Malware Analysis Report

2025-01-02 15:03

Sample ID 201112-1msph2mg2s
Target eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d
SHA256 eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d
Tags
cerber ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d

Threat Level: Known bad

The file eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d was found to be: Known bad.

Malicious Activity Summary

cerber ransomware

Cerber

Blacklisted process makes network request

Drops startup file

Deletes itself

Loads dropped DLL

Sets desktop wallpaper using registry

Suspicious use of SetThreadContext

Drops file in Program Files directory

Drops file in Windows directory

Kills process with taskkill

Suspicious use of FindShellTrayWindow

Modifies Internet Explorer settings

Modifies system certificate store

Suspicious use of WriteProcessMemory

Suspicious behavior: MapViewOfSection

Modifies registry class

Runs ping.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2020-11-12 14:32

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2020-11-12 14:32

Reported

2020-11-12 15:58

Platform

win7v20201028

Max time kernel

150s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe"

Signatures

Cerber

ransomware cerber

Blacklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp5CDF.bmp" C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification \??\c:\program files (x86)\bitcoin C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\excel C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe N/A
File opened for modification \??\c:\program files (x86)\ C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\outlook C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe N/A
File opened for modification \??\c:\program files (x86)\onenote C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe N/A
File opened for modification \??\c:\program files (x86)\powerpoint C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe N/A
File opened for modification \??\c:\program files (x86)\steam C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe N/A
File opened for modification \??\c:\program files (x86)\thunderbird C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft sql server C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\office C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\powerpoint C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\word C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe N/A
File opened for modification \??\c:\program files (x86)\office C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe N/A
File opened for modification \??\c:\program files (x86)\outlook C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe N/A
File opened for modification \??\c:\program files (x86)\the bat! C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe N/A
File opened for modification \??\c:\program files (x86)\word C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\microsoft sql server C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe N/A
File opened for modification \??\c:\program files (x86)\excel C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\onenote C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe N/A
File opened for modification \??\c:\program files\ C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification \??\c:\windows\ C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\taskkill.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 C:\Windows\SysWOW64\mshta.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b0b000000010000001600000047006c006f00620061006c005300690067006e0000005300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802020f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 C:\Windows\SysWOW64\mshta.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C C:\Windows\SysWOW64\mshta.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\DllHost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1080 wrote to memory of 1484 N/A C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe
PID 1080 wrote to memory of 1484 N/A C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe
PID 1080 wrote to memory of 1484 N/A C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe
PID 1080 wrote to memory of 1484 N/A C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe
PID 1080 wrote to memory of 1484 N/A C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe
PID 1484 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe C:\Windows\SysWOW64\mshta.exe
PID 1484 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe C:\Windows\SysWOW64\mshta.exe
PID 1484 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe C:\Windows\SysWOW64\mshta.exe
PID 1484 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe C:\Windows\SysWOW64\mshta.exe
PID 1484 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe C:\Windows\system32\cmd.exe
PID 1484 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe C:\Windows\system32\cmd.exe
PID 1484 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe C:\Windows\system32\cmd.exe
PID 1484 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe C:\Windows\system32\cmd.exe
PID 2020 wrote to memory of 432 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2020 wrote to memory of 432 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2020 wrote to memory of 432 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2020 wrote to memory of 1216 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\PING.EXE
PID 2020 wrote to memory of 1216 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\PING.EXE
PID 2020 wrote to memory of 1216 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\PING.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe

"C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe"

C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe

"C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe"

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_SALT_README_.hta"

C:\Windows\SysWOW64\DllHost.exe

C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}

C:\Windows\SysWOW64\DllHost.exe

C:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\taskkill.exe

taskkill /f /im "eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe"

C:\Windows\system32\PING.EXE

ping -n 1 127.0.0.1

Network

Country Destination Domain Proto
N/A 15.44.20.0:6892 udp
N/A 15.44.20.1:6892 udp
N/A 15.44.20.2:6892 udp
N/A 15.44.20.3:6892 udp
N/A 15.44.20.4:6892 udp
N/A 15.44.20.5:6892 udp
N/A 15.44.20.6:6892 udp
N/A 15.44.20.7:6892 udp
N/A 15.44.20.8:6892 udp
N/A 15.44.20.9:6892 udp
N/A 15.44.20.10:6892 udp
N/A 15.44.20.11:6892 udp
N/A 15.44.20.12:6892 udp
N/A 15.44.20.13:6892 udp
N/A 15.44.20.14:6892 udp
N/A 15.44.20.15:6892 udp
N/A 15.44.20.16:6892 udp
N/A 15.44.20.17:6892 udp
N/A 15.44.20.18:6892 udp
N/A 15.44.20.19:6892 udp
N/A 15.44.20.20:6892 udp
N/A 15.44.20.21:6892 udp
N/A 15.44.20.22:6892 udp
N/A 15.44.20.23:6892 udp
N/A 15.44.20.24:6892 udp
N/A 15.44.20.25:6892 udp
N/A 15.44.20.26:6892 udp
N/A 15.44.20.27:6892 udp
N/A 15.44.20.28:6892 udp
N/A 15.44.20.29:6892 udp
N/A 15.44.20.30:6892 udp
N/A 15.44.20.31:6892 udp
N/A 16.43.12.0:6892 udp
N/A 16.43.12.1:6892 udp
N/A 16.43.12.2:6892 udp
N/A 16.43.12.3:6892 udp
N/A 16.43.12.4:6892 udp
N/A 16.43.12.5:6892 udp
N/A 16.43.12.6:6892 udp
N/A 16.43.12.7:6892 udp
N/A 16.43.12.8:6892 udp
N/A 16.43.12.9:6892 udp
N/A 16.43.12.10:6892 udp
N/A 16.43.12.11:6892 udp
N/A 16.43.12.12:6892 udp
N/A 16.43.12.13:6892 udp
N/A 16.43.12.14:6892 udp
N/A 16.43.12.15:6892 udp
N/A 16.43.12.16:6892 udp
N/A 16.43.12.17:6892 udp
N/A 16.43.12.18:6892 udp
N/A 16.43.12.19:6892 udp
N/A 16.43.12.20:6892 udp
N/A 16.43.12.21:6892 udp
N/A 16.43.12.22:6892 udp
N/A 16.43.12.23:6892 udp
N/A 16.43.12.24:6892 udp
N/A 16.43.12.25:6892 udp
N/A 16.43.12.26:6892 udp
N/A 16.43.12.27:6892 udp
N/A 16.43.12.28:6892 udp
N/A 16.43.12.29:6892 udp
N/A 16.43.12.30:6892 udp
N/A 16.43.12.31:6892 udp
N/A 91.239.24.0:6892 udp
N/A 91.239.24.1:6892 udp
N/A 91.239.24.2:6892 udp
N/A 91.239.24.3:6892 udp
N/A 91.239.24.4:6892 udp
N/A 91.239.24.5:6892 udp
N/A 91.239.24.6:6892 udp
N/A 91.239.24.7:6892 udp
N/A 91.239.24.8:6892 udp
N/A 91.239.24.9:6892 udp
N/A 91.239.24.10:6892 udp
N/A 91.239.24.11:6892 udp
N/A 91.239.24.12:6892 udp
N/A 91.239.24.13:6892 udp
N/A 91.239.24.14:6892 udp
N/A 91.239.24.15:6892 udp
N/A 91.239.24.16:6892 udp
N/A 91.239.24.17:6892 udp
N/A 91.239.24.18:6892 udp
N/A 91.239.24.19:6892 udp
N/A 91.239.24.20:6892 udp
N/A 91.239.24.21:6892 udp
N/A 91.239.24.22:6892 udp
N/A 91.239.24.23:6892 udp
N/A 91.239.24.24:6892 udp
N/A 91.239.24.25:6892 udp
N/A 91.239.24.26:6892 udp
N/A 91.239.24.27:6892 udp
N/A 91.239.24.28:6892 udp
N/A 91.239.24.29:6892 udp
N/A 91.239.24.30:6892 udp
N/A 91.239.24.31:6892 udp
N/A 91.239.24.32:6892 udp
N/A 91.239.24.33:6892 udp
N/A 91.239.24.34:6892 udp
N/A 91.239.24.35:6892 udp
N/A 91.239.24.36:6892 udp
N/A 91.239.24.37:6892 udp
N/A 91.239.24.38:6892 udp
N/A 91.239.24.39:6892 udp
N/A 91.239.24.40:6892 udp
N/A 91.239.24.41:6892 udp
N/A 91.239.24.42:6892 udp
N/A 91.239.24.43:6892 udp
N/A 91.239.24.44:6892 udp
N/A 91.239.24.45:6892 udp
N/A 91.239.24.46:6892 udp
N/A 91.239.24.47:6892 udp
N/A 91.239.24.48:6892 udp
N/A 91.239.24.49:6892 udp
N/A 91.239.24.50:6892 udp
N/A 91.239.24.51:6892 udp
N/A 91.239.24.52:6892 udp
N/A 91.239.24.53:6892 udp
N/A 91.239.24.54:6892 udp
N/A 91.239.24.55:6892 udp
N/A 91.239.24.56:6892 udp
N/A 91.239.24.57:6892 udp
N/A 91.239.24.58:6892 udp
N/A 91.239.24.59:6892 udp
N/A 91.239.24.60:6892 udp
N/A 91.239.24.61:6892 udp
N/A 91.239.24.62:6892 udp
N/A 91.239.24.63:6892 udp
N/A 91.239.24.64:6892 udp
N/A 91.239.24.65:6892 udp
N/A 91.239.24.66:6892 udp
N/A 91.239.24.67:6892 udp
N/A 91.239.24.68:6892 udp
N/A 91.239.24.69:6892 udp
N/A 91.239.24.70:6892 udp
N/A 91.239.24.71:6892 udp
N/A 91.239.24.72:6892 udp
N/A 91.239.24.73:6892 udp
N/A 91.239.24.74:6892 udp
N/A 91.239.24.75:6892 udp
N/A 91.239.24.76:6892 udp
N/A 91.239.24.77:6892 udp
N/A 91.239.24.78:6892 udp
N/A 91.239.24.79:6892 udp
N/A 91.239.24.80:6892 udp
N/A 91.239.24.81:6892 udp
N/A 91.239.24.82:6892 udp
N/A 91.239.24.83:6892 udp
N/A 91.239.24.84:6892 udp
N/A 91.239.24.85:6892 udp
N/A 91.239.24.86:6892 udp
N/A 91.239.24.87:6892 udp
N/A 91.239.24.88:6892 udp
N/A 91.239.24.89:6892 udp
N/A 91.239.24.90:6892 udp
N/A 91.239.24.91:6892 udp
N/A 91.239.24.92:6892 udp
N/A 91.239.24.93:6892 udp
N/A 91.239.24.94:6892 udp
N/A 91.239.24.95:6892 udp
N/A 91.239.24.96:6892 udp
N/A 91.239.24.97:6892 udp
N/A 91.239.24.98:6892 udp
N/A 91.239.24.99:6892 udp
N/A 91.239.24.100:6892 udp
N/A 91.239.24.101:6892 udp
N/A 91.239.24.102:6892 udp
N/A 91.239.24.103:6892 udp
N/A 91.239.24.104:6892 udp
N/A 91.239.24.105:6892 udp
N/A 91.239.24.106:6892 udp
N/A 91.239.24.107:6892 udp
N/A 91.239.24.108:6892 udp
N/A 91.239.24.109:6892 udp
N/A 91.239.24.110:6892 udp
N/A 91.239.24.111:6892 udp
N/A 91.239.24.112:6892 udp
N/A 91.239.24.113:6892 udp
N/A 91.239.24.114:6892 udp
N/A 91.239.24.115:6892 udp
N/A 91.239.24.116:6892 udp
N/A 91.239.24.117:6892 udp
N/A 91.239.24.118:6892 udp
N/A 91.239.24.119:6892 udp
N/A 91.239.24.120:6892 udp
N/A 91.239.24.121:6892 udp
N/A 91.239.24.122:6892 udp
N/A 91.239.24.123:6892 udp
N/A 91.239.24.124:6892 udp
N/A 91.239.24.125:6892 udp
N/A 91.239.24.126:6892 udp
N/A 91.239.24.127:6892 udp
N/A 91.239.24.128:6892 udp
N/A 91.239.24.129:6892 udp
N/A 91.239.24.130:6892 udp
N/A 91.239.24.131:6892 udp
N/A 91.239.24.132:6892 udp
N/A 91.239.24.133:6892 udp
N/A 91.239.24.134:6892 udp
N/A 91.239.24.135:6892 udp
N/A 91.239.24.136:6892 udp
N/A 91.239.24.137:6892 udp
N/A 91.239.24.138:6892 udp
N/A 91.239.24.139:6892 udp
N/A 91.239.24.140:6892 udp
N/A 91.239.24.141:6892 udp
N/A 91.239.24.142:6892 udp
N/A 91.239.24.143:6892 udp
N/A 91.239.24.144:6892 udp
N/A 91.239.24.145:6892 udp
N/A 91.239.24.146:6892 udp
N/A 91.239.24.147:6892 udp
N/A 91.239.24.148:6892 udp
N/A 91.239.24.149:6892 udp
N/A 91.239.24.150:6892 udp
N/A 91.239.24.151:6892 udp
N/A 91.239.24.152:6892 udp
N/A 91.239.24.153:6892 udp
N/A 91.239.24.154:6892 udp
N/A 91.239.24.155:6892 udp
N/A 91.239.24.156:6892 udp
N/A 91.239.24.157:6892 udp
N/A 91.239.24.158:6892 udp
N/A 91.239.24.159:6892 udp
N/A 91.239.24.160:6892 udp
N/A 91.239.24.161:6892 udp
N/A 91.239.24.162:6892 udp
N/A 91.239.24.163:6892 udp
N/A 91.239.24.164:6892 udp
N/A 91.239.24.165:6892 udp
N/A 91.239.24.166:6892 udp
N/A 91.239.24.167:6892 udp
N/A 91.239.24.168:6892 udp
N/A 91.239.24.169:6892 udp
N/A 91.239.24.170:6892 udp
N/A 91.239.24.171:6892 udp
N/A 91.239.24.172:6892 udp
N/A 91.239.24.173:6892 udp
N/A 91.239.24.174:6892 udp
N/A 91.239.24.175:6892 udp
N/A 91.239.24.176:6892 udp
N/A 91.239.24.177:6892 udp
N/A 91.239.24.178:6892 udp
N/A 91.239.24.179:6892 udp
N/A 91.239.24.180:6892 udp
N/A 91.239.24.181:6892 udp
N/A 91.239.24.182:6892 udp
N/A 91.239.24.183:6892 udp
N/A 91.239.24.184:6892 udp
N/A 91.239.24.185:6892 udp
N/A 91.239.24.186:6892 udp
N/A 91.239.24.187:6892 udp
N/A 91.239.24.188:6892 udp
N/A 91.239.24.189:6892 udp
N/A 91.239.24.190:6892 udp
N/A 91.239.24.191:6892 udp
N/A 91.239.24.192:6892 udp
N/A 91.239.24.193:6892 udp
N/A 91.239.24.194:6892 udp
N/A 91.239.24.195:6892 udp
N/A 91.239.24.196:6892 udp
N/A 91.239.24.197:6892 udp
N/A 91.239.24.198:6892 udp
N/A 91.239.24.199:6892 udp
N/A 91.239.24.200:6892 udp
N/A 91.239.24.201:6892 udp
N/A 91.239.24.202:6892 udp
N/A 91.239.24.203:6892 udp
N/A 91.239.24.204:6892 udp
N/A 91.239.24.205:6892 udp
N/A 91.239.24.206:6892 udp
N/A 91.239.24.207:6892 udp
N/A 91.239.24.208:6892 udp
N/A 91.239.24.209:6892 udp
N/A 91.239.24.210:6892 udp
N/A 91.239.24.211:6892 udp
N/A 91.239.24.212:6892 udp
N/A 91.239.24.213:6892 udp
N/A 91.239.24.214:6892 udp
N/A 91.239.24.215:6892 udp
N/A 91.239.24.216:6892 udp
N/A 91.239.24.217:6892 udp
N/A 91.239.24.218:6892 udp
N/A 91.239.24.219:6892 udp
N/A 91.239.24.220:6892 udp
N/A 91.239.24.221:6892 udp
N/A 91.239.24.222:6892 udp
N/A 91.239.24.223:6892 udp
N/A 91.239.24.224:6892 udp
N/A 91.239.24.225:6892 udp
N/A 91.239.24.226:6892 udp
N/A 91.239.24.227:6892 udp
N/A 91.239.24.228:6892 udp
N/A 91.239.24.229:6892 udp
N/A 91.239.24.230:6892 udp
N/A 91.239.24.231:6892 udp
N/A 91.239.24.232:6892 udp
N/A 91.239.24.233:6892 udp
N/A 91.239.24.234:6892 udp
N/A 91.239.24.235:6892 udp
N/A 91.239.24.236:6892 udp
N/A 91.239.24.237:6892 udp
N/A 91.239.24.238:6892 udp
N/A 91.239.24.239:6892 udp
N/A 91.239.24.240:6892 udp
N/A 91.239.24.241:6892 udp
N/A 91.239.24.242:6892 udp
N/A 91.239.24.243:6892 udp
N/A 91.239.24.244:6892 udp
N/A 91.239.24.245:6892 udp
N/A 91.239.24.246:6892 udp
N/A 91.239.24.247:6892 udp
N/A 91.239.24.248:6892 udp
N/A 91.239.24.249:6892 udp
N/A 91.239.24.250:6892 udp
N/A 91.239.24.251:6892 udp
N/A 91.239.24.252:6892 udp
N/A 91.239.24.253:6892 udp
N/A 91.239.24.254:6892 udp
N/A 91.239.24.255:6892 udp
N/A 91.239.25.0:6892 udp
N/A 91.239.25.1:6892 udp
N/A 91.239.25.2:6892 udp
N/A 91.239.25.3:6892 udp
N/A 91.239.25.4:6892 udp
N/A 91.239.25.5:6892 udp
N/A 91.239.25.6:6892 udp
N/A 91.239.25.7:6892 udp
N/A 91.239.25.8:6892 udp
N/A 91.239.25.9:6892 udp
N/A 91.239.25.10:6892 udp
N/A 91.239.25.11:6892 udp
N/A 91.239.25.12:6892 udp
N/A 91.239.25.13:6892 udp
N/A 91.239.25.14:6892 udp
N/A 91.239.25.15:6892 udp
N/A 91.239.25.16:6892 udp
N/A 91.239.25.17:6892 udp
N/A 91.239.25.18:6892 udp
N/A 91.239.25.19:6892 udp
N/A 91.239.25.20:6892 udp
N/A 91.239.25.21:6892 udp
N/A 91.239.25.22:6892 udp
N/A 91.239.25.23:6892 udp
N/A 91.239.25.24:6892 udp
N/A 91.239.25.25:6892 udp
N/A 91.239.25.26:6892 udp
N/A 91.239.25.27:6892 udp
N/A 91.239.25.28:6892 udp
N/A 91.239.25.29:6892 udp
N/A 91.239.25.30:6892 udp
N/A 91.239.25.31:6892 udp
N/A 91.239.25.32:6892 udp
N/A 91.239.25.33:6892 udp
N/A 91.239.25.34:6892 udp
N/A 91.239.25.35:6892 udp
N/A 91.239.25.36:6892 udp
N/A 91.239.25.37:6892 udp
N/A 91.239.25.38:6892 udp
N/A 91.239.25.39:6892 udp
N/A 91.239.25.40:6892 udp
N/A 91.239.25.41:6892 udp
N/A 91.239.25.42:6892 udp
N/A 91.239.25.43:6892 udp
N/A 91.239.25.44:6892 udp
N/A 91.239.25.45:6892 udp
N/A 91.239.25.46:6892 udp
N/A 91.239.25.47:6892 udp
N/A 91.239.25.48:6892 udp
N/A 91.239.25.49:6892 udp
N/A 91.239.25.50:6892 udp
N/A 91.239.25.51:6892 udp
N/A 91.239.25.52:6892 udp
N/A 91.239.25.53:6892 udp
N/A 91.239.25.54:6892 udp
N/A 91.239.25.55:6892 udp
N/A 91.239.25.56:6892 udp
N/A 91.239.25.57:6892 udp
N/A 91.239.25.58:6892 udp
N/A 91.239.25.59:6892 udp
N/A 91.239.25.60:6892 udp
N/A 91.239.25.61:6892 udp
N/A 91.239.25.62:6892 udp
N/A 91.239.25.63:6892 udp
N/A 91.239.25.64:6892 udp
N/A 91.239.25.65:6892 udp
N/A 91.239.25.66:6892 udp
N/A 91.239.25.67:6892 udp
N/A 91.239.25.68:6892 udp
N/A 91.239.25.69:6892 udp
N/A 91.239.25.70:6892 udp
N/A 91.239.25.71:6892 udp
N/A 91.239.25.72:6892 udp
N/A 91.239.25.73:6892 udp
N/A 91.239.25.74:6892 udp
N/A 91.239.25.75:6892 udp
N/A 91.239.25.76:6892 udp
N/A 91.239.25.77:6892 udp
N/A 91.239.25.78:6892 udp
N/A 91.239.25.79:6892 udp
N/A 91.239.25.80:6892 udp
N/A 91.239.25.81:6892 udp
N/A 91.239.25.82:6892 udp
N/A 91.239.25.83:6892 udp
N/A 91.239.25.84:6892 udp
N/A 91.239.25.85:6892 udp
N/A 91.239.25.86:6892 udp
N/A 91.239.25.87:6892 udp
N/A 91.239.25.88:6892 udp
N/A 91.239.25.89:6892 udp
N/A 91.239.25.90:6892 udp
N/A 91.239.25.91:6892 udp
N/A 91.239.25.92:6892 udp
N/A 91.239.25.93:6892 udp
N/A 91.239.25.94:6892 udp
N/A 91.239.25.95:6892 udp
N/A 91.239.25.96:6892 udp
N/A 91.239.25.97:6892 udp
N/A 91.239.25.98:6892 udp
N/A 91.239.25.99:6892 udp
N/A 91.239.25.100:6892 udp
N/A 91.239.25.101:6892 udp
N/A 91.239.25.102:6892 udp
N/A 91.239.25.103:6892 udp
N/A 91.239.25.104:6892 udp
N/A 91.239.25.105:6892 udp
N/A 91.239.25.106:6892 udp
N/A 91.239.25.107:6892 udp
N/A 91.239.25.108:6892 udp
N/A 91.239.25.109:6892 udp
N/A 91.239.25.110:6892 udp
N/A 91.239.25.111:6892 udp
N/A 91.239.25.112:6892 udp
N/A 91.239.25.113:6892 udp
N/A 91.239.25.114:6892 udp
N/A 91.239.25.115:6892 udp
N/A 91.239.25.116:6892 udp
N/A 91.239.25.117:6892 udp
N/A 91.239.25.118:6892 udp
N/A 91.239.25.119:6892 udp
N/A 91.239.25.120:6892 udp
N/A 91.239.25.121:6892 udp
N/A 91.239.25.122:6892 udp
N/A 91.239.25.123:6892 udp
N/A 91.239.25.124:6892 udp
N/A 91.239.25.125:6892 udp
N/A 91.239.25.126:6892 udp
N/A 91.239.25.127:6892 udp
N/A 91.239.25.128:6892 udp
N/A 91.239.25.129:6892 udp
N/A 91.239.25.130:6892 udp
N/A 91.239.25.131:6892 udp
N/A 91.239.25.132:6892 udp
N/A 91.239.25.133:6892 udp
N/A 91.239.25.134:6892 udp
N/A 91.239.25.135:6892 udp
N/A 91.239.25.136:6892 udp
N/A 91.239.25.137:6892 udp
N/A 91.239.25.138:6892 udp
N/A 91.239.25.139:6892 udp
N/A 91.239.25.140:6892 udp
N/A 91.239.25.141:6892 udp
N/A 91.239.25.142:6892 udp
N/A 91.239.25.143:6892 udp
N/A 91.239.25.144:6892 udp
N/A 91.239.25.145:6892 udp
N/A 91.239.25.146:6892 udp
N/A 91.239.25.147:6892 udp
N/A 91.239.25.148:6892 udp
N/A 91.239.25.149:6892 udp
N/A 91.239.25.150:6892 udp
N/A 91.239.25.151:6892 udp
N/A 91.239.25.152:6892 udp
N/A 91.239.25.153:6892 udp
N/A 91.239.25.154:6892 udp
N/A 91.239.25.155:6892 udp
N/A 91.239.25.156:6892 udp
N/A 91.239.25.157:6892 udp
N/A 91.239.25.158:6892 udp
N/A 91.239.25.159:6892 udp
N/A 91.239.25.160:6892 udp
N/A 91.239.25.161:6892 udp
N/A 91.239.25.162:6892 udp
N/A 91.239.25.163:6892 udp
N/A 91.239.25.164:6892 udp
N/A 91.239.25.165:6892 udp
N/A 91.239.25.166:6892 udp
N/A 91.239.25.167:6892 udp
N/A 91.239.25.168:6892 udp
N/A 91.239.25.169:6892 udp
N/A 91.239.25.170:6892 udp
N/A 91.239.25.171:6892 udp
N/A 91.239.25.172:6892 udp
N/A 91.239.25.173:6892 udp
N/A 91.239.25.174:6892 udp
N/A 91.239.25.175:6892 udp
N/A 91.239.25.176:6892 udp
N/A 91.239.25.177:6892 udp
N/A 91.239.25.178:6892 udp
N/A 91.239.25.179:6892 udp
N/A 91.239.25.180:6892 udp
N/A 91.239.25.181:6892 udp
N/A 91.239.25.182:6892 udp
N/A 91.239.25.183:6892 udp
N/A 91.239.25.184:6892 udp
N/A 91.239.25.185:6892 udp
N/A 91.239.25.186:6892 udp
N/A 91.239.25.187:6892 udp
N/A 91.239.25.188:6892 udp
N/A 91.239.25.189:6892 udp
N/A 91.239.25.190:6892 udp
N/A 91.239.25.191:6892 udp
N/A 91.239.25.192:6892 udp
N/A 91.239.25.193:6892 udp
N/A 91.239.25.194:6892 udp
N/A 91.239.25.195:6892 udp
N/A 91.239.25.196:6892 udp
N/A 91.239.25.197:6892 udp
N/A 91.239.25.198:6892 udp
N/A 91.239.25.199:6892 udp
N/A 91.239.25.200:6892 udp
N/A 91.239.25.201:6892 udp
N/A 91.239.25.202:6892 udp
N/A 91.239.25.203:6892 udp
N/A 91.239.25.204:6892 udp
N/A 91.239.25.205:6892 udp
N/A 91.239.25.206:6892 udp
N/A 91.239.25.207:6892 udp
N/A 91.239.25.208:6892 udp
N/A 91.239.25.209:6892 udp
N/A 91.239.25.210:6892 udp
N/A 91.239.25.211:6892 udp
N/A 91.239.25.212:6892 udp
N/A 91.239.25.213:6892 udp
N/A 91.239.25.214:6892 udp
N/A 91.239.25.215:6892 udp
N/A 91.239.25.216:6892 udp
N/A 91.239.25.217:6892 udp
N/A 91.239.25.218:6892 udp
N/A 91.239.25.219:6892 udp
N/A 91.239.25.220:6892 udp
N/A 91.239.25.221:6892 udp
N/A 91.239.25.222:6892 udp
N/A 91.239.25.223:6892 udp
N/A 91.239.25.224:6892 udp
N/A 91.239.25.225:6892 udp
N/A 91.239.25.226:6892 udp
N/A 91.239.25.227:6892 udp
N/A 91.239.25.228:6892 udp
N/A 91.239.25.229:6892 udp
N/A 91.239.25.230:6892 udp
N/A 91.239.25.231:6892 udp
N/A 91.239.25.232:6892 udp
N/A 91.239.25.233:6892 udp
N/A 91.239.25.234:6892 udp
N/A 91.239.25.235:6892 udp
N/A 91.239.25.236:6892 udp
N/A 91.239.25.237:6892 udp
N/A 91.239.25.238:6892 udp
N/A 91.239.25.239:6892 udp
N/A 91.239.25.240:6892 udp
N/A 91.239.25.241:6892 udp
N/A 91.239.25.242:6892 udp
N/A 91.239.25.243:6892 udp
N/A 91.239.25.244:6892 udp
N/A 91.239.25.245:6892 udp
N/A 91.239.25.246:6892 udp
N/A 91.239.25.247:6892 udp
N/A 91.239.25.248:6892 udp
N/A 91.239.25.249:6892 udp
N/A 91.239.25.250:6892 udp
N/A 91.239.25.251:6892 udp
N/A 91.239.25.252:6892 udp
N/A 91.239.25.253:6892 udp
N/A 91.239.25.254:6892 udp
N/A 91.239.25.255:6892 udp
N/A 15.44.20.0:6892 udp
N/A 15.44.20.1:6892 udp
N/A 15.44.20.2:6892 udp
N/A 15.44.20.3:6892 udp
N/A 15.44.20.4:6892 udp
N/A 15.44.20.5:6892 udp
N/A 15.44.20.6:6892 udp
N/A 15.44.20.7:6892 udp
N/A 15.44.20.8:6892 udp
N/A 15.44.20.9:6892 udp
N/A 15.44.20.10:6892 udp
N/A 15.44.20.11:6892 udp
N/A 15.44.20.12:6892 udp
N/A 15.44.20.13:6892 udp
N/A 15.44.20.14:6892 udp
N/A 15.44.20.15:6892 udp
N/A 15.44.20.16:6892 udp
N/A 15.44.20.17:6892 udp
N/A 15.44.20.18:6892 udp
N/A 15.44.20.19:6892 udp
N/A 15.44.20.20:6892 udp
N/A 15.44.20.21:6892 udp
N/A 15.44.20.22:6892 udp
N/A 15.44.20.23:6892 udp
N/A 15.44.20.24:6892 udp
N/A 15.44.20.25:6892 udp
N/A 15.44.20.26:6892 udp
N/A 15.44.20.27:6892 udp
N/A 15.44.20.28:6892 udp
N/A 15.44.20.29:6892 udp
N/A 15.44.20.30:6892 udp
N/A 15.44.20.31:6892 udp
N/A 16.43.12.0:6892 udp
N/A 16.43.12.1:6892 udp
N/A 16.43.12.2:6892 udp
N/A 16.43.12.3:6892 udp
N/A 16.43.12.4:6892 udp
N/A 16.43.12.5:6892 udp
N/A 16.43.12.6:6892 udp
N/A 16.43.12.7:6892 udp
N/A 16.43.12.8:6892 udp
N/A 16.43.12.9:6892 udp
N/A 16.43.12.10:6892 udp
N/A 16.43.12.11:6892 udp
N/A 16.43.12.12:6892 udp
N/A 16.43.12.13:6892 udp
N/A 16.43.12.14:6892 udp
N/A 16.43.12.15:6892 udp
N/A 16.43.12.16:6892 udp
N/A 16.43.12.17:6892 udp
N/A 16.43.12.18:6892 udp
N/A 16.43.12.19:6892 udp
N/A 16.43.12.20:6892 udp
N/A 16.43.12.21:6892 udp
N/A 16.43.12.22:6892 udp
N/A 16.43.12.23:6892 udp
N/A 16.43.12.24:6892 udp
N/A 16.43.12.25:6892 udp
N/A 16.43.12.26:6892 udp
N/A 16.43.12.27:6892 udp
N/A 16.43.12.28:6892 udp
N/A 16.43.12.29:6892 udp
N/A 16.43.12.30:6892 udp
N/A 16.43.12.31:6892 udp
N/A 91.239.24.0:6892 udp
N/A 91.239.24.1:6892 udp
N/A 91.239.24.2:6892 udp
N/A 91.239.24.3:6892 udp
N/A 91.239.24.4:6892 udp
N/A 91.239.24.5:6892 udp
N/A 91.239.24.6:6892 udp
N/A 91.239.24.7:6892 udp
N/A 91.239.24.8:6892 udp
N/A 91.239.24.9:6892 udp
N/A 91.239.24.10:6892 udp
N/A 91.239.24.11:6892 udp
N/A 91.239.24.12:6892 udp
N/A 91.239.24.13:6892 udp
N/A 91.239.24.14:6892 udp
N/A 91.239.24.15:6892 udp
N/A 91.239.24.16:6892 udp
N/A 91.239.24.17:6892 udp
N/A 91.239.24.18:6892 udp
N/A 91.239.24.19:6892 udp
N/A 91.239.24.20:6892 udp
N/A 91.239.24.21:6892 udp
N/A 91.239.24.22:6892 udp
N/A 91.239.24.23:6892 udp
N/A 91.239.24.24:6892 udp
N/A 91.239.24.25:6892 udp
N/A 91.239.24.26:6892 udp
N/A 91.239.24.27:6892 udp
N/A 91.239.24.28:6892 udp
N/A 91.239.24.29:6892 udp
N/A 91.239.24.30:6892 udp
N/A 91.239.24.31:6892 udp
N/A 91.239.24.32:6892 udp
N/A 91.239.24.33:6892 udp
N/A 91.239.24.34:6892 udp
N/A 91.239.24.35:6892 udp
N/A 91.239.24.36:6892 udp
N/A 91.239.24.37:6892 udp
N/A 91.239.24.38:6892 udp
N/A 91.239.24.39:6892 udp
N/A 91.239.24.40:6892 udp
N/A 91.239.24.41:6892 udp
N/A 91.239.24.42:6892 udp
N/A 91.239.24.43:6892 udp
N/A 91.239.24.44:6892 udp
N/A 91.239.24.45:6892 udp
N/A 91.239.24.46:6892 udp
N/A 91.239.24.47:6892 udp
N/A 91.239.24.48:6892 udp
N/A 91.239.24.49:6892 udp
N/A 91.239.24.50:6892 udp
N/A 91.239.24.51:6892 udp
N/A 91.239.24.52:6892 udp
N/A 91.239.24.53:6892 udp
N/A 91.239.24.54:6892 udp
N/A 91.239.24.55:6892 udp
N/A 91.239.24.56:6892 udp
N/A 91.239.24.57:6892 udp
N/A 91.239.24.58:6892 udp
N/A 91.239.24.59:6892 udp
N/A 91.239.24.60:6892 udp
N/A 91.239.24.61:6892 udp
N/A 91.239.24.62:6892 udp
N/A 91.239.24.63:6892 udp
N/A 91.239.24.64:6892 udp
N/A 91.239.24.65:6892 udp
N/A 91.239.24.66:6892 udp
N/A 91.239.24.67:6892 udp
N/A 91.239.24.68:6892 udp
N/A 91.239.24.69:6892 udp
N/A 91.239.24.70:6892 udp
N/A 91.239.24.71:6892 udp
N/A 91.239.24.72:6892 udp
N/A 91.239.24.73:6892 udp
N/A 91.239.24.74:6892 udp
N/A 91.239.24.75:6892 udp
N/A 91.239.24.76:6892 udp
N/A 91.239.24.77:6892 udp
N/A 91.239.24.78:6892 udp
N/A 91.239.24.79:6892 udp
N/A 91.239.24.80:6892 udp
N/A 91.239.24.81:6892 udp
N/A 91.239.24.82:6892 udp
N/A 91.239.24.83:6892 udp
N/A 91.239.24.84:6892 udp
N/A 91.239.24.85:6892 udp
N/A 91.239.24.86:6892 udp
N/A 91.239.24.87:6892 udp
N/A 91.239.24.88:6892 udp
N/A 91.239.24.89:6892 udp
N/A 91.239.24.90:6892 udp
N/A 91.239.24.91:6892 udp
N/A 91.239.24.92:6892 udp
N/A 91.239.24.93:6892 udp
N/A 91.239.24.94:6892 udp
N/A 91.239.24.95:6892 udp
N/A 91.239.24.96:6892 udp
N/A 91.239.24.97:6892 udp
N/A 91.239.24.98:6892 udp
N/A 91.239.24.99:6892 udp
N/A 91.239.24.100:6892 udp
N/A 91.239.24.101:6892 udp
N/A 91.239.24.102:6892 udp
N/A 91.239.24.103:6892 udp
N/A 91.239.24.104:6892 udp
N/A 91.239.24.105:6892 udp
N/A 91.239.24.106:6892 udp
N/A 91.239.24.107:6892 udp
N/A 91.239.24.108:6892 udp
N/A 91.239.24.109:6892 udp
N/A 91.239.24.110:6892 udp
N/A 91.239.24.111:6892 udp
N/A 91.239.24.112:6892 udp
N/A 91.239.24.113:6892 udp
N/A 91.239.24.114:6892 udp
N/A 91.239.24.115:6892 udp
N/A 91.239.24.116:6892 udp
N/A 91.239.24.117:6892 udp
N/A 91.239.24.118:6892 udp
N/A 91.239.24.119:6892 udp
N/A 91.239.24.120:6892 udp
N/A 91.239.24.121:6892 udp
N/A 91.239.24.122:6892 udp
N/A 91.239.24.123:6892 udp
N/A 91.239.24.124:6892 udp
N/A 91.239.24.125:6892 udp
N/A 91.239.24.126:6892 udp
N/A 91.239.24.127:6892 udp
N/A 91.239.24.128:6892 udp
N/A 91.239.24.129:6892 udp
N/A 91.239.24.130:6892 udp
N/A 91.239.24.131:6892 udp
N/A 91.239.24.132:6892 udp
N/A 91.239.24.133:6892 udp
N/A 91.239.24.134:6892 udp
N/A 91.239.24.135:6892 udp
N/A 91.239.24.136:6892 udp
N/A 91.239.24.137:6892 udp
N/A 91.239.24.138:6892 udp
N/A 91.239.24.139:6892 udp
N/A 91.239.24.140:6892 udp
N/A 91.239.24.141:6892 udp
N/A 91.239.24.142:6892 udp
N/A 91.239.24.143:6892 udp
N/A 91.239.24.144:6892 udp
N/A 91.239.24.145:6892 udp
N/A 91.239.24.146:6892 udp
N/A 91.239.24.147:6892 udp
N/A 91.239.24.148:6892 udp
N/A 91.239.24.149:6892 udp
N/A 91.239.24.150:6892 udp
N/A 91.239.24.151:6892 udp
N/A 91.239.24.152:6892 udp
N/A 91.239.24.153:6892 udp
N/A 91.239.24.154:6892 udp
N/A 91.239.24.155:6892 udp
N/A 91.239.24.156:6892 udp
N/A 91.239.24.157:6892 udp
N/A 91.239.24.158:6892 udp
N/A 91.239.24.159:6892 udp
N/A 91.239.24.160:6892 udp
N/A 91.239.24.161:6892 udp
N/A 91.239.24.162:6892 udp
N/A 91.239.24.163:6892 udp
N/A 91.239.24.164:6892 udp
N/A 91.239.24.165:6892 udp
N/A 91.239.24.166:6892 udp
N/A 91.239.24.167:6892 udp
N/A 91.239.24.168:6892 udp
N/A 91.239.24.169:6892 udp
N/A 91.239.24.170:6892 udp
N/A 91.239.24.171:6892 udp
N/A 91.239.24.172:6892 udp
N/A 91.239.24.173:6892 udp
N/A 91.239.24.174:6892 udp
N/A 91.239.24.175:6892 udp
N/A 91.239.24.176:6892 udp
N/A 91.239.24.177:6892 udp
N/A 91.239.24.178:6892 udp
N/A 91.239.24.179:6892 udp
N/A 91.239.24.180:6892 udp
N/A 91.239.24.181:6892 udp
N/A 91.239.24.182:6892 udp
N/A 91.239.24.183:6892 udp
N/A 91.239.24.184:6892 udp
N/A 91.239.24.185:6892 udp
N/A 91.239.24.186:6892 udp
N/A 91.239.24.187:6892 udp
N/A 91.239.24.188:6892 udp
N/A 91.239.24.189:6892 udp
N/A 91.239.24.190:6892 udp
N/A 91.239.24.191:6892 udp
N/A 91.239.24.192:6892 udp
N/A 91.239.24.193:6892 udp
N/A 91.239.24.194:6892 udp
N/A 91.239.24.195:6892 udp
N/A 91.239.24.196:6892 udp
N/A 91.239.24.197:6892 udp
N/A 91.239.24.198:6892 udp
N/A 91.239.24.199:6892 udp
N/A 91.239.24.200:6892 udp
N/A 91.239.24.201:6892 udp
N/A 91.239.24.202:6892 udp
N/A 91.239.24.203:6892 udp
N/A 91.239.24.204:6892 udp
N/A 91.239.24.205:6892 udp
N/A 91.239.24.206:6892 udp
N/A 91.239.24.207:6892 udp
N/A 91.239.24.208:6892 udp
N/A 91.239.24.209:6892 udp
N/A 91.239.24.210:6892 udp
N/A 91.239.24.211:6892 udp
N/A 91.239.24.212:6892 udp
N/A 91.239.24.213:6892 udp
N/A 91.239.24.214:6892 udp
N/A 91.239.24.215:6892 udp
N/A 91.239.24.216:6892 udp
N/A 91.239.24.217:6892 udp
N/A 91.239.24.218:6892 udp
N/A 91.239.24.219:6892 udp
N/A 91.239.24.220:6892 udp
N/A 91.239.24.221:6892 udp
N/A 91.239.24.222:6892 udp
N/A 91.239.24.223:6892 udp
N/A 91.239.24.224:6892 udp
N/A 91.239.24.225:6892 udp
N/A 91.239.24.226:6892 udp
N/A 91.239.24.227:6892 udp
N/A 91.239.24.228:6892 udp
N/A 91.239.24.229:6892 udp
N/A 91.239.24.230:6892 udp
N/A 91.239.24.231:6892 udp
N/A 91.239.24.232:6892 udp
N/A 91.239.24.233:6892 udp
N/A 91.239.24.234:6892 udp
N/A 91.239.24.235:6892 udp
N/A 91.239.24.236:6892 udp
N/A 91.239.24.237:6892 udp
N/A 91.239.24.238:6892 udp
N/A 91.239.24.239:6892 udp
N/A 91.239.24.240:6892 udp
N/A 91.239.24.241:6892 udp
N/A 91.239.24.242:6892 udp
N/A 91.239.24.243:6892 udp
N/A 91.239.24.244:6892 udp
N/A 91.239.24.245:6892 udp
N/A 91.239.24.246:6892 udp
N/A 91.239.24.247:6892 udp
N/A 91.239.24.248:6892 udp
N/A 91.239.24.249:6892 udp
N/A 91.239.24.250:6892 udp
N/A 91.239.24.251:6892 udp
N/A 91.239.24.252:6892 udp
N/A 91.239.24.253:6892 udp
N/A 91.239.24.254:6892 udp
N/A 91.239.24.255:6892 udp
N/A 91.239.25.0:6892 udp
N/A 91.239.25.1:6892 udp
N/A 91.239.25.2:6892 udp
N/A 91.239.25.3:6892 udp
N/A 91.239.25.4:6892 udp
N/A 91.239.25.5:6892 udp
N/A 91.239.25.6:6892 udp
N/A 91.239.25.7:6892 udp
N/A 91.239.25.8:6892 udp
N/A 91.239.25.9:6892 udp
N/A 91.239.25.10:6892 udp
N/A 91.239.25.11:6892 udp
N/A 91.239.25.12:6892 udp
N/A 91.239.25.13:6892 udp
N/A 91.239.25.14:6892 udp
N/A 91.239.25.15:6892 udp
N/A 91.239.25.16:6892 udp
N/A 91.239.25.17:6892 udp
N/A 91.239.25.18:6892 udp
N/A 91.239.25.19:6892 udp
N/A 91.239.25.20:6892 udp
N/A 91.239.25.21:6892 udp
N/A 91.239.25.22:6892 udp
N/A 91.239.25.23:6892 udp
N/A 91.239.25.24:6892 udp
N/A 91.239.25.25:6892 udp
N/A 91.239.25.26:6892 udp
N/A 91.239.25.27:6892 udp
N/A 91.239.25.28:6892 udp
N/A 91.239.25.29:6892 udp
N/A 91.239.25.30:6892 udp
N/A 91.239.25.31:6892 udp
N/A 91.239.25.32:6892 udp
N/A 91.239.25.33:6892 udp
N/A 91.239.25.34:6892 udp
N/A 91.239.25.35:6892 udp
N/A 91.239.25.36:6892 udp
N/A 91.239.25.37:6892 udp
N/A 91.239.25.38:6892 udp
N/A 91.239.25.39:6892 udp
N/A 91.239.25.40:6892 udp
N/A 91.239.25.41:6892 udp
N/A 91.239.25.42:6892 udp
N/A 91.239.25.43:6892 udp
N/A 91.239.25.44:6892 udp
N/A 91.239.25.45:6892 udp
N/A 91.239.25.46:6892 udp
N/A 91.239.25.47:6892 udp
N/A 91.239.25.48:6892 udp
N/A 91.239.25.49:6892 udp
N/A 91.239.25.50:6892 udp
N/A 91.239.25.51:6892 udp
N/A 91.239.25.52:6892 udp
N/A 91.239.25.53:6892 udp
N/A 91.239.25.54:6892 udp
N/A 91.239.25.55:6892 udp
N/A 91.239.25.56:6892 udp
N/A 91.239.25.57:6892 udp
N/A 91.239.25.58:6892 udp
N/A 91.239.25.59:6892 udp
N/A 91.239.25.60:6892 udp
N/A 91.239.25.61:6892 udp
N/A 91.239.25.62:6892 udp
N/A 91.239.25.63:6892 udp
N/A 91.239.25.64:6892 udp
N/A 91.239.25.65:6892 udp
N/A 91.239.25.66:6892 udp
N/A 91.239.25.67:6892 udp
N/A 91.239.25.68:6892 udp
N/A 91.239.25.69:6892 udp
N/A 91.239.25.70:6892 udp
N/A 91.239.25.71:6892 udp
N/A 91.239.25.72:6892 udp
N/A 91.239.25.73:6892 udp
N/A 91.239.25.74:6892 udp
N/A 91.239.25.75:6892 udp
N/A 91.239.25.76:6892 udp
N/A 91.239.25.77:6892 udp
N/A 91.239.25.78:6892 udp
N/A 91.239.25.79:6892 udp
N/A 91.239.25.80:6892 udp
N/A 91.239.25.81:6892 udp
N/A 91.239.25.82:6892 udp
N/A 91.239.25.83:6892 udp
N/A 91.239.25.84:6892 udp
N/A 91.239.25.85:6892 udp
N/A 91.239.25.86:6892 udp
N/A 91.239.25.87:6892 udp
N/A 91.239.25.88:6892 udp
N/A 91.239.25.89:6892 udp
N/A 91.239.25.90:6892 udp
N/A 91.239.25.91:6892 udp
N/A 91.239.25.92:6892 udp
N/A 91.239.25.93:6892 udp
N/A 91.239.25.94:6892 udp
N/A 91.239.25.95:6892 udp
N/A 91.239.25.96:6892 udp
N/A 91.239.25.97:6892 udp
N/A 91.239.25.98:6892 udp
N/A 91.239.25.99:6892 udp
N/A 91.239.25.100:6892 udp
N/A 91.239.25.101:6892 udp
N/A 91.239.25.102:6892 udp
N/A 91.239.25.103:6892 udp
N/A 91.239.25.104:6892 udp
N/A 91.239.25.105:6892 udp
N/A 91.239.25.106:6892 udp
N/A 91.239.25.107:6892 udp
N/A 91.239.25.108:6892 udp
N/A 91.239.25.109:6892 udp
N/A 91.239.25.110:6892 udp
N/A 91.239.25.111:6892 udp
N/A 91.239.25.112:6892 udp
N/A 91.239.25.113:6892 udp
N/A 91.239.25.114:6892 udp
N/A 91.239.25.115:6892 udp
N/A 91.239.25.116:6892 udp
N/A 91.239.25.117:6892 udp
N/A 91.239.25.118:6892 udp
N/A 91.239.25.119:6892 udp
N/A 91.239.25.120:6892 udp
N/A 91.239.25.121:6892 udp
N/A 91.239.25.122:6892 udp
N/A 91.239.25.123:6892 udp
N/A 91.239.25.124:6892 udp
N/A 91.239.25.125:6892 udp
N/A 91.239.25.126:6892 udp
N/A 91.239.25.127:6892 udp
N/A 91.239.25.128:6892 udp
N/A 91.239.25.129:6892 udp
N/A 91.239.25.130:6892 udp
N/A 91.239.25.131:6892 udp
N/A 91.239.25.132:6892 udp
N/A 91.239.25.133:6892 udp
N/A 91.239.25.134:6892 udp
N/A 91.239.25.135:6892 udp
N/A 91.239.25.136:6892 udp
N/A 91.239.25.137:6892 udp
N/A 91.239.25.138:6892 udp
N/A 91.239.25.139:6892 udp
N/A 91.239.25.140:6892 udp
N/A 91.239.25.141:6892 udp
N/A 91.239.25.142:6892 udp
N/A 91.239.25.143:6892 udp
N/A 91.239.25.144:6892 udp
N/A 91.239.25.145:6892 udp
N/A 91.239.25.146:6892 udp
N/A 91.239.25.147:6892 udp
N/A 91.239.25.148:6892 udp
N/A 91.239.25.149:6892 udp
N/A 91.239.25.150:6892 udp
N/A 91.239.25.151:6892 udp
N/A 91.239.25.152:6892 udp
N/A 91.239.25.153:6892 udp
N/A 91.239.25.154:6892 udp
N/A 91.239.25.155:6892 udp
N/A 91.239.25.156:6892 udp
N/A 91.239.25.157:6892 udp
N/A 91.239.25.158:6892 udp
N/A 91.239.25.159:6892 udp
N/A 91.239.25.160:6892 udp
N/A 91.239.25.161:6892 udp
N/A 91.239.25.162:6892 udp
N/A 91.239.25.163:6892 udp
N/A 91.239.25.164:6892 udp
N/A 91.239.25.165:6892 udp
N/A 91.239.25.166:6892 udp
N/A 91.239.25.167:6892 udp
N/A 91.239.25.168:6892 udp
N/A 91.239.25.169:6892 udp
N/A 91.239.25.170:6892 udp
N/A 91.239.25.171:6892 udp
N/A 91.239.25.172:6892 udp
N/A 91.239.25.173:6892 udp
N/A 91.239.25.174:6892 udp
N/A 91.239.25.175:6892 udp
N/A 91.239.25.176:6892 udp
N/A 91.239.25.177:6892 udp
N/A 91.239.25.178:6892 udp
N/A 91.239.25.179:6892 udp
N/A 91.239.25.180:6892 udp
N/A 91.239.25.181:6892 udp
N/A 91.239.25.182:6892 udp
N/A 91.239.25.183:6892 udp
N/A 91.239.25.184:6892 udp
N/A 91.239.25.185:6892 udp
N/A 91.239.25.186:6892 udp
N/A 91.239.25.187:6892 udp
N/A 91.239.25.188:6892 udp
N/A 91.239.25.189:6892 udp
N/A 91.239.25.190:6892 udp
N/A 91.239.25.191:6892 udp
N/A 91.239.25.192:6892 udp
N/A 91.239.25.193:6892 udp
N/A 91.239.25.194:6892 udp
N/A 91.239.25.195:6892 udp
N/A 91.239.25.196:6892 udp
N/A 91.239.25.197:6892 udp
N/A 91.239.25.198:6892 udp
N/A 91.239.25.199:6892 udp
N/A 91.239.25.200:6892 udp
N/A 91.239.25.201:6892 udp
N/A 91.239.25.202:6892 udp
N/A 91.239.25.203:6892 udp
N/A 91.239.25.204:6892 udp
N/A 91.239.25.205:6892 udp
N/A 91.239.25.206:6892 udp
N/A 91.239.25.207:6892 udp
N/A 91.239.25.208:6892 udp
N/A 91.239.25.209:6892 udp
N/A 91.239.25.210:6892 udp
N/A 91.239.25.211:6892 udp
N/A 91.239.25.212:6892 udp
N/A 91.239.25.213:6892 udp
N/A 91.239.25.214:6892 udp
N/A 91.239.25.215:6892 udp
N/A 91.239.25.216:6892 udp
N/A 91.239.25.217:6892 udp
N/A 91.239.25.218:6892 udp
N/A 91.239.25.219:6892 udp
N/A 91.239.25.220:6892 udp
N/A 91.239.25.221:6892 udp
N/A 91.239.25.222:6892 udp
N/A 91.239.25.223:6892 udp
N/A 91.239.25.224:6892 udp
N/A 91.239.25.225:6892 udp
N/A 91.239.25.226:6892 udp
N/A 91.239.25.227:6892 udp
N/A 91.239.25.228:6892 udp
N/A 91.239.25.229:6892 udp
N/A 91.239.25.230:6892 udp
N/A 91.239.25.231:6892 udp
N/A 91.239.25.232:6892 udp
N/A 91.239.25.233:6892 udp
N/A 91.239.25.234:6892 udp
N/A 91.239.25.235:6892 udp
N/A 91.239.25.236:6892 udp
N/A 91.239.25.237:6892 udp
N/A 91.239.25.238:6892 udp
N/A 91.239.25.239:6892 udp
N/A 91.239.25.240:6892 udp
N/A 91.239.25.241:6892 udp
N/A 91.239.25.242:6892 udp
N/A 91.239.25.243:6892 udp
N/A 91.239.25.244:6892 udp
N/A 91.239.25.245:6892 udp
N/A 91.239.25.246:6892 udp
N/A 91.239.25.247:6892 udp
N/A 91.239.25.248:6892 udp
N/A 91.239.25.249:6892 udp
N/A 91.239.25.250:6892 udp
N/A 91.239.25.251:6892 udp
N/A 91.239.25.252:6892 udp
N/A 91.239.25.253:6892 udp
N/A 91.239.25.254:6892 udp
N/A 91.239.25.255:6892 udp
N/A 8.8.8.8:53 api.blockcypher.com udp
N/A 104.20.21.251:80 api.blockcypher.com tcp
N/A 8.8.8.8:53 btc.blockr.io udp
N/A 8.8.8.8:53 bitaps.com udp
N/A 178.128.255.179:443 bitaps.com tcp
N/A 8.8.8.8:53 www.download.windowsupdate.com udp
N/A 8.8.8.8:53 chain.so udp
N/A 104.24.104.254:443 chain.so tcp
N/A 8.8.8.8:53 crl.verisign.com udp

Files

\Users\Admin\AppData\Local\Temp\nsn194D.tmp\System.dll

MD5 a4dd044bcd94e9b3370ccf095b31f896
SHA1 17c78201323ab2095bc53184aa8267c9187d5173
SHA256 2e226715419a5882e2e14278940ee8ef0aa648a3ef7af5b3dc252674111962bc
SHA512 87335a43b9ca13e1300c7c23e702e87c669e2bcf4f6065f0c684fc53165e9c1f091cc4d79a3eca3910f0518d3b647120ac0be1a68eaade2e75eaa64adfc92c5a

memory/1080-1-0x0000000000400000-0x0000000000441000-memory.dmp

memory/1484-2-0x0000000000400000-0x0000000000436000-memory.dmp

memory/1484-3-0x000000000040305B-mapping.dmp

memory/1484-4-0x0000000000400000-0x0000000000436000-memory.dmp

memory/1020-6-0x0000000000000000-mapping.dmp

C:\Users\Admin\Desktop\_SALT_README_.hta

MD5 5c6031fc08d4c34e59b9196455fd859d
SHA1 dff17aebf61e2035d8974305deb692518b0ff042
SHA256 d1e280a967c0011391e454fff025d5aac8d9a25e32a4e7183bd45ae5f54bc0be
SHA512 b7e704c11e5e431d8a5bea1797c642f451c40e0f7bbbbbadb452f0752ae4cf692119e2241fcc4f94e7ec270c1d80d27c0b914b07040f279c605beba4dc2e4ef7

memory/756-16-0x000007FEF6930000-0x000007FEF6BAA000-memory.dmp

C:\Users\Admin\Desktop\_SALT_README_.jpg

MD5 f198e2e76aad7a90cdd1a5fcd7335112
SHA1 fa10bf6ba6bc2d85d22f96a083542a79296802c6
SHA256 7053480e7048ba2b302ed5ba594873afdc561a05235e2e6d6e9d449786d2aab6
SHA512 3ac6ca0a5e39b251b68df773579514aee2a4ee98879fb03ba266c277f9e3dfd38444095f5ca9af725daa547ce8abe0fcc73273c21a9604c6a8b0dc740cab0e01

memory/2020-18-0x0000000000000000-mapping.dmp

memory/432-19-0x0000000000000000-mapping.dmp

memory/1216-20-0x0000000000000000-mapping.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2020-11-12 14:32

Reported

2020-11-12 15:58

Platform

win10v20201028

Max time kernel

86s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe"

Signatures

Cerber

ransomware cerber

Blacklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A

Drops startup file

Description Indicator Process Target
File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\word\startup\ C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp92FE.bmp" C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification \??\c:\program files (x86)\steam C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe N/A
File opened for modification \??\c:\program files\ C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe N/A
File opened for modification \??\c:\program files (x86)\bitcoin C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe N/A
File opened for modification \??\c:\program files (x86)\excel C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\office C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\word C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe N/A
File opened for modification \??\c:\program files (x86)\outlook C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe N/A
File opened for modification \??\c:\program files (x86)\powerpoint C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe N/A
File opened for modification \??\c:\program files (x86)\word C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe N/A
File opened for modification \??\c:\program files (x86)\ C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\outlook C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\powerpoint C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe N/A
File opened for modification \??\c:\program files (x86)\the bat! C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe N/A
File opened for modification \??\c:\program files (x86)\thunderbird C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\excel C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe N/A
File opened for modification \??\c:\program files (x86)\office C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft sql server C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\microsoft sql server C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\onenote C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe N/A
File opened for modification \??\c:\program files (x86)\onenote C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification \??\c:\windows\ C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\taskkill.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe N/A
Token: 33 N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4076 wrote to memory of 424 N/A C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe
PID 4076 wrote to memory of 424 N/A C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe
PID 4076 wrote to memory of 424 N/A C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe
PID 4076 wrote to memory of 424 N/A C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe
PID 424 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe C:\Windows\SysWOW64\mshta.exe
PID 424 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe C:\Windows\SysWOW64\mshta.exe
PID 424 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe C:\Windows\SysWOW64\mshta.exe
PID 424 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe C:\Windows\system32\cmd.exe
PID 424 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe C:\Windows\system32\cmd.exe
PID 3892 wrote to memory of 3508 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3892 wrote to memory of 3508 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3892 wrote to memory of 3628 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\PING.EXE
PID 3892 wrote to memory of 3628 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\PING.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe

"C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe"

C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe

"C:\Users\Admin\AppData\Local\Temp\eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe"

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_WV6WJNY_README_.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x424

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\taskkill.exe

taskkill /f /im "eec41a3e29e670a2590f9e37a8e1640853dd92aa70e00661c9e047b61273757d.exe"

C:\Windows\system32\PING.EXE

ping -n 1 127.0.0.1

Network

Country Destination Domain Proto
N/A 52.109.8.21:443 tcp
N/A 15.44.20.0:6892 udp
N/A 15.44.20.1:6892 udp
N/A 15.44.20.2:6892 udp
N/A 15.44.20.3:6892 udp
N/A 15.44.20.4:6892 udp
N/A 15.44.20.5:6892 udp
N/A 15.44.20.6:6892 udp
N/A 15.44.20.7:6892 udp
N/A 15.44.20.8:6892 udp
N/A 15.44.20.9:6892 udp
N/A 15.44.20.10:6892 udp
N/A 15.44.20.11:6892 udp
N/A 15.44.20.12:6892 udp
N/A 15.44.20.13:6892 udp
N/A 15.44.20.14:6892 udp
N/A 15.44.20.15:6892 udp
N/A 15.44.20.16:6892 udp
N/A 15.44.20.17:6892 udp
N/A 15.44.20.18:6892 udp
N/A 15.44.20.19:6892 udp
N/A 15.44.20.20:6892 udp
N/A 15.44.20.21:6892 udp
N/A 15.44.20.22:6892 udp
N/A 15.44.20.23:6892 udp
N/A 15.44.20.24:6892 udp
N/A 15.44.20.25:6892 udp
N/A 15.44.20.26:6892 udp
N/A 15.44.20.27:6892 udp
N/A 15.44.20.28:6892 udp
N/A 15.44.20.29:6892 udp
N/A 15.44.20.30:6892 udp
N/A 15.44.20.31:6892 udp
N/A 16.43.12.0:6892 udp
N/A 16.43.12.1:6892 udp
N/A 16.43.12.2:6892 udp
N/A 16.43.12.3:6892 udp
N/A 16.43.12.4:6892 udp
N/A 16.43.12.5:6892 udp
N/A 16.43.12.6:6892 udp
N/A 16.43.12.7:6892 udp
N/A 16.43.12.8:6892 udp
N/A 16.43.12.9:6892 udp
N/A 16.43.12.10:6892 udp
N/A 16.43.12.11:6892 udp
N/A 16.43.12.12:6892 udp
N/A 16.43.12.13:6892 udp
N/A 16.43.12.14:6892 udp
N/A 16.43.12.15:6892 udp
N/A 16.43.12.16:6892 udp
N/A 16.43.12.17:6892 udp
N/A 16.43.12.18:6892 udp
N/A 16.43.12.19:6892 udp
N/A 16.43.12.20:6892 udp
N/A 16.43.12.21:6892 udp
N/A 16.43.12.22:6892 udp
N/A 16.43.12.23:6892 udp
N/A 16.43.12.24:6892 udp
N/A 16.43.12.25:6892 udp
N/A 16.43.12.26:6892 udp
N/A 16.43.12.27:6892 udp
N/A 16.43.12.28:6892 udp
N/A 16.43.12.29:6892 udp
N/A 16.43.12.30:6892 udp
N/A 16.43.12.31:6892 udp
N/A 91.239.24.0:6892 udp
N/A 91.239.24.1:6892 udp
N/A 91.239.24.2:6892 udp
N/A 91.239.24.3:6892 udp
N/A 91.239.24.4:6892 udp
N/A 91.239.24.5:6892 udp
N/A 91.239.24.6:6892 udp
N/A 91.239.24.7:6892 udp
N/A 91.239.24.8:6892 udp
N/A 91.239.24.9:6892 udp
N/A 91.239.24.10:6892 udp
N/A 91.239.24.11:6892 udp
N/A 91.239.24.12:6892 udp
N/A 91.239.24.13:6892 udp
N/A 91.239.24.14:6892 udp
N/A 91.239.24.15:6892 udp
N/A 91.239.24.16:6892 udp
N/A 91.239.24.17:6892 udp
N/A 91.239.24.18:6892 udp
N/A 91.239.24.19:6892 udp
N/A 91.239.24.20:6892 udp
N/A 91.239.24.21:6892 udp
N/A 91.239.24.22:6892 udp
N/A 91.239.24.23:6892 udp
N/A 91.239.24.24:6892 udp
N/A 91.239.24.25:6892 udp
N/A 91.239.24.26:6892 udp
N/A 91.239.24.27:6892 udp
N/A 91.239.24.28:6892 udp
N/A 91.239.24.29:6892 udp
N/A 91.239.24.30:6892 udp
N/A 91.239.24.31:6892 udp
N/A 91.239.24.32:6892 udp
N/A 91.239.24.33:6892 udp
N/A 91.239.24.34:6892 udp
N/A 91.239.24.35:6892 udp
N/A 91.239.24.36:6892 udp
N/A 91.239.24.37:6892 udp
N/A 91.239.24.38:6892 udp
N/A 91.239.24.39:6892 udp
N/A 91.239.24.40:6892 udp
N/A 91.239.24.41:6892 udp
N/A 91.239.24.42:6892 udp
N/A 91.239.24.43:6892 udp
N/A 91.239.24.44:6892 udp
N/A 91.239.24.45:6892 udp
N/A 91.239.24.46:6892 udp
N/A 91.239.24.47:6892 udp
N/A 91.239.24.48:6892 udp
N/A 91.239.24.49:6892 udp
N/A 91.239.24.50:6892 udp
N/A 91.239.24.51:6892 udp
N/A 91.239.24.52:6892 udp
N/A 91.239.24.53:6892 udp
N/A 91.239.24.54:6892 udp
N/A 91.239.24.55:6892 udp
N/A 91.239.24.56:6892 udp
N/A 91.239.24.57:6892 udp
N/A 91.239.24.58:6892 udp
N/A 91.239.24.59:6892 udp
N/A 91.239.24.60:6892 udp
N/A 91.239.24.61:6892 udp
N/A 91.239.24.62:6892 udp
N/A 91.239.24.63:6892 udp
N/A 91.239.24.64:6892 udp
N/A 91.239.24.65:6892 udp
N/A 91.239.24.66:6892 udp
N/A 91.239.24.67:6892 udp
N/A 91.239.24.68:6892 udp
N/A 91.239.24.69:6892 udp
N/A 91.239.24.70:6892 udp
N/A 91.239.24.71:6892 udp
N/A 91.239.24.72:6892 udp
N/A 91.239.24.73:6892 udp
N/A 91.239.24.74:6892 udp
N/A 91.239.24.75:6892 udp
N/A 91.239.24.76:6892 udp
N/A 91.239.24.77:6892 udp
N/A 91.239.24.78:6892 udp
N/A 91.239.24.79:6892 udp
N/A 91.239.24.80:6892 udp
N/A 91.239.24.81:6892 udp
N/A 91.239.24.82:6892 udp
N/A 91.239.24.83:6892 udp
N/A 91.239.24.84:6892 udp
N/A 91.239.24.85:6892 udp
N/A 91.239.24.86:6892 udp
N/A 91.239.24.87:6892 udp
N/A 91.239.24.88:6892 udp
N/A 91.239.24.89:6892 udp
N/A 91.239.24.90:6892 udp
N/A 91.239.24.91:6892 udp
N/A 91.239.24.92:6892 udp
N/A 91.239.24.93:6892 udp
N/A 91.239.24.94:6892 udp
N/A 91.239.24.95:6892 udp
N/A 91.239.24.96:6892 udp
N/A 91.239.24.97:6892 udp
N/A 91.239.24.98:6892 udp
N/A 91.239.24.99:6892 udp
N/A 91.239.24.100:6892 udp
N/A 91.239.24.101:6892 udp
N/A 91.239.24.102:6892 udp
N/A 91.239.24.103:6892 udp
N/A 91.239.24.104:6892 udp
N/A 91.239.24.105:6892 udp
N/A 91.239.24.106:6892 udp
N/A 91.239.24.107:6892 udp
N/A 91.239.24.108:6892 udp
N/A 91.239.24.109:6892 udp
N/A 91.239.24.110:6892 udp
N/A 91.239.24.111:6892 udp
N/A 91.239.24.112:6892 udp
N/A 91.239.24.113:6892 udp
N/A 91.239.24.114:6892 udp
N/A 91.239.24.115:6892 udp
N/A 91.239.24.116:6892 udp
N/A 91.239.24.117:6892 udp
N/A 91.239.24.118:6892 udp
N/A 91.239.24.119:6892 udp
N/A 91.239.24.120:6892 udp
N/A 91.239.24.121:6892 udp
N/A 91.239.24.122:6892 udp
N/A 91.239.24.123:6892 udp
N/A 91.239.24.124:6892 udp
N/A 91.239.24.125:6892 udp
N/A 91.239.24.126:6892 udp
N/A 91.239.24.127:6892 udp
N/A 91.239.24.128:6892 udp
N/A 91.239.24.129:6892 udp
N/A 91.239.24.130:6892 udp
N/A 91.239.24.131:6892 udp
N/A 91.239.24.132:6892 udp
N/A 91.239.24.133:6892 udp
N/A 91.239.24.134:6892 udp
N/A 91.239.24.135:6892 udp
N/A 91.239.24.136:6892 udp
N/A 91.239.24.137:6892 udp
N/A 91.239.24.138:6892 udp
N/A 91.239.24.139:6892 udp
N/A 91.239.24.140:6892 udp
N/A 91.239.24.141:6892 udp
N/A 91.239.24.142:6892 udp
N/A 91.239.24.143:6892 udp
N/A 91.239.24.144:6892 udp
N/A 91.239.24.145:6892 udp
N/A 91.239.24.146:6892 udp
N/A 91.239.24.147:6892 udp
N/A 91.239.24.148:6892 udp
N/A 91.239.24.149:6892 udp
N/A 91.239.24.150:6892 udp
N/A 91.239.24.151:6892 udp
N/A 91.239.24.152:6892 udp
N/A 91.239.24.153:6892 udp
N/A 91.239.24.154:6892 udp
N/A 91.239.24.155:6892 udp
N/A 91.239.24.156:6892 udp
N/A 91.239.24.157:6892 udp
N/A 91.239.24.158:6892 udp
N/A 91.239.24.159:6892 udp
N/A 91.239.24.160:6892 udp
N/A 91.239.24.161:6892 udp
N/A 91.239.24.162:6892 udp
N/A 91.239.24.163:6892 udp
N/A 91.239.24.164:6892 udp
N/A 91.239.24.165:6892 udp
N/A 91.239.24.166:6892 udp
N/A 91.239.24.167:6892 udp
N/A 91.239.24.168:6892 udp
N/A 91.239.24.169:6892 udp
N/A 91.239.24.170:6892 udp
N/A 91.239.24.171:6892 udp
N/A 91.239.24.172:6892 udp
N/A 91.239.24.173:6892 udp
N/A 91.239.24.174:6892 udp
N/A 91.239.24.175:6892 udp
N/A 91.239.24.176:6892 udp
N/A 91.239.24.177:6892 udp
N/A 91.239.24.178:6892 udp
N/A 91.239.24.179:6892 udp
N/A 91.239.24.180:6892 udp
N/A 91.239.24.181:6892 udp
N/A 91.239.24.182:6892 udp
N/A 91.239.24.183:6892 udp
N/A 91.239.24.184:6892 udp
N/A 91.239.24.185:6892 udp
N/A 91.239.24.186:6892 udp
N/A 91.239.24.187:6892 udp
N/A 91.239.24.188:6892 udp
N/A 91.239.24.189:6892 udp
N/A 91.239.24.190:6892 udp
N/A 91.239.24.191:6892 udp
N/A 91.239.24.192:6892 udp
N/A 91.239.24.193:6892 udp
N/A 91.239.24.194:6892 udp
N/A 91.239.24.195:6892 udp
N/A 91.239.24.196:6892 udp
N/A 91.239.24.197:6892 udp
N/A 91.239.24.198:6892 udp
N/A 91.239.24.199:6892 udp
N/A 91.239.24.200:6892 udp
N/A 91.239.24.201:6892 udp
N/A 91.239.24.202:6892 udp
N/A 91.239.24.203:6892 udp
N/A 91.239.24.204:6892 udp
N/A 91.239.24.205:6892 udp
N/A 91.239.24.206:6892 udp
N/A 91.239.24.207:6892 udp
N/A 91.239.24.208:6892 udp
N/A 91.239.24.209:6892 udp
N/A 91.239.24.210:6892 udp
N/A 91.239.24.211:6892 udp
N/A 91.239.24.212:6892 udp
N/A 91.239.24.213:6892 udp
N/A 91.239.24.214:6892 udp
N/A 91.239.24.215:6892 udp
N/A 91.239.24.216:6892 udp
N/A 91.239.24.217:6892 udp
N/A 91.239.24.218:6892 udp
N/A 91.239.24.219:6892 udp
N/A 91.239.24.220:6892 udp
N/A 91.239.24.221:6892 udp
N/A 91.239.24.222:6892 udp
N/A 91.239.24.223:6892 udp
N/A 91.239.24.224:6892 udp
N/A 91.239.24.225:6892 udp
N/A 91.239.24.226:6892 udp
N/A 91.239.24.227:6892 udp
N/A 91.239.24.228:6892 udp
N/A 91.239.24.229:6892 udp
N/A 91.239.24.230:6892 udp
N/A 91.239.24.231:6892 udp
N/A 91.239.24.232:6892 udp
N/A 91.239.24.233:6892 udp
N/A 91.239.24.234:6892 udp
N/A 91.239.24.235:6892 udp
N/A 91.239.24.236:6892 udp
N/A 91.239.24.237:6892 udp
N/A 91.239.24.238:6892 udp
N/A 91.239.24.239:6892 udp
N/A 91.239.24.240:6892 udp
N/A 91.239.24.241:6892 udp
N/A 91.239.24.242:6892 udp
N/A 91.239.24.243:6892 udp
N/A 91.239.24.244:6892 udp
N/A 91.239.24.245:6892 udp
N/A 91.239.24.246:6892 udp
N/A 91.239.24.247:6892 udp
N/A 91.239.24.248:6892 udp
N/A 91.239.24.249:6892 udp
N/A 91.239.24.250:6892 udp
N/A 91.239.24.251:6892 udp
N/A 91.239.24.252:6892 udp
N/A 91.239.24.253:6892 udp
N/A 91.239.24.254:6892 udp
N/A 91.239.24.255:6892 udp
N/A 91.239.25.0:6892 udp
N/A 91.239.25.1:6892 udp
N/A 91.239.25.2:6892 udp
N/A 91.239.25.3:6892 udp
N/A 91.239.25.4:6892 udp
N/A 91.239.25.5:6892 udp
N/A 91.239.25.6:6892 udp
N/A 91.239.25.7:6892 udp
N/A 91.239.25.8:6892 udp
N/A 91.239.25.9:6892 udp
N/A 91.239.25.10:6892 udp
N/A 91.239.25.11:6892 udp
N/A 91.239.25.12:6892 udp
N/A 91.239.25.13:6892 udp
N/A 91.239.25.14:6892 udp
N/A 91.239.25.15:6892 udp
N/A 91.239.25.16:6892 udp
N/A 91.239.25.17:6892 udp
N/A 91.239.25.18:6892 udp
N/A 91.239.25.19:6892 udp
N/A 91.239.25.20:6892 udp
N/A 91.239.25.21:6892 udp
N/A 91.239.25.22:6892 udp
N/A 91.239.25.23:6892 udp
N/A 91.239.25.24:6892 udp
N/A 91.239.25.25:6892 udp
N/A 91.239.25.26:6892 udp
N/A 91.239.25.27:6892 udp
N/A 91.239.25.28:6892 udp
N/A 91.239.25.29:6892 udp
N/A 91.239.25.30:6892 udp
N/A 91.239.25.31:6892 udp
N/A 91.239.25.32:6892 udp
N/A 91.239.25.33:6892 udp
N/A 91.239.25.34:6892 udp
N/A 91.239.25.35:6892 udp
N/A 91.239.25.36:6892 udp
N/A 91.239.25.37:6892 udp
N/A 91.239.25.38:6892 udp
N/A 91.239.25.39:6892 udp
N/A 91.239.25.40:6892 udp
N/A 91.239.25.41:6892 udp
N/A 91.239.25.42:6892 udp
N/A 91.239.25.43:6892 udp
N/A 91.239.25.44:6892 udp
N/A 91.239.25.45:6892 udp
N/A 91.239.25.46:6892 udp
N/A 91.239.25.47:6892 udp
N/A 91.239.25.48:6892 udp
N/A 91.239.25.49:6892 udp
N/A 91.239.25.50:6892 udp
N/A 91.239.25.51:6892 udp
N/A 91.239.25.52:6892 udp
N/A 91.239.25.53:6892 udp
N/A 91.239.25.54:6892 udp
N/A 91.239.25.55:6892 udp
N/A 91.239.25.56:6892 udp
N/A 91.239.25.57:6892 udp
N/A 91.239.25.58:6892 udp
N/A 91.239.25.59:6892 udp
N/A 91.239.25.60:6892 udp
N/A 91.239.25.61:6892 udp
N/A 91.239.25.62:6892 udp
N/A 91.239.25.63:6892 udp
N/A 91.239.25.64:6892 udp
N/A 91.239.25.65:6892 udp
N/A 91.239.25.66:6892 udp
N/A 91.239.25.67:6892 udp
N/A 91.239.25.68:6892 udp
N/A 91.239.25.69:6892 udp
N/A 91.239.25.70:6892 udp
N/A 91.239.25.71:6892 udp
N/A 91.239.25.72:6892 udp
N/A 91.239.25.73:6892 udp
N/A 91.239.25.74:6892 udp
N/A 91.239.25.75:6892 udp
N/A 91.239.25.76:6892 udp
N/A 91.239.25.77:6892 udp
N/A 91.239.25.78:6892 udp
N/A 91.239.25.79:6892 udp
N/A 91.239.25.80:6892 udp
N/A 91.239.25.81:6892 udp
N/A 91.239.25.82:6892 udp
N/A 91.239.25.83:6892 udp
N/A 91.239.25.84:6892 udp
N/A 91.239.25.85:6892 udp
N/A 91.239.25.86:6892 udp
N/A 91.239.25.87:6892 udp
N/A 91.239.25.88:6892 udp
N/A 91.239.25.89:6892 udp
N/A 91.239.25.90:6892 udp
N/A 91.239.25.91:6892 udp
N/A 91.239.25.92:6892 udp
N/A 91.239.25.93:6892 udp
N/A 91.239.25.94:6892 udp
N/A 91.239.25.95:6892 udp
N/A 91.239.25.96:6892 udp
N/A 91.239.25.97:6892 udp
N/A 91.239.25.98:6892 udp
N/A 91.239.25.99:6892 udp
N/A 91.239.25.100:6892 udp
N/A 91.239.25.101:6892 udp
N/A 91.239.25.102:6892 udp
N/A 91.239.25.103:6892 udp
N/A 91.239.25.104:6892 udp
N/A 91.239.25.105:6892 udp
N/A 91.239.25.106:6892 udp
N/A 91.239.25.107:6892 udp
N/A 91.239.25.108:6892 udp
N/A 91.239.25.109:6892 udp
N/A 91.239.25.110:6892 udp
N/A 91.239.25.111:6892 udp
N/A 91.239.25.112:6892 udp
N/A 91.239.25.113:6892 udp
N/A 91.239.25.114:6892 udp
N/A 91.239.25.115:6892 udp
N/A 91.239.25.116:6892 udp
N/A 91.239.25.117:6892 udp
N/A 91.239.25.118:6892 udp
N/A 91.239.25.119:6892 udp
N/A 91.239.25.120:6892 udp
N/A 91.239.25.121:6892 udp
N/A 91.239.25.122:6892 udp
N/A 91.239.25.123:6892 udp
N/A 91.239.25.124:6892 udp
N/A 91.239.25.125:6892 udp
N/A 91.239.25.126:6892 udp
N/A 91.239.25.127:6892 udp
N/A 91.239.25.128:6892 udp
N/A 91.239.25.129:6892 udp
N/A 91.239.25.130:6892 udp
N/A 91.239.25.131:6892 udp
N/A 91.239.25.132:6892 udp
N/A 91.239.25.133:6892 udp
N/A 91.239.25.134:6892 udp
N/A 91.239.25.135:6892 udp
N/A 91.239.25.136:6892 udp
N/A 91.239.25.137:6892 udp
N/A 91.239.25.138:6892 udp
N/A 91.239.25.139:6892 udp
N/A 91.239.25.140:6892 udp
N/A 91.239.25.141:6892 udp
N/A 91.239.25.142:6892 udp
N/A 91.239.25.143:6892 udp
N/A 91.239.25.144:6892 udp
N/A 91.239.25.145:6892 udp
N/A 91.239.25.146:6892 udp
N/A 91.239.25.147:6892 udp
N/A 91.239.25.148:6892 udp
N/A 91.239.25.149:6892 udp
N/A 91.239.25.150:6892 udp
N/A 91.239.25.151:6892 udp
N/A 91.239.25.152:6892 udp
N/A 91.239.25.153:6892 udp
N/A 91.239.25.154:6892 udp
N/A 91.239.25.155:6892 udp
N/A 91.239.25.156:6892 udp
N/A 91.239.25.157:6892 udp
N/A 91.239.25.158:6892 udp
N/A 91.239.25.159:6892 udp
N/A 91.239.25.160:6892 udp
N/A 91.239.25.161:6892 udp
N/A 91.239.25.162:6892 udp
N/A 91.239.25.163:6892 udp
N/A 91.239.25.164:6892 udp
N/A 91.239.25.165:6892 udp
N/A 91.239.25.166:6892 udp
N/A 91.239.25.167:6892 udp
N/A 91.239.25.168:6892 udp
N/A 91.239.25.169:6892 udp
N/A 91.239.25.170:6892 udp
N/A 91.239.25.171:6892 udp
N/A 91.239.25.172:6892 udp
N/A 91.239.25.173:6892 udp
N/A 91.239.25.174:6892 udp
N/A 91.239.25.175:6892 udp
N/A 91.239.25.176:6892 udp
N/A 91.239.25.177:6892 udp
N/A 91.239.25.178:6892 udp
N/A 91.239.25.179:6892 udp
N/A 91.239.25.180:6892 udp
N/A 91.239.25.181:6892 udp
N/A 91.239.25.182:6892 udp
N/A 91.239.25.183:6892 udp
N/A 91.239.25.184:6892 udp
N/A 91.239.25.185:6892 udp
N/A 91.239.25.186:6892 udp
N/A 91.239.25.187:6892 udp
N/A 91.239.25.188:6892 udp
N/A 91.239.25.189:6892 udp
N/A 91.239.25.190:6892 udp
N/A 91.239.25.191:6892 udp
N/A 91.239.25.192:6892 udp
N/A 91.239.25.193:6892 udp
N/A 91.239.25.194:6892 udp
N/A 91.239.25.195:6892 udp
N/A 91.239.25.196:6892 udp
N/A 91.239.25.197:6892 udp
N/A 91.239.25.198:6892 udp
N/A 91.239.25.199:6892 udp
N/A 91.239.25.200:6892 udp
N/A 91.239.25.201:6892 udp
N/A 91.239.25.202:6892 udp
N/A 91.239.25.203:6892 udp
N/A 91.239.25.204:6892 udp
N/A 91.239.25.205:6892 udp
N/A 91.239.25.206:6892 udp
N/A 91.239.25.207:6892 udp
N/A 91.239.25.208:6892 udp
N/A 91.239.25.209:6892 udp
N/A 91.239.25.210:6892 udp
N/A 91.239.25.211:6892 udp
N/A 91.239.25.212:6892 udp
N/A 91.239.25.213:6892 udp
N/A 91.239.25.214:6892 udp
N/A 91.239.25.215:6892 udp
N/A 91.239.25.216:6892 udp
N/A 91.239.25.217:6892 udp
N/A 91.239.25.218:6892 udp
N/A 91.239.25.219:6892 udp
N/A 91.239.25.220:6892 udp
N/A 91.239.25.221:6892 udp
N/A 91.239.25.222:6892 udp
N/A 91.239.25.223:6892 udp
N/A 91.239.25.224:6892 udp
N/A 91.239.25.225:6892 udp
N/A 91.239.25.226:6892 udp
N/A 91.239.25.227:6892 udp
N/A 91.239.25.228:6892 udp
N/A 91.239.25.229:6892 udp
N/A 91.239.25.230:6892 udp
N/A 91.239.25.231:6892 udp
N/A 91.239.25.232:6892 udp
N/A 91.239.25.233:6892 udp
N/A 91.239.25.234:6892 udp
N/A 91.239.25.235:6892 udp
N/A 91.239.25.236:6892 udp
N/A 91.239.25.237:6892 udp
N/A 91.239.25.238:6892 udp
N/A 91.239.25.239:6892 udp
N/A 91.239.25.240:6892 udp
N/A 91.239.25.241:6892 udp
N/A 91.239.25.242:6892 udp
N/A 91.239.25.243:6892 udp
N/A 91.239.25.244:6892 udp
N/A 91.239.25.245:6892 udp
N/A 91.239.25.246:6892 udp
N/A 91.239.25.247:6892 udp
N/A 91.239.25.248:6892 udp
N/A 91.239.25.249:6892 udp
N/A 91.239.25.250:6892 udp
N/A 91.239.25.251:6892 udp
N/A 91.239.25.252:6892 udp
N/A 91.239.25.253:6892 udp
N/A 91.239.25.254:6892 udp
N/A 91.239.25.255:6892 udp
N/A 15.44.20.0:6892 udp
N/A 15.44.20.1:6892 udp
N/A 15.44.20.2:6892 udp
N/A 15.44.20.3:6892 udp
N/A 15.44.20.4:6892 udp
N/A 15.44.20.5:6892 udp
N/A 15.44.20.6:6892 udp
N/A 15.44.20.7:6892 udp
N/A 15.44.20.8:6892 udp
N/A 15.44.20.9:6892 udp
N/A 15.44.20.10:6892 udp
N/A 15.44.20.11:6892 udp
N/A 15.44.20.12:6892 udp
N/A 15.44.20.13:6892 udp
N/A 15.44.20.14:6892 udp
N/A 15.44.20.15:6892 udp
N/A 15.44.20.16:6892 udp
N/A 15.44.20.17:6892 udp
N/A 15.44.20.18:6892 udp
N/A 15.44.20.19:6892 udp
N/A 15.44.20.20:6892 udp
N/A 15.44.20.21:6892 udp
N/A 15.44.20.22:6892 udp
N/A 15.44.20.23:6892 udp
N/A 15.44.20.24:6892 udp
N/A 15.44.20.25:6892 udp
N/A 15.44.20.26:6892 udp
N/A 15.44.20.27:6892 udp
N/A 15.44.20.28:6892 udp
N/A 15.44.20.29:6892 udp
N/A 15.44.20.30:6892 udp
N/A 15.44.20.31:6892 udp
N/A 16.43.12.0:6892 udp
N/A 16.43.12.1:6892 udp
N/A 16.43.12.2:6892 udp
N/A 16.43.12.3:6892 udp
N/A 16.43.12.4:6892 udp
N/A 16.43.12.5:6892 udp
N/A 16.43.12.6:6892 udp
N/A 16.43.12.7:6892 udp
N/A 16.43.12.8:6892 udp
N/A 16.43.12.9:6892 udp
N/A 16.43.12.10:6892 udp
N/A 16.43.12.11:6892 udp
N/A 16.43.12.12:6892 udp
N/A 16.43.12.13:6892 udp
N/A 16.43.12.14:6892 udp
N/A 16.43.12.15:6892 udp
N/A 16.43.12.16:6892 udp
N/A 16.43.12.17:6892 udp
N/A 16.43.12.18:6892 udp
N/A 16.43.12.19:6892 udp
N/A 16.43.12.20:6892 udp
N/A 16.43.12.21:6892 udp
N/A 16.43.12.22:6892 udp
N/A 16.43.12.23:6892 udp
N/A 16.43.12.24:6892 udp
N/A 16.43.12.25:6892 udp
N/A 16.43.12.26:6892 udp
N/A 16.43.12.27:6892 udp
N/A 16.43.12.28:6892 udp
N/A 16.43.12.29:6892 udp
N/A 16.43.12.30:6892 udp
N/A 16.43.12.31:6892 udp
N/A 91.239.24.0:6892 udp
N/A 91.239.24.1:6892 udp
N/A 91.239.24.2:6892 udp
N/A 91.239.24.3:6892 udp
N/A 91.239.24.4:6892 udp
N/A 91.239.24.5:6892 udp
N/A 91.239.24.6:6892 udp
N/A 91.239.24.7:6892 udp
N/A 91.239.24.8:6892 udp
N/A 91.239.24.9:6892 udp
N/A 91.239.24.10:6892 udp
N/A 91.239.24.11:6892 udp
N/A 91.239.24.12:6892 udp
N/A 91.239.24.13:6892 udp
N/A 91.239.24.14:6892 udp
N/A 91.239.24.15:6892 udp
N/A 91.239.24.16:6892 udp
N/A 91.239.24.17:6892 udp
N/A 91.239.24.18:6892 udp
N/A 91.239.24.19:6892 udp
N/A 91.239.24.20:6892 udp
N/A 91.239.24.21:6892 udp
N/A 91.239.24.22:6892 udp
N/A 91.239.24.23:6892 udp
N/A 91.239.24.24:6892 udp
N/A 91.239.24.25:6892 udp
N/A 91.239.24.26:6892 udp
N/A 91.239.24.27:6892 udp
N/A 91.239.24.28:6892 udp
N/A 91.239.24.29:6892 udp
N/A 91.239.24.30:6892 udp
N/A 91.239.24.31:6892 udp
N/A 91.239.24.32:6892 udp
N/A 91.239.24.33:6892 udp
N/A 91.239.24.34:6892 udp
N/A 91.239.24.35:6892 udp
N/A 91.239.24.36:6892 udp
N/A 91.239.24.37:6892 udp
N/A 91.239.24.38:6892 udp
N/A 91.239.24.39:6892 udp
N/A 91.239.24.40:6892 udp
N/A 91.239.24.41:6892 udp
N/A 91.239.24.42:6892 udp
N/A 91.239.24.43:6892 udp
N/A 91.239.24.44:6892 udp
N/A 91.239.24.45:6892 udp
N/A 91.239.24.46:6892 udp
N/A 91.239.24.47:6892 udp
N/A 91.239.24.48:6892 udp
N/A 91.239.24.49:6892 udp
N/A 91.239.24.50:6892 udp
N/A 91.239.24.51:6892 udp
N/A 91.239.24.52:6892 udp
N/A 91.239.24.53:6892 udp
N/A 91.239.24.54:6892 udp
N/A 91.239.24.55:6892 udp
N/A 91.239.24.56:6892 udp
N/A 91.239.24.57:6892 udp
N/A 91.239.24.58:6892 udp
N/A 91.239.24.59:6892 udp
N/A 91.239.24.60:6892 udp
N/A 91.239.24.61:6892 udp
N/A 91.239.24.62:6892 udp
N/A 91.239.24.63:6892 udp
N/A 91.239.24.64:6892 udp
N/A 91.239.24.65:6892 udp
N/A 91.239.24.66:6892 udp
N/A 91.239.24.67:6892 udp
N/A 91.239.24.68:6892 udp
N/A 91.239.24.69:6892 udp
N/A 91.239.24.70:6892 udp
N/A 91.239.24.71:6892 udp
N/A 91.239.24.72:6892 udp
N/A 91.239.24.73:6892 udp
N/A 91.239.24.74:6892 udp
N/A 91.239.24.75:6892 udp
N/A 91.239.24.76:6892 udp
N/A 91.239.24.77:6892 udp
N/A 91.239.24.78:6892 udp
N/A 91.239.24.79:6892 udp
N/A 91.239.24.80:6892 udp
N/A 91.239.24.81:6892 udp
N/A 91.239.24.82:6892 udp
N/A 91.239.24.83:6892 udp
N/A 91.239.24.84:6892 udp
N/A 91.239.24.85:6892 udp
N/A 91.239.24.86:6892 udp
N/A 91.239.24.87:6892 udp
N/A 91.239.24.88:6892 udp
N/A 91.239.24.89:6892 udp
N/A 91.239.24.90:6892 udp
N/A 91.239.24.91:6892 udp
N/A 91.239.24.92:6892 udp
N/A 91.239.24.93:6892 udp
N/A 91.239.24.94:6892 udp
N/A 91.239.24.95:6892 udp
N/A 91.239.24.96:6892 udp
N/A 91.239.24.97:6892 udp
N/A 91.239.24.98:6892 udp
N/A 91.239.24.99:6892 udp
N/A 91.239.24.100:6892 udp
N/A 91.239.24.101:6892 udp
N/A 91.239.24.102:6892 udp
N/A 91.239.24.103:6892 udp
N/A 91.239.24.104:6892 udp
N/A 91.239.24.105:6892 udp
N/A 91.239.24.106:6892 udp
N/A 91.239.24.107:6892 udp
N/A 91.239.24.108:6892 udp
N/A 91.239.24.109:6892 udp
N/A 91.239.24.110:6892 udp
N/A 91.239.24.111:6892 udp
N/A 91.239.24.112:6892 udp
N/A 91.239.24.113:6892 udp
N/A 91.239.24.114:6892 udp
N/A 91.239.24.115:6892 udp
N/A 91.239.24.116:6892 udp
N/A 91.239.24.117:6892 udp
N/A 91.239.24.118:6892 udp
N/A 91.239.24.119:6892 udp
N/A 91.239.24.120:6892 udp
N/A 91.239.24.121:6892 udp
N/A 91.239.24.122:6892 udp
N/A 91.239.24.123:6892 udp
N/A 91.239.24.124:6892 udp
N/A 91.239.24.125:6892 udp
N/A 91.239.24.126:6892 udp
N/A 91.239.24.127:6892 udp
N/A 91.239.24.128:6892 udp
N/A 91.239.24.129:6892 udp
N/A 91.239.24.130:6892 udp
N/A 91.239.24.131:6892 udp
N/A 91.239.24.132:6892 udp
N/A 91.239.24.133:6892 udp
N/A 91.239.24.134:6892 udp
N/A 91.239.24.135:6892 udp
N/A 91.239.24.136:6892 udp
N/A 91.239.24.137:6892 udp
N/A 91.239.24.138:6892 udp
N/A 91.239.24.139:6892 udp
N/A 91.239.24.140:6892 udp
N/A 91.239.24.141:6892 udp
N/A 91.239.24.142:6892 udp
N/A 91.239.24.143:6892 udp
N/A 91.239.24.144:6892 udp
N/A 91.239.24.145:6892 udp
N/A 91.239.24.146:6892 udp
N/A 91.239.24.147:6892 udp
N/A 91.239.24.148:6892 udp
N/A 91.239.24.149:6892 udp
N/A 91.239.24.150:6892 udp
N/A 91.239.24.151:6892 udp
N/A 91.239.24.152:6892 udp
N/A 91.239.24.153:6892 udp
N/A 91.239.24.154:6892 udp
N/A 91.239.24.155:6892 udp
N/A 91.239.24.156:6892 udp
N/A 91.239.24.157:6892 udp
N/A 91.239.24.158:6892 udp
N/A 91.239.24.159:6892 udp
N/A 91.239.24.160:6892 udp
N/A 91.239.24.161:6892 udp
N/A 91.239.24.162:6892 udp
N/A 91.239.24.163:6892 udp
N/A 91.239.24.164:6892 udp
N/A 91.239.24.165:6892 udp
N/A 91.239.24.166:6892 udp
N/A 91.239.24.167:6892 udp
N/A 91.239.24.168:6892 udp
N/A 91.239.24.169:6892 udp
N/A 91.239.24.170:6892 udp
N/A 91.239.24.171:6892 udp
N/A 91.239.24.172:6892 udp
N/A 91.239.24.173:6892 udp
N/A 91.239.24.174:6892 udp
N/A 91.239.24.175:6892 udp
N/A 91.239.24.176:6892 udp
N/A 91.239.24.177:6892 udp
N/A 91.239.24.178:6892 udp
N/A 91.239.24.179:6892 udp
N/A 91.239.24.180:6892 udp
N/A 91.239.24.181:6892 udp
N/A 91.239.24.182:6892 udp
N/A 91.239.24.183:6892 udp
N/A 91.239.24.184:6892 udp
N/A 91.239.24.185:6892 udp
N/A 91.239.24.186:6892 udp
N/A 91.239.24.187:6892 udp
N/A 91.239.24.188:6892 udp
N/A 91.239.24.189:6892 udp
N/A 91.239.24.190:6892 udp
N/A 91.239.24.191:6892 udp
N/A 91.239.24.192:6892 udp
N/A 91.239.24.193:6892 udp
N/A 91.239.24.194:6892 udp
N/A 91.239.24.195:6892 udp
N/A 91.239.24.196:6892 udp
N/A 91.239.24.197:6892 udp
N/A 91.239.24.198:6892 udp
N/A 91.239.24.199:6892 udp
N/A 91.239.24.200:6892 udp
N/A 91.239.24.201:6892 udp
N/A 91.239.24.202:6892 udp
N/A 91.239.24.203:6892 udp
N/A 91.239.24.204:6892 udp
N/A 91.239.24.205:6892 udp
N/A 91.239.24.206:6892 udp
N/A 91.239.24.207:6892 udp
N/A 91.239.24.208:6892 udp
N/A 91.239.24.209:6892 udp
N/A 91.239.24.210:6892 udp
N/A 91.239.24.211:6892 udp
N/A 91.239.24.212:6892 udp
N/A 91.239.24.213:6892 udp
N/A 91.239.24.214:6892 udp
N/A 91.239.24.215:6892 udp
N/A 91.239.24.216:6892 udp
N/A 91.239.24.217:6892 udp
N/A 91.239.24.218:6892 udp
N/A 91.239.24.219:6892 udp
N/A 91.239.24.220:6892 udp
N/A 91.239.24.221:6892 udp
N/A 91.239.24.222:6892 udp
N/A 91.239.24.223:6892 udp
N/A 91.239.24.224:6892 udp
N/A 91.239.24.225:6892 udp
N/A 91.239.24.226:6892 udp
N/A 91.239.24.227:6892 udp
N/A 91.239.24.228:6892 udp
N/A 91.239.24.229:6892 udp
N/A 91.239.24.230:6892 udp
N/A 91.239.24.231:6892 udp
N/A 91.239.24.232:6892 udp
N/A 91.239.24.233:6892 udp
N/A 91.239.24.234:6892 udp
N/A 91.239.24.235:6892 udp
N/A 91.239.24.236:6892 udp
N/A 91.239.24.237:6892 udp
N/A 91.239.24.238:6892 udp
N/A 91.239.24.239:6892 udp
N/A 91.239.24.240:6892 udp
N/A 91.239.24.241:6892 udp
N/A 91.239.24.242:6892 udp
N/A 91.239.24.243:6892 udp
N/A 91.239.24.244:6892 udp
N/A 91.239.24.245:6892 udp
N/A 91.239.24.246:6892 udp
N/A 91.239.24.247:6892 udp
N/A 91.239.24.248:6892 udp
N/A 91.239.24.249:6892 udp
N/A 91.239.24.250:6892 udp
N/A 91.239.24.251:6892 udp
N/A 91.239.24.252:6892 udp
N/A 91.239.24.253:6892 udp
N/A 91.239.24.254:6892 udp
N/A 91.239.24.255:6892 udp
N/A 91.239.25.0:6892 udp
N/A 91.239.25.1:6892 udp
N/A 91.239.25.2:6892 udp
N/A 91.239.25.3:6892 udp
N/A 91.239.25.4:6892 udp
N/A 91.239.25.5:6892 udp
N/A 91.239.25.6:6892 udp
N/A 91.239.25.7:6892 udp
N/A 91.239.25.8:6892 udp
N/A 91.239.25.9:6892 udp
N/A 91.239.25.10:6892 udp
N/A 91.239.25.11:6892 udp
N/A 91.239.25.12:6892 udp
N/A 91.239.25.13:6892 udp
N/A 91.239.25.14:6892 udp
N/A 91.239.25.15:6892 udp
N/A 91.239.25.16:6892 udp
N/A 91.239.25.17:6892 udp
N/A 91.239.25.18:6892 udp
N/A 91.239.25.19:6892 udp
N/A 91.239.25.20:6892 udp
N/A 91.239.25.21:6892 udp
N/A 91.239.25.22:6892 udp
N/A 91.239.25.23:6892 udp
N/A 91.239.25.24:6892 udp
N/A 91.239.25.25:6892 udp
N/A 91.239.25.26:6892 udp
N/A 91.239.25.27:6892 udp
N/A 91.239.25.28:6892 udp
N/A 91.239.25.29:6892 udp
N/A 91.239.25.30:6892 udp
N/A 91.239.25.31:6892 udp
N/A 91.239.25.32:6892 udp
N/A 91.239.25.33:6892 udp
N/A 91.239.25.34:6892 udp
N/A 91.239.25.35:6892 udp
N/A 91.239.25.36:6892 udp
N/A 91.239.25.37:6892 udp
N/A 91.239.25.38:6892 udp
N/A 91.239.25.39:6892 udp
N/A 91.239.25.40:6892 udp
N/A 91.239.25.41:6892 udp
N/A 91.239.25.42:6892 udp
N/A 91.239.25.43:6892 udp
N/A 91.239.25.44:6892 udp
N/A 91.239.25.45:6892 udp
N/A 91.239.25.46:6892 udp
N/A 91.239.25.47:6892 udp
N/A 91.239.25.48:6892 udp
N/A 91.239.25.49:6892 udp
N/A 91.239.25.50:6892 udp
N/A 91.239.25.51:6892 udp
N/A 91.239.25.52:6892 udp
N/A 91.239.25.53:6892 udp
N/A 91.239.25.54:6892 udp
N/A 91.239.25.55:6892 udp
N/A 91.239.25.56:6892 udp
N/A 91.239.25.57:6892 udp
N/A 91.239.25.58:6892 udp
N/A 91.239.25.59:6892 udp
N/A 91.239.25.60:6892 udp
N/A 91.239.25.61:6892 udp
N/A 91.239.25.62:6892 udp
N/A 91.239.25.63:6892 udp
N/A 91.239.25.64:6892 udp
N/A 91.239.25.65:6892 udp
N/A 91.239.25.66:6892 udp
N/A 91.239.25.67:6892 udp
N/A 91.239.25.68:6892 udp
N/A 91.239.25.69:6892 udp
N/A 91.239.25.70:6892 udp
N/A 91.239.25.71:6892 udp
N/A 91.239.25.72:6892 udp
N/A 91.239.25.73:6892 udp
N/A 91.239.25.74:6892 udp
N/A 91.239.25.75:6892 udp
N/A 91.239.25.76:6892 udp
N/A 91.239.25.77:6892 udp
N/A 91.239.25.78:6892 udp
N/A 91.239.25.79:6892 udp
N/A 91.239.25.80:6892 udp
N/A 91.239.25.81:6892 udp
N/A 91.239.25.82:6892 udp
N/A 91.239.25.83:6892 udp
N/A 91.239.25.84:6892 udp
N/A 91.239.25.85:6892 udp
N/A 91.239.25.86:6892 udp
N/A 91.239.25.87:6892 udp
N/A 91.239.25.88:6892 udp
N/A 91.239.25.89:6892 udp
N/A 91.239.25.90:6892 udp
N/A 91.239.25.91:6892 udp
N/A 91.239.25.92:6892 udp
N/A 91.239.25.93:6892 udp
N/A 91.239.25.94:6892 udp
N/A 91.239.25.95:6892 udp
N/A 91.239.25.96:6892 udp
N/A 91.239.25.97:6892 udp
N/A 91.239.25.98:6892 udp
N/A 91.239.25.99:6892 udp
N/A 91.239.25.100:6892 udp
N/A 91.239.25.101:6892 udp
N/A 91.239.25.102:6892 udp
N/A 91.239.25.103:6892 udp
N/A 91.239.25.104:6892 udp
N/A 91.239.25.105:6892 udp
N/A 91.239.25.106:6892 udp
N/A 91.239.25.107:6892 udp
N/A 91.239.25.108:6892 udp
N/A 91.239.25.109:6892 udp
N/A 91.239.25.110:6892 udp
N/A 91.239.25.111:6892 udp
N/A 91.239.25.112:6892 udp
N/A 91.239.25.113:6892 udp
N/A 91.239.25.114:6892 udp
N/A 91.239.25.115:6892 udp
N/A 91.239.25.116:6892 udp
N/A 91.239.25.117:6892 udp
N/A 91.239.25.118:6892 udp
N/A 91.239.25.119:6892 udp
N/A 91.239.25.120:6892 udp
N/A 91.239.25.121:6892 udp
N/A 91.239.25.122:6892 udp
N/A 91.239.25.123:6892 udp
N/A 91.239.25.124:6892 udp
N/A 91.239.25.125:6892 udp
N/A 91.239.25.126:6892 udp
N/A 91.239.25.127:6892 udp
N/A 91.239.25.128:6892 udp
N/A 91.239.25.129:6892 udp
N/A 91.239.25.130:6892 udp
N/A 91.239.25.131:6892 udp
N/A 91.239.25.132:6892 udp
N/A 91.239.25.133:6892 udp
N/A 91.239.25.134:6892 udp
N/A 91.239.25.135:6892 udp
N/A 91.239.25.136:6892 udp
N/A 91.239.25.137:6892 udp
N/A 91.239.25.138:6892 udp
N/A 91.239.25.139:6892 udp
N/A 91.239.25.140:6892 udp
N/A 91.239.25.141:6892 udp
N/A 91.239.25.142:6892 udp
N/A 91.239.25.143:6892 udp
N/A 91.239.25.144:6892 udp
N/A 91.239.25.145:6892 udp
N/A 91.239.25.146:6892 udp
N/A 91.239.25.147:6892 udp
N/A 91.239.25.148:6892 udp
N/A 91.239.25.149:6892 udp
N/A 91.239.25.150:6892 udp
N/A 91.239.25.151:6892 udp
N/A 91.239.25.152:6892 udp
N/A 91.239.25.153:6892 udp
N/A 91.239.25.154:6892 udp
N/A 91.239.25.155:6892 udp
N/A 91.239.25.156:6892 udp
N/A 91.239.25.157:6892 udp
N/A 91.239.25.158:6892 udp
N/A 91.239.25.159:6892 udp
N/A 91.239.25.160:6892 udp
N/A 91.239.25.161:6892 udp
N/A 91.239.25.162:6892 udp
N/A 91.239.25.163:6892 udp
N/A 91.239.25.164:6892 udp
N/A 91.239.25.165:6892 udp
N/A 91.239.25.166:6892 udp
N/A 91.239.25.167:6892 udp
N/A 91.239.25.168:6892 udp
N/A 91.239.25.169:6892 udp
N/A 91.239.25.170:6892 udp
N/A 91.239.25.171:6892 udp
N/A 91.239.25.172:6892 udp
N/A 91.239.25.173:6892 udp
N/A 91.239.25.174:6892 udp
N/A 91.239.25.175:6892 udp
N/A 91.239.25.176:6892 udp
N/A 91.239.25.177:6892 udp
N/A 91.239.25.178:6892 udp
N/A 91.239.25.179:6892 udp
N/A 91.239.25.180:6892 udp
N/A 91.239.25.181:6892 udp
N/A 91.239.25.182:6892 udp
N/A 91.239.25.183:6892 udp
N/A 91.239.25.184:6892 udp
N/A 91.239.25.185:6892 udp
N/A 91.239.25.186:6892 udp
N/A 91.239.25.187:6892 udp
N/A 91.239.25.188:6892 udp
N/A 91.239.25.189:6892 udp
N/A 91.239.25.190:6892 udp
N/A 91.239.25.191:6892 udp
N/A 91.239.25.192:6892 udp
N/A 91.239.25.193:6892 udp
N/A 91.239.25.194:6892 udp
N/A 91.239.25.195:6892 udp
N/A 91.239.25.196:6892 udp
N/A 91.239.25.197:6892 udp
N/A 91.239.25.198:6892 udp
N/A 91.239.25.199:6892 udp
N/A 91.239.25.200:6892 udp
N/A 91.239.25.201:6892 udp
N/A 91.239.25.202:6892 udp
N/A 91.239.25.203:6892 udp
N/A 91.239.25.204:6892 udp
N/A 91.239.25.205:6892 udp
N/A 91.239.25.206:6892 udp
N/A 91.239.25.207:6892 udp
N/A 91.239.25.208:6892 udp
N/A 91.239.25.209:6892 udp
N/A 91.239.25.210:6892 udp
N/A 91.239.25.211:6892 udp
N/A 91.239.25.212:6892 udp
N/A 91.239.25.213:6892 udp
N/A 91.239.25.214:6892 udp
N/A 91.239.25.215:6892 udp
N/A 91.239.25.216:6892 udp
N/A 91.239.25.217:6892 udp
N/A 91.239.25.218:6892 udp
N/A 91.239.25.219:6892 udp
N/A 91.239.25.220:6892 udp
N/A 91.239.25.221:6892 udp
N/A 91.239.25.222:6892 udp
N/A 91.239.25.223:6892 udp
N/A 91.239.25.224:6892 udp
N/A 91.239.25.225:6892 udp
N/A 91.239.25.226:6892 udp
N/A 91.239.25.227:6892 udp
N/A 91.239.25.228:6892 udp
N/A 91.239.25.229:6892 udp
N/A 91.239.25.230:6892 udp
N/A 91.239.25.231:6892 udp
N/A 91.239.25.232:6892 udp
N/A 91.239.25.233:6892 udp
N/A 91.239.25.234:6892 udp
N/A 91.239.25.235:6892 udp
N/A 91.239.25.236:6892 udp
N/A 91.239.25.237:6892 udp
N/A 91.239.25.238:6892 udp
N/A 91.239.25.239:6892 udp
N/A 91.239.25.240:6892 udp
N/A 91.239.25.241:6892 udp
N/A 91.239.25.242:6892 udp
N/A 91.239.25.243:6892 udp
N/A 91.239.25.244:6892 udp
N/A 91.239.25.245:6892 udp
N/A 91.239.25.246:6892 udp
N/A 91.239.25.247:6892 udp
N/A 91.239.25.248:6892 udp
N/A 91.239.25.249:6892 udp
N/A 91.239.25.250:6892 udp
N/A 91.239.25.251:6892 udp
N/A 91.239.25.252:6892 udp
N/A 91.239.25.253:6892 udp
N/A 91.239.25.254:6892 udp
N/A 91.239.25.255:6892 udp
N/A 8.8.8.8:53 api.blockcypher.com udp
N/A 104.20.21.251:80 api.blockcypher.com tcp
N/A 8.8.8.8:53 btc.blockr.io udp
N/A 8.8.8.8:53 bitaps.com udp
N/A 178.128.255.179:443 bitaps.com tcp
N/A 8.8.8.8:53 chain.so udp
N/A 104.24.105.254:443 chain.so tcp
N/A 8.8.8.8:53 sochain.com udp
N/A 104.26.14.247:443 sochain.com tcp
N/A 8.8.8.8:53 p27dokhpz2n7nvgr.1lseoi.top udp

Files

\Users\Admin\AppData\Local\Temp\nsi40CA.tmp\System.dll

MD5 a4dd044bcd94e9b3370ccf095b31f896
SHA1 17c78201323ab2095bc53184aa8267c9187d5173
SHA256 2e226715419a5882e2e14278940ee8ef0aa648a3ef7af5b3dc252674111962bc
SHA512 87335a43b9ca13e1300c7c23e702e87c669e2bcf4f6065f0c684fc53165e9c1f091cc4d79a3eca3910f0518d3b647120ac0be1a68eaade2e75eaa64adfc92c5a

memory/4076-1-0x0000000000400000-0x0000000000441000-memory.dmp

memory/424-2-0x0000000000400000-0x0000000000436000-memory.dmp

memory/424-3-0x000000000040305B-mapping.dmp

memory/424-4-0x0000000000400000-0x0000000000436000-memory.dmp

memory/4076-5-0x0000000004790000-0x00000000047C6000-memory.dmp

memory/1360-6-0x0000000000000000-mapping.dmp

C:\Users\Admin\Desktop\_WV6WJNY_README_.hta

MD5 c415aff6eac4751c76544037adae2456
SHA1 1130e0c826a465fcb8a027de8b764014fb144a7e
SHA256 6c8681eaa259f2aef5b9e45f4327bc84f5ac1ab96c2bd020d437c81b8e095414
SHA512 642c0b03e884dc66d9f985e0294a38e2687621835bc4040c5d6f9db9e287e4ce1c2f5ee72c6bca61b5078a30c6f76e9c3fcf820f50c08d384375a16e9fc3a202

memory/3892-8-0x0000000000000000-mapping.dmp

memory/3508-9-0x0000000000000000-mapping.dmp

memory/3628-10-0x0000000000000000-mapping.dmp