179.219:6893 udp
N/A 87.98.179.220:6893 udp
N/A 87.98.179.221:6893 udp
N/A 87.98.179.222:6893 udp
N/A 87.98.179.223:6893 udp
N/A 87.98.179.224:6893 udp
N/A 87.98.179.225:6893 udp
N/A 87.98.179.226:6893 udp
N/A 87.98.179.227:6893 udp
N/A 87.98.179.228:6893 udp
N/A 87.98.179.229:6893 udp
N/A 87.98.179.230:6893 udp
N/A 87.98.179.231:6893 udp
N/A 87.98.179.232:6893 udp
N/A 87.98.179.233:6893 udp
N/A 87.98.179.234:6893 udp
N/A 87.98.179.235:6893 udp
N/A 87.98.179.236:6893 udp
N/A 87.98.179.237:6893 udp
N/A 87.98.179.238:6893 udp
N/A 87.98.179.239:6893 udp
N/A 87.98.179.240:6893 udp
N/A 87.98.179.241:6893 udp
N/A 87.98.179.242:6893 udp
N/A 87.98.179.243:6893 udp
N/A 87.98.179.244:6893 udp
N/A 87.98.179.245:6893 udp
N/A 87.98.179.246:6893 udp
N/A 87.98.179.247:6893 udp
N/A 87.98.179.248:6893 udp
N/A 87.98.179.249:6893 udp
N/A 87.98.179.250:6893 udp
N/A 87.98.179.251:6893 udp
N/A 87.98.179.252:6893 udp
N/A 87.98.179.253:6893 udp
N/A 87.98.179.254:6893 udp
N/A 87.98.179.255:6893 udp
N/A 8.8.8.8:53 api.blockcypher.com udp
N/A 104.20.20.251:80 api.blockcypher.com tcp
N/A 8.8.8.8:53 btc.blockr.io udp
N/A 8.8.8.8:53 bitaps.com udp
N/A 178.128.255.179:443 bitaps.com tcp
N/A 8.8.8.8:53 www.download.windowsupdate.com udp
N/A 8.8.8.8:53 chain.so udp
N/A 104.24.104.254:443 chain.so tcp
N/A 8.8.8.8:53 crl.verisign.com udp

Files

memory/1700-0-0x0000000000000000-mapping.dmp

memory/1672-1-0x0000000000000000-mapping.dmp

memory/1724-2-0x0000000000000000-mapping.dmp

memory/1384-3-0x0000000000000000-mapping.dmp

C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___5MXVFOR3_.txt

MD5 5e5c358c0ef804ee2a9fafd794a6f331
SHA1 b6651b932be82a290d38d015d01048e5db173e7d
SHA256 430a714f05e18a6d03e716a428500eed3b7252d46ee6d5428a404022392ea6d8
SHA512 581f6f540d5e4956f8109be84dc99e2cae3d4a146fb6f6619e977c661bcfda05cd13d85eafe238aa2c0690e7aec1c7a64f29da43be341f55464cfaf3ebe6a09e

C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___5870WTA_.hta

MD5 531e9a438c18c1eb7212d86f0c6fb31e
SHA1 37c6b22be0b0ecb77dc20bd46872436eeb8eb562
SHA256 f97282aca727ad664b78f199946eb4647b6d103e2fdcc875d5386807f47e34e7
SHA512 065a3df25bd4403c1e10a09dd9e74f9d63a84b8a8b21bda189e997063c3bce9290a2b403d512d227d0e958e8e1d27a45c629a8535e57ebcd9865900ecaeb93da

memory/1260-6-0x000007FEF6010000-0x000007FEF628A000-memory.dmp

memory/1532-15-0x0000000000000000-mapping.dmp

memory/1632-16-0x0000000000000000-mapping.dmp

memory/960-17-0x0000000000000000-mapping.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2020-11-08 14:22

Reported

2020-11-08 15:27

Platform

win10v20201028

Max time kernel

118s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe"

Signatures

Cerber

ransomware cerber

Blacklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A

Modifies Windows Firewall

evasion

Drops startup file

Description Indicator Process Target
File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\word\startup\ C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\o: C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened (read-only) \??\t: C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened (read-only) \??\b: C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened (read-only) \??\f: C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened (read-only) \??\g: C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened (read-only) \??\p: C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened (read-only) \??\q: C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened (read-only) \??\v: C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened (read-only) \??\z: C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened (read-only) \??\n: C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened (read-only) \??\a: C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened (read-only) \??\e: C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened (read-only) \??\h: C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened (read-only) \??\i: C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened (read-only) \??\j: C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened (read-only) \??\l: C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened (read-only) \??\m: C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened (read-only) \??\w: C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened (read-only) \??\x: C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened (read-only) \??\k: C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened (read-only) \??\r: C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened (read-only) \??\s: C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened (read-only) \??\u: C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened (read-only) \??\y: C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\outlook C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft sql server C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft sql server C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\powerpoint C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\excel C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\word C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\onenote C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\word C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\onenote C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\steam C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\microsoft sql server C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\office C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\onenote C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\outlook C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\office C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\excel C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\office C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\thunderbird C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\powerpoint C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\powerpoint C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\powerpoint C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\steam C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\thunderbird C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\excel C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\microsoft sql server C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\outlook C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\desktop C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\office C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\outlook C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\the bat! C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\the bat! C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\documents C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\bitcoin C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\bitcoin C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\word C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\excel C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\onenote C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\word C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp679.bmp" C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification \??\c:\program files (x86)\powerpoint C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\program files (x86)\steam C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\program files (x86)\thunderbird C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\program files (x86)\ C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\excel C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\office C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\outlook C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\program files (x86)\bitcoin C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\program files (x86)\onenote C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\program files (x86)\outlook C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\program files (x86)\the bat! C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\program files (x86)\excel C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\program files (x86)\office C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\powerpoint C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\word C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\program files (x86)\word C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\program files\ C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft sql server C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\microsoft sql server C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\onenote C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft sql server C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\excel C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\onenote C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\powerpoint C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\desktop C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\excel C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\outlook C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\onenote C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\outlook C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\steam C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\excel C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\word C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\thunderbird C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\bitcoin C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\office C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\powerpoint C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\steam C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\word C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\word C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\excel C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\office C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\onenote C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\office C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\outlook C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\steam C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\thunderbird C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\bitcoin C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\word C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\documents C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\documents C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\excel C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft sql server C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\onenote C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\outlook C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\outlook C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\powerpoint C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\word C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\office C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\office C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\the bat! C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\thunderbird C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\ C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\microsoft sql server C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\office C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\outlook C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\thunderbird C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\microsoft sql server C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\powerpoint C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\office C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\onenote C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\onenote C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\outlook C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\word C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\bitcoin C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\powerpoint C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\the bat! C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\onenote C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\the bat! C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\excel C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\powerpoint C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\the bat! C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\excel C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft sql server C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft sql server C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\excel C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\office C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\onenote C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\outlook C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\word C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\bitcoin C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\microsoft sql server C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\microsoft sql server C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\powerpoint C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\powerpoint C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\steam C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\word C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\desktop C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\NOTEPAD.EXE N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4696 wrote to memory of 4164 N/A C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe C:\Windows\SysWOW64\netsh.exe
PID 4696 wrote to memory of 4164 N/A C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe C:\Windows\SysWOW64\netsh.exe
PID 4696 wrote to memory of 4164 N/A C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe C:\Windows\SysWOW64\netsh.exe
PID 4696 wrote to memory of 3180 N/A C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe C:\Windows\SysWOW64\netsh.exe
PID 4696 wrote to memory of 3180 N/A C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe C:\Windows\SysWOW64\netsh.exe
PID 4696 wrote to memory of 3180 N/A C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe C:\Windows\SysWOW64\netsh.exe
PID 4696 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe C:\Windows\SysWOW64\mshta.exe
PID 4696 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe C:\Windows\SysWOW64\mshta.exe
PID 4696 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe C:\Windows\SysWOW64\mshta.exe
PID 4696 wrote to memory of 1868 N/A C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe C:\Windows\SysWOW64\NOTEPAD.EXE
PID 4696 wrote to memory of 1868 N/A C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe C:\Windows\SysWOW64\NOTEPAD.EXE
PID 4696 wrote to memory of 1868 N/A C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe C:\Windows\SysWOW64\NOTEPAD.EXE
PID 4696 wrote to memory of 4444 N/A C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe C:\Windows\SysWOW64\cmd.exe
PID 4696 wrote to memory of 4444 N/A C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe C:\Windows\SysWOW64\cmd.exe
PID 4696 wrote to memory of 4444 N/A C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe C:\Windows\SysWOW64\cmd.exe
PID 4444 wrote to memory of 4520 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4444 wrote to memory of 4520 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4444 wrote to memory of 4520 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4444 wrote to memory of 1296 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4444 wrote to memory of 1296 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4444 wrote to memory of 1296 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe

"C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe"

C:\Windows\SysWOW64\netsh.exe

C:\Windows\system32\netsh.exe advfirewall set allprofiles state on

C:\Windows\SysWOW64\netsh.exe

C:\Windows\system32\netsh.exe advfirewall reset

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___GJJMBYWB_.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___BRS5T01_.txt

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /d /c taskkill /f /im "871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe" > NUL && exit

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "871093a0f144cdc4e6f47058f824db4bb6c3f06493c64465e8717488fcb6fd90.exe"

C:\Windows\SysWOW64\PING.EXE

ping -n 1 127.0.0.1

Network

Country Destination Domain Proto
N/A 52.109.12.18:443 tcp
N/A 77.12.57.0:6893 udp
N/A 77.12.57.1:6893 udp
N/A 77.12.57.2:6893 udp
N/A 77.12.57.3:6893 udp
N/A 77.12.57.4:6893 udp
N/A 77.12.57.5:6893 udp
N/A 77.12.57.6:6893 udp
N/A 77.12.57.7:6893 udp
N/A 77.12.57.8:6893 udp
N/A 77.12.57.9:6893 udp
N/A 77.12.57.10:6893 udp
N/A 77.12.57.11:6893 udp
N/A 77.12.57.12:6893 udp
N/A 77.12.57.13:6893 udp
N/A 77.12.57.14:6893 udp
N/A 77.12.57.15:6893 udp
N/A 77.12.57.16:6893 udp
N/A 77.12.57.17:6893 udp
N/A 77.12.57.18:6893 udp
N/A 77.12.57.19:6893 udp
N/A 77.12.57.20:6893 udp
N/A 77.12.57.21:6893 udp
N/A 77.12.57.22:6893 udp
N/A 77.12.57.23:6893 udp
N/A 77.12.57.24:6893 udp
N/A 77.12.57.25:6893 udp
N/A 77.12.57.26:6893 udp
N/A 77.12.57.27:6893 udp
N/A 77.12.57.28:6893 udp
N/A 77.12.57.29:6893 udp
N/A 77.12.57.30:6893 udp
N/A 77.12.57.31:6893 udp
N/A 19.48.17.0:6893 udp
N/A 19.48.17.1:6893 udp
N/A 19.48.17.2:6893 udp
N/A 19.48.17.3:6893 udp
N/A 19.48.17.4:6893 udp
N/A 19.48.17.5:6893 udp
N/A 19.48.17.6:6893 udp
N/A 19.48.17.7:6893 udp
N/A 19.48.17.8:6893 udp
N/A 19.48.17.9:6893 udp
N/A 19.48.17.10:6893 udp
N/A 19.48.17.11:6893 udp
N/A 19.48.17.12:6893 udp
N/A 19.48.17.13:6893 udp
N/A 19.48.17.14:6893 udp
N/A 19.48.17.15:6893 udp
N/A 19.48.17.16:6893 udp
N/A 19.48.17.17:6893 udp
N/A 19.48.17.18:6893 udp
N/A 19.48.17.19:6893 udp
N/A 19.48.17.20:6893 udp
N/A 19.48.17.21:6893 udp
N/A 19.48.17.22:6893 udp
N/A 19.48.17.23:6893 udp
N/A 19.48.17.24:6893 udp
N/A 19.48.17.25:6893 udp
N/A 19.48.17.26:6893 udp
N/A 19.48.17.27:6893 udp
N/A 19.48.17.28:6893 udp
N/A 19.48.17.29:6893 udp
N/A 19.48.17.30:6893 udp
N/A 19.48.17.31:6893 udp
N/A 87.98.176.0:6893 udp
N/A 87.98.176.1:6893 udp
N/A 87.98.176.2:6893 udp
N/A 87.98.176.3:6893 udp
N/A 87.98.176.4:6893 udp
N/A 87.98.176.5:6893 udp
N/A 87.98.176.6:6893 udp
N/A 87.98.176.7:6893 udp
N/A 87.98.176.8:6893 udp
N/A 87.98.176.9:6893 udp
N/A 87.98.176.10:6893 udp
N/A 87.98.176.11:6893 udp
N/A 87.98.176.12:6893 udp
N/A 87.98.176.13:6893 udp
N/A 87.98.176.14:6893 udp
N/A 87.98.176.15:6893 udp
N/A 87.98.176.16:6893 udp
N/A 87.98.176.17:6893 udp
N/A 87.98.176.18:6893 udp
N/A 87.98.176.19:6893 udp
N/A 87.98.176.20:6893 udp
N/A 87.98.176.21:6893 udp
N/A 87.98.176.22:6893 udp
N/A 87.98.176.23:6893 udp
N/A 87.98.176.24:6893 udp
N/A 87.98.176.25:6893 udp
N/A 87.98.176.26:6893 udp
N/A 87.98.176.27:6893 udp
N/A 87.98.176.28:6893 udp
N/A 87.98.176.29:6893 udp
N/A 87.98.176.30:6893 udp
N/A 87.98.176.31:6893 udp
N/A 87.98.176.32:6893 udp
N/A 87.98.176.33:6893 udp
N/A 87.98.176.34:6893 udp
N/A 87.98.176.35:6893 udp
N/A 87.98.176.36:6893 udp
N/A 87.98.176.37:6893 udp
N/A 87.98.176.38:6893 udp
N/A 87.98.176.39:6893 udp
N/A 87.98.176.40:6893 udp
N/A 87.98.176.41:6893 udp
N/A 87.98.176.42:6893 udp
N/A 87.98.176.43:6893 udp
N/A 87.98.176.44:6893 udp
N/A 87.98.176.45:6893 udp
N/A 87.98.176.46:6893 udp
N/A 87.98.176.47:6893 udp
N/A 87.98.176.48:6893 udp
N/A 87.98.176.49:6893 udp
N/A 87.98.176.50:6893 udp
N/A 87.98.176.51:6893 udp
N/A 87.98.176.52:6893 udp
N/A 87.98.176.53:6893 udp
N/A 87.98.176.54:6893 udp
N/A 87.98.176.55:6893 udp
N/A 87.98.176.56:6893 udp
N/A 87.98.176.57:6893 udp
N/A 87.98.176.58:6893 udp
N/A 87.98.176.59:6893 udp
N/A 87.98.176.60:6893 udp
N/A 87.98.176.61:6893 udp
N/A 87.98.176.62:6893 udp
N/A 87.98.176.63:6893 udp
N/A 87.98.176.64:6893 udp
N/A 87.98.176.65:6893 udp
N/A 87.98.176.66:6893 udp
N/A 87.98.176.67:6893 udp
N/A 87.98.176.68:6893 udp
N/A 87.98.176.69:6893 udp
N/A 87.98.176.70:6893 udp
N/A 87.98.176.71:6893 udp
N/A 87.98.176.72:6893 udp
N/A 87.98.176.73:6893 udp
N/A 87.98.176.74:6893 udp
N/A 87.98.176.75:6893 udp
N/A 87.98.176.76:6893 udp
N/A 87.98.176.77:6893 udp
N/A 87.98.176.78:6893 udp
N/A 87.98.176.79:6893 udp
N/A 87.98.176.80:6893 udp
N/A 87.98.176.81:6893 udp
N/A 87.98.176.82:6893 udp
N/A 87.98.176.83:6893 udp
N/A 87.98.176.84:6893 udp
N/A 87.98.176.85:6893 udp
N/A 87.98.176.86:6893 udp
N/A 87.98.176.87:6893 udp
N/A 87.98.176.88:6893 udp
N/A 87.98.176.89:6893 udp
N/A 87.98.176.90:6893 udp
N/A 87.98.176.91:6893 udp
N/A 87.98.176.92:6893 udp
N/A 87.98.176.93:6893 udp
N/A 87.98.176.94:6893 udp
N/A 87.98.176.95:6893 udp
N/A 87.98.176.96:6893 udp
N/A 87.98.176.97:6893 udp
N/A 87.98.176.98:6893 udp
N/A 87.98.176.99:6893 udp
N/A 87.98.176.100:6893 udp
N/A 87.98.176.101:6893 udp
N/A 87.98.176.102:6893 udp
N/A 87.98.176.103:6893 udp
N/A 87.98.176.104:6893 udp
N/A 87.98.176.105:6893 udp
N/A 87.98.176.106:6893 udp
N/A 87.98.176.107:6893 udp
N/A 87.98.176.108:6893 udp
N/A 87.98.176.109:6893 udp
N/A 87.98.176.110:6893 udp
N/A 87.98.176.111:6893 udp
N/A 87.98.176.112:6893 udp
N/A 87.98.176.113:6893 udp
N/A 87.98.176.114:6893 udp
N/A 87.98.176.115:6893 udp
N/A 87.98.176.116:6893 udp
N/A 87.98.176.117:6893 udp
N/A 87.98.176.118:6893 udp
N/A 87.98.176.119:6893 udp
N/A 87.98.176.120:6893 udp
N/A 87.98.176.121:6893 udp
N/A 87.98.176.122:6893 udp
N/A 87.98.176.123:6893 udp
N/A 87.98.176.124:6893 udp
N/A 87.98.176.125:6893 udp
N/A 87.98.176.126:6893 udp
N/A 87.98.176.127:6893 udp
N/A 87.98.176.128:6893 udp
N/A 87.98.176.129:6893 udp
N/A 87.98.176.130:6893 udp
N/A 87.98.176.131:6893 udp
N/A 87.98.176.132:6893 udp
N/A 87.98.176.133:6893 udp
N/A 87.98.176.134:6893 udp
N/A 87.98.176.135:6893 udp
N/A 87.98.176.136:6893 udp
N/A 87.98.176.137:6893 udp
N/A 87.98.176.138:6893 udp
N/A 87.98.176.139:6893 udp
N/A 87.98.176.140:6893 udp
N/A 87.98.176.141:6893 udp
N/A 87.98.176.142:6893 udp
N/A 87.98.176.143:6893 udp
N/A 87.98.176.144:6893 udp
N/A 87.98.176.145:6893 udp
N/A 87.98.176.146:6893 udp
N/A 87.98.176.147:6893 udp
N/A 87.98.176.148:6893 udp
N/A 87.98.176.149:6893 udp
N/A 87.98.176.150:6893 udp
N/A 87.98.176.151:6893 udp
N/A 87.98.176.152:6893 udp
N/A 87.98.176.153:6893 udp
N/A 87.98.176.154:6893 udp
N/A 87.98.176.155:6893 udp
N/A 87.98.176.156:6893 udp
N/A 87.98.176.157:6893 udp
N/A 87.98.176.158:6893 udp
N/A 87.98.176.159:6893 udp
N/A 87.98.176.160:6893 udp
N/A 87.98.176.161:6893 udp
N/A 87.98.176.162:6893 udp
N/A 87.98.176.163:6893 udp
N/A 87.98.176.164:6893 udp
N/A 87.98.176.165:6893 udp
N/A 87.98.176.166:6893 udp
N/A 87.98.176.167:6893 udp
N/A 87.98.176.168:6893 udp
N/A 87.98.176.169:6893 udp
N/A 87.98.176.170:6893 udp
N/A 87.98.176.171:6893 udp
N/A 87.98.176.172:6893 udp
N/A 87.98.176.173:6893 udp
N/A 87.98.176.174:6893 udp
N/A 87.98.176.175:6893 udp
N/A 87.98.176.176:6893 udp
N/A 87.98.176.177:6893 udp
N/A 87.98.176.178:6893 udp
N/A 87.98.176.179:6893 udp
N/A 87.98.176.180:6893 udp
N/A 87.98.176.181:6893 udp
N/A 87.98.176.182:6893 udp
N/A 87.98.176.183:6893 udp
N/A 87.98.176.184:6893 udp
N/A 87.98.176.185:6893 udp
N/A 87.98.176.186:6893 udp
N/A 87.98.176.187:6893 udp
N/A 87.98.176.188:6893 udp
N/A 87.98.176.189:6893 udp
N/A 87.98.176.190:6893 udp
N/A 87.98.176.191:6893 udp
N/A 87.98.176.192:6893 udp
N/A 87.98.176.193:6893 udp
N/A 87.98.176.194:6893 udp
N/A 87.98.176.195:6893 udp
N/A 87.98.176.196:6893 udp
N/A 87.98.176.197:6893 udp
N/A 87.98.176.198:6893 udp
N/A 87.98.176.199:6893 udp
N/A 87.98.176.200:6893 udp
N/A 87.98.176.201:6893 udp
N/A 87.98.176.202:6893 udp
N/A 87.98.176.203:6893 udp
N/A 87.98.176.204:6893 udp
N/A 87.98.176.205:6893 udp
N/A 87.98.176.206:6893 udp
N/A 87.98.176.207:6893 udp
N/A 87.98.176.208:6893 udp
N/A 87.98.176.209:6893 udp
N/A 87.98.176.210:6893 udp
N/A 87.98.176.211:6893 udp
N/A 87.98.176.212:6893 udp
N/A 87.98.176.213:6893 udp
N/A 87.98.176.214:6893 udp
N/A 87.98.176.215:6893 udp
N/A 87.98.176.216:6893 udp
N/A 87.98.176.217:6893 udp
N/A 87.98.176.218:6893 udp
N/A 87.98.176.219:6893 udp
N/A 87.98.176.220:6893 udp
N/A 87.98.176.221:6893 udp
N/A 87.98.176.222:6893 udp
N/A 87.98.176.223:6893 udp
N/A 87.98.176.224:6893 udp
N/A 87.98.176.225:6893 udp
N/A 87.98.176.226:6893 udp
N/A 87.98.176.227:6893 udp
N/A 87.98.176.228:6893 udp
N/A 87.98.176.229:6893 udp
N/A 87.98.176.230:6893 udp
N/A 87.98.176.231:6893 udp
N/A 87.98.176.232:6893 udp
N/A 87.98.176.233:6893 udp
N/A 87.98.176.234:6893 udp
N/A 87.98.176.235:6893 udp
N/A 87.98.176.236:6893 udp
N/A 87.98.176.237:6893 udp
N/A 87.98.176.238:6893 udp
N/A 87.98.176.239:6893 udp
N/A 87.98.176.240:6893 udp
N/A 87.98.176.241:6893 udp
N/A 87.98.176.242:6893 udp
N/A 87.98.176.243:6893 udp
N/A 87.98.176.244:6893 udp
N/A 87.98.176.245:6893 udp
N/A 87.98.176.246:6893 udp
N/A 87.98.176.247:6893 udp
N/A 87.98.176.248:6893 udp
N/A 87.98.176.249:6893 udp
N/A 87.98.176.250:6893 udp
N/A 87.98.176.251:6893 udp
N/A 87.98.176.252:6893 udp
N/A 87.98.176.253:6893 udp
N/A 87.98.176.254:6893 udp
N/A 87.98.176.255:6893 udp
N/A 87.98.177.0:6893 udp
N/A 87.98.177.1:6893 udp
N/A 87.98.177.2:6893 udp
N/A 87.98.177.3:6893 udp
N/A 87.98.177.4:6893 udp
N/A 87.98.177.5:6893 udp
N/A 87.98.177.6:6893 udp
N/A 87.98.177.7:6893 udp
N/A 87.98.177.8:6893 udp
N/A 87.98.177.9:6893 udp
N/A 87.98.177.10:6893 udp
N/A 87.98.177.11:6893 udp
N/A 87.98.177.12:6893 udp
N/A 87.98.177.13:6893 udp
N/A 87.98.177.14:6893 udp
N/A 87.98.177.15:6893 udp
N/A 87.98.177.16:6893 udp
N/A 87.98.177.17:6893 udp
N/A 87.98.177.18:6893 udp
N/A 87.98.177.19:6893 udp
N/A 87.98.177.20:6893 udp
N/A 87.98.177.21:6893 udp
N/A 87.98.177.22:6893 udp
N/A 87.98.177.23:6893 udp
N/A 87.98.177.24:6893 udp
N/A 87.98.177.25:6893 udp
N/A 87.98.177.26:6893 udp
N/A 87.98.177.27:6893 udp
N/A 87.98.177.28:6893 udp
N/A 87.98.177.29:6893 udp
N/A 87.98.177.30:6893 udp
N/A 87.98.177.31:6893 udp
N/A 87.98.177.32:6893 udp
N/A 87.98.177.33:6893 udp
N/A 87.98.177.34:6893 udp
N/A 87.98.177.35:6893 udp
N/A 87.98.177.36:6893 udp
N/A 87.98.177.37:6893 udp
N/A 87.98.177.38:6893 udp
N/A 87.98.177.39:6893 udp
N/A 87.98.177.40:6893 udp
N/A 87.98.177.41:6893 udp
N/A 87.98.177.42:6893 udp
N/A 87.98.177.43:6893 udp
N/A 87.98.177.44:6893 udp
N/A 87.98.177.45:6893 udp
N/A 87.98.177.46:6893 udp
N/A 87.98.177.47:6893 udp
N/A 87.98.177.48:6893 udp
N/A 87.98.177.49:6893 udp
N/A 87.98.177.50:6893 udp
N/A 87.98.177.51:6893 udp
N/A 87.98.177.52:6893 udp
N/A 87.98.177.53:6893 udp
N/A 87.98.177.54:6893 udp
N/A 87.98.177.55:6893 udp
N/A 87.98.177.56:6893 udp
N/A 87.98.177.57:6893 udp
N/A 87.98.177.58:6893 udp
N/A 87.98.177.59:6893 udp
N/A 87.98.177.60:6893 udp
N/A 87.98.177.61:6893 udp
N/A 87.98.177.62:6893 udp
N/A 87.98.177.63:6893 udp
N/A 87.98.177.64:6893 udp
N/A 87.98.177.65:6893 udp
N/A 87.98.177.66:6893 udp
N/A 87.98.177.67:6893 udp
N/A 87.98.177.68:6893 udp
N/A 87.98.177.69:6893 udp
N/A 87.98.177.70:6893 udp
N/A 87.98.177.71:6893 udp
N/A 87.98.177.72:6893 udp
N/A 87.98.177.73:6893 udp
N/A 87.98.177.74:6893 udp
N/A 87.98.177.75:6893 udp
N/A 87.98.177.76:6893 udp
N/A 87.98.177.77:6893 udp
N/A 87.98.177.78:6893 udp
N/A 87.98.177.79:6893 udp
N/A 87.98.177.80:6893 udp
N/A 87.98.177.81:6893 udp
N/A 87.98.177.82:6893 udp
N/A 87.98.177.83:6893 udp
N/A 87.98.177.84:6893 udp
N/A 87.98.177.85:6893 udp
N/A 87.98.177.86:6893 udp
N/A 87.98.177.87:6893 udp
N/A 87.98.177.88:6893 udp
N/A 87.98.177.89:6893 udp
N/A 87.98.177.90:6893 udp
N/A 87.98.177.91:6893 udp
N/A 87.98.177.92:6893 udp
N/A 87.98.177.93:6893 udp
N/A 87.98.177.94:6893 udp
N/A 87.98.177.95:6893 udp
N/A 87.98.177.96:6893 udp
N/A 87.98.177.97:6893 udp
N/A 87.98.177.98:6893 udp
N/A 87.98.177.99:6893 udp
N/A 87.98.177.100:6893 udp
N/A 87.98.177.101:6893 udp
N/A 87.98.177.102:6893 udp
N/A 87.98.177.103:6893 udp
N/A 87.98.177.104:6893 udp
N/A 87.98.177.105:6893 udp
N/A 87.98.177.106:6893 udp
N/A 87.98.177.107:6893 udp
N/A 87.98.177.108:6893 udp
N/A 87.98.177.109:6893 udp
N/A 87.98.177.110:6893 udp
N/A 87.98.177.111:6893 udp
N/A 87.98.177.112:6893 udp
N/A 87.98.177.113:6893 udp
N/A 87.98.177.114:6893 udp
N/A 87.98.177.115:6893 udp
N/A 87.98.177.116:6893 udp
N/A 87.98.177.117:6893 udp
N/A 87.98.177.118:6893 udp
N/A 87.98.177.119:6893 udp
N/A 87.98.177.120:6893 udp
N/A 87.98.177.121:6893 udp
N/A 87.98.177.122:6893 udp
N/A 87.98.177.123:6893 udp
N/A 87.98.177.124:6893 udp
N/A 87.98.177.125:6893 udp
N/A 87.98.177.126:6893 udp
N/A 87.98.177.127:6893 udp
N/A 87.98.177.128:6893 udp
N/A 87.98.177.129:6893 udp
N/A 87.98.177.130:6893 udp
N/A 87.98.177.131:6893 udp
N/A 87.98.177.132:6893 udp
N/A 87.98.177.133:6893 udp
N/A 87.98.177.134:6893 udp
N/A 87.98.177.135:6893 udp
N/A 87.98.177.136:6893 udp
N/A 87.98.177.137:6893 udp
N/A 87.98.177.138:6893 udp
N/A 87.98.177.139:6893 udp
N/A 87.98.177.140:6893 udp
N/A 87.98.177.141:6893 udp
N/A 87.98.177.142:6893 udp
N/A 87.98.177.143:6893 udp
N/A 87.98.177.144:6893 udp
N/A 87.98.177.145:6893 udp
N/A 87.98.177.146:6893 udp
N/A 87.98.177.147:6893 udp
N/A 87.98.177.148:6893 udp
N/A 87.98.177.149:6893 udp
N/A 87.98.177.150:6893 udp
N/A 87.98.177.151:6893 udp
N/A 87.98.177.152:6893 udp
N/A 87.98.177.153:6893 udp
N/A 87.98.177.154:6893 udp
N/A 87.98.177.155:6893 udp
N/A 87.98.177.156:6893 udp
N/A 87.98.177.157:6893 udp
N/A 87.98.177.158:6893 udp
N/A 87.98.177.159:6893 udp
N/A 87.98.177.160:6893 udp
N/A 87.98.177.161:6893 udp
N/A 87.98.177.162:6893 udp
N/A 87.98.177.163:6893 udp
N/A 87.98.177.164:6893 udp
N/A 87.98.177.165:6893 udp
N/A 87.98.177.166:6893 udp
N/A 87.98.177.167:6893 udp
N/A 87.98.177.168:6893 udp
N/A 87.98.177.169:6893 udp
N/A 87.98.177.170:6893 udp
N/A 87.98.177.171:6893 udp
N/A 87.98.177.172:6893 udp
N/A 87.98.177.173:6893 udp
N/A 87.98.177.174:6893 udp
N/A 87.98.177.175:6893 udp
N/A 87.98.177.176:6893 udp
N/A 87.98.177.177:6893 udp
N/A 87.98.177.178:6893 udp
N/A 87.98.177.179:6893 udp
N/A 87.98.177.180:6893 udp
N/A 87.98.177.181:6893 udp
N/A 87.98.177.182:6893 udp
N/A 87.98.177.183:6893 udp
N/A 87.98.177.184:6893 udp
N/A 87.98.177.185:6893 udp
N/A 87.98.177.186:6893 udp
N/A 87.98.177.187:6893 udp
N/A 87.98.177.188:6893 udp
N/A 87.98.177.189:6893 udp
N/A 87.98.177.190:6893 udp
N/A 87.98.177.191:6893 udp
N/A 87.98.177.192:6893 udp
N/A 87.98.177.193:6893 udp
N/A 87.98.177.194:6893 udp
N/A 87.98.177.195:6893 udp
N/A 87.98.177.196:6893 udp
N/A 87.98.177.197:6893 udp
N/A 87.98.177.198:6893 udp
N/A 87.98.177.199:6893 udp
N/A 87.98.177.200:6893 udp
N/A 87.98.177.201:6893 udp
N/A 87.98.177.202:6893 udp
N/A 87.98.177.203:6893 udp
N/A 87.98.177.204:6893 udp
N/A 87.98.177.205:6893 udp
N/A 87.98.177.206:6893 udp
N/A 87.98.177.207:6893 udp
N/A 87.98.177.208:6893 udp
N/A 87.98.177.209:6893 udp
N/A 87.98.177.210:6893 udp
N/A 87.98.177.211:6893 udp
N/A 87.98.177.212:6893 udp
N/A 87.98.177.213:6893 udp
N/A 87.98.177.214:6893 udp
N/A 87.98.177.215:6893 udp
N/A 87.98.177.216:6893 udp
N/A 87.98.177.217:6893 udp
N/A 87.98.177.218:6893 udp
N/A 87.98.177.219:6893 udp
N/A 87.98.177.220:6893 udp
N/A 87.98.177.221:6893 udp
N/A 87.98.177.222:6893 udp
N/A 87.98.177.223:6893 udp
N/A 87.98.177.224:6893 udp
N/A 87.98.177.225:6893 udp
N/A 87.98.177.226:6893 udp
N/A 87.98.177.227:6893 udp
N/A 87.98.177.228:6893 udp
N/A 87.98.177.229:6893 udp
N/A 87.98.177.230:6893 udp
N/A 87.98.177.231:6893 udp
N/A 87.98.177.232:6893 udp
N/A 87.98.177.233:6893 udp
N/A 87.98.177.234:6893 udp
N/A 87.98.177.235:6893 udp
N/A 87.98.177.236:6893 udp
N/A 87.98.177.237:6893 udp
N/A 87.98.177.238:6893 udp
N/A 87.98.177.239:6893 udp
N/A 87.98.177.240:6893 udp
N/A 87.98.177.241:6893 udp
N/A 87.98.177.242:6893 udp
N/A 87.98.177.243:6893 udp
N/A 87.98.177.244:6893 udp
N/A 87.98.177.245:6893 udp
N/A 87.98.177.246:6893 udp
N/A 87.98.177.247:6893 udp
N/A 87.98.177.248:6893 udp
N/A 87.98.177.249:6893 udp
N/A 87.98.177.250:6893 udp
N/A 87.98.177.251:6893 udp
N/A 87.98.177.252:6893 udp
N/A 87.98.177.253:6893 udp
N/A 87.98.177.254:6893 udp
N/A 87.98.177.255:6893 udp
N/A 87.98.178.0:6893 udp
N/A 87.98.178.1:6893 udp
N/A 87.98.178.2:6893 udp
N/A 87.98.178.3:6893 udp
N/A 87.98.178.4:6893 udp
N/A 87.98.178.5:6893 udp
N/A 87.98.178.6:6893 udp
N/A 87.98.178.7:6893 udp
N/A 87.98.178.8:6893 udp
N/A 87.98.178.9:6893 udp
N/A 87.98.178.10:6893 udp
N/A 87.98.178.11:6893 udp
N/A 87.98.178.12:6893 udp
N/A 87.98.178.13:6893 udp
N/A 87.98.178.14:6893 udp
N/A 87.98.178.15:6893 udp
N/A 87.98.178.16:6893 udp
N/A 87.98.178.17:6893 udp
N/A 87.98.178.18:6893 udp
N/A 87.98.178.19:6893 udp
N/A 87.98.178.20:6893 udp
N/A 87.98.178.21:6893 udp
N/A 87.98.178.22:6893 udp
N/A 87.98.178.23:6893 udp
N/A 87.98.178.24:6893 udp
N/A 87.98.178.25:6893 udp
N/A 87.98.178.26:6893 udp
N/A 87.98.178.27:6893 udp
N/A 87.98.178.28:6893 udp
N/A 87.98.178.29:6893 udp
N/A 87.98.178.30:6893 udp
N/A 87.98.178.31:6893 udp
N/A 87.98.178.32:6893 udp
N/A 87.98.178.33:6893 udp
N/A 87.98.178.34:6893 udp
N/A 87.98.178.35:6893 udp
N/A 87.98.178.36:6893 udp
N/A 87.98.178.37:6893 udp
N/A 87.98.178.38:6893 udp
N/A 87.98.178.39:6893 udp
N/A 87.98.178.40:6893 udp
N/A 87.98.178.41:6893 udp
N/A 87.98.178.42:6893 udp
N/A 87.98.178.43:6893 udp
N/A 87.98.178.44:6893 udp
N/A 87.98.178.45:6893 udp
N/A 87.98.178.46:6893 udp
N/A 87.98.178.47:6893 udp
N/A 87.98.178.48:6893 udp
N/A 87.98.178.49:6893 udp
N/A 87.98.178.50:6893 udp
N/A 87.98.178.51:6893 udp
N/A 87.98.178.52:6893 udp
N/A 87.98.178.53:6893 udp
N/A 87.98.178.54:6893 udp
N/A 87.98.178.55:6893 udp
N/A 87.98.178.56:6893 udp
N/A 87.98.178.57:6893 udp
N/A 87.98.178.58:6893 udp
N/A 87.98.178.59:6893 udp
N/A 87.98.178.60:6893 udp
N/A 87.98.178.61:6893 udp
N/A 87.98.178.62:6893 udp
N/A 87.98.178.63:6893 udp
N/A 87.98.178.64:6893 udp
N/A 87.98.178.65:6893 udp
N/A 87.98.178.66:6893 udp
N/A 87.98.178.67:6893 udp
N/A 87.98.178.68:6893 udp
N/A 87.98.178.69:6893 udp
N/A 87.98.178.70:6893 udp
N/A 87.98.178.71:6893 udp
N/A 87.98.178.72:6893 udp
N/A 87.98.178.73:6893 udp
N/A 87.98.178.74:6893 udp
N/A 87.98.178.75:6893 udp
N/A 87.98.178.76:6893 udp
N/A 87.98.178.77:6893 udp
N/A 87.98.178.78:6893 udp
N/A 87.98.178.79:6893 udp
N/A 87.98.178.80:6893 udp
N/A 87.98.178.81:6893 udp
N/A 87.98.178.82:6893 udp
N/A 87.98.178.83:6893 udp
N/A 87.98.178.84:6893 udp
N/A 87.98.178.85:6893 udp
N/A 87.98.178.86:6893 udp
N/A 87.98.178.87:6893 udp
N/A 87.98.178.88:6893 udp
N/A 87.98.178.89:6893 udp
N/A 87.98.178.90:6893 udp
N/A 87.98.178.91:6893 udp
N/A 87.98.178.92:6893 udp
N/A 87.98.178.93:6893 udp
N/A 87.98.178.94:6893 udp
N/A 87.98.178.95:6893 udp
N/A 87.98.178.96:6893 udp
N/A 87.98.178.97:6893 udp
N/A 87.98.178.98:6893 udp
N/A 87.98.178.99:6893 udp
N/A 87.98.178.100:6893 udp
N/A 87.98.178.101:6893 udp
N/A 87.98.178.102:6893 udp
N/A 87.98.178.103:6893 udp
N/A 87.98.178.104:6893 udp
N/A 87.98.178.105:6893 udp
N/A 87.98.178.106:6893 udp
N/A 87.98.178.107:6893 udp
N/A 87.98.178.108:6893 udp
N/A 87.98.178.109:6893 udp
N/A 87.98.178.110:6893 udp
N/A 87.98.178.111:6893 udp
N/A 87.98.178.112:6893 udp
N/A 87.98.178.113:6893 udp
N/A 87.98.178.114:6893 udp
N/A 87.98.178.115:6893 udp
N/A 87.98.178.116:6893 udp
N/A 87.98.178.117:6893 udp
N/A 87.98.178.118:6893 udp
N/A 87.98.178.119:6893 udp
N/A 87.98.178.120:6893 udp
N/A 87.98.178.121:6893 udp
N/A 87.98.178.122:6893 udp
N/A 87.98.178.123:6893 udp
N/A 87.98.178.124:6893 udp
N/A 87.98.178.125:6893 udp
N/A 87.98.178.126:6893 udp
N/A 87.98.178.127:6893 udp
N/A 87.98.178.128:6893 udp
N/A 87.98.178.129:6893 udp
N/A 87.98.178.130:6893 udp
N/A 87.98.178.131:6893 udp
N/A 87.98.178.132:6893 udp
N/A 87.98.178.133:6893 udp
N/A 87.98.178.134:6893 udp
N/A 87.98.178.135:6893 udp
N/A 87.98.178.136:6893 udp
N/A 87.98.178.137:6893 udp
N/A 87.98.178.138:6893 udp
N/A 87.98.178.139:6893 udp
N/A 87.98.178.140:6893 udp
N/A 87.98.178.141:6893 udp
N/A 87.98.178.142:6893 udp
N/A 87.98.178.143:6893 udp
N/A 87.98.178.144:6893 udp
N/A 87.98.178.145:6893 udp
N/A 87.98.178.146:6893 udp
N/A 87.98.178.147:6893 udp
N/A 87.98.178.148:6893 udp
N/A 87.98.178.149:6893 udp
N/A 87.98.178.150:6893 udp
N/A 87.98.178.151:6893 udp
N/A 87.98.178.152:6893 udp
N/A 87.98.178.153:6893 udp
N/A 87.98.178.154:6893 udp
N/A 87.98.178.155:6893 udp
N/A 87.98.178.156:6893 udp
N/A 87.98.178.157:6893 udp
N/A 87.98.178.158:6893 udp
N/A 87.98.178.159:6893 udp
N/A 87.98.178.160:6893 udp
N/A 87.98.178.161:6893 udp
N/A 87.98.178.162:6893 udp
N/A 87.98.178.163:6893 udp
N/A 87.98.178.164:6893 udp
N/A 87.98.178.165:6893 udp
N/A 87.98.178.166:6893 udp
N/A 87.98.178.167:6893 udp
N/A 87.98.178.168:6893 udp
N/A 87.98.178.169:6893 udp
N/A 87.98.178.170:6893 udp
N/A 87.98.178.171:6893 udp
N/A 87.98.178.172:6893 udp
N/A 87.98.178.173:6893 udp
N/A 87.98.178.174:6893 udp
N/A 87.98.178.175:6893 udp
N/A 87.98.178.176:6893 udp
N/A 87.98.178.177:6893 udp
N/A 87.98.178.178:6893 udp
N/A 87.98.178.179:6893 udp
N/A 87.98.178.180:6893 udp
N/A 87.98.178.181:6893 udp
N/A 87.98.178.182:6893 udp
N/A 87.98.178.183:6893 udp
N/A 87.98.178.184:6893 udp
N/A 87.98.178.185:6893 udp
N/A 87.98.178.186:6893 udp
N/A 87.98.178.187:6893 udp
N/A 87.98.178.188:6893 udp
N/A 87.98.178.189:6893 udp
N/A 87.98.178.190:6893 udp
N/A 87.98.178.191:6893 udp
N/A 87.98.178.192:6893 udp
N/A 87.98.178.193:6893 udp
N/A 87.98.178.194:6893 udp
N/A 87.98.178.195:6893 udp
N/A 87.98.178.196:6893 udp
N/A 87.98.178.197:6893 udp
N/A 87.98.178.198:6893 udp
N/A 87.98.178.199:6893 udp
N/A 87.98.178.200:6893 udp
N/A 87.98.178.201:6893 udp
N/A 87.98.178.202:6893 udp
N/A 87.98.178.203:6893 udp
N/A 87.98.178.204:6893 udp
N/A 87.98.178.205:6893 udp
N/A 87.98.178.206:6893 udp
N/A 87.98.178.207:6893 udp
N/A 87.98.178.208:6893 udp
N/A 87.98.178.209:6893 udp
N/A 87.98.178.210:6893 udp
N/A 87.98.178.211:6893 udp
N/A 87.98.178.212:6893 udp
N/A 87.98.178.213:6893 udp
N/A 87.98.178.214:6893 udp
N/A 87.98.178.215:6893 udp
N/A 87.98.178.216:6893 udp
N/A 87.98.178.217:6893 udp
N/A 87.98.178.218:6893 udp
N/A 87.98.178.219:6893 udp
N/A 87.98.178.220:6893 udp
N/A 87.98.178.221:6893 udp
N/A 87.98.178.222:6893 udp
N/A 87.98.178.223:6893 udp
N/A 87.98.178.224:6893 udp
N/A 87.98.178.225:6893 udp
N/A 87.98.178.226:6893 udp
N/A 87.98.178.227:6893 udp
N/A 87.98.178.228:6893 udp
N/A 87.98.178.229:6893 udp
N/A 87.98.178.230:6893 udp
N/A 87.98.178.231:6893 udp
N/A 87.98.178.232:6893 udp
N/A 87.98.178.233:6893 udp
N/A 87.98.178.234:6893 udp
N/A 87.98.178.235:6893 udp
N/A 87.98.178.236:6893 udp
N/A 87.98.178.237:6893 udp
N/A 87.98.178.238:6893 udp
N/A 87.98.178.239:6893 udp
N/A 87.98.178.240:6893 udp
N/A 87.98.178.241:6893 udp
N/A 87.98.178.242:6893 udp
N/A 87.98.178.243:6893 udp
N/A 87.98.178.244:6893 udp
N/A 87.98.178.245:6893 udp
N/A 87.98.178.246:6893 udp
N/A 87.98.178.247:6893 udp
N/A 87.98.178.248:6893 udp
N/A 87.98.178.249:6893 udp
N/A 87.98.178.250:6893 udp
N/A 87.98.178.251:6893 udp
N/A 87.98.178.252:6893 udp
N/A 87.98.178.253:6893 udp
N/A 87.98.178.254:6893 udp
N/A 87.98.178.255:6893 udp
N/A 87.98.179.0:6893 udp
N/A 87.98.179.1:6893 udp
N/A 87.98.179.2:6893 udp
N/A 87.98.179.3:6893 udp
N/A 87.98.179.4:6893 udp
N/A 87.98.179.5:6893 udp
N/A 87.98.179.6:6893 udp
N/A 87.98.179.7:6893 udp
N/A 87.98.179.8:6893 udp
N/A 87.98.179.9:6893 udp
N/A 87.98.179.10:6893 udp
N/A 87.98.179.11:6893 udp
N/A 87.98.179.12:6893 udp
N/A 87.98.179.13:6893 udp
N/A 87.98.179.14:6893 udp
N/A 87.98.179.15:6893 udp
N/A 87.98.179.16:6893 udp
N/A 87.98.179.17:6893 udp
N/A 87.98.179.18:6893 udp
N/A 87.98.179.19:6893 udp
N/A 87.98.179.20:6893 udp
N/A 87.98.179.21:6893 udp
N/A 87.98.179.22:6893 udp
N/A 87.98.179.23:6893 udp
N/A 87.98.179.24:6893 udp
N/A 87.98.179.25:6893 udp
N/A 87.98.179.26:6893 udp
N/A 87.98.179.27:6893 udp
N/A 87.98.179.28:6893 udp
N/A 87.98.179.29:6893 udp
N/A 87.98.179.30:6893 udp
N/A 87.98.179.31:6893 udp
N/A 87.98.179.32:6893 udp
N/A 87.98.179.33:6893 udp
N/A 87.98.179.34:6893 udp
N/A 87.98.179.35:6893 udp
N/A 87.98.179.36:6893 udp
N/A 87.98.179.37:6893 udp
N/A 87.98.179.38:6893 udp
N/A 87.98.179.39:6893 udp
N/A 87.98.179.40:6893 udp
N/A 87.98.179.41:6893 udp
N/A 87.98.179.42:6893 udp
N/A 87.98.179.43:6893 udp
N/A 87.98.179.44:6893 udp
N/A 87.98.179.45:6893 udp
N/A 87.98.179.46:6893 udp
N/A 87.98.179.47:6893 udp
N/A 87.98.179.48:6893 udp
N/A 87.98.179.49:6893 udp
N/A 87.98.179.50:6893 udp
N/A 87.98.179.51:6893 udp
N/A 87.98.179.52:6893 udp
N/A 87.98.179.53:6893 udp
N/A 87.98.179.54:6893 udp
N/A 87.98.179.55:6893 udp
N/A 87.98.179.56:6893 udp
N/A 87.98.179.57:6893 udp
N/A 87.98.179.58:6893 udp
N/A 87.98.179.59:6893 udp
N/A 87.98.179.60:6893 udp
N/A 87.98.179.61:6893 udp
N/A 87.98.179.62:6893 udp
N/A 87.98.179.63:6893 udp
N/A 87.98.179.64:6893 udp
N/A 87.98.179.65:6893 udp
N/A 87.98.179.66:6893 udp
N/A 87.98.179.67:6893 udp
N/A 87.98.179.68:6893 udp
N/A 87.98.179.69:6893 udp
N/A 87.98.179.70:6893 udp
N/A 87.98.179.71:6893 udp
N/A 87.98.179.72:6893 udp
N/A 87.98.179.73:6893 udp
N/A 87.98.179.74:6893 udp
N/A 87.98.179.75:6893 udp
N/A 87.98.179.76:6893 udp
N/A 87.98.179.77:6893 udp
N/A 87.98.179.78:6893 udp
N/A 87.98.179.79:6893 udp
N/A 87.98.179.80:6893 udp
N/A 87.98.179.81:6893 udp
N/A 87.98.179.82:6893 udp
N/A 87.98.179.83:6893 udp
N/A 87.98.179.84:6893 udp
N/A 87.98.179.85:6893 udp
N/A 87.98.179.86:6893 udp
N/A 87.98.179.87:6893 udp
N/A 87.98.179.88:6893 udp
N/A 87.98.179.89:6893 udp
N/A 87.98.179.90:6893 udp
N/A 87.98.179.91:6893 udp
N/A 87.98.179.92:6893 udp
N/A 87.98.179.93:6893 udp
N/A 87.98.179.94:6893 udp
N/A 87.98.179.95:6893 udp
N/A 87.98.179.96:6893 udp
N/A 87.98.179.97:6893 udp
N/A 87.98.179.98:6893 udp
N/A 87.98.179.99:6893 udp
N/A 87.98.179.100:6893 udp
N/A 87.98.179.101:6893 udp
N/A 87.98.179.102:6893 udp
N/A 87.98.179.103:6893 udp
N/A 87.98.179.104:6893 udp
N/A 87.98.179.105:6893 udp
N/A 87.98.179.106:6893 udp
N/A 87.98.179.107:6893 udp
N/A 87.98.179.108:6893 udp
N/A 87.98.179.109:6893 udp
N/A 87.98.179.110:6893 udp
N/A 87.98.179.111:6893 udp
N/A 87.98.179.112:6893 udp
N/A 87.98.179.113:6893 udp
N/A 87.98.179.114:6893 udp
N/A 87.98.179.115:6893 udp
N/A 87.98.179.116:6893 udp
N/A 87.98.179.117:6893 udp
N/A 87.98.179.118:6893 udp
N/A 87.98.179.119:6893 udp
N/A 87.98.179.120:6893 udp
N/A 87.98.179.121:6893 udp
N/A 87.98.179.122:6893 udp
N/A 87.98.179.123:6893 udp
N/A 87.98.179.124:6893 udp
N/A 87.98.179.125:6893 udp
N/A 87.98.179.126:6893 udp
N/A 87.98.179.127:6893 udp
N/A 87.98.179.128:6893 udp
N/A 87.98.179.129:6893 udp
N/A 87.98.179.130:6893 udp
N/A 87.98.179.131:6893 udp
N/A 87.98.179.132:6893 udp
N/A 87.98.179.133:6893 udp
N/A 87.98.179.134:6893 udp
N/A 87.98.179.135:6893 udp
N/A 87.98.179.136:6893 udp
N/A 87.98.179.137:6893 udp
N/A 87.98.179.138:6893 udp
N/A 87.98.179.139:6893 udp
N/A 87.98.179.140:6893 udp
N/A 87.98.179.141:6893 udp
N/A 87.98.179.142:6893 udp
N/A 87.98.179.143:6893 udp
N/A 87.98.179.144:6893 udp
N/A 87.98.179.145:6893 udp
N/A 87.98.179.146:6893 udp
N/A 87.98.179.147:6893 udp
N/A 87.98.179.148:6893 udp
N/A 87.98.179.149:6893 udp
N/A 87.98.179.150:6893 udp
N/A 87.98.179.151:6893 udp
N/A 87.98.179.152:6893 udp
N/A 87.98.179.153:6893 udp
N/A 87.98.179.154:6893 udp
N/A 87.98.179.155:6893 udp
N/A 87.98.179.156:6893 udp
N/A 87.98.179.157:6893 udp
N/A 87.98.179.158:6893 udp
N/A 87.98.179.159:6893 udp
N/A 87.98.179.160:6893 udp
N/A 87.98.179.161:6893 udp
N/A 87.98.179.162:6893 udp
N/A 87.98.179.163:6893 udp
N/A 87.98.179.164:6893 udp
N/A 87.98.179.165:6893 udp
N/A 87.98.179.166:6893 udp
N/A 87.98.179.167:6893 udp
N/A 87.98.179.168:6893 udp
N/A 87.98.179.169:6893 udp
N/A 87.98.179.170:6893 udp
N/A 87.98.179.171:6893 udp
N/A 87.98.179.172:6893 udp
N/A 87.98.179.173:6893 udp
N/A 87.98.179.174:6893 udp
N/A 87.98.179.175:6893 udp
N/A 87.98.179.176:6893 udp
N/A 87.98.179.177:6893 udp
N/A 87.98.179.178:6893 udp
N/A 87.98.179.179:6893 udp
N/A 87.98.179.180:6893 udp
N/A 87.98.179.181:6893 udp
N/A 87.98.179.182:6893 udp
N/A 87.98.179.183:6893 udp
N/A 87.98.179.184:6893 udp
N/A 87.98.179.185:6893 udp
N/A 87.98.179.186:6893 udp
N/A 87.98.179.187:6893 udp
N/A 87.98.179.188:6893 udp
N/A 87.98.179.189:6893 udp
N/A 87.98.179.190:6893 udp
N/A 87.98.179.191:6893 udp
N/A 87.98.179.192:6893 udp
N/A 87.98.179.193:6893 udp
N/A 87.98.179.194:6893 udp
N/A 87.98.179.195:6893 udp
N/A 87.98.179.196:6893 udp
N/A 87.98.179.197:6893 udp
N/A 87.98.179.198:6893 udp
N/A 87.98.179.199:6893 udp
N/A 87.98.179.200:6893 udp
N/A 87.98.179.201:6893 udp
N/A 87.98.179.202:6893 udp
N/A 87.98.179.203:6893 udp
N/A 87.98.179.204:6893 udp
N/A 87.98.179.205:6893 udp
N/A 87.98.179.206:6893 udp
N/A 87.98.179.207:6893 udp
N/A 87.98.179.208:6893 udp
N/A 87.98.179.209:6893 udp
N/A 87.98.179.210:6893 udp
N/A 87.98.179.211:6893 udp
N/A 87.98.179.212:6893 udp
N/A 87.98.179.213:6893 udp
N/A 87.98.179.214:6893 udp
N/A 87.98.179.215:6893 udp
N/A 87.98.179.216:6893 udp
N/A 87.98.179.217:6893 udp
N/A 87.98.179.218:6893 udp
N/A 87.98.179.219:6893 udp
N/A 87.98.179.220:6893 udp
N/A 87.98.179.221:6893 udp
N/A 87.98.179.222:6893 udp
N/A 87.98.179.223:6893 udp
N/A 87.98.179.224:6893 udp
N/A 87.98.179.225:6893 udp
N/A 87.98.179.226:6893 udp
N/A 87.98.179.227:6893 udp
N/A 87.98.179.228:6893 udp
N/A 87.98.179.229:6893 udp
N/A 87.98.179.230:6893 udp
N/A 87.98.179.231:6893 udp
N/A 87.98.179.232:6893 udp
N/A 87.98.179.233:6893 udp
N/A 87.98.179.234:6893 udp
N/A 87.98.179.235:6893 udp
N/A 87.98.179.236:6893 udp
N/A 87.98.179.237:6893 udp
N/A 87.98.179.238:6893 udp
N/A 87.98.179.239:6893 udp
N/A 87.98.179.240:6893 udp
N/A 87.98.179.241:6893 udp
N/A 87.98.179.242:6893 udp
N/A 87.98.179.243:6893 udp
N/A 87.98.179.244:6893 udp
N/A 87.98.179.245:6893 udp
N/A 87.98.179.246:6893 udp
N/A 87.98.179.247:6893 udp
N/A 87.98.179.248:6893 udp
N/A 87.98.179.249:6893 udp
N/A 87.98.179.250:6893 udp
N/A 87.98.179.251:6893 udp
N/A 87.98.179.252:6893 udp
N/A 87.98.179.253:6893 udp
N/A 87.98.179.254:6893 udp
N/A 87.98.179.255:6893 udp
N/A 77.12.57.0:6893 udp
N/A 77.12.57.1:6893 udp
N/A 77.12.57.2:6893 udp
N/A 77.12.57.3:6893 udp
N/A 77.12.57.4:6893 udp
N/A 77.12.57.5:6893 udp
N/A 77.12.57.6:6893 udp
N/A 77.12.57.7:6893 udp
N/A 77.12.57.8:6893 udp
N/A 77.12.57.9:6893 udp
N/A 77.12.57.10:6893 udp
N/A 77.12.57.11:6893 udp
N/A 77.12.57.12:6893 udp
N/A 77.12.57.13:6893 udp
N/A 77.12.57.14:6893 udp
N/A 77.12.57.15:6893 udp
N/A 77.12.57.16:6893 udp
N/A 77.12.57.17:6893 udp
N/A 77.12.57.18:6893 udp
N/A 77.12.57.19:6893 udp
N/A 77.12.57.20:6893 udp
N/A 77.12.57.21:6893 udp
N/A 77.12.57.22:6893 udp
N/A 77.12.57.23:6893 udp
N/A 77.12.57.24:6893 udp
N/A 77.12.57.25:6893 udp
N/A 77.12.57.26:6893 udp
N/A 77.12.57.27:6893 udp
N/A 77.12.57.28:6893 udp
N/A 77.12.57.29:6893 udp
N/A 77.12.57.30:6893 udp
N/A 77.12.57.31:6893 udp
N/A 19.48.17.0:6893 udp
N/A 19.48.17.1:6893 udp
N/A 19.48.17.2:6893 udp
N/A 19.48.17.3:6893 udp
N/A 19.48.17.4:6893 udp
N/A 19.48.17.5:6893 udp
N/A 19.48.17.6:6893 udp
N/A 19.48.17.7:6893 udp
N/A 19.48.17.8:6893 udp
N/A 19.48.17.9:6893 udp
N/A 19.48.17.10:6893 udp
N/A 19.48.17.11:6893 udp
N/A 19.48.17.12:6893 udp
N/A 19.48.17.13:6893 udp
N/A 19.48.17.14:6893 udp
N/A 19.48.17.15:6893 udp
N/A 19.48.17.16:6893 udp
N/A 19.48.17.17:6893 udp
N/A 19.48.17.18:6893 udp
N/A 19.48.17.19:6893 udp
N/A 19.48.17.20:6893 udp
N/A 19.48.17.21:6893 udp
N/A 19.48.17.22:6893 udp
N/A 19.48.17.23:6893 udp
N/A 19.48.17.24:6893 udp
N/A 19.48.17.25:6893 udp
N/A 19.48.17.26:6893 udp
N/A 19.48.17.27:6893 udp
N/A 19.48.17.28:6893 udp
N/A 19.48.17.29:6893 udp
N/A 19.48.17.30:6893 udp
N/A 19.48.17.31:6893 udp
N/A 87.98.176.0:6893 udp
N/A 87.98.176.1:6893 udp
N/A 87.98.176.2:6893 udp
N/A 87.98.176.3:6893 udp
N/A 87.98.176.4:6893 udp
N/A 87.98.176.5:6893 udp
N/A 87.98.176.6:6893 udp
N/A 87.98.176.7:6893 udp
N/A 87.98.176.8:6893 udp
N/A 87.98.176.9:6893 udp
N/A 87.98.176.10:6893 udp
N/A 87.98.176.11:6893 udp
N/A 87.98.176.12:6893 udp
N/A 87.98.176.13:6893 udp
N/A 87.98.176.14:6893 udp
N/A 87.98.176.15:6893 udp
N/A 87.98.176.16:6893 udp
N/A 87.98.176.17:6893 udp
N/A 87.98.176.18:6893 udp
N/A 87.98.176.19:6893 udp
N/A 87.98.176.20:6893 udp
N/A 87.98.176.21:6893 udp
N/A 87.98.176.22:6893 udp
N/A 87.98.176.23:6893 udp
N/A 87.98.176.24:6893 udp
N/A 87.98.176.25:6893 udp
N/A 87.98.176.26:6893 udp
N/A 87.98.176.27:6893 udp
N/A 87.98.176.28:6893 udp
N/A 87.98.176.29:6893 udp
N/A 87.98.176.30:6893 udp
N/A 87.98.176.31:6893 udp
N/A 87.98.176.32:6893 udp
N/A 87.98.176.33:6893 udp
N/A 87.98.176.34:6893 udp
N/A 87.98.176.35:6893 udp
N/A 87.98.176.36:6893 udp
N/A 87.98.176.37:6893 udp
N/A 87.98.176.38:6893 udp
N/A 87.98.176.39:6893 udp
N/A 87.98.176.40:6893 udp
N/A 87.98.176.41:6893 udp
N/A 87.98.176.42:6893 udp
N/A 87.98.176.43:6893 udp
N/A 87.98.176.44:6893 udp
N/A 87.98.176.45:6893 udp
N/A 87.98.176.46:6893 udp
N/A 87.98.176.47:6893 udp
N/A 87.98.176.48:6893 udp
N/A 87.98.176.49:6893 udp
N/A 87.98.176.50:6893 udp
N/A 87.98.176.51:6893 udp
N/A 87.98.176.52:6893 udp
N/A 87.98.176.53:6893 udp
N/A 87.98.176.54:6893 udp
N/A 87.98.176.55:6893 udp
N/A 87.98.176.56:6893 udp
N/A 87.98.176.57:6893 udp
N/A 87.98.176.58:6893 udp
N/A 87.98.176.59:6893 udp
N/A 87.98.176.60:6893 udp
N/A 87.98.176.61:6893 udp
N/A 87.98.176.62:6893 udp
N/A 87.98.176.63:6893 udp
N/A 87.98.176.64:6893 udp
N/A 87.98.176.65:6893 udp
N/A 87.98.176.66:6893 udp
N/A 87.98.176.67:6893 udp
N/A 87.98.176.68:6893 udp
N/A 87.98.176.69:6893 udp
N/A 87.98.176.70:6893 udp
N/A 87.98.176.71:6893 udp
N/A 87.98.176.72:6893 udp
N/A 87.98.176.73:6893 udp
N/A 87.98.176.74:6893 udp
N/A 87.98.176.75:6893 udp
N/A 87.98.176.76:6893 udp
N/A 87.98.176.77:6893 udp
N/A 87.98.176.78:6893 udp
N/A 87.98.176.79:6893 udp
N/A 87.98.176.80:6893 udp
N/A 87.98.176.81:6893 udp
N/A 87.98.176.82:6893 udp
N/A 87.98.176.83:6893 udp
N/A 87.98.176.84:6893 udp
N/A 87.98.176.85:6893 udp
N/A 87.98.176.86:6893 udp
N/A 87.98.176.87:6893 udp
N/A 87.98.176.88:6893 udp
N/A 87.98.176.89:6893 udp
N/A 87.98.176.90:6893 udp
N/A 87.98.176.91:6893 udp
N/A 87.98.176.92:6893 udp
N/A 87.98.176.93:6893 udp
N/A 87.98.176.94:6893 udp
N/A 87.98.176.95:6893 udp
N/A 87.98.176.96:6893 udp
N/A 87.98.176.97:6893 udp
N/A 87.98.176.98:6893 udp
N/A 87.98.176.99:6893 udp
N/A 87.98.176.100:6893 udp
N/A 87.98.176.101:6893 udp
N/A 87.98.176.102:6893 udp
N/A 87.98.176.103:6893 udp
N/A 87.98.176.104:6893 udp
N/A 87.98.176.105:6893 udp
N/A 87.98.176.106:6893 udp
N/A 87.98.176.107:6893 udp
N/A 87.98.176.108:6893 udp
N/A 87.98.176.109:6893 udp
N/A 87.98.176.110:6893 udp
N/A 87.98.176.111:6893 udp
N/A 87.98.176.112:6893 udp
N/A 87.98.176.113:6893 udp
N/A 87.98.176.114:6893 udp
N/A 87.98.176.115:6893 udp
N/A 87.98.176.116:6893 udp
N/A 87.98.176.117:6893 udp
N/A 87.98.176.118:6893 udp
N/A 87.98.176.119:6893 udp
N/A 87.98.176.120:6893 udp
N/A 87.98.176.121:6893 udp
N/A 87.98.176.122:6893 udp
N/A 87.98.176.123:6893 udp
N/A 87.98.176.124:6893 udp
N/A 87.98.176.125:6893 udp
N/A 87.98.176.126:6893 udp
N/A 87.98.176.127:6893 udp
N/A 87.98.176.128:6893 udp
N/A 87.98.176.129:6893 udp
N/A 87.98.176.130:6893 udp
N/A 87.98.176.131:6893 udp
N/A 87.98.176.132:6893 udp
N/A 87.98.176.133:6893 udp
N/A 87.98.176.134:6893 udp
N/A 87.98.176.135:6893 udp
N/A 87.98.176.136:6893 udp
N/A 87.98.176.137:6893 udp
N/A 87.98.176.138:6893 udp
N/A 87.98.176.139:6893 udp
N/A 87.98.176.140:6893 udp
N/A 87.98.176.141:6893 udp
N/A 87.98.176.142:6893 udp
N/A 87.98.176.143:6893 udp
N/A 87.98.176.144:6893 udp
N/A 87.98.176.145:6893 udp
N/A 87.98.176.146:6893 udp
N/A 87.98.176.147:6893 udp
N/A 87.98.176.148:6893 udp
N/A 87.98.176.149:6893 udp
N/A 87.98.176.150:6893 udp
N/A 87.98.176.151:6893 udp
N/A 87.98.176.152:6893 udp
N/A 87.98.176.153:6893 udp
N/A 87.98.176.154:6893 udp
N/A 87.98.176.155:6893 udp
N/A 87.98.176.156:6893 udp
N/A 87.98.176.157:6893 udp
N/A 87.98.176.158:6893 udp
N/A 87.98.176.159:6893 udp
N/A 87.98.176.160:6893 udp
N/A 87.98.176.161:6893 udp
N/A 87.98.176.162:6893 udp
N/A 87.98.176.163:6893 udp
N/A 87.98.176.164:6893 udp
N/A 87.98.176.165:6893 udp
N/A 87.98.176.166:6893 udp
N/A 87.98.176.167:6893 udp
N/A 87.98.176.168:6893 udp
N/A 87.98.176.169:6893 udp
N/A 87.98.176.170:6893 udp
N/A 87.98.176.171:6893 udp
N/A 87.98.176.172:6893 udp
N/A 87.98.176.173:6893 udp
N/A 87.98.176.174:6893 udp
N/A 87.98.176.175:6893 udp
N/A 87.98.176.176:6893 udp
N/A 87.98.176.177:6893 udp
N/A 87.98.176.178:6893 udp
N/A 87.98.176.179:6893 udp
N/A 87.98.176.180:6893 udp
N/A 87.98.176.181:6893 udp
N/A 87.98.176.182:6893 udp
N/A 87.98.176.183:6893 udp
N/A 87.98.176.184:6893 udp
N/A 87.98.176.185:6893 udp
N/A 87.98.176.186:6893 udp
N/A 87.98.176.187:6893 udp
N/A 87.98.176.188:6893 udp
N/A 87.98.176.189:6893 udp
N/A 87.98.176.190:6893 udp
N/A 87.98.176.191:6893 udp
N/A 87.98.176.192:6893 udp
N/A 87.98.176.193:6893 udp
N/A 87.98.176.194:6893 udp
N/A 87.98.176.195:6893 udp
N/A 87.98.176.196:6893 udp
N/A 87.98.176.197:6893 udp
N/A 87.98.176.198:6893 udp
N/A 87.98.176.199:6893 udp
N/A 87.98.176.200:6893 udp
N/A 87.98.176.201:6893 udp
N/A 87.98.176.202:6893 udp
N/A 87.98.176.203:6893 udp
N/A 87.98.176.204:6893 udp
N/A 87.98.176.205:6893 udp
N/A 87.98.176.206:6893 udp
N/A 87.98.176.207:6893 udp
N/A 87.98.176.208:6893 udp
N/A 87.98.176.209:6893 udp
N/A 87.98.176.210:6893 udp
N/A 87.98.176.211:6893 udp
N/A 87.98.176.212:6893 udp
N/A 87.98.176.213:6893 udp
N/A 87.98.176.214:6893 udp
N/A 87.98.176.215:6893 udp
N/A 87.98.176.216:6893 udp
N/A 87.98.176.217:6893 udp
N/A 87.98.176.218:6893 udp
N/A 87.98.176.219:6893 udp
N/A 87.98.176.220:6893 udp
N/A 87.98.176.221:6893 udp
N/A 87.98.176.222:6893 udp
N/A 87.98.176.223:6893 udp
N/A 87.98.176.224:6893 udp
N/A 87.98.176.225:6893 udp
N/A 87.98.176.226:6893 udp
N/A 87.98.176.227:6893 udp
N/A 87.98.176.228:6893 udp
N/A 87.98.176.229:6893 udp
N/A 87.98.176.230:6893 udp
N/A 87.98.176.231:6893 udp
N/A 87.98.176.232:6893 udp
N/A 87.98.176.233:6893 udp
N/A 87.98.176.234:6893 udp
N/A 87.98.176.235:6893 udp
N/A 87.98.176.236:6893 udp
N/A 87.98.176.237:6893 udp
N/A 87.98.176.238:6893 udp
N/A 87.98.176.239:6893 udp
N/A 87.98.176.240:6893 udp
N/A 87.98.176.241:6893 udp
N/A 87.98.176.242:6893 udp
N/A 87.98.176.243:6893 udp
N/A 87.98.176.244:6893 udp
N/A 87.98.176.245:6893 udp
N/A 87.98.176.246:6893 udp
N/A 87.98.176.247:6893 udp
N/A 87.98.176.248:6893 udp
N/A 87.98.176.249:6893 udp
N/A 87.98.176.250:6893 udp
N/A 87.98.176.251:6893 udp
N/A 87.98.176.252:6893 udp
N/A 87.98.176.253:6893 udp
N/A 87.98.176.254:6893 udp
N/A 87.98.176.255:6893 udp
N/A 87.98.177.0:6893 udp
N/A 87.98.177.1:6893 udp
N/A 87.98.177.2:6893 udp
N/A 87.98.177.3:6893 udp
N/A 87.98.177.4:6893 udp
N/A 87.98.177.5:6893 udp
N/A 87.98.177.6:6893 udp
N/A 87.98.177.7:6893 udp
N/A 87.98.177.8:6893 udp
N/A 87.98.177.9:6893 udp
N/A 87.98.177.10:6893 udp
N/A 87.98.177.11:6893 udp
N/A 87.98.177.12:6893 udp
N/A 87.98.177.13:6893 udp
N/A 87.98.177.14:6893 udp
N/A 87.98.177.15:6893 udp
N/A 87.98.177.16:6893 udp
N/A 87.98.177.17:6893 udp
N/A 87.98.177.18:6893 udp
N/A 87.98.177.19:6893 udp
N/A 87.98.177.20:6893 udp
N/A 87.98.177.21:6893 udp
N/A 87.98.177.22:6893 udp
N/A 87.98.177.23:6893 udp
N/A 87.98.177.24:6893 udp
N/A 87.98.177.25:6893 udp
N/A 87.98.177.26:6893 udp
N/A 87.98.177.27:6893 udp
N/A 87.98.177.28:6893 udp
N/A 87.98.177.29:6893 udp
N/A 87.98.177.30:6893 udp
N/A 87.98.177.31:6893 udp
N/A 87.98.177.32:6893 udp
N/A 87.98.177.33:6893 udp
N/A 87.98.177.34:6893 udp
N/A 87.98.177.35:6893 udp
N/A 87.98.177.36:6893 udp
N/A 87.98.177.37:6893 udp
N/A 87.98.177.38:6893 udp
N/A 87.98.177.39:6893 udp
N/A 87.98.177.40:6893 udp
N/A 87.98.177.41:6893 udp
N/A 87.98.177.42:6893 udp
N/A 87.98.177.43:6893 udp
N/A 87.98.177.44:6893 udp
N/A 87.98.177.45:6893 udp
N/A 87.98.177.46:6893 udp
N/A 87.98.177.47:6893 udp
N/A 87.98.177.48:6893 udp
N/A 87.98.177.49:6893 udp
N/A 87.98.177.50:6893 udp
N/A 87.98.177.51:6893 udp
N/A 87.98.177.52:6893 udp
N/A 87.98.177.53:6893 udp
N/A 87.98.177.54:6893 udp
N/A 87.98.177.55:6893 udp
N/A 87.98.177.56:6893 udp
N/A 87.98.177.57:6893 udp
N/A 87.98.177.58:6893 udp
N/A 87.98.177.59:6893 udp
N/A 87.98.177.60:6893 udp
N/A 87.98.177.61:6893 udp
N/A 87.98.177.62:6893 udp
N/A 87.98.177.63:6893 udp
N/A 87.98.177.64:6893 udp
N/A 87.98.177.65:6893 udp
N/A 87.98.177.66:6893 udp
N/A 87.98.177.67:6893 udp
N/A 87.98.177.68:6893 udp
N/A 87.98.177.69:6893 udp
N/A 87.98.177.70:6893 udp
N/A 87.98.177.71:6893 udp
N/A 87.98.177.72:6893 udp
N/A 87.98.177.73:6893 udp
N/A 87.98.177.74:6893 udp
N/A 87.98.177.75:6893 udp
N/A 87.98.177.76:6893 udp
N/A 87.98.177.77:6893 udp
N/A 87.98.177.78:6893 udp
N/A 87.98.177.79:6893 udp
N/A 87.98.177.80:6893 udp
N/A 87.98.177.81:6893 udp
N/A 87.98.177.82:6893 udp
N/A 87.98.177.83:6893 udp
N/A 87.98.177.84:6893 udp
N/A 87.98.177.85:6893 udp
N/A 87.98.177.86:6893 udp
N/A 87.98.177.87:6893 udp
N/A 87.98.177.88:6893 udp
N/A 87.98.177.89:6893 udp
N/A 87.98.177.90:6893 udp
N/A 87.98.177.91:6893 udp
N/A 87.98.177.92:6893 udp
N/A 87.98.177.93:6893 udp
N/A 87.98.177.94:6893 udp
N/A 87.98.177.95:6893 udp
N/A 87.98.177.96:6893 udp
N/A 87.98.177.97:6893 udp
N/A 87.98.177.98:6893 udp
N/A 87.98.177.99:6893 udp
N/A 87.98.177.100:6893 udp
N/A 87.98.177.101:6893 udp
N/A 87.98.177.102:6893 udp
N/A 87.98.177.103:6893 udp
N/A 87.98.177.104:6893 udp
N/A 87.98.177.105:6893 udp
N/A 87.98.177.106:6893 udp
N/A 87.98.177.107:6893 udp
N/A 87.98.177.108:6893 udp
N/A 87.98.177.109:6893 udp
N/A 87.98.177.110:6893 udp
N/A 87.98.177.111:6893 udp
N/A 87.98.177.112:6893 udp
N/A 87.98.177.113:6893 udp
N/A 87.98.177.114:6893 udp
N/A 87.98.177.115:6893 udp
N/A 87.98.177.116:6893 udp
N/A 87.98.177.117:6893 udp
N/A 87.98.177.118:6893 udp
N/A 87.98.177.119:6893 udp
N/A 87.98.177.120:6893 udp
N/A 87.98.177.121:6893 udp
N/A 87.98.177.122:6893 udp
N/A 87.98.177.123:6893 udp
N/A 87.98.177.124:6893 udp
N/A 87.98.177.125:6893 udp
N/A 87.98.177.126:6893 udp
N/A 87.98.177.127:6893 udp
N/A 87.98.177.128:6893 udp
N/A 87.98.177.129:6893 udp
N/A 87.98.177.130:6893 udp
N/A 87.98.177.131:6893 udp
N/A 87.98.177.132:6893 udp
N/A 87.98.177.133:6893 udp
N/A 87.98.177.134:6893 udp
N/A 87.98.177.135:6893 udp
N/A 87.98.177.136:6893 udp
N/A 87.98.177.137:6893 udp
N/A 87.98.177.138:6893 udp
N/A 87.98.177.139:6893 udp
N/A 87.98.177.140:6893 udp
N/A 87.98.177.141:6893 udp
N/A 87.98.177.142:6893 udp
N/A 87.98.177.143:6893 udp
N/A 87.98.177.144:6893 udp
N/A 87.98.177.145:6893 udp
N/A 87.98.177.146:6893 udp
N/A 87.98.177.147:6893 udp
N/A 87.98.177.148:6893 udp
N/A 87.98.177.149:6893 udp
N/A 87.98.177.150:6893 udp
N/A 87.98.177.151:6893 udp
N/A 87.98.177.152:6893 udp
N/A 87.98.177.153:6893 udp
N/A 87.98.177.154:6893 udp
N/A 87.98.177.155:6893 udp
N/A 87.98.177.156:6893 udp
N/A 87.98.177.157:6893 udp
N/A 87.98.177.158:6893 udp
N/A 87.98.177.159:6893 udp
N/A 87.98.177.160:6893 udp
N/A 87.98.177.161:6893 udp
N/A 87.98.177.162:6893 udp
N/A 87.98.177.163:6893 udp
N/A 87.98.177.164:6893 udp
N/A 87.98.177.165:6893 udp
N/A 87.98.177.166:6893 udp
N/A 87.98.177.167:6893 udp
N/A 87.98.177.168:6893 udp
N/A 87.98.177.169:6893 udp
N/A 87.98.177.170:6893 udp
N/A 87.98.177.171:6893 udp
N/A 87.98.177.172:6893 udp
N/A 87.98.177.173:6893 udp
N/A 87.98.177.174:6893 udp
N/A 87.98.177.175:6893 udp
N/A 87.98.177.176:6893 udp
N/A 87.98.177.177:6893 udp
N/A 87.98.177.178:6893 udp
N/A 87.98.177.179:6893 udp
N/A 87.98.177.180:6893 udp
N/A 87.98.177.181:6893 udp
N/A 87.98.177.182:6893 udp
N/A 87.98.177.183:6893 udp
N/A 87.98.177.184:6893 udp
N/A 87.98.177.185:6893 udp
N/A 87.98.177.186:6893 udp
N/A 87.98.177.187:6893 udp
N/A 87.98.177.188:6893 udp
N/A 87.98.177.189:6893 udp
N/A 87.98.177.190:6893 udp
N/A 87.98.177.191:6893 udp
N/A 87.98.177.192:6893 udp
N/A 87.98.177.193:6893 udp
N/A 87.98.177.194:6893 udp
N/A 87.98.177.195:6893 udp
N/A 87.98.177.196:6893 udp
N/A 87.98.177.197:6893 udp
N/A 87.98.177.198:6893 udp
N/A 87.98.177.199:6893 udp
N/A 87.98.177.200:6893 udp
N/A 87.98.177.201:6893 udp
N/A 87.98.177.202:6893 udp
N/A 87.98.177.203:6893 udp
N/A 87.98.177.204:6893 udp
N/A 87.98.177.205:6893 udp
N/A 87.98.177.206:6893 udp
N/A 87.98.177.207:6893 udp
N/A 87.98.177.208:6893 udp
N/A 87.98.177.209:6893 udp
N/A 87.98.177.210:6893 udp
N/A 87.98.177.211:6893 udp
N/A 87.98.177.212:6893 udp
N/A 87.98.177.213:6893 udp
N/A 87.98.177.214:6893 udp
N/A 87.98.177.215:6893 udp
N/A 87.98.177.216:6893 udp
N/A 87.98.177.217:6893 udp
N/A 87.98.177.218:6893 udp
N/A 87.98.177.219:6893 udp
N/A 87.98.177.220:6893 udp
N/A 87.98.177.221:6893 udp
N/A 87.98.177.222:6893 udp
N/A 87.98.177.223:6893 udp
N/A 87.98.177.224:6893 udp
N/A 87.98.177.225:6893 udp
N/A 87.98.177.226:6893 udp
N/A 87.98.177.227:6893 udp
N/A 87.98.177.228:6893 udp
N/A 87.98.177.229:6893 udp
N/A 87.98.177.230:6893 udp
N/A 87.98.177.231:6893 udp
N/A 87.98.177.232:6893 udp
N/A 87.98.177.233:6893 udp
N/A 87.98.177.234:6893 udp
N/A 87.98.177.235:6893 udp
N/A 87.98.177.236:6893 udp
N/A 87.98.177.237:6893 udp
N/A 87.98.177.238:6893 udp
N/A 87.98.177.239:6893 udp
N/A 87.98.177.240:6893 udp
N/A 87.98.177.241:6893 udp
N/A 87.98.177.242:6893 udp
N/A 87.98.177.243:6893 udp
N/A 87.98.177.244:6893 udp
N/A 87.98.177.245:6893 udp
N/A 87.98.177.246:6893 udp
N/A 87.98.177.247:6893 udp
N/A 87.98.177.248:6893 udp
N/A 87.98.177.249:6893 udp
N/A 87.98.177.250:6893 udp
N/A 87.98.177.251:6893 udp
N/A 87.98.177.252:6893 udp
N/A 87.98.177.253:6893 udp
N/A 87.98.177.254:6893 udp
N/A 87.98.177.255:6893 udp
N/A 87.98.178.0:6893 udp
N/A 87.98.178.1:6893 udp
N/A 87.98.178.2:6893 udp
N/A 87.98.178.3:6893 udp
N/A 87.98.178.4:6893 udp
N/A 87.98.178.5:6893 udp
N/A 87.98.178.6:6893 udp
N/A 87.98.178.7:6893 udp
N/A 87.98.178.8:6893 udp
N/A 87.98.178.9:6893 udp
N/A 87.98.178.10:6893 udp
N/A 87.98.178.11:6893 udp
N/A 87.98.178.12:6893 udp
N/A 87.98.178.13:6893 udp
N/A 87.98.178.14:6893 udp
N/A 87.98.178.15:6893 udp
N/A 87.98.178.16:6893 udp
N/A 87.98.178.17:6893 udp
N/A 87.98.178.18:6893 udp
N/A 87.98.178.19:6893 udp
N/A 87.98.178.20:6893 udp
N/A 87.98.178.21:6893 udp
N/A 87.98.178.22:6893 udp
N/A 87.98.178.23:6893 udp
N/A 87.98.178.24:6893 udp
N/A 87.98.178.25:6893 udp
N/A 87.98.178.26:6893 udp
N/A 87.98.178.27:6893 udp
N/A 87.98.178.28:6893 udp
N/A 87.98.178.29:6893 udp
N/A 87.98.178.30:6893 udp
N/A 87.98.178.31:6893 udp
N/A 87.98.178.32:6893 udp
N/A 87.98.178.33:6893 udp
N/A 87.98.178.34:6893 udp
N/A 87.98.178.35:6893 udp
N/A 87.98.178.36:6893 udp
N/A 87.98.178.37:6893 udp
N/A 87.98.178.38:6893 udp
N/A 87.98.178.39:6893 udp
N/A 87.98.178.40:6893 udp
N/A 87.98.178.41:6893 udp
N/A 87.98.178.42:6893 udp
N/A 87.98.178.43:6893 udp
N/A 87.98.178.44:6893 udp
N/A 87.98.178.45:6893 udp
N/A 87.98.178.46:6893 udp
N/A 87.98.178.47:6893 udp
N/A 87.98.178.48:6893 udp
N/A 87.98.178.49:6893 udp
N/A 87.98.178.50:6893 udp
N/A 87.98.178.51:6893 udp
N/A 87.98.178.52:6893 udp
N/A 87.98.178.53:6893 udp
N/A 87.98.178.54:6893 udp
N/A 87.98.178.55:6893 udp
N/A 87.98.178.56:6893 udp
N/A 87.98.178.57:6893 udp
N/A 87.98.178.58:6893 udp
N/A 87.98.178.59:6893 udp
N/A 87.98.178.60:6893 udp
N/A 87.98.178.61:6893 udp
N/A 87.98.178.62:6893 udp
N/A 87.98.178.63:6893 udp
N/A 87.98.178.64:6893 udp
N/A 87.98.178.65:6893 udp
N/A 87.98.178.66:6893 udp
N/A 87.98.178.67:6893 udp
N/A 87.98.178.68:6893 udp
N/A 87.98.178.69:6893 udp
N/A 87.98.178.70:6893 udp
N/A 87.98.178.71:6893 udp
N/A 87.98.178.72:6893 udp
N/A 87.98.178.73:6893 udp
N/A 87.98.178.74:6893 udp
N/A 87.98.178.75:6893 udp
N/A 87.98.178.76:6893 udp
N/A 87.98.178.77:6893 udp
N/A 87.98.178.78:6893 udp
N/A 87.98.178.79:6893 udp
N/A 87.98.178.80:6893 udp
N/A 87.98.178.81:6893 udp
N/A 87.98.178.82:6893 udp
N/A 87.98.178.83:6893 udp
N/A 87.98.178.84:6893 udp
N/A 87.98.178.85:6893 udp
N/A 87.98.178.86:6893 udp
N/A 87.98.178.87:6893 udp
N/A 87.98.178.88:6893 udp
N/A 87.98.178.89:6893 udp
N/A 87.98.178.90:6893 udp
N/A 87.98.178.91:6893 udp
N/A 87.98.178.92:6893 udp
N/A 87.98.178.93:6893 udp
N/A 87.98.178.94:6893 udp
N/A 87.98.178.95:6893 udp
N/A 87.98.178.96:6893 udp
N/A 87.98.178.97:6893 udp
N/A 87.98.178.98:6893 udp
N/A 87.98.178.99:6893 udp
N/A 87.98.178.100:6893 udp
N/A 87.98.178.101:6893 udp
N/A 87.98.178.102:6893 udp
N/A 87.98.178.103:6893 udp
N/A 87.98.178.104:6893 udp
N/A 87.98.178.105:6893 udp
N/A 87.98.178.106:6893 udp
N/A 87.98.178.107:6893 udp
N/A 87.98.178.108:6893 udp
N/A 87.98.178.109:6893 udp
N/A 87.98.178.110:6893 udp
N/A 87.98.178.111:6893 udp
N/A 87.98.178.112:6893 udp
N/A 87.98.178.113:6893 udp
N/A 87.98.178.114:6893 udp
N/A 87.98.178.115:6893 udp
N/A 87.98.178.116:6893 udp
N/A 87.98.178.117:6893 udp
N/A 87.98.178.118:6893 udp
N/A 87.98.178.119:6893 udp
N/A 87.98.178.120:6893 udp
N/A 87.98.178.121:6893 udp
N/A 87.98.178.122:6893 udp
N/A 87.98.178.123:6893 udp
N/A 87.98.178.124:6893 udp
N/A 87.98.178.125:6893 udp
N/A 87.98.178.126:6893 udp
N/A 87.98.178.127:6893 udp
N/A 87.98.178.128:6893 udp
N/A 87.98.178.129:6893 udp
N/A 87.98.178.130:6893 udp
N/A 87.98.178.131:6893 udp
N/A 87.98.178.132:6893 udp
N/A 87.98.178.133:6893 udp
N/A 87.98.178.134:6893 udp
N/A 87.98.178.135:6893 udp
N/A 87.98.178.136:6893 udp
N/A 87.98.178.137:6893 udp
N/A 87.98.178.138:6893 udp
N/A 87.98.178.139:6893 udp
N/A 87.98.178.140:6893 udp
N/A 87.98.178.141:6893 udp
N/A 87.98.178.142:6893 udp
N/A 87.98.178.143:6893 udp
N/A 87.98.178.144:6893 udp
N/A 87.98.178.145:6893 udp
N/A 87.98.178.146:6893 udp
N/A 87.98.178.147:6893 udp
N/A 87.98.178.148:6893 udp
N/A 87.98.178.149:6893 udp
N/A 87.98.178.150:6893 udp
N/A 87.98.178.151:6893 udp
N/A 87.98.178.152:6893 udp
N/A 87.98.178.153:6893 udp
N/A 87.98.178.154:6893 udp
N/A 87.98.178.155:6893 udp
N/A 87.98.178.156:6893 udp
N/A 87.98.178.157:6893 udp
N/A 87.98.178.158:6893 udp
N/A 87.98.178.159:6893 udp
N/A 87.98.178.160:6893 udp
N/A 87.98.178.161:6893 udp
N/A 87.98.178.162:6893 udp
N/A 87.98.178.163:6893 udp
N/A 87.98.178.164:6893 udp
N/A 87.98.178.165:6893 udp
N/A 87.98.178.166:6893 udp
N/A 87.98.178.167:6893 udp
N/A 87.98.178.168:6893 udp
N/A 87.98.178.169:6893 udp
N/A 87.98.178.170:6893 udp
N/A 87.98.178.171:6893 udp
N/A 87.98.178.172:6893 udp
N/A 87.98.178.173:6893 udp
N/A 87.98.178.174:6893 udp
N/A 87.98.178.175:6893 udp
N/A 87.98.178.176:6893 udp
N/A 87.98.178.177:6893 udp
N/A 87.98.178.178:6893 udp
N/A 87.98.178.179:6893 udp
N/A 87.98.178.180:6893 udp
N/A 87.98.178.181:6893 udp
N/A 87.98.178.182:6893 udp
N/A 87.98.178.183:6893 udp
N/A 87.98.178.184:6893 udp
N/A 87.98.178.185:6893 udp
N/A 87.98.178.186:6893 udp
N/A 87.98.178.187:6893 udp
N/A 87.98.178.188:6893 udp
N/A 87.98.178.189:6893 udp
N/A 87.98.178.190:6893 udp
N/A 87.98.178.191:6893 udp
N/A 87.98.178.192:6893 udp
N/A 87.98.178.193:6893 udp
N/A 87.98.178.194:6893 udp
N/A 87.98.178.195:6893 udp
N/A 87.98.178.196:6893 udp
N/A 87.98.178.197:6893 udp
N/A 87.98.178.198:6893 udp
N/A 87.98.178.199:6893 udp
N/A 87.98.178.200:6893 udp
N/A 87.98.178.201:6893 udp
N/A 87.98.178.202:6893 udp
N/A 87.98.178.203:6893 udp
N/A 87.98.178.204:6893 udp
N/A 87.98.178.205:6893 udp
N/A 87.98.178.206:6893 udp
N/A 87.98.178.207:6893 udp
N/A 87.98.178.208:6893 udp
N/A 87.98.178.209:6893 udp
N/A 87.98.178.210:6893 udp
N/A 87.98.178.211:6893 udp
N/A 87.98.178.212:6893 udp
N/A 87.98.178.213:6893 udp
N/A 87.98.178.214:6893 udp
N/A 87.98.178.215:6893 udp
N/A 87.98.178.216:6893 udp
N/A 87.98.178.217:6893 udp
N/A 87.98.178.218:6893 udp
N/A 87.98.178.219:6893 udp
N/A 87.98.178.220:6893 udp
N/A 87.98.178.221:6893 udp
N/A 87.98.178.222:6893 udp
N/A 87.98.178.223:6893 udp
N/A 87.98.178.224:6893 udp
N/A 87.98.178.225:6893 udp
N/A 87.98.178.226:6893 udp
N/A 87.98.178.227:6893 udp
N/A 87.98.178.228:6893 udp
N/A 87.98.178.229:6893 udp
N/A 87.98.178.230:6893 udp
N/A 87.98.178.231:6893 udp
N/A 87.98.178.232:6893 udp
N/A 87.98.178.233:6893 udp
N/A 87.98.178.234:6893 udp
N/A 87.98.178.235:6893 udp
N/A 87.98.178.236:6893 udp
N/A 87.98.178.237:6893 udp
N/A 87.98.178.238:6893 udp
N/A 87.98.178.239:6893 udp
N/A 87.98.178.240:6893 udp
N/A 87.98.178.241:6893 udp
N/A 87.98.178.242:6893 udp
N/A 87.98.178.243:6893 udp
N/A 87.98.178.244:6893 udp
N/A 87.98.178.245:6893 udp
N/A 87.98.178.246:6893 udp
N/A 87.98.178.247:6893 udp
N/A 87.98.178.248:6893 udp
N/A 87.98.178.249:6893 udp
N/A 87.98.178.250:6893 udp
N/A 87.98.178.251:6893 udp
N/A 87.98.178.252:6893 udp
N/A 87.98.178.253:6893 udp
N/A 87.98.178.254:6893 udp
N/A 87.98.178.255:6893 udp
N/A 87.98.179.0:6893 udp
N/A 87.98.179.1:6893 udp
N/A 87.98.179.2:6893 udp
N/A 87.98.179.3:6893 udp
N/A 87.98.179.4:6893 udp
N/A 87.98.179.5:6893 udp
N/A 87.98.179.6:6893 udp
N/A 87.98.179.7:6893 udp
N/A 87.98.179.8:6893 udp
N/A 87.98.179.9:6893 udp
N/A 87.98.179.10:6893 udp
N/A 87.98.179.11:6893 udp
N/A 87.98.179.12:6893 udp
N/A 87.98.179.13:6893 udp
N/A 87.98.179.14:6893 udp
N/A 87.98.179.15:6893 udp
N/A 87.98.179.16:6893 udp
N/A 87.98.179.17:6893 udp
N/A 87.98.179.18:6893 udp
N/A 87.98.179.19:6893 udp
N/A 87.98.179.20:6893 udp
N/A 87.98.179.21:6893 udp
N/A 87.98.179.22:6893 udp
N/A 87.98.179.23:6893 udp
N/A 87.98.179.24:6893 udp
N/A 87.98.179.25:6893 udp
N/A 87.98.179.26:6893 udp
N/A 87.98.179.27:6893 udp
N/A 87.98.179.28:6893 udp
N/A 87.98.179.29:6893 udp
N/A 87.98.179.30:6893 udp
N/A 87.98.179.31:6893 udp
N/A 87.98.179.32:6893 udp
N/A 87.98.179.33:6893 udp
N/A 87.98.179.34:6893 udp
N/A 87.98.179.35:6893 udp
N/A 87.98.179.36:6893 udp
N/A 87.98.179.37:6893 udp
N/A 87.98.179.38:6893 udp
N/A 87.98.179.39:6893 udp
N/A 87.98.179.40:6893 udp
N/A 87.98.179.41:6893 udp
N/A 87.98.179.42:6893 udp
N/A 87.98.179.43:6893 udp
N/A 87.98.179.44:6893 udp
N/A 87.98.179.45:6893 udp
N/A 87.98.179.46:6893 udp
N/A 87.98.179.47:6893 udp
N/A 87.98.179.48:6893 udp
N/A 87.98.179.49:6893 udp
N/A 87.98.179.50:6893 udp
N/A 87.98.179.51:6893 udp
N/A 87.98.179.52:6893 udp
N/A 87.98.179.53:6893 udp
N/A 87.98.179.54:6893 udp
N/A 87.98.179.55:6893 udp
N/A 87.98.179.56:6893 udp
N/A 87.98.179.57:6893 udp
N/A 87.98.179.58:6893 udp
N/A 87.98.179.59:6893 udp
N/A 87.98.179.60:6893 udp
N/A 87.98.179.61:6893 udp
N/A 87.98.179.62:6893 udp
N/A 87.98.179.63:6893 udp
N/A 87.98.179.64:6893 udp
N/A 87.98.179.65:6893 udp
N/A 87.98.179.66:6893 udp
N/A 87.98.179.67:6893 udp
N/A 87.98.179.68:6893 udp
N/A 87.98.179.69:6893 udp
N/A 87.98.179.70:6893 udp
N/A 87.98.179.71:6893 udp
N/A 87.98.179.72:6893 udp
N/A 87.98.179.73:6893 udp
N/A 87.98.179.74:6893 udp
N/A 87.98.179.75:6893 udp
N/A 87.98.179.76:6893 udp
N/A 87.98.179.77:6893 udp
N/A 87.98.179.78:6893 udp
N/A 87.98.179.79:6893 udp
N/A 87.98.179.80:6893 udp
N/A 87.98.179.81:6893 udp
N/A 87.98.179.82:6893 udp
N/A 87.98.179.83:6893 udp
N/A 87.98.179.84:6893 udp
N/A 87.98.179.85:6893 udp
N/A 87.98.179.86:6893 udp
N/A 87.98.179.87:6893 udp
N/A 87.98.179.88:6893 udp
N/A 87.98.179.89:6893 udp
N/A 87.98.179.90:6893 udp
N/A 87.98.179.91:6893 udp
N/A 87.98.179.92:6893 udp
N/A 87.98.179.93:6893 udp
N/A 87.98.179.94:6893 udp
N/A 87.98.179.95:6893 udp
N/A 87.98.179.96:6893 udp
N/A 87.98.179.97:6893 udp
N/A 87.98.179.98:6893 udp
N/A 87.98.179.99:6893 udp
N/A 87.98.179.100:6893 udp
N/A 87.98.179.101:6893 udp
N/A 87.98.179.102:6893 udp
N/A 87.98.179.103:6893 udp
N/A 87.98.179.104:6893 udp
N/A 87.98.179.105:6893 udp
N/A 87.98.179.106:6893 udp
N/A 87.98.179.107:6893 udp
N/A 87.98.179.108:6893 udp
N/A 87.98.179.109:6893 udp
N/A 87.98.179.110:6893 udp
N/A 87.98.179.111:6893 udp
N/A 87.98.179.112:6893 udp
N/A 87.98.179.113:6893 udp
N/A 87.98.179.114:6893 udp
N/A 87.98.179.115:6893 udp
N/A 87.98.179.116:6893 udp
N/A 87.98.179.117:6893 udp
N/A 87.98.179.118:6893 udp
N/A 87.98.179.119:6893 udp
N/A 87.98.179.120:6893 udp
N/A 87.98.179.121:6893 udp
N/A 87.98.179.122:6893 udp
N/A 87.98.179.123:6893 udp
N/A 87.98.179.124:6893 udp
N/A 87.98.179.125:6893 udp
N/A 87.98.179.126:6893 udp
N/A 87.98.179.127:6893 udp
N/A 87.98.179.128:6893 udp
N/A 87.98.179.129:6893 udp
N/A 87.98.179.130:6893 udp
N/A 87.98.179.131:6893 udp
N/A 87.98.179.132:6893 udp
N/A 87.98.179.133:6893 udp
N/A 87.98.179.134:6893 udp
N/A 87.98.179.135:6893 udp
N/A 87.98.179.136:6893 udp
N/A 87.98.179.137:6893 udp
N/A 87.98.179.138:6893 udp
N/A 87.98.179.139:6893 udp
N/A 87.98.179.140:6893 udp
N/A 87.98.179.141:6893 udp
N/A 87.98.179.142:6893 udp
N/A 87.98.179.143:6893 udp
N/A 87.98.179.144:6893 udp
N/A 87.98.179.145:6893 udp
N/A 87.98.179.146:6893 udp
N/A 87.98.179.147:6893 udp
N/A 87.98.179.148:6893 udp
N/A 87.98.179.149:6893 udp
N/A 87.98.179.150:6893 udp
N/A 87.98.179.151:6893 udp
N/A 87.98.179.152:6893 udp
N/A 87.98.179.153:6893 udp
N/A 87.98.179.154:6893 udp
N/A 87.98.179.155:6893 udp
N/A 87.98.179.156:6893 udp
N/A 87.98.179.157:6893 udp
N/A 87.98.179.158:6893 udp
N/A 87.98.179.159:6893 udp
N/A 87.98.179.160:6893 udp
N/A 87.98.179.161:6893 udp
N/A 87.98.179.162:6893 udp
N/A 87.98.179.163:6893 udp
N/A 87.98.179.164:6893 udp
N/A 87.98.179.165:6893 udp
N/A 87.98.179.166:6893 udp
N/A 87.98.179.167:6893 udp
N/A 87.98.179.168:6893 udp
N/A 87.98.179.169:6893 udp
N/A 87.98.179.170:6893 udp
N/A 87.98.179.171:6893 udp
N/A 87.98.179.172:6893 udp
N/A 87.98.179.173:6893 udp
N/A 87.98.179.174:6893 udp
N/A 87.98.179.175:6893 udp
N/A 87.98.179.176:6893 udp
N/A 87.98.179.177:6893 udp
N/A 87.98.179.178:6893 udp
N/A 87.98.179.179:6893 udp
N/A 87.98.179.180:6893 udp
N/A 87.98.179.181:6893 udp
N/A 87.98.179.182:6893 udp
N/A 87.98.179.183:6893 udp
N/A 87.98.179.184:6893 udp
N/A 87.98.179.185:6893 udp
N/A 87.98.179.186:6893 udp
N/A 87.98.179.187:6893 udp
N/A 87.98.179.188:6893 udp
N/A 87.98.179.189:6893 udp
N/A 87.98.179.190:6893 udp
N/A 87.98.179.191:6893 udp
N/A 87.98.179.192:6893 udp
N/A 87.98.179.193:6893 udp
N/A 87.98.179.194:6893 udp
N/A 87.98.179.195:6893 udp
N/A 87.98.179.196:6893 udp
N/A 87.98.179.197:6893 udp
N/A 87.98.179.198:6893 udp
N/A 87.98.179.199:6893 udp
N/A 87.98.179.200:6893 udp
N/A 87.98.179.201:6893 udp
N/A 87.98.179.202:6893 udp
N/A 87.98.179.203:6893 udp
N/A 87.98.179.204:6893 udp
N/A 87.98.179.205:6893 udp
N/A 87.98.179.206:6893 udp
N/A 87.98.179.207:6893 udp
N/A 87.98.179.208:6893 udp
N/A 87.98.179.209:6893 udp
N/A 87.98.179.210:6893 udp
N/A 87.98.179.211:6893 udp
N/A 87.98.179.212:6893 udp
N/A 87.98.179.213:6893 udp
N/A 87.98.179.214:6893 udp
N/A 87.98.179.215:6893 udp
N/A 87.98.179.216:6893 udp
N/A 87.98.179.217:6893 udp
N/A 87.98.179.218:6893 udp
N/A 87.98.179.219:6893 udp
N/A 87.98.179.220:6893 udp
N/A 87.98.179.221:6893 udp
N/A 87.98.179.222:6893 udp
N/A 87.98.179.223:6893 udp
N/A 87.98.179.224:6893 udp
N/A 87.98.179.225:6893 udp
N/A 87.98.179.226:6893 udp
N/A 87.98.179.227:6893 udp
N/A 87.98.179.228:6893 udp
N/A 87.98.179.229:6893 udp
N/A 87.98.179.230:6893 udp
N/A 87.98.179.231:6893 udp
N/A 87.98.179.232:6893 udp
N/A 87.98.179.233:6893 udp
N/A 87.98.179.234:6893 udp
N/A 87.98.179.235:6893 udp
N/A 87.98.179.236:6893 udp
N/A 87.98.179.237:6893 udp
N/A 87.98.179.238:6893 udp
N/A 87.98.179.239:6893 udp
N/A 87.98.179.240:6893 udp
N/A 87.98.179.241:6893 udp
N/A 87.98.179.242:6893 udp
N/A 87.98.179.243:6893 udp
N/A 87.98.179.244:6893 udp
N/A 87.98.179.245:6893 udp
N/A 87.98.179.246:6893 udp
N/A 87.98.179.247:6893 udp
N/A 87.98.179.248:6893 udp
N/A 87.98.179.249:6893 udp
N/A 87.98.179.250:6893 udp
N/A 87.98.179.251:6893 udp
N/A 87.98.179.252:6893 udp
N/A 87.98.179.253:6893 udp
N/A 87.98.179.254:6893 udp
N/A 87.98.179.255:6893 udp
N/A 8.8.8.8:53 api.blockcypher.com udp
N/A 172.67.2.88:80 api.blockcypher.com tcp
N/A 8.8.8.8:53 btc.blockr.io udp
N/A 8.8.8.8:53 bitaps.com udp
N/A 178.128.255.179:443 bitaps.com tcp
N/A 8.8.8.8:53 chain.so udp
N/A 104.24.105.254:443 chain.so tcp
N/A 8.8.8.8:53 sochain.com udp
N/A 172.67.69.167:443 sochain.com tcp
N/A 8.8.8.8:53 xpcx6erilkjced3j.14pxvn.top udp

Files

memory/4164-0-0x0000000000000000-mapping.dmp

memory/3180-1-0x0000000000000000-mapping.dmp

memory/2100-2-0x0000000000000000-mapping.dmp

memory/1868-3-0x0000000000000000-mapping.dmp

memory/4444-4-0x0000000000000000-mapping.dmp

memory/4520-5-0x0000000000000000-mapping.dmp

C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___GJJMBYWB_.hta

MD5 e53d5c72641b7dfe610ab4945c7aa773
SHA1 204c8d166f3f00e1745d394962bc1f26ab8b9779
SHA256 f1ad4a6fe2d1e88fe25b92c8a0c5e729f41bea8840f12c8ae431a19e7a3ee56b
SHA512 5cdd8a400bd85b3ef7cdb14cb18b21ddfd34d6d754a8b27dcfd4751d9d321009dd23b2277aef282ec2e1f0d41db8bab5521c610f098816cb834610a05ff2cf25

C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___BRS5T01_.txt

MD5 de50161acd5815741ab38b5c43cce5cf
SHA1 3b26b0c97162fff93d29af325124e9017c1a46dc
SHA256 df08f85b5d150c358e9e68005fa0c1c67ded373b95f91dedbaefe5cc2c826ebf
SHA512 37e54bf3bcefaaf7ec0d4e40964fa0278ebed6cb8cadce1ada2fb0abdbbe50ad1ef4cfaae505416eca7dc49a62491f16f8f6228d571cd740c095ab916d425f1c

memory/1296-8-0x0000000000000000-mapping.dmp