Analysis Overview
SHA256
203100dffe14333162faeaee7a57b6ac484ee4b03351811921a03471d4ab78be
Threat Level: Known bad
The file 203100dffe14333162faeaee7a57b6ac484ee4b03351811921a03471d4ab78be was found to be: Known bad.
Malicious Activity Summary
Modifies WinLogon for persistence
simda
Simda family
Executes dropped EXE
Loads dropped DLL
Modifies WinLogon
Drops file in Windows directory
System Location Discovery: System Language Discovery
Suspicious behavior: RenamesItself
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-11-05 20:25
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-11-05 20:25
Reported
2024-11-05 20:28
Platform
win7-20241010-en
Max time kernel
142s
Max time network
152s
Command Line
Signatures
Modifies WinLogon for persistence
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\apppatch\\svchost.exe," | C:\Windows\apppatch\svchost.exe | N/A |
Simda family
simda
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\apppatch\svchost.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\203100dffe14333162faeaee7a57b6ac484ee4b03351811921a03471d4ab78be.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\203100dffe14333162faeaee7a57b6ac484ee4b03351811921a03471d4ab78be.exe | N/A |
Modifies WinLogon
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\b7b59b30 = "M]B\x19'«A€±\x199¡]^¯\x03±†gôF\x01.ªúl\t jmð'N§ç\u008d`÷vº.\x15ð\x15—¯\x02mÇM\x1dÀ\x16. Š\x1dÕu_e6Í‚\x17Ïh¶Þµæºgâ-ßf¯½Ž&\x7fŸw>Å……àV_>Õÿ¢B½]=×â—M¦çE\x05·¥\x12Ïš\x0eönÅ\u0090†î\u00adåØGͧ:võHß\u008dîþŠ\x1dN-þ\r\x10\u008fÝ‚µ\x0en=\x7ff}G.¾.x=\x12f\u008f:–\"òFv\u008fV\a¥õŸ¶½\u0090Gî¯\x17R¾RŸ6ˆ–¥b?%EºøUï\x16–V•ψ°¿u\"\u00adf8\x1d˜\u00a0F\u009d\x7fÕGÝ\u00a0\u00ad¥õ§m\u009db\x15ß`\x15§ˆv\x7f¦îV\x1fï\x7fØÎ\x16¾\n†\x15Þßbwµš5Ïý\nÕ¾\x05&" | C:\Users\Admin\AppData\Local\Temp\203100dffe14333162faeaee7a57b6ac484ee4b03351811921a03471d4ab78be.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\b7b59b30 = "M]B\x19'«A€±\x199¡]^¯\x03±†gôF\x01.ªúl\t jmð'N§ç\u008d`÷vº.\x15ð\x15—¯\x02mÇM\x1dÀ\x16. Š\x1dÕu_e6Í‚\x17Ïh¶Þµæºgâ-ßf¯½Ž&\x7fŸw>Å……àV_>Õÿ¢B½]=×â—M¦çE\x05·¥\x12Ïš\x0eönÅ\u0090†î\u00adåØGͧ:võHß\u008dîþŠ\x1dN-þ\r\x10\u008fÝ‚µ\x0en=\x7ff}G.¾.x=\x12f\u008f:–\"òFv\u008fV\a¥õŸ¶½\u0090Gî¯\x17R¾RŸ6ˆ–¥b?%EºøUï\x16–V•ψ°¿u\"\u00adf8\x1d˜\u00a0F\u009d\x7fÕGÝ\u00a0\u00ad¥õ§m\u009db\x15ß`\x15§ˆv\x7f¦îV\x1fï\x7fØÎ\x16¾\n†\x15Þßbwµš5Ïý\nÕ¾\x05&" | C:\Windows\apppatch\svchost.exe | N/A |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\apppatch\svchost.exe | C:\Users\Admin\AppData\Local\Temp\203100dffe14333162faeaee7a57b6ac484ee4b03351811921a03471d4ab78be.exe | N/A |
| File opened for modification | C:\Windows\apppatch\svchost.exe | C:\Users\Admin\AppData\Local\Temp\203100dffe14333162faeaee7a57b6ac484ee4b03351811921a03471d4ab78be.exe | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\203100dffe14333162faeaee7a57b6ac484ee4b03351811921a03471d4ab78be.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\apppatch\svchost.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\203100dffe14333162faeaee7a57b6ac484ee4b03351811921a03471d4ab78be.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2004 wrote to memory of 2868 | N/A | C:\Users\Admin\AppData\Local\Temp\203100dffe14333162faeaee7a57b6ac484ee4b03351811921a03471d4ab78be.exe | C:\Windows\apppatch\svchost.exe |
| PID 2004 wrote to memory of 2868 | N/A | C:\Users\Admin\AppData\Local\Temp\203100dffe14333162faeaee7a57b6ac484ee4b03351811921a03471d4ab78be.exe | C:\Windows\apppatch\svchost.exe |
| PID 2004 wrote to memory of 2868 | N/A | C:\Users\Admin\AppData\Local\Temp\203100dffe14333162faeaee7a57b6ac484ee4b03351811921a03471d4ab78be.exe | C:\Windows\apppatch\svchost.exe |
| PID 2004 wrote to memory of 2868 | N/A | C:\Users\Admin\AppData\Local\Temp\203100dffe14333162faeaee7a57b6ac484ee4b03351811921a03471d4ab78be.exe | C:\Windows\apppatch\svchost.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\203100dffe14333162faeaee7a57b6ac484ee4b03351811921a03471d4ab78be.exe
"C:\Users\Admin\AppData\Local\Temp\203100dffe14333162faeaee7a57b6ac484ee4b03351811921a03471d4ab78be.exe"
C:\Windows\apppatch\svchost.exe
"C:\Windows\apppatch\svchost.exe"
Network
| Country | Destination | Domain | Proto |
| GB | 92.123.128.186:80 | www.bing.com | tcp |
| US | 8.8.8.8:53 | vojyqem.com | udp |
| US | 8.8.8.8:53 | pujyjav.com | udp |
| US | 8.8.8.8:53 | vopybyt.com | udp |
| US | 8.8.8.8:53 | ganypih.com | udp |
| US | 8.8.8.8:53 | qekykev.com | udp |
| US | 8.8.8.8:53 | lysynur.com | udp |
| US | 8.8.8.8:53 | pumypog.com | udp |
| US | 8.8.8.8:53 | volykyc.com | udp |
| US | 8.8.8.8:53 | gadyniw.com | udp |
| US | 8.8.8.8:53 | gatyfus.com | udp |
| US | 8.8.8.8:53 | qeqysag.com | udp |
| US | 8.8.8.8:53 | lyxylux.com | udp |
| US | 8.8.8.8:53 | pufymoq.com | udp |
| US | 8.8.8.8:53 | vowydef.com | udp |
| US | 8.8.8.8:53 | gacyzuz.com | udp |
| US | 8.8.8.8:53 | qegyqaq.com | udp |
| US | 8.8.8.8:53 | lyryfyd.com | udp |
| US | 8.8.8.8:53 | puvyxil.com | udp |
| US | 8.8.8.8:53 | lyvytuj.com | udp |
| US | 8.8.8.8:53 | qetyvep.com | udp |
| US | 8.8.8.8:53 | gahyhob.com | udp |
| US | 8.8.8.8:53 | vocyruk.com | udp |
| US | 8.8.8.8:53 | purycap.com | udp |
| US | 8.8.8.8:53 | lygygin.com | udp |
| US | 8.8.8.8:53 | qexyryl.com | udp |
| US | 8.8.8.8:53 | gaqycos.com | udp |
| US | 8.8.8.8:53 | vofygum.com | udp |
| US | 8.8.8.8:53 | puzywel.com | udp |
| US | 8.8.8.8:53 | lymyxid.com | udp |
| US | 8.8.8.8:53 | qedyfyq.com | udp |
| US | 8.8.8.8:53 | lyvyxor.com | udp |
| US | 8.8.8.8:53 | galyqaz.com | udp |
| US | 8.8.8.8:53 | qetyfuv.com | udp |
| US | 8.8.8.8:53 | gahyqah.com | udp |
| US | 8.8.8.8:53 | vonyzuf.com | udp |
| US | 8.8.8.8:53 | qexylup.com | udp |
| US | 8.8.8.8:53 | gaqydeb.com | udp |
| US | 8.8.8.8:53 | vocyzit.com | udp |
| US | 8.8.8.8:53 | vofymik.com | udp |
| US | 8.8.8.8:53 | lygymoj.com | udp |
| US | 8.8.8.8:53 | purydyv.com | udp |
| US | 8.8.8.8:53 | puzylyp.com | udp |
| US | 8.8.8.8:53 | lymysan.com | udp |
| US | 8.8.8.8:53 | qedynul.com | udp |
| US | 8.8.8.8:53 | galykes.com | udp |
| US | 8.8.8.8:53 | vonypom.com | udp |
| US | 8.8.8.8:53 | pupybul.com | udp |
| US | 8.8.8.8:53 | lykyjad.com | udp |
| US | 8.8.8.8:53 | qebytiq.com | udp |
| US | 8.8.8.8:53 | gatyvyz.com | udp |
| US | 8.8.8.8:53 | vojyjof.com | udp |
| US | 8.8.8.8:53 | puvytuq.com | udp |
| US | 8.8.8.8:53 | lyryvex.com | udp |
| US | 8.8.8.8:53 | qegyhig.com | udp |
| US | 8.8.8.8:53 | gacyryw.com | udp |
| US | 8.8.8.8:53 | vowycac.com | udp |
| US | 8.8.8.8:53 | udp | |
| US | 8.8.8.8:53 | lyxywer.com | udp |
| US | 8.8.8.8:53 | qeqyxov.com | udp |
| US | 8.8.8.8:53 | gadyfuh.com | udp |
| US | 8.8.8.8:53 | volyqat.com | udp |
| US | 8.8.8.8:53 | pumyxiv.com | udp |
| US | 8.8.8.8:53 | lysyfyj.com | udp |
| US | 8.8.8.8:53 | qekyqop.com | udp |
| US | 8.8.8.8:53 | galyqaz.com | udp |
| US | 8.8.8.8:53 | puzylyp.com | udp |
| US | 8.8.8.8:53 | qegyhig.com | udp |
| US | 8.8.8.8:53 | vocyzit.com | udp |
| US | 8.8.8.8:53 | vonypom.com | udp |
| US | 8.8.8.8:53 | gahyqah.com | udp |
| US | 8.8.8.8:53 | vojyqem.com | udp |
| US | 8.8.8.8:53 | gatyfus.com | udp |
| US | 8.8.8.8:53 | qetyfuv.com | udp |
| US | 8.8.8.8:53 | gadyniw.com | udp |
| US | 8.8.8.8:53 | lymyxid.com | udp |
| US | 8.8.8.8:53 | lysyfyj.com | udp |
| US | 8.8.8.8:53 | lyvyxor.com | udp |
| US | 3.94.10.34:80 | lymyxid.com | tcp |
| DE | 178.162.203.202:80 | gatyfus.com | tcp |
| US | 172.234.222.143:80 | vojyqem.com | tcp |
| US | 199.191.50.83:80 | galyqaz.com | tcp |
| US | 69.162.80.55:80 | lysyfyj.com | tcp |
| US | 44.221.84.105:80 | qetyfuv.com | tcp |
| US | 162.255.119.102:80 | gahyqah.com | tcp |
| US | 99.83.170.3:80 | puzylyp.com | tcp |
| US | 104.21.30.183:80 | qegyhig.com | tcp |
| US | 208.100.26.245:80 | lyvyxor.com | tcp |
| US | 18.208.156.248:80 | vonypom.com | tcp |
| US | 44.221.84.105:80 | qetyfuv.com | tcp |
| HK | 154.212.231.82:80 | gadyniw.com | tcp |
| US | 99.83.170.3:80 | puzylyp.com | tcp |
| US | 172.234.222.143:80 | vojyqem.com | tcp |
| US | 8.8.8.8:53 | www.gahyqah.com | udp |
| US | 104.21.30.183:443 | qegyhig.com | tcp |
| DE | 91.195.240.19:80 | www.gahyqah.com | tcp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| GB | 142.250.187.227:80 | c.pki.goog | tcp |
| US | 104.21.30.183:443 | qegyhig.com | tcp |
| NL | 5.79.71.205:80 | gatyfus.com | tcp |
| DE | 178.162.217.107:80 | gatyfus.com | tcp |
| DE | 178.162.203.211:80 | gatyfus.com | tcp |
| NL | 85.17.31.122:80 | gatyfus.com | tcp |
| US | 8.8.8.8:53 | pupydeq.com | udp |
| US | 8.8.8.8:53 | lykymox.com | udp |
| US | 8.8.8.8:53 | qebylug.com | udp |
| US | 8.8.8.8:53 | gatydaw.com | udp |
| US | 8.8.8.8:53 | vojymic.com | udp |
| US | 8.8.8.8:53 | puvylyg.com | udp |
| US | 8.8.8.8:53 | lyrysor.com | udp |
| US | 8.8.8.8:53 | qegynuv.com | udp |
| US | 8.8.8.8:53 | vowypit.com | udp |
| US | 8.8.8.8:53 | gacykeh.com | udp |
| US | 8.8.8.8:53 | pufybyv.com | udp |
| US | 8.8.8.8:53 | lyxyjaj.com | udp |
| US | 8.8.8.8:53 | qeqytup.com | udp |
| US | 8.8.8.8:53 | gadyveb.com | udp |
| US | 8.8.8.8:53 | volyjok.com | udp |
| US | 8.8.8.8:53 | pumytup.com | udp |
| US | 8.8.8.8:53 | lysyvan.com | udp |
| US | 8.8.8.8:53 | qekyhil.com | udp |
| US | 8.8.8.8:53 | ganyrys.com | udp |
| US | 8.8.8.8:53 | vopycom.com | udp |
| US | 8.8.8.8:53 | pujygul.com | udp |
| US | 8.8.8.8:53 | qetyxiq.com | udp |
| US | 8.8.8.8:53 | lyvywed.com | udp |
| US | 8.8.8.8:53 | gahyfyz.com | udp |
| US | 8.8.8.8:53 | vocyqaf.com | udp |
| US | 8.8.8.8:53 | puryxuq.com | udp |
| US | 8.8.8.8:53 | lygyfex.com | udp |
| US | 8.8.8.8:53 | qexyqog.com | udp |
| US | 8.8.8.8:53 | gaqyzuw.com | udp |
| US | 8.8.8.8:53 | vofydac.com | udp |
| US | 8.8.8.8:53 | ganyzub.com | udp |
| US | 8.8.8.8:53 | vopydek.com | udp |
| US | 8.8.8.8:53 | pujymip.com | udp |
| US | 8.8.8.8:53 | lyvylyn.com | udp |
| US | 8.8.8.8:53 | qetysal.com | udp |
| US | 8.8.8.8:53 | gahynus.com | udp |
| US | 8.8.8.8:53 | lysyvan.com | udp |
| US | 8.8.8.8:53 | vocykem.com | udp |
| US | 8.8.8.8:53 | purypol.com | udp |
| US | 8.8.8.8:53 | lygynud.com | udp |
| US | 8.8.8.8:53 | qexykaq.com | udp |
| US | 104.21.26.151:80 | lysyvan.com | tcp |
| US | 8.8.8.8:53 | gaqypiz.com | udp |
| US | 8.8.8.8:53 | vofybyf.com | udp |
| US | 8.8.8.8:53 | puzyjoq.com | udp |
| US | 8.8.8.8:53 | lymytux.com | udp |
| US | 8.8.8.8:53 | qedyveg.com | udp |
| US | 8.8.8.8:53 | lygynud.com | udp |
| US | 8.8.8.8:53 | galyhiw.com | udp |
| US | 8.8.8.8:53 | vonyryc.com | udp |
| US | 8.8.8.8:53 | pupycag.com | udp |
| US | 8.8.8.8:53 | lykygur.com | udp |
| US | 8.8.8.8:53 | qebyrev.com | udp |
| US | 8.8.8.8:53 | gatycoh.com | udp |
| US | 8.8.8.8:53 | vojygut.com | udp |
| US | 104.155.138.21:80 | lygynud.com | tcp |
| US | 8.8.8.8:53 | puvywav.com | udp |
| US | 8.8.8.8:53 | lyryxij.com | udp |
| US | 8.8.8.8:53 | qegyfyp.com | udp |
| US | 8.8.8.8:53 | gacyqob.com | udp |
| US | 8.8.8.8:53 | vowyzuk.com | udp |
| US | 8.8.8.8:53 | pufydep.com | udp |
| US | 8.8.8.8:53 | lyxymin.com | udp |
| US | 8.8.8.8:53 | puzymig.com | udp |
| US | 8.8.8.8:53 | lymylyr.com | udp |
| US | 8.8.8.8:53 | qeqylyl.com | udp |
| US | 8.8.8.8:53 | pupycag.com | udp |
| US | 8.8.8.8:53 | gadydas.com | udp |
| US | 8.8.8.8:53 | volymum.com | udp |
| US | 18.208.156.248:80 | pupycag.com | tcp |
| US | 104.21.26.151:443 | lysyvan.com | tcp |
| US | 8.8.8.8:53 | pupydeq.com | udp |
| US | 13.248.169.48:80 | pupydeq.com | tcp |
| US | 8.8.8.8:53 | lyrysor.com | udp |
| CN | 103.150.10.48:80 | lyrysor.com | tcp |
| US | 104.21.26.151:443 | lysyvan.com | tcp |
| US | 13.248.169.48:80 | pupydeq.com | tcp |
| CN | 103.150.10.48:80 | lyrysor.com | tcp |
| US | 8.8.8.8:53 | qedysov.com | udp |
| US | 8.8.8.8:53 | vonyket.com | udp |
| US | 8.8.8.8:53 | galynuh.com | udp |
| US | 8.8.8.8:53 | pupypiv.com | udp |
| US | 8.8.8.8:53 | lykynyj.com | udp |
| US | 8.8.8.8:53 | vojybek.com | udp |
| US | 8.8.8.8:53 | gatypub.com | udp |
| US | 8.8.8.8:53 | puvyjop.com | udp |
| US | 8.8.8.8:53 | lyrytun.com | udp |
| US | 8.8.8.8:53 | qegyval.com | udp |
| US | 8.8.8.8:53 | gacyhis.com | udp |
| US | 8.8.8.8:53 | vowyrym.com | udp |
| US | 8.8.8.8:53 | pufycol.com | udp |
| US | 8.8.8.8:53 | lyxygud.com | udp |
| US | 8.8.8.8:53 | qeqyreq.com | udp |
| US | 8.8.8.8:53 | gadyciz.com | udp |
| US | 8.8.8.8:53 | volygyf.com | udp |
| US | 8.8.8.8:53 | pumywaq.com | udp |
| US | 8.8.8.8:53 | lysyxux.com | udp |
| US | 8.8.8.8:53 | qekyfeg.com | udp |
| US | 8.8.8.8:53 | vopyzuc.com | udp |
| US | 8.8.8.8:53 | ganyqow.com | udp |
| US | 8.8.8.8:53 | pujydag.com | udp |
| US | 8.8.8.8:53 | lyvymir.com | udp |
| US | 8.8.8.8:53 | qetylyv.com | udp |
| US | 8.8.8.8:53 | gahydoh.com | udp |
| US | 8.8.8.8:53 | vocymut.com | udp |
| US | 8.8.8.8:53 | purylev.com | udp |
| US | 8.8.8.8:53 | qexynyp.com | udp |
| US | 8.8.8.8:53 | lygysij.com | udp |
| US | 8.8.8.8:53 | gaqykab.com | udp |
| US | 8.8.8.8:53 | pumylel.com | udp |
| US | 8.8.8.8:53 | lysysod.com | udp |
| US | 8.8.8.8:53 | qekynuq.com | udp |
| US | 8.8.8.8:53 | ganykaz.com | udp |
| US | 8.8.8.8:53 | vopypif.com | udp |
| US | 8.8.8.8:53 | pujybyq.com | udp |
| US | 8.8.8.8:53 | lyvyjox.com | udp |
| US | 8.8.8.8:53 | qetytug.com | udp |
| US | 8.8.8.8:53 | gahyvew.com | udp |
| US | 8.8.8.8:53 | vocyjic.com | udp |
| US | 8.8.8.8:53 | purytyg.com | udp |
| US | 8.8.8.8:53 | lygyvar.com | udp |
| US | 8.8.8.8:53 | qexyhuv.com | udp |
| US | 8.8.8.8:53 | gaqyreh.com | udp |
| US | 8.8.8.8:53 | vofycot.com | udp |
| US | 8.8.8.8:53 | puzyguv.com | udp |
| US | 8.8.8.8:53 | lymywaj.com | udp |
| US | 8.8.8.8:53 | qedyxip.com | udp |
| US | 8.8.8.8:53 | galyfyb.com | udp |
| US | 8.8.8.8:53 | vonyqok.com | udp |
| US | 8.8.8.8:53 | pupyxup.com | udp |
| US | 8.8.8.8:53 | lykyfen.com | udp |
| US | 8.8.8.8:53 | qebyqil.com | udp |
| US | 8.8.8.8:53 | gatyzys.com | udp |
| US | 8.8.8.8:53 | vojydam.com | udp |
| US | 8.8.8.8:53 | puvymul.com | udp |
| US | 8.8.8.8:53 | lyryled.com | udp |
| US | 8.8.8.8:53 | qegysoq.com | udp |
| US | 8.8.8.8:53 | gacynuz.com | udp |
| US | 8.8.8.8:53 | vowykaf.com | udp |
| US | 8.8.8.8:53 | pufypiq.com | udp |
| US | 8.8.8.8:53 | lyxynyx.com | udp |
| US | 8.8.8.8:53 | galynuh.com | udp |
| US | 64.225.91.73:80 | galynuh.com | tcp |
| US | 8.8.8.8:53 | lyxynyx.com | udp |
| US | 103.224.212.210:80 | lyxynyx.com | tcp |
| US | 8.8.8.8:53 | qexyhuv.com | udp |
| US | 8.8.8.8:53 | vofycot.com | udp |
| US | 8.8.8.8:53 | gadyciz.com | udp |
| US | 103.224.182.252:80 | vofycot.com | tcp |
| US | 13.248.213.45:80 | qexyhuv.com | tcp |
| US | 44.221.84.105:80 | gadyciz.com | tcp |
| US | 8.8.8.8:53 | ww25.lyxynyx.com | udp |
| US | 8.8.8.8:53 | qegyval.com | udp |
| US | 199.59.243.227:80 | ww25.lyxynyx.com | tcp |
| US | 8.8.8.8:53 | ww16.vofycot.com | udp |
| DE | 64.190.63.136:80 | ww16.vofycot.com | tcp |
| HK | 154.85.183.50:80 | qegyval.com | tcp |
| US | 13.248.213.45:80 | qexyhuv.com | tcp |
| HK | 154.85.183.50:80 | qegyval.com | tcp |
Files
memory/2004-1-0x0000000000230000-0x0000000000281000-memory.dmp
memory/2004-0-0x0000000000400000-0x00000000004C7000-memory.dmp
memory/2004-2-0x0000000000400000-0x000000000045F000-memory.dmp
\Windows\AppPatch\svchost.exe
| MD5 | 49fcee7a204430faad086c633c472765 |
| SHA1 | 298757dff1fb5eae76da2232c498157aa3514c14 |
| SHA256 | b8137fe04482339c9c11191efb710e833161c0a176bab342a1002c63a3154709 |
| SHA512 | e15af6d4119509c5e12bff81244192e395610f51b717553b8358908ffab959b939250e1cab4715e4ea3ab7b9ebaa512505152b7d2b0728be2bab18c05a6e975e |
memory/2868-19-0x0000000000400000-0x00000000004C7000-memory.dmp
memory/2004-18-0x0000000000400000-0x000000000045F000-memory.dmp
memory/2868-20-0x0000000000400000-0x00000000004C7000-memory.dmp
memory/2004-17-0x0000000000230000-0x0000000000281000-memory.dmp
memory/2004-16-0x0000000000400000-0x00000000004C7000-memory.dmp
memory/2868-21-0x0000000000400000-0x00000000004C7000-memory.dmp
memory/2868-30-0x00000000023C0000-0x0000000002468000-memory.dmp
memory/2868-28-0x00000000023C0000-0x0000000002468000-memory.dmp
memory/2868-26-0x00000000023C0000-0x0000000002468000-memory.dmp
memory/2868-24-0x00000000023C0000-0x0000000002468000-memory.dmp
memory/2868-22-0x00000000023C0000-0x0000000002468000-memory.dmp
memory/2868-32-0x00000000023C0000-0x0000000002468000-memory.dmp
memory/2868-33-0x0000000000400000-0x00000000004C7000-memory.dmp
memory/2868-34-0x0000000002570000-0x0000000002626000-memory.dmp
memory/2868-38-0x0000000002570000-0x0000000002626000-memory.dmp
memory/2868-36-0x0000000002570000-0x0000000002626000-memory.dmp
memory/2868-49-0x0000000002570000-0x0000000002626000-memory.dmp
memory/2868-52-0x0000000002570000-0x0000000002626000-memory.dmp
memory/2868-84-0x0000000002570000-0x0000000002626000-memory.dmp
memory/2868-83-0x0000000002570000-0x0000000002626000-memory.dmp
memory/2868-82-0x0000000002570000-0x0000000002626000-memory.dmp
memory/2868-81-0x0000000002570000-0x0000000002626000-memory.dmp
memory/2868-80-0x0000000002570000-0x0000000002626000-memory.dmp
memory/2868-79-0x0000000002570000-0x0000000002626000-memory.dmp
memory/2868-78-0x0000000002570000-0x0000000002626000-memory.dmp
memory/2868-77-0x0000000002570000-0x0000000002626000-memory.dmp
memory/2868-76-0x0000000002570000-0x0000000002626000-memory.dmp
memory/2868-75-0x0000000002570000-0x0000000002626000-memory.dmp
memory/2868-73-0x0000000002570000-0x0000000002626000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\9AF0.tmp
| MD5 | 48557ceb18a79faa7ed5038232f92be7 |
| SHA1 | 9ba0b8f846f4a6f609ff814afd67336c44a7e3a4 |
| SHA256 | 2999de9abbb9cf9b64da946305585ef7aafe83cf2556a6fcf194297e1965f336 |
| SHA512 | 6955726cc05aa5f308c9a4700df9a5d8cf7dc6b6296898c310ff7f39ac49df62641556ebb5627d73abb2f1d73162926ab65e2899f215881279312b87a9e15067 |
memory/2868-72-0x0000000002570000-0x0000000002626000-memory.dmp
memory/2868-71-0x0000000002570000-0x0000000002626000-memory.dmp
memory/2868-70-0x0000000002570000-0x0000000002626000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\9ADD.tmp
| MD5 | ea56b80947a964ab16afca2f2b3c40c5 |
| SHA1 | 7cdd22d544d48b6bb0d7e03443b1e85a1b44f903 |
| SHA256 | e3e514fddbea8bda457ca5a9ec4564cd75a72441171f398333894aeb067fe223 |
| SHA512 | 2ca40d0d561533bfd0a13f0101f011c2dfca21508f83d9e17178c73388a4f8b3aff29b6c17587d275c2aa5f37eab84ec6eefaf59f5c6b8b7227a8a3b942f1ece |
memory/2868-69-0x0000000002570000-0x0000000002626000-memory.dmp
memory/2868-68-0x0000000002570000-0x0000000002626000-memory.dmp
memory/2868-67-0x0000000002570000-0x0000000002626000-memory.dmp
memory/2868-66-0x0000000002570000-0x0000000002626000-memory.dmp
memory/2868-65-0x0000000002570000-0x0000000002626000-memory.dmp
memory/2868-64-0x0000000002570000-0x0000000002626000-memory.dmp
memory/2868-63-0x0000000002570000-0x0000000002626000-memory.dmp
memory/2868-61-0x0000000002570000-0x0000000002626000-memory.dmp
memory/2868-60-0x0000000002570000-0x0000000002626000-memory.dmp
memory/2868-59-0x0000000002570000-0x0000000002626000-memory.dmp
memory/2868-57-0x0000000002570000-0x0000000002626000-memory.dmp
memory/2868-56-0x0000000002570000-0x0000000002626000-memory.dmp
memory/2868-55-0x0000000002570000-0x0000000002626000-memory.dmp
memory/2868-54-0x0000000002570000-0x0000000002626000-memory.dmp
memory/2868-53-0x0000000002570000-0x0000000002626000-memory.dmp
memory/2868-51-0x0000000002570000-0x0000000002626000-memory.dmp
memory/2868-50-0x0000000002570000-0x0000000002626000-memory.dmp
memory/2868-48-0x0000000002570000-0x0000000002626000-memory.dmp
memory/2868-46-0x0000000002570000-0x0000000002626000-memory.dmp
memory/2868-45-0x0000000002570000-0x0000000002626000-memory.dmp
memory/2868-44-0x0000000002570000-0x0000000002626000-memory.dmp
memory/2868-43-0x0000000002570000-0x0000000002626000-memory.dmp
memory/2868-42-0x0000000002570000-0x0000000002626000-memory.dmp
memory/2868-74-0x0000000002570000-0x0000000002626000-memory.dmp
memory/2868-40-0x0000000002570000-0x0000000002626000-memory.dmp
memory/2868-62-0x0000000002570000-0x0000000002626000-memory.dmp
memory/2868-58-0x0000000002570000-0x0000000002626000-memory.dmp
memory/2868-47-0x0000000002570000-0x0000000002626000-memory.dmp
memory/2868-41-0x0000000002570000-0x0000000002626000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\9B42.tmp
| MD5 | 0e1bc0cbefd2410491894cfd892ccfcf |
| SHA1 | c64d374fb7f026f1c143ab781409045f874ae679 |
| SHA256 | d5419ba2f6c2985dbfa1571c91c30f146357c502db4585c8d94fa411133f00ba |
| SHA512 | 08a2de6a84e40a5f1232604ed5091682ba3001291fc0ad7f3abedf08b44b1e75649bfc913af656dc0162ae048c3a1bfab9815b79b2fd449b302b46f5322506ed |
C:\Users\Admin\AppData\Local\Temp\436B.tmp
| MD5 | 926512864979bc27cf187f1de3f57aff |
| SHA1 | acdeb9d6187932613c7fa08eaf28f0cd8116f4b5 |
| SHA256 | b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f |
| SHA512 | f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b |
C:\Users\Admin\AppData\Local\Temp\439B.tmp
| MD5 | cdc3350868c4d9bcb27c16e24d9b43d5 |
| SHA1 | 21827d06d7ae5891bcdbfbaf385fe3132ea44991 |
| SHA256 | f99954d967b01c2348139f5e48e28158569c5f72e45e5c350149a5777f62cdaf |
| SHA512 | a338cad1b6ab52e2286cdf89cd1998f7dc5e5682cbc3f735e08c6d12bd1020cd4636dc5386d1ee58e20d4460cf3057066e30f921a4e56fef66c18805c804752e |
Analysis: behavioral2
Detonation Overview
Submitted
2024-11-05 20:25
Reported
2024-11-05 20:28
Platform
win10v2004-20241007-en
Max time kernel
149s
Max time network
150s
Command Line
Signatures
Modifies WinLogon for persistence
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\apppatch\\svchost.exe," | C:\Windows\apppatch\svchost.exe | N/A |
Simda family
simda
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\apppatch\svchost.exe | N/A |
Modifies WinLogon
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\555bb64e = "üO6\fÛ(~5–Òñ(Î#~\x10è\u008f²iá“àÎ}ªßƒWW³¢\x14\véŽ\x0f«kþZçr]Î^±\x04»GJ²\nÎÆÇ¿J\x1aéÁ\x11kN\x1c÷©\x0fçAŽ\x19é:‡]sy7Q¾V|“òªÑ̓º¶\u008f:вLó\x1fÁV]s\x1c÷òÏ}²Ã\x7fâÆT\x04‘\u008f¤ª\"2\\ªö>Ÿ\x11>4\rµÆª2’\x01_\"¶±\x13}%Ù‰âVÊùÆÌ“í²ƒ2’\vBnªå2QCÚO¼öîŒs\"U´šd*ƺ¾+Ì\u008dŽyu¢v\x13×^gÔײä6jl1κò>ÃÂz\u008drÄÊ\x17“ÞÉ\"â?iyÔZ\"R/ý.ºÎí\r+2Í\x1d$ºêâ»Ú)|¢ÌÌvRËl\"–:íEM‚l\x03." | C:\Users\Admin\AppData\Local\Temp\203100dffe14333162faeaee7a57b6ac484ee4b03351811921a03471d4ab78be.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\555bb64e = "üO6\fÛ(~5–Òñ(Î#~\x10è\u008f²iá“àÎ}ªßƒWW³¢\x14\véŽ\x0f«kþZçr]Î^±\x04»GJ²\nÎÆÇ¿J\x1aéÁ\x11kN\x1c÷©\x0fçAŽ\x19é:‡]sy7Q¾V|“òªÑ̓º¶\u008f:вLó\x1fÁV]s\x1c÷òÏ}²Ã\x7fâÆT\x04‘\u008f¤ª\"2\\ªö>Ÿ\x11>4\rµÆª2’\x01_\"¶±\x13}%Ù‰âVÊùÆÌ“í²ƒ2’\vBnªå2QCÚO¼öîŒs\"U´šd*ƺ¾+Ì\u008dŽyu¢v\x13×^gÔײä6jl1κò>ÃÂz\u008drÄÊ\x17“ÞÉ\"â?iyÔZ\"R/ý.ºÎí\r+2Í\x1d$ºêâ»Ú)|¢ÌÌvRËl\"–:íEM‚l\x03." | C:\Windows\apppatch\svchost.exe | N/A |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\apppatch\svchost.exe | C:\Users\Admin\AppData\Local\Temp\203100dffe14333162faeaee7a57b6ac484ee4b03351811921a03471d4ab78be.exe | N/A |
| File opened for modification | C:\Windows\apppatch\svchost.exe | C:\Users\Admin\AppData\Local\Temp\203100dffe14333162faeaee7a57b6ac484ee4b03351811921a03471d4ab78be.exe | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\203100dffe14333162faeaee7a57b6ac484ee4b03351811921a03471d4ab78be.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\apppatch\svchost.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\203100dffe14333162faeaee7a57b6ac484ee4b03351811921a03471d4ab78be.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2916 wrote to memory of 396 | N/A | C:\Users\Admin\AppData\Local\Temp\203100dffe14333162faeaee7a57b6ac484ee4b03351811921a03471d4ab78be.exe | C:\Windows\apppatch\svchost.exe |
| PID 2916 wrote to memory of 396 | N/A | C:\Users\Admin\AppData\Local\Temp\203100dffe14333162faeaee7a57b6ac484ee4b03351811921a03471d4ab78be.exe | C:\Windows\apppatch\svchost.exe |
| PID 2916 wrote to memory of 396 | N/A | C:\Users\Admin\AppData\Local\Temp\203100dffe14333162faeaee7a57b6ac484ee4b03351811921a03471d4ab78be.exe | C:\Windows\apppatch\svchost.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\203100dffe14333162faeaee7a57b6ac484ee4b03351811921a03471d4ab78be.exe
"C:\Users\Admin\AppData\Local\Temp\203100dffe14333162faeaee7a57b6ac484ee4b03351811921a03471d4ab78be.exe"
C:\Windows\apppatch\svchost.exe
"C:\Windows\apppatch\svchost.exe"
Network
| Country | Destination | Domain | Proto |
| GB | 92.123.128.164:80 | www.bing.com | tcp |
| US | 8.8.8.8:53 | gatyfus.com | udp |
| US | 8.8.8.8:53 | lyvyxor.com | udp |
| US | 8.8.8.8:53 | vojyqem.com | udp |
| US | 8.8.8.8:53 | qetyfuv.com | udp |
| US | 8.8.8.8:53 | puvyxil.com | udp |
| US | 8.8.8.8:53 | gahyqah.com | udp |
| US | 8.8.8.8:53 | lyryfyd.com | udp |
| US | 8.8.8.8:53 | vocyzit.com | udp |
| US | 8.8.8.8:53 | qegyqaq.com | udp |
| US | 8.8.8.8:53 | purydyv.com | udp |
| US | 8.8.8.8:53 | gacyzuz.com | udp |
| US | 8.8.8.8:53 | lygymoj.com | udp |
| US | 8.8.8.8:53 | vowydef.com | udp |
| US | 8.8.8.8:53 | qexylup.com | udp |
| US | 8.8.8.8:53 | gaqydeb.com | udp |
| US | 8.8.8.8:53 | pufymoq.com | udp |
| US | 8.8.8.8:53 | lyxylux.com | udp |
| US | 8.8.8.8:53 | vofymik.com | udp |
| US | 8.8.8.8:53 | qeqysag.com | udp |
| US | 8.8.8.8:53 | puzylyp.com | udp |
| US | 8.8.8.8:53 | gadyniw.com | udp |
| US | 8.8.8.8:53 | lymysan.com | udp |
| US | 8.8.8.8:53 | volykyc.com | udp |
| US | 8.8.8.8:53 | qedynul.com | udp |
| US | 8.8.8.8:53 | pumypog.com | udp |
| US | 8.8.8.8:53 | galykes.com | udp |
| US | 8.8.8.8:53 | lysynur.com | udp |
| US | 8.8.8.8:53 | vonypom.com | udp |
| US | 8.8.8.8:53 | qekykev.com | udp |
| US | 8.8.8.8:53 | pupybul.com | udp |
| US | 8.8.8.8:53 | ganypih.com | udp |
| US | 8.8.8.8:53 | lykyjad.com | udp |
| US | 8.8.8.8:53 | vopybyt.com | udp |
| US | 8.8.8.8:53 | qebytiq.com | udp |
| US | 8.8.8.8:53 | pujyjav.com | udp |
| US | 8.8.8.8:53 | gatyvyz.com | udp |
| US | 8.8.8.8:53 | lyvytuj.com | udp |
| US | 8.8.8.8:53 | vojyjof.com | udp |
| US | 8.8.8.8:53 | qetyvep.com | udp |
| US | 8.8.8.8:53 | puvytuq.com | udp |
| US | 8.8.8.8:53 | gahyhob.com | udp |
| US | 8.8.8.8:53 | lyryvex.com | udp |
| US | 8.8.8.8:53 | vocyruk.com | udp |
| US | 8.8.8.8:53 | qegyhig.com | udp |
| US | 8.8.8.8:53 | purycap.com | udp |
| US | 8.8.8.8:53 | gacyryw.com | udp |
| US | 8.8.8.8:53 | lygygin.com | udp |
| US | 8.8.8.8:53 | vowycac.com | udp |
| US | 8.8.8.8:53 | qexyryl.com | udp |
| US | 8.8.8.8:53 | pufygug.com | udp |
| US | 8.8.8.8:53 | gaqycos.com | udp |
| US | 8.8.8.8:53 | lyxywer.com | udp |
| US | 8.8.8.8:53 | vofygum.com | udp |
| US | 8.8.8.8:53 | qeqyxov.com | udp |
| US | 8.8.8.8:53 | puzywel.com | udp |
| US | 8.8.8.8:53 | gadyfuh.com | udp |
| US | 8.8.8.8:53 | volyqat.com | udp |
| US | 8.8.8.8:53 | lymyxid.com | udp |
| US | 8.8.8.8:53 | qedyfyq.com | udp |
| US | 8.8.8.8:53 | galyqaz.com | udp |
| US | 8.8.8.8:53 | pumyxiv.com | udp |
| US | 8.8.8.8:53 | lysyfyj.com | udp |
| US | 8.8.8.8:53 | vonyzuf.com | udp |
| US | 8.8.8.8:53 | qekyqop.com | udp |
| US | 8.8.8.8:53 | vojyqem.com | udp |
| US | 8.8.8.8:53 | lymyxid.com | udp |
| US | 172.234.222.138:80 | vojyqem.com | tcp |
| US | 8.8.8.8:53 | qegyhig.com | udp |
| US | 8.8.8.8:53 | gatyfus.com | udp |
| US | 8.8.8.8:53 | qetyfuv.com | udp |
| US | 8.8.8.8:53 | vocyzit.com | udp |
| US | 8.8.8.8:53 | gahyqah.com | udp |
| US | 8.8.8.8:53 | galyqaz.com | udp |
| US | 8.8.8.8:53 | lysyfyj.com | udp |
| US | 8.8.8.8:53 | lyvyxor.com | udp |
| US | 8.8.8.8:53 | puzylyp.com | udp |
| US | 3.94.10.34:80 | lymyxid.com | tcp |
| US | 69.162.80.55:80 | lysyfyj.com | tcp |
| US | 99.83.170.3:80 | puzylyp.com | tcp |
| NL | 5.79.71.205:80 | gatyfus.com | tcp |
| US | 104.21.30.183:80 | qegyhig.com | tcp |
| US | 23.253.46.64:80 | gahyqah.com | tcp |
| US | 208.100.26.245:80 | lyvyxor.com | tcp |
| US | 44.221.84.105:80 | vocyzit.com | tcp |
| US | 44.221.84.105:80 | vocyzit.com | tcp |
| US | 18.208.156.248:80 | vonypom.com | tcp |
| US | 199.191.50.83:80 | galyqaz.com | tcp |
| US | 172.234.222.138:80 | vojyqem.com | tcp |
| US | 23.253.46.64:80 | gahyqah.com | tcp |
| US | 99.83.170.3:443 | puzylyp.com | tcp |
| US | 104.21.30.183:443 | qegyhig.com | tcp |
| US | 8.8.8.8:53 | ww5.galyqaz.com | udp |
| US | 76.223.26.96:80 | ww5.galyqaz.com | tcp |
| US | 8.8.8.8:53 | 13.86.106.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 164.128.123.92.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 79.190.18.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 183.30.21.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 138.222.234.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 34.10.94.3.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 3.170.83.99.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 245.26.100.208.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 55.80.162.69.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 64.46.253.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 105.84.221.44.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 248.156.208.18.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 76.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 83.50.191.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 233.38.18.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 96.26.223.76.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 23.149.64.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | gadyniw.com | udp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| GB | 142.250.187.227:80 | c.pki.goog | tcp |
| HK | 154.212.231.82:80 | gadyniw.com | tcp |
| US | 8.8.8.8:53 | 205.71.79.5.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 97.17.167.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 227.187.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.35.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 82.231.212.154.in-addr.arpa | udp |
| US | 104.21.30.183:443 | qegyhig.com | tcp |
| US | 8.8.8.8:53 | 58.55.71.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 212.20.149.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 101.11.19.2.in-addr.arpa | udp |
| NL | 5.79.71.205:80 | gatyfus.com | tcp |
| US | 8.8.8.8:53 | 133.190.18.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | pupydeq.com | udp |
| US | 8.8.8.8:53 | ganyzub.com | udp |
| US | 8.8.8.8:53 | lykymox.com | udp |
| US | 8.8.8.8:53 | vopydek.com | udp |
| US | 8.8.8.8:53 | qebylug.com | udp |
| US | 8.8.8.8:53 | pujymip.com | udp |
| US | 8.8.8.8:53 | gatydaw.com | udp |
| US | 8.8.8.8:53 | lyvylyn.com | udp |
| US | 8.8.8.8:53 | vojymic.com | udp |
| US | 8.8.8.8:53 | qetysal.com | udp |
| US | 8.8.8.8:53 | puvylyg.com | udp |
| US | 8.8.8.8:53 | gahynus.com | udp |
| US | 8.8.8.8:53 | vocykem.com | udp |
| US | 8.8.8.8:53 | qegynuv.com | udp |
| US | 8.8.8.8:53 | purypol.com | udp |
| US | 8.8.8.8:53 | gacykeh.com | udp |
| US | 8.8.8.8:53 | lygynud.com | udp |
| US | 8.8.8.8:53 | vowypit.com | udp |
| US | 8.8.8.8:53 | qexykaq.com | udp |
| US | 8.8.8.8:53 | pufybyv.com | udp |
| US | 8.8.8.8:53 | gaqypiz.com | udp |
| US | 8.8.8.8:53 | vofybyf.com | udp |
| US | 8.8.8.8:53 | lyxyjaj.com | udp |
| US | 8.8.8.8:53 | qeqytup.com | udp |
| US | 8.8.8.8:53 | puzyjoq.com | udp |
| US | 8.8.8.8:53 | gadyveb.com | udp |
| US | 8.8.8.8:53 | lymytux.com | udp |
| US | 8.8.8.8:53 | volyjok.com | udp |
| US | 8.8.8.8:53 | qedyveg.com | udp |
| US | 8.8.8.8:53 | pumytup.com | udp |
| US | 8.8.8.8:53 | galyhiw.com | udp |
| US | 8.8.8.8:53 | lysyvan.com | udp |
| US | 8.8.8.8:53 | vonyryc.com | udp |
| US | 8.8.8.8:53 | qekyhil.com | udp |
| US | 8.8.8.8:53 | pupycag.com | udp |
| US | 8.8.8.8:53 | ganyrys.com | udp |
| US | 8.8.8.8:53 | lykygur.com | udp |
| US | 8.8.8.8:53 | vopycom.com | udp |
| US | 8.8.8.8:53 | qebyrev.com | udp |
| US | 8.8.8.8:53 | pujygul.com | udp |
| US | 8.8.8.8:53 | gatycoh.com | udp |
| US | 8.8.8.8:53 | lyvywed.com | udp |
| US | 8.8.8.8:53 | vojygut.com | udp |
| US | 8.8.8.8:53 | qetyxiq.com | udp |
| US | 8.8.8.8:53 | puvywav.com | udp |
| US | 8.8.8.8:53 | gahyfyz.com | udp |
| US | 8.8.8.8:53 | lyryxij.com | udp |
| US | 8.8.8.8:53 | vocyqaf.com | udp |
| US | 8.8.8.8:53 | qegyfyp.com | udp |
| US | 8.8.8.8:53 | puryxuq.com | udp |
| US | 8.8.8.8:53 | gacyqob.com | udp |
| US | 8.8.8.8:53 | lygyfex.com | udp |
| US | 8.8.8.8:53 | vowyzuk.com | udp |
| US | 8.8.8.8:53 | qexyqog.com | udp |
| US | 8.8.8.8:53 | pufydep.com | udp |
| US | 8.8.8.8:53 | lyxymin.com | udp |
| US | 8.8.8.8:53 | gaqyzuw.com | udp |
| US | 8.8.8.8:53 | vofydac.com | udp |
| US | 8.8.8.8:53 | qeqylyl.com | udp |
| US | 8.8.8.8:53 | puzymig.com | udp |
| US | 8.8.8.8:53 | gadydas.com | udp |
| US | 8.8.8.8:53 | volymum.com | udp |
| US | 8.8.8.8:53 | lymylyr.com | udp |
| US | 8.8.8.8:53 | pupydeq.com | udp |
| US | 76.223.54.146:80 | pupydeq.com | tcp |
| US | 8.8.8.8:53 | lygynud.com | udp |
| US | 8.8.8.8:53 | lysyvan.com | udp |
| US | 8.8.8.8:53 | pupycag.com | udp |
| US | 107.178.223.183:80 | lygynud.com | tcp |
| US | 172.67.136.136:80 | lysyvan.com | tcp |
| US | 8.8.8.8:53 | lyrysor.com | udp |
| CN | 103.150.10.48:80 | lyrysor.com | tcp |
| US | 18.208.156.248:80 | pupycag.com | tcp |
| US | 172.67.136.136:443 | lysyvan.com | tcp |
| US | 8.8.8.8:53 | 183.223.178.107.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 146.54.223.76.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 136.136.67.172.in-addr.arpa | udp |
| US | 172.67.136.136:443 | lysyvan.com | tcp |
| US | 76.223.54.146:80 | pupydeq.com | tcp |
| US | 8.8.8.8:53 | 11.227.111.52.in-addr.arpa | udp |
| CN | 103.150.10.48:80 | lyrysor.com | tcp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 10.28.171.150.in-addr.arpa | udp |
| US | 8.8.8.8:53 | qedysov.com | udp |
| US | 8.8.8.8:53 | pumylel.com | udp |
| US | 8.8.8.8:53 | galynuh.com | udp |
| US | 8.8.8.8:53 | lysysod.com | udp |
| US | 8.8.8.8:53 | vonyket.com | udp |
| US | 8.8.8.8:53 | qekynuq.com | udp |
| US | 8.8.8.8:53 | pupypiv.com | udp |
| US | 8.8.8.8:53 | ganykaz.com | udp |
| US | 8.8.8.8:53 | lykynyj.com | udp |
| US | 8.8.8.8:53 | vopypif.com | udp |
| US | 8.8.8.8:53 | qebykap.com | udp |
| US | 8.8.8.8:53 | pujybyq.com | udp |
| US | 8.8.8.8:53 | gatypub.com | udp |
| US | 8.8.8.8:53 | lyvyjox.com | udp |
| US | 8.8.8.8:53 | vojybek.com | udp |
| US | 8.8.8.8:53 | qetytug.com | udp |
| US | 8.8.8.8:53 | puvyjop.com | udp |
| US | 8.8.8.8:53 | gahyvew.com | udp |
| US | 8.8.8.8:53 | lyrytun.com | udp |
| US | 8.8.8.8:53 | vocyjic.com | udp |
| US | 8.8.8.8:53 | qegyval.com | udp |
| US | 8.8.8.8:53 | purytyg.com | udp |
| US | 8.8.8.8:53 | gacyhis.com | udp |
| US | 8.8.8.8:53 | lygyvar.com | udp |
| US | 8.8.8.8:53 | vowyrym.com | udp |
| US | 8.8.8.8:53 | qexyhuv.com | udp |
| US | 8.8.8.8:53 | pufycol.com | udp |
| US | 8.8.8.8:53 | lyxygud.com | udp |
| US | 8.8.8.8:53 | gaqyreh.com | udp |
| US | 8.8.8.8:53 | vofycot.com | udp |
| US | 8.8.8.8:53 | puzyguv.com | udp |
| US | 8.8.8.8:53 | qeqyreq.com | udp |
| US | 8.8.8.8:53 | lymywaj.com | udp |
| US | 8.8.8.8:53 | volygyf.com | udp |
| US | 8.8.8.8:53 | qedyxip.com | udp |
| US | 8.8.8.8:53 | pumywaq.com | udp |
| US | 8.8.8.8:53 | galyfyb.com | udp |
| US | 8.8.8.8:53 | lysyxux.com | udp |
| US | 8.8.8.8:53 | vonyqok.com | udp |
| US | 8.8.8.8:53 | qekyfeg.com | udp |
| US | 8.8.8.8:53 | pupyxup.com | udp |
| US | 8.8.8.8:53 | ganyqow.com | udp |
| US | 8.8.8.8:53 | lykyfen.com | udp |
| US | 8.8.8.8:53 | vopyzuc.com | udp |
| US | 8.8.8.8:53 | qebyqil.com | udp |
| US | 8.8.8.8:53 | pujydag.com | udp |
| US | 8.8.8.8:53 | gatyzys.com | udp |
| US | 8.8.8.8:53 | lyvymir.com | udp |
| US | 8.8.8.8:53 | vojydam.com | udp |
| US | 8.8.8.8:53 | qetylyv.com | udp |
| US | 8.8.8.8:53 | puvymul.com | udp |
| US | 8.8.8.8:53 | gahydoh.com | udp |
| US | 8.8.8.8:53 | lyryled.com | udp |
| US | 8.8.8.8:53 | vocymut.com | udp |
| US | 8.8.8.8:53 | qegysoq.com | udp |
| US | 8.8.8.8:53 | purylev.com | udp |
| US | 8.8.8.8:53 | gacynuz.com | udp |
| US | 8.8.8.8:53 | lygysij.com | udp |
| US | 8.8.8.8:53 | vowykaf.com | udp |
| US | 8.8.8.8:53 | qexynyp.com | udp |
| US | 8.8.8.8:53 | pufypiq.com | udp |
| US | 8.8.8.8:53 | gaqykab.com | udp |
| US | 8.8.8.8:53 | lyxynyx.com | udp |
| US | 8.8.8.8:53 | lyxynyx.com | udp |
| US | 8.8.8.8:53 | vofycot.com | udp |
| US | 8.8.8.8:53 | gadyciz.com | udp |
| US | 103.224.212.210:80 | lyxynyx.com | tcp |
| US | 103.224.182.252:80 | vofycot.com | tcp |
| US | 44.221.84.105:80 | gadyciz.com | tcp |
| US | 8.8.8.8:53 | ww16.vofycot.com | udp |
| US | 199.59.243.227:80 | ww25.lyxynyx.com | tcp |
| DE | 64.190.63.136:80 | ww16.vofycot.com | tcp |
| US | 8.8.8.8:53 | galynuh.com | udp |
| US | 64.225.91.73:80 | galynuh.com | tcp |
| US | 76.223.67.189:80 | qexyhuv.com | tcp |
| US | 8.8.8.8:53 | 252.182.224.103.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 210.212.224.103.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 136.63.190.64.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 227.243.59.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 189.67.223.76.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 73.91.225.64.in-addr.arpa | udp |
| US | 8.8.8.8:53 | qegyval.com | udp |
| HK | 154.85.183.50:80 | qegyval.com | tcp |
| US | 8.8.8.8:53 | 50.183.85.154.in-addr.arpa | udp |
| US | 76.223.67.189:80 | qexyhuv.com | tcp |
| US | 8.8.8.8:53 | vofypuk.com | udp |
| US | 8.8.8.8:53 | qeqykog.com | udp |
| US | 8.8.8.8:53 | puzybep.com | udp |
| US | 8.8.8.8:53 | gadypuw.com | udp |
| US | 8.8.8.8:53 | lymyjon.com | udp |
| US | 8.8.8.8:53 | volybec.com | udp |
| US | 8.8.8.8:53 | qedytul.com | udp |
| US | 8.8.8.8:53 | pumyjig.com | udp |
| US | 8.8.8.8:53 | galyvas.com | udp |
| US | 8.8.8.8:53 | lysytyr.com | udp |
| US | 8.8.8.8:53 | vonyjim.com | udp |
| US | 8.8.8.8:53 | qekyvav.com | udp |
| US | 8.8.8.8:53 | pupytyl.com | udp |
| US | 8.8.8.8:53 | ganyhuh.com | udp |
| US | 8.8.8.8:53 | lykyvod.com | udp |
| US | 8.8.8.8:53 | vopyret.com | udp |
| US | 8.8.8.8:53 | qebyhuq.com | udp |
| US | 8.8.8.8:53 | pujycov.com | udp |
| US | 8.8.8.8:53 | gatyrez.com | udp |
| US | 8.8.8.8:53 | lyvyguj.com | udp |
| US | 8.8.8.8:53 | vojycif.com | udp |
| US | 8.8.8.8:53 | qetyrap.com | udp |
| US | 8.8.8.8:53 | puvygyq.com | udp |
| US | 8.8.8.8:53 | lyrywax.com | udp |
| US | 8.8.8.8:53 | vocygyk.com | udp |
| US | 8.8.8.8:53 | qegyxug.com | udp |
| US | 8.8.8.8:53 | purywop.com | udp |
| US | 8.8.8.8:53 | gacyfew.com | udp |
| US | 8.8.8.8:53 | lygyxun.com | udp |
| US | 8.8.8.8:53 | vowyqoc.com | udp |
| US | 8.8.8.8:53 | pufyxug.com | udp |
| US | 8.8.8.8:53 | qexyfel.com | udp |
| US | 8.8.8.8:53 | lyxyfar.com | udp |
| US | 8.8.8.8:53 | gaqyqis.com | udp |
| US | 8.8.8.8:53 | vofyzym.com | udp |
| US | 8.8.8.8:53 | qeqyqiv.com | udp |
| US | 8.8.8.8:53 | puzydal.com | udp |
| US | 8.8.8.8:53 | gadyzyh.com | udp |
| US | 8.8.8.8:53 | lymymud.com | udp |
| US | 8.8.8.8:53 | volydot.com | udp |
| US | 8.8.8.8:53 | qedyleq.com | udp |
| US | 8.8.8.8:53 | pumymuv.com | udp |
| US | 8.8.8.8:53 | galydoz.com | udp |
| US | 8.8.8.8:53 | lysylej.com | udp |
| US | 8.8.8.8:53 | vonymuf.com | udp |
| US | 8.8.8.8:53 | qekysip.com | udp |
| US | 8.8.8.8:53 | pupylaq.com | udp |
| US | 8.8.8.8:53 | lykysix.com | udp |
| US | 8.8.8.8:53 | vopykak.com | udp |
| US | 8.8.8.8:53 | qebynyg.com | udp |
| US | 8.8.8.8:53 | pujypup.com | udp |
| US | 8.8.8.8:53 | gatykow.com | udp |
| US | 8.8.8.8:53 | lyvynen.com | udp |
| US | 8.8.8.8:53 | vojypuc.com | udp |
| US | 8.8.8.8:53 | qetykol.com | udp |
| US | 8.8.8.8:53 | puvybeg.com | udp |
| US | 8.8.8.8:53 | gahypus.com | udp |
| US | 8.8.8.8:53 | lyryjir.com | udp |
| US | 8.8.8.8:53 | vocybam.com | udp |
| US | 8.8.8.8:53 | qegytyv.com | udp |
| US | 8.8.8.8:53 | puryjil.com | udp |
| US | 8.8.8.8:53 | gacyvah.com | udp |
| US | 8.8.8.8:53 | ganynyb.com | udp |
| US | 8.8.8.8:53 | lygytyd.com | udp |
| US | 8.8.8.8:53 | vowyjut.com | udp |
| US | 8.8.8.8:53 | qexyvoq.com | udp |
| US | 8.8.8.8:53 | pufytev.com | udp |
| US | 8.8.8.8:53 | gaqyhuz.com | udp |
| US | 8.8.8.8:53 | lyxyvoj.com | udp |
| US | 8.8.8.8:53 | vofyref.com | udp |
| US | 8.8.8.8:53 | qeqyhup.com | udp |
| US | 8.8.8.8:53 | puzyciq.com | udp |
| US | 8.8.8.8:53 | gadyrab.com | udp |
| US | 8.8.8.8:53 | lymygyx.com | udp |
| US | 8.8.8.8:53 | volycik.com | udp |
| US | 8.8.8.8:53 | qedyrag.com | udp |
| US | 8.8.8.8:53 | pumygyp.com | udp |
| US | 8.8.8.8:53 | galycuw.com | udp |
| US | 8.8.8.8:53 | lysywon.com | udp |
| US | 8.8.8.8:53 | vonygec.com | udp |
| US | 8.8.8.8:53 | qekyxul.com | udp |
| US | 8.8.8.8:53 | pupywog.com | udp |
| US | 8.8.8.8:53 | ganyfes.com | udp |
| US | 8.8.8.8:53 | lykyxur.com | udp |
| US | 8.8.8.8:53 | vopyqim.com | udp |
| US | 8.8.8.8:53 | qebyfav.com | udp |
| US | 8.8.8.8:53 | pujyxyl.com | udp |
| US | 8.8.8.8:53 | gatyqih.com | udp |
| US | 8.8.8.8:53 | lyvyfad.com | udp |
| US | 8.8.8.8:53 | vojyzyt.com | udp |
| US | 8.8.8.8:53 | qetyquq.com | udp |
| US | 8.8.8.8:53 | puvydov.com | udp |
| US | 8.8.8.8:53 | gahyzez.com | udp |
| US | 8.8.8.8:53 | lyrymuj.com | udp |
| US | 8.8.8.8:53 | qegylep.com | udp |
| US | 8.8.8.8:53 | purymuq.com | udp |
| US | 8.8.8.8:53 | gacydib.com | udp |
| US | 8.8.8.8:53 | lygylax.com | udp |
| US | 8.8.8.8:53 | vowymyk.com | udp |
| US | 8.8.8.8:53 | qexysig.com | udp |
| US | 8.8.8.8:53 | pufylap.com | udp |
| US | 8.8.8.8:53 | gaqynyw.com | udp |
| US | 8.8.8.8:53 | lyxysun.com | udp |
| US | 8.8.8.8:53 | vofykoc.com | udp |
| US | 8.8.8.8:53 | qeqynel.com | udp |
| US | 8.8.8.8:53 | puzypug.com | udp |
| US | 8.8.8.8:53 | gadykos.com | udp |
| US | 8.8.8.8:53 | volypum.com | udp |
| US | 8.8.8.8:53 | qedykiv.com | udp |
| US | 8.8.8.8:53 | lymyner.com | udp |
| US | 8.8.8.8:53 | galypyh.com | udp |
| US | 8.8.8.8:53 | pumybal.com | udp |
| US | 8.8.8.8:53 | lysyjid.com | udp |
| US | 8.8.8.8:53 | vonybat.com | udp |
| US | 8.8.8.8:53 | qekytyq.com | udp |
| US | 8.8.8.8:53 | pupyjuv.com | udp |
| US | 8.8.8.8:53 | ganyvoz.com | udp |
| US | 8.8.8.8:53 | vopyjuf.com | udp |
| US | 8.8.8.8:53 | lykytej.com | udp |
| US | 8.8.8.8:53 | pujyteq.com | udp |
| US | 8.8.8.8:53 | qebyvop.com | udp |
| US | 8.8.8.8:53 | gatyhub.com | udp |
| US | 8.8.8.8:53 | lyvyvix.com | udp |
| US | 8.8.8.8:53 | vojyrak.com | udp |
| US | 8.8.8.8:53 | qetyhyg.com | udp |
| US | 8.8.8.8:53 | puvycip.com | udp |
| US | 8.8.8.8:53 | gatyhub.com | udp |
| US | 8.8.8.8:53 | qetyhyg.com | udp |
| US | 72.52.179.174:80 | gatyhub.com | tcp |
| US | 64.225.91.73:80 | qetyhyg.com | tcp |
| US | 72.52.179.174:80 | gatyhub.com | tcp |
| US | 8.8.8.8:53 | gahyraw.com | udp |
| US | 8.8.8.8:53 | lyrygyn.com | udp |
| US | 8.8.8.8:53 | vocycuc.com | udp |
| US | 8.8.8.8:53 | qegyrol.com | udp |
| US | 8.8.8.8:53 | purygeg.com | udp |
| US | 8.8.8.8:53 | gacycus.com | udp |
| US | 8.8.8.8:53 | lygywor.com | udp |
| US | 8.8.8.8:53 | vowygem.com | udp |
| US | 8.8.8.8:53 | qexyxuv.com | udp |
| US | 8.8.8.8:53 | pufywil.com | udp |
| US | 8.8.8.8:53 | gaqyfah.com | udp |
| US | 8.8.8.8:53 | lyxyxyd.com | udp |
| US | 8.8.8.8:53 | vofyqit.com | udp |
| US | 8.8.8.8:53 | qeqyfaq.com | udp |
| US | 8.8.8.8:53 | gadyquz.com | udp |
| US | 8.8.8.8:53 | lymyfoj.com | udp |
| US | 8.8.8.8:53 | volyzef.com | udp |
| US | 8.8.8.8:53 | qedyqup.com | udp |
| US | 8.8.8.8:53 | pumydoq.com | udp |
| US | 8.8.8.8:53 | galyzeb.com | udp |
| US | 8.8.8.8:53 | lysymux.com | udp |
| US | 8.8.8.8:53 | vonydik.com | udp |
| US | 8.8.8.8:53 | qekylag.com | udp |
| US | 8.8.8.8:53 | pupymyp.com | udp |
| US | 8.8.8.8:53 | ganydiw.com | udp |
| US | 8.8.8.8:53 | lykylan.com | udp |
| US | 8.8.8.8:53 | vopymyc.com | udp |
| US | 8.8.8.8:53 | qebysul.com | udp |
| US | 8.8.8.8:53 | pujylog.com | udp |
| US | 8.8.8.8:53 | gatynes.com | udp |
| US | 8.8.8.8:53 | lyvysur.com | udp |
| US | 8.8.8.8:53 | qetynev.com | udp |
| US | 8.8.8.8:53 | vojykom.com | udp |
| US | 8.8.8.8:53 | puvypul.com | udp |
| US | 8.8.8.8:53 | gahykih.com | udp |
| US | 8.8.8.8:53 | lyrynad.com | udp |
| US | 8.8.8.8:53 | vocypyt.com | udp |
| US | 8.8.8.8:53 | qegykiq.com | udp |
| US | 8.8.8.8:53 | purybav.com | udp |
| US | 8.8.8.8:53 | gacypyz.com | udp |
| US | 8.8.8.8:53 | lygyjuj.com | udp |
| US | 8.8.8.8:53 | vowybof.com | udp |
| US | 8.8.8.8:53 | pufyjuq.com | udp |
| US | 8.8.8.8:53 | gaqyvob.com | udp |
| US | 8.8.8.8:53 | qexytep.com | udp |
| US | 8.8.8.8:53 | lyxytex.com | udp |
| US | 8.8.8.8:53 | vofyjuk.com | udp |
| US | 8.8.8.8:53 | qeqyvig.com | udp |
| US | 8.8.8.8:53 | puzytap.com | udp |
| US | 8.8.8.8:53 | gadyhyw.com | udp |
| US | 8.8.8.8:53 | lymyvin.com | udp |
| US | 8.8.8.8:53 | volyrac.com | udp |
| US | 8.8.8.8:53 | pumycug.com | udp |
| US | 8.8.8.8:53 | qedyhyl.com | udp |
| US | 8.8.8.8:53 | galyros.com | udp |
| US | 8.8.8.8:53 | lysyger.com | udp |
| US | 8.8.8.8:53 | qekyrov.com | udp |
| US | 8.8.8.8:53 | vonycum.com | udp |
| US | 8.8.8.8:53 | pupygel.com | udp |
| US | 8.8.8.8:53 | ganycuh.com | udp |
| US | 8.8.8.8:53 | lykywid.com | udp |
| US | 8.8.8.8:53 | vopygat.com | udp |
| US | 8.8.8.8:53 | qebyxyq.com | udp |
| US | 8.8.8.8:53 | 174.179.52.72.in-addr.arpa | udp |
| US | 8.8.8.8:53 | gatyfaz.com | udp |
| US | 8.8.8.8:53 | lyvyxyj.com | udp |
| US | 8.8.8.8:53 | vojyquf.com | udp |
| US | 8.8.8.8:53 | qetyfop.com | udp |
| US | 8.8.8.8:53 | puvyxeq.com | udp |
| US | 8.8.8.8:53 | gahyqub.com | udp |
| US | 8.8.8.8:53 | lyryfox.com | udp |
| US | 8.8.8.8:53 | vocyzek.com | udp |
| US | 8.8.8.8:53 | qegyqug.com | udp |
| US | 8.8.8.8:53 | purydip.com | udp |
| US | 8.8.8.8:53 | gacyzaw.com | udp |
| US | 8.8.8.8:53 | lygymyn.com | udp |
| US | 8.8.8.8:53 | vowydic.com | udp |
| US | 8.8.8.8:53 | qexylal.com | udp |
| US | 8.8.8.8:53 | pufymyg.com | udp |
| US | 8.8.8.8:53 | gaqydus.com | udp |
| US | 8.8.8.8:53 | lyxylor.com | udp |
| US | 8.8.8.8:53 | vofymem.com | udp |
| US | 8.8.8.8:53 | qeqysuv.com | udp |
| US | 8.8.8.8:53 | puzylol.com | udp |
| US | 8.8.8.8:53 | gadyneh.com | udp |
| US | 8.8.8.8:53 | lymysud.com | udp |
| US | 8.8.8.8:53 | volykit.com | udp |
| US | 8.8.8.8:53 | qedynaq.com | udp |
| US | 8.8.8.8:53 | pumypyv.com | udp |
| US | 8.8.8.8:53 | galykiz.com | udp |
| US | 8.8.8.8:53 | lysynaj.com | udp |
| US | 8.8.8.8:53 | vonypyf.com | udp |
| US | 8.8.8.8:53 | qekykup.com | udp |
| US | 8.8.8.8:53 | pupyboq.com | udp |
| US | 8.8.8.8:53 | ganypeb.com | udp |
| US | 8.8.8.8:53 | lykyjux.com | udp |
| US | 8.8.8.8:53 | vopybok.com | udp |
| US | 8.8.8.8:53 | qebyteg.com | udp |
| US | 8.8.8.8:53 | pujyjup.com | udp |
| US | 8.8.8.8:53 | gatyviw.com | udp |
| US | 8.8.8.8:53 | lyvytan.com | udp |
| US | 8.8.8.8:53 | vojyjyc.com | udp |
| US | 8.8.8.8:53 | qetyvil.com | udp |
| US | 8.8.8.8:53 | puvytag.com | udp |
| US | 8.8.8.8:53 | lyryvur.com | udp |
| US | 8.8.8.8:53 | gahyhys.com | udp |
| US | 8.8.8.8:53 | vocyrom.com | udp |
| US | 8.8.8.8:53 | qegyhev.com | udp |
| US | 8.8.8.8:53 | gacyroh.com | udp |
| US | 8.8.8.8:53 | purycul.com | udp |
| US | 8.8.8.8:53 | vowycut.com | udp |
| US | 8.8.8.8:53 | qexyriq.com | udp |
| US | 8.8.8.8:53 | pufygav.com | udp |
| US | 8.8.8.8:53 | lygyged.com | udp |
| US | 8.8.8.8:53 | lyxywij.com | udp |
| US | 8.8.8.8:53 | gaqycyz.com | udp |
| US | 8.8.8.8:53 | vofygaf.com | udp |
| US | 8.8.8.8:53 | puzywuq.com | udp |
| US | 8.8.8.8:53 | qeqyxyp.com | udp |
| US | 8.8.8.8:53 | gadyfob.com | udp |
| US | 8.8.8.8:53 | lymyxex.com | udp |
| US | 8.8.8.8:53 | volyquk.com | udp |
| US | 8.8.8.8:53 | pumyxep.com | udp |
| US | 8.8.8.8:53 | galyquw.com | udp |
| US | 8.8.8.8:53 | lysyfin.com | udp |
| US | 8.8.8.8:53 | vonyzac.com | udp |
| US | 8.8.8.8:53 | qekyqyl.com | udp |
| US | 8.8.8.8:53 | pupydig.com | udp |
| US | 8.8.8.8:53 | ganyzas.com | udp |
| US | 8.8.8.8:53 | lykymyr.com | udp |
| US | 8.8.8.8:53 | vopydum.com | udp |
| US | 8.8.8.8:53 | qebylov.com | udp |
| US | 8.8.8.8:53 | pujymel.com | udp |
| US | 8.8.8.8:53 | gatyduh.com | udp |
| US | 8.8.8.8:53 | lyvylod.com | udp |
| US | 8.8.8.8:53 | vojymet.com | udp |
| US | 8.8.8.8:53 | qetysuq.com | udp |
| US | 8.8.8.8:53 | gahynaz.com | udp |
| US | 8.8.8.8:53 | lyrysyj.com | udp |
| US | 8.8.8.8:53 | vocykif.com | udp |
| US | 8.8.8.8:53 | qegynap.com | udp |
| US | 8.8.8.8:53 | purypyq.com | udp |
| US | 8.8.8.8:53 | gacykub.com | udp |
| US | 8.8.8.8:53 | lygynox.com | udp |
| US | 8.8.8.8:53 | vowypek.com | udp |
| US | 8.8.8.8:53 | qexykug.com | udp |
| US | 8.8.8.8:53 | pufybop.com | udp |
| US | 8.8.8.8:53 | gaqypew.com | udp |
| US | 8.8.8.8:53 | lyxyjun.com | udp |
| US | 8.8.8.8:53 | vofybic.com | udp |
| US | 8.8.8.8:53 | qeqytal.com | udp |
| US | 8.8.8.8:53 | puzyjyg.com | udp |
| US | 8.8.8.8:53 | gadyvis.com | udp |
| US | 8.8.8.8:53 | lymytar.com | udp |
| US | 8.8.8.8:53 | volyjym.com | udp |
| US | 8.8.8.8:53 | qedyvuv.com | udp |
| US | 8.8.8.8:53 | pumytol.com | udp |
| US | 8.8.8.8:53 | galyheh.com | udp |
| US | 8.8.8.8:53 | vonyrot.com | udp |
| US | 8.8.8.8:53 | lysyvud.com | udp |
| US | 8.8.8.8:53 | qekyheq.com | udp |
| US | 8.8.8.8:53 | pupycuv.com | udp |
| US | 8.8.8.8:53 | ganyriz.com | udp |
| US | 8.8.8.8:53 | lykygaj.com | udp |
| US | 8.8.8.8:53 | vopycyf.com | udp |
| US | 8.8.8.8:53 | qebyrip.com | udp |
| US | 8.8.8.8:53 | pujygaq.com | udp |
| US | 8.8.8.8:53 | gatycyb.com | udp |
| US | 8.8.8.8:53 | lyvywux.com | udp |
| US | 8.8.8.8:53 | vojygok.com | udp |
| US | 8.8.8.8:53 | qetyxeg.com | udp |
| US | 8.8.8.8:53 | gahyfow.com | udp |
| US | 8.8.8.8:53 | lyryxen.com | udp |
| US | 8.8.8.8:53 | qegyfil.com | udp |
| US | 8.8.8.8:53 | puryxag.com | udp |
| US | 8.8.8.8:53 | gacyqys.com | udp |
| US | 8.8.8.8:53 | lygyfir.com | udp |
| US | 8.8.8.8:53 | vowyzam.com | udp |
| US | 8.8.8.8:53 | qexyqyv.com | udp |
| US | 8.8.8.8:53 | pufydul.com | udp |
| US | 8.8.8.8:53 | gaqyzoh.com | udp |
| US | 8.8.8.8:53 | lyxymed.com | udp |
| US | 8.8.8.8:53 | vofydut.com | udp |
| US | 8.8.8.8:53 | qeqyloq.com | udp |
| US | 8.8.8.8:53 | puzymev.com | udp |
| US | 8.8.8.8:53 | gadyduz.com | udp |
| US | 8.8.8.8:53 | lymylij.com | udp |
| US | 8.8.8.8:53 | volymaf.com | udp |
| US | 8.8.8.8:53 | qedysyp.com | udp |
| US | 8.8.8.8:53 | pumyliq.com | udp |
| US | 8.8.8.8:53 | lysysyx.com | udp |
| US | 8.8.8.8:53 | vonykuk.com | udp |
| US | 8.8.8.8:53 | pupypep.com | udp |
| US | 8.8.8.8:53 | ganykuw.com | udp |
| US | 8.8.8.8:53 | lykynon.com | udp |
| US | 8.8.8.8:53 | vopypec.com | udp |
| US | 8.8.8.8:53 | qebykul.com | udp |
| US | 8.8.8.8:53 | pujybig.com | udp |
| US | 8.8.8.8:53 | gatypas.com | udp |
| US | 8.8.8.8:53 | lyvyjyr.com | udp |
| US | 8.8.8.8:53 | vojybim.com | udp |
| US | 8.8.8.8:53 | qetytav.com | udp |
| US | 8.8.8.8:53 | puvyjyl.com | udp |
| US | 8.8.8.8:53 | gahyvuh.com | udp |
| US | 8.8.8.8:53 | lyrytod.com | udp |
| US | 8.8.8.8:53 | vocyjet.com | udp |
| US | 8.8.8.8:53 | qegyvuq.com | udp |
| US | 8.8.8.8:53 | purytov.com | udp |
| US | 8.8.8.8:53 | gacyhez.com | udp |
| US | 8.8.8.8:53 | vowyrif.com | udp |
| US | 8.8.8.8:53 | qexyhap.com | udp |
| US | 8.8.8.8:53 | pufycyq.com | udp |
| US | 8.8.8.8:53 | gaqyrib.com | udp |
| US | 8.8.8.8:53 | lyxygax.com | udp |
| US | 8.8.8.8:53 | vofycyk.com | udp |
| US | 8.8.8.8:53 | qeqyrug.com | udp |
| US | 8.8.8.8:53 | puzygop.com | udp |
| US | 8.8.8.8:53 | gadycew.com | udp |
| US | 8.8.8.8:53 | lymywun.com | udp |
| US | 8.8.8.8:53 | volygoc.com | udp |
| US | 8.8.8.8:53 | qedyxel.com | udp |
| US | 8.8.8.8:53 | pumywug.com | udp |
| US | 8.8.8.8:53 | galyfis.com | udp |
| US | 8.8.8.8:53 | lysyxar.com | udp |
| US | 8.8.8.8:53 | qekyfiv.com | udp |
| US | 8.8.8.8:53 | vonyqym.com | udp |
| US | 8.8.8.8:53 | ganyqyh.com | udp |
| US | 8.8.8.8:53 | pupyxal.com | udp |
| US | 8.8.8.8:53 | vopyzot.com | udp |
| US | 8.8.8.8:53 | qebyqeq.com | udp |
| US | 8.8.8.8:53 | pujyduv.com | udp |
| US | 8.8.8.8:53 | gatyzoz.com | udp |
| US | 8.8.8.8:53 | lyvymej.com | udp |
| US | 8.8.8.8:53 | vojyduf.com | udp |
| US | 8.8.8.8:53 | qetylip.com | udp |
| US | 8.8.8.8:53 | gahydyb.com | udp |
| US | 8.8.8.8:53 | puvymaq.com | udp |
| US | 8.8.8.8:53 | vocymak.com | udp |
| US | 8.8.8.8:53 | lyrylix.com | udp |
| US | 8.8.8.8:53 | purylup.com | udp |
| US | 8.8.8.8:53 | qegysyg.com | udp |
| US | 8.8.8.8:53 | lygysen.com | udp |
| US | 8.8.8.8:53 | gacynow.com | udp |
| US | 8.8.8.8:53 | vowykuc.com | udp |
| US | 8.8.8.8:53 | qexynol.com | udp |
| US | 8.8.8.8:53 | pufypeg.com | udp |
| US | 8.8.8.8:53 | gaqykus.com | udp |
| US | 8.8.8.8:53 | lygyvuj.com | udp |
| US | 52.34.198.229:80 | lygyvuj.com | tcp |
| US | 8.8.8.8:53 | lyxynir.com | udp |
| US | 8.8.8.8:53 | qeqykyv.com | udp |
| US | 8.8.8.8:53 | puzybil.com | udp |
| US | 8.8.8.8:53 | gadypah.com | udp |
| US | 8.8.8.8:53 | lymyjyd.com | udp |
| US | 8.8.8.8:53 | volybut.com | udp |
| US | 8.8.8.8:53 | qedytoq.com | udp |
| US | 8.8.8.8:53 | pumyjev.com | udp |
| US | 8.8.8.8:53 | galyvuz.com | udp |
| US | 8.8.8.8:53 | lysytoj.com | udp |
| US | 8.8.8.8:53 | qekyvup.com | udp |
| US | 8.8.8.8:53 | pupytiq.com | udp |
| US | 8.8.8.8:53 | ganyhab.com | udp |
| US | 8.8.8.8:53 | vopyrik.com | udp |
| US | 8.8.8.8:53 | qebyhag.com | udp |
| US | 8.8.8.8:53 | pujycyp.com | udp |
| US | 8.8.8.8:53 | gatyruw.com | udp |
| US | 8.8.8.8:53 | lyvygon.com | udp |
| US | 8.8.8.8:53 | vojycec.com | udp |
| US | 8.8.8.8:53 | qetyrul.com | udp |
| US | 8.8.8.8:53 | puvygog.com | udp |
| US | 8.8.8.8:53 | gahyces.com | udp |
| US | 8.8.8.8:53 | vocygim.com | udp |
| US | 8.8.8.8:53 | lyrywur.com | udp |
| US | 8.8.8.8:53 | purywyl.com | udp |
| US | 8.8.8.8:53 | qegyxav.com | udp |
| US | 8.8.8.8:53 | gacyfih.com | udp |
| US | 8.8.8.8:53 | lygyxad.com | udp |
| US | 8.8.8.8:53 | vowyqyt.com | udp |
| US | 8.8.8.8:53 | qexyfuq.com | udp |
| US | 8.8.8.8:53 | pufyxov.com | udp |
| US | 8.8.8.8:53 | gaqyqez.com | udp |
| US | 8.8.8.8:53 | lyxyfuj.com | udp |
| US | 8.8.8.8:53 | vofyzof.com | udp |
| US | 8.8.8.8:53 | qeqyqep.com | udp |
| US | 8.8.8.8:53 | puzyduq.com | udp |
| US | 8.8.8.8:53 | gadyzib.com | udp |
| US | 8.8.8.8:53 | lymymax.com | udp |
| US | 8.8.8.8:53 | volydyk.com | udp |
| US | 8.8.8.8:53 | qedylig.com | udp |
| US | 8.8.8.8:53 | pumymap.com | udp |
| US | 8.8.8.8:53 | galydyw.com | udp |
| US | 8.8.8.8:53 | lysylun.com | udp |
| US | 8.8.8.8:53 | vonymoc.com | udp |
| US | 8.8.8.8:53 | qekysel.com | udp |
| US | 8.8.8.8:53 | pupylug.com | udp |
| US | 8.8.8.8:53 | ganynos.com | udp |
| US | 8.8.8.8:53 | lykyser.com | udp |
| US | 8.8.8.8:53 | vopykum.com | udp |
| US | 8.8.8.8:53 | qebyniv.com | udp |
| US | 8.8.8.8:53 | gatykyh.com | udp |
| US | 8.8.8.8:53 | pujypal.com | udp |
| US | 8.8.8.8:53 | lyvynid.com | udp |
| US | 8.8.8.8:53 | vojypat.com | udp |
| US | 8.8.8.8:53 | qetykyq.com | udp |
| US | 8.8.8.8:53 | puvybuv.com | udp |
| US | 8.8.8.8:53 | vocybuf.com | udp |
| US | 8.8.8.8:53 | lyryjej.com | udp |
| US | 8.8.8.8:53 | qegytop.com | udp |
| US | 8.8.8.8:53 | puryjeq.com | udp |
| US | 8.8.8.8:53 | 229.198.34.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | gacyvub.com | udp |
| US | 8.8.8.8:53 | lygytix.com | udp |
| US | 8.8.8.8:53 | vowyjak.com | udp |
| US | 8.8.8.8:53 | qexyvyg.com | udp |
| US | 8.8.8.8:53 | pufytip.com | udp |
| US | 8.8.8.8:53 | gaqyhaw.com | udp |
| US | 8.8.8.8:53 | lyxyvyn.com | udp |
| US | 8.8.8.8:53 | vofyruc.com | udp |
| US | 8.8.8.8:53 | qeqyhol.com | udp |
| US | 8.8.8.8:53 | puzyceg.com | udp |
| US | 8.8.8.8:53 | gadyrus.com | udp |
| US | 8.8.8.8:53 | lymygor.com | udp |
| US | 8.8.8.8:53 | volycem.com | udp |
| US | 8.8.8.8:53 | qedyruv.com | udp |
| US | 8.8.8.8:53 | pumygil.com | udp |
| US | 8.8.8.8:53 | galycah.com | udp |
| US | 8.8.8.8:53 | vonygit.com | udp |
| US | 8.8.8.8:53 | qekyxaq.com | udp |
| US | 8.8.8.8:53 | pupywyv.com | udp |
| US | 8.8.8.8:53 | ganyfuz.com | udp |
| US | 8.8.8.8:53 | lykyxoj.com | udp |
| US | 8.8.8.8:53 | vopyqef.com | udp |
| US | 8.8.8.8:53 | qebyfup.com | udp |
| US | 8.8.8.8:53 | pujyxoq.com | udp |
| US | 8.8.8.8:53 | lyvyfux.com | udp |
| US | 8.8.8.8:53 | vojyzik.com | udp |
| US | 8.8.8.8:53 | qetyqag.com | udp |
| US | 8.8.8.8:53 | puvydyp.com | udp |
| US | 8.8.8.8:53 | gahyziw.com | udp |
| US | 8.8.8.8:53 | lyryman.com | udp |
| US | 8.8.8.8:53 | vocydyc.com | udp |
| US | 8.8.8.8:53 | qegylul.com | udp |
| US | 8.8.8.8:53 | purymog.com | udp |
| US | 8.8.8.8:53 | gacydes.com | udp |
| US | 8.8.8.8:53 | lygylur.com | udp |
| US | 8.8.8.8:53 | vowymom.com | udp |
| US | 8.8.8.8:53 | qexysev.com | udp |
| US | 8.8.8.8:53 | pufylul.com | udp |
| US | 8.8.8.8:53 | gaqynih.com | udp |
| US | 8.8.8.8:53 | lyxysad.com | udp |
| US | 8.8.8.8:53 | vofykyt.com | udp |
| US | 8.8.8.8:53 | qeqyniq.com | udp |
| US | 8.8.8.8:53 | puzypav.com | udp |
| US | 8.8.8.8:53 | gadykyz.com | udp |
| US | 8.8.8.8:53 | volypof.com | udp |
| US | 8.8.8.8:53 | lymynuj.com | udp |
| US | 8.8.8.8:53 | pumybuq.com | udp |
| US | 8.8.8.8:53 | qedykep.com | udp |
| US | 8.8.8.8:53 | galypob.com | udp |
| US | 8.8.8.8:53 | lysyjex.com | udp |
| US | 8.8.8.8:53 | vonybuk.com | udp |
| US | 8.8.8.8:53 | qekytig.com | udp |
| US | 8.8.8.8:53 | pupyjap.com | udp |
| US | 8.8.8.8:53 | ganyvyw.com | udp |
| US | 8.8.8.8:53 | lykytin.com | udp |
| US | 8.8.8.8:53 | vopyjac.com | udp |
| US | 8.8.8.8:53 | qebyvyl.com | udp |
| US | 8.8.8.8:53 | pujytug.com | udp |
| US | 8.8.8.8:53 | gatyhos.com | udp |
| US | 8.8.8.8:53 | lyvyver.com | udp |
| US | 8.8.8.8:53 | vojyrum.com | udp |
Files
memory/2916-0-0x0000000000400000-0x00000000004C7000-memory.dmp
memory/2916-1-0x0000000002260000-0x00000000022B1000-memory.dmp
memory/2916-2-0x0000000000400000-0x000000000045F000-memory.dmp
C:\Windows\apppatch\svchost.exe
| MD5 | 4ac2f74aa04268335b0f340894bbcbeb |
| SHA1 | 3564cea684b72ad4b0f3d651cf4a344c95c9cc3a |
| SHA256 | f0dc6310e88a63e05f6c9385d22452a4c5bbea2a5d7308a554eaedc303b71798 |
| SHA512 | 3cdfdcdd567f5c053d6a862e8e117a684ab83bf70723d1851f8e221350ce8c8fa2395eed6eabfb58961af6f207440843a4ee791f1ac3accec66c503b7db64581 |
memory/396-12-0x0000000000400000-0x00000000004C7000-memory.dmp
memory/2916-15-0x0000000000400000-0x000000000045F000-memory.dmp
memory/396-16-0x0000000000400000-0x00000000004C7000-memory.dmp
memory/2916-14-0x0000000002260000-0x00000000022B1000-memory.dmp
memory/2916-13-0x0000000000400000-0x00000000004C7000-memory.dmp
memory/396-17-0x0000000000400000-0x00000000004C7000-memory.dmp
memory/396-18-0x0000000002A00000-0x0000000002AA8000-memory.dmp
memory/396-19-0x0000000000400000-0x00000000004C7000-memory.dmp
memory/396-20-0x0000000002BF0000-0x0000000002CA6000-memory.dmp
memory/396-22-0x0000000002BF0000-0x0000000002CA6000-memory.dmp
memory/396-24-0x0000000002BF0000-0x0000000002CA6000-memory.dmp
memory/396-44-0x0000000002BF0000-0x0000000002CA6000-memory.dmp
memory/396-47-0x0000000002BF0000-0x0000000002CA6000-memory.dmp
memory/396-79-0x0000000002BF0000-0x0000000002CA6000-memory.dmp
memory/396-78-0x0000000002BF0000-0x0000000002CA6000-memory.dmp
memory/396-77-0x0000000002BF0000-0x0000000002CA6000-memory.dmp
memory/396-76-0x0000000002BF0000-0x0000000002CA6000-memory.dmp
memory/396-75-0x0000000002BF0000-0x0000000002CA6000-memory.dmp
memory/396-74-0x0000000002BF0000-0x0000000002CA6000-memory.dmp
memory/396-73-0x0000000002BF0000-0x0000000002CA6000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\9A42.tmp
| MD5 | cdfaa9c08bea592db2905b8725d60801 |
| SHA1 | b7259534debf128083d40ea661e718934e1660dd |
| SHA256 | e29def893f374fe2453d9fa712482f03adb1ea0f6ffd60637886ff9a6af02296 |
| SHA512 | 200485e602be73ad33475535be18436b6a49ba3cf54a68aae694e135cfb3d2b25cb67ea09167ecdc07185e1719b39573612cec4d85b22450fc9f4be8d320e36e |
memory/396-72-0x0000000002BF0000-0x0000000002CA6000-memory.dmp
memory/396-71-0x0000000002BF0000-0x0000000002CA6000-memory.dmp
memory/396-70-0x0000000002BF0000-0x0000000002CA6000-memory.dmp
memory/396-69-0x0000000002BF0000-0x0000000002CA6000-memory.dmp
memory/396-68-0x0000000002BF0000-0x0000000002CA6000-memory.dmp
memory/396-66-0x0000000002BF0000-0x0000000002CA6000-memory.dmp
memory/396-65-0x0000000002BF0000-0x0000000002CA6000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\9AA4.tmp
| MD5 | 94127dba1802e89cce6184adf274a366 |
| SHA1 | 4cff601b9f555da5a247021931fdf9029af1c224 |
| SHA256 | cd3980ac69d2e1eb2b16cf000d15401448da0e5ad275ff9f752746bc0b965817 |
| SHA512 | f305cd0b400b2896c27a3c87408ffc5a8cdff6a69af0fce62122416c259364d1cb45386fd288a50ecf255be120d285564151ce2dc30ed79add9aa26634b68e51 |
memory/396-64-0x0000000002BF0000-0x0000000002CA6000-memory.dmp
memory/396-63-0x0000000002BF0000-0x0000000002CA6000-memory.dmp
memory/396-62-0x0000000002BF0000-0x0000000002CA6000-memory.dmp
memory/396-61-0x0000000002BF0000-0x0000000002CA6000-memory.dmp
memory/396-60-0x0000000002BF0000-0x0000000002CA6000-memory.dmp
memory/396-59-0x0000000002BF0000-0x0000000002CA6000-memory.dmp
memory/396-58-0x0000000002BF0000-0x0000000002CA6000-memory.dmp
memory/396-57-0x0000000002BF0000-0x0000000002CA6000-memory.dmp
memory/396-56-0x0000000002BF0000-0x0000000002CA6000-memory.dmp
memory/396-55-0x0000000002BF0000-0x0000000002CA6000-memory.dmp
memory/396-54-0x0000000002BF0000-0x0000000002CA6000-memory.dmp
memory/396-53-0x0000000002BF0000-0x0000000002CA6000-memory.dmp
memory/396-52-0x0000000002BF0000-0x0000000002CA6000-memory.dmp
memory/396-51-0x0000000002BF0000-0x0000000002CA6000-memory.dmp
memory/396-50-0x0000000002BF0000-0x0000000002CA6000-memory.dmp
memory/396-49-0x0000000002BF0000-0x0000000002CA6000-memory.dmp
memory/396-48-0x0000000002BF0000-0x0000000002CA6000-memory.dmp
memory/396-46-0x0000000002BF0000-0x0000000002CA6000-memory.dmp
memory/396-45-0x0000000002BF0000-0x0000000002CA6000-memory.dmp
memory/396-43-0x0000000002BF0000-0x0000000002CA6000-memory.dmp
memory/396-41-0x0000000002BF0000-0x0000000002CA6000-memory.dmp
memory/396-42-0x0000000002BF0000-0x0000000002CA6000-memory.dmp
memory/396-40-0x0000000002BF0000-0x0000000002CA6000-memory.dmp
memory/396-39-0x0000000002BF0000-0x0000000002CA6000-memory.dmp
memory/396-38-0x0000000002BF0000-0x0000000002CA6000-memory.dmp
memory/396-37-0x0000000002BF0000-0x0000000002CA6000-memory.dmp
memory/396-36-0x0000000002BF0000-0x0000000002CA6000-memory.dmp
memory/396-35-0x0000000002BF0000-0x0000000002CA6000-memory.dmp
memory/396-34-0x0000000002BF0000-0x0000000002CA6000-memory.dmp
memory/396-33-0x0000000002BF0000-0x0000000002CA6000-memory.dmp
memory/396-32-0x0000000002BF0000-0x0000000002CA6000-memory.dmp
memory/396-30-0x0000000002BF0000-0x0000000002CA6000-memory.dmp
memory/396-29-0x0000000002BF0000-0x0000000002CA6000-memory.dmp
memory/396-28-0x0000000002BF0000-0x0000000002CA6000-memory.dmp
memory/396-27-0x0000000002BF0000-0x0000000002CA6000-memory.dmp
memory/396-67-0x0000000002BF0000-0x0000000002CA6000-memory.dmp
memory/396-26-0x0000000002BF0000-0x0000000002CA6000-memory.dmp
memory/396-25-0x0000000002BF0000-0x0000000002CA6000-memory.dmp
memory/396-31-0x0000000002BF0000-0x0000000002CA6000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\B1DB.tmp
| MD5 | 926512864979bc27cf187f1de3f57aff |
| SHA1 | acdeb9d6187932613c7fa08eaf28f0cd8116f4b5 |
| SHA256 | b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f |
| SHA512 | f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b |