Malware Analysis Report

2025-01-02 14:55

Sample ID 241128-2g47satjfy
Target Ransomware-master.zip
SHA256 3e2ba9a25e9891c6dcb75ad73c1262d523e09f0eb3d095ede9ea9d11f42ebc28
Tags
defense_evasion discovery execution impact persistence ransomware upx cerber evasion privilege_escalation jigsaw spyware stealer locky
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral15

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral18

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral25

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral26

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral28

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral31

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral22

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral32

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral27

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral19

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral16

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral17

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral24

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral30

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral20

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral23

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral21

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral29

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

3e2ba9a25e9891c6dcb75ad73c1262d523e09f0eb3d095ede9ea9d11f42ebc28

Threat Level: Known bad

The file Ransomware-master.zip was found to be: Known bad.

Malicious Activity Summary

defense_evasion discovery execution impact persistence ransomware upx cerber evasion privilege_escalation jigsaw spyware stealer locky

Cerber

Cerber family

Jigsaw family

Jigsaw Ransomware

Locky family

Locky

Renames multiple (2002) files with added filename extension

Deletes shadow copies

Renames multiple (3735) files with added filename extension

Contacts a large (1100) amount of remote hosts

Blocklisted process makes network request

Contacts a large (1101) amount of remote hosts

Contacts a large (1096) amount of remote hosts

Modifies Windows Firewall

Checks computer location settings

Executes dropped EXE

Reads user/profile data of web browsers

Deletes itself

Drops startup file

Loads dropped DLL

Looks up external IP address via web service

Adds Run key to start application

UPX packed file

Suspicious use of SetThreadContext

Drops file in System32 directory

Sets desktop wallpaper using registry

Drops file in Windows directory

Drops file in Program Files directory

System Network Configuration Discovery: Internet Connection Discovery

Program crash

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

System Location Discovery: System Language Discovery

Unsigned PE

Suspicious use of UnmapMainImage

Kills process with taskkill

Opens file in notepad (likely ransom note)

Uses Volume Shadow Copy service COM API

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Modifies registry class

Suspicious behavior: MapViewOfSection

Suspicious use of FindShellTrayWindow

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: GetForegroundWindowSpam

Modifies Internet Explorer settings

Runs ping.exe

Interacts with shadow copies

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-28 22:34

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral14

Detonation Overview

Submitted

2024-11-28 22:34

Reported

2024-11-28 22:37

Platform

win10v2004-20241007-en

Max time kernel

148s

Max time network

153s

Command Line

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Ransomware-master\etc\Ransomware.Cryptowall.zip"

Signatures

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: 35 N/A C:\Program Files\7-Zip\7zFM.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A

Processes

C:\Program Files\7-Zip\7zFM.exe

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Ransomware-master\etc\Ransomware.Cryptowall.zip"

Network

Country Destination Domain Proto
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 103.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 92.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 106.208.201.84.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral15

Detonation Overview

Submitted

2024-11-28 22:34

Reported

2024-11-28 22:36

Platform

win7-20240903-en

Max time kernel

146s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\cryptowall.exe"

Signatures

Deletes shadow copies

ransomware defense_evasion impact execution

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9bf0c776.exe C:\Windows\syswow64\explorer.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\9bf0c77 = "C:\\9bf0c776\\9bf0c776.exe" C:\Windows\syswow64\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\*bf0c77 = "C:\\9bf0c776\\9bf0c776.exe" C:\Windows\syswow64\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\9bf0c776 = "C:\\Users\\Admin\\AppData\\Roaming\\9bf0c776.exe" C:\Windows\syswow64\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\*bf0c776 = "C:\\Users\\Admin\\AppData\\Roaming\\9bf0c776.exe" C:\Windows\syswow64\explorer.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-addr.es N/A N/A
N/A myexternalip.com N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2644 set thread context of 2256 N/A C:\Users\Admin\AppData\Local\Temp\cryptowall.exe C:\Users\Admin\AppData\Local\Temp\cryptowall.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\cryptowall.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\cryptowall.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\vssadmin.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\syswow64\vssadmin.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\cryptowall.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cryptowall.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\cryptowall.exe N/A
N/A N/A C:\Windows\syswow64\explorer.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\cryptowall.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\cryptowall.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: 33 N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: 33 N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\AUDIODG.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2644 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\cryptowall.exe C:\Users\Admin\AppData\Local\Temp\cryptowall.exe
PID 2644 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\cryptowall.exe C:\Users\Admin\AppData\Local\Temp\cryptowall.exe
PID 2644 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\cryptowall.exe C:\Users\Admin\AppData\Local\Temp\cryptowall.exe
PID 2644 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\cryptowall.exe C:\Users\Admin\AppData\Local\Temp\cryptowall.exe
PID 2644 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\cryptowall.exe C:\Users\Admin\AppData\Local\Temp\cryptowall.exe
PID 2644 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\cryptowall.exe C:\Users\Admin\AppData\Local\Temp\cryptowall.exe
PID 2644 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\cryptowall.exe C:\Users\Admin\AppData\Local\Temp\cryptowall.exe
PID 2644 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\cryptowall.exe C:\Users\Admin\AppData\Local\Temp\cryptowall.exe
PID 2644 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\cryptowall.exe C:\Users\Admin\AppData\Local\Temp\cryptowall.exe
PID 2644 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\cryptowall.exe C:\Users\Admin\AppData\Local\Temp\cryptowall.exe
PID 2256 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\cryptowall.exe C:\Windows\syswow64\explorer.exe
PID 2256 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\cryptowall.exe C:\Windows\syswow64\explorer.exe
PID 2256 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\cryptowall.exe C:\Windows\syswow64\explorer.exe
PID 2256 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\cryptowall.exe C:\Windows\syswow64\explorer.exe
PID 2816 wrote to memory of 2120 N/A C:\Windows\syswow64\explorer.exe C:\Windows\syswow64\svchost.exe
PID 2816 wrote to memory of 2120 N/A C:\Windows\syswow64\explorer.exe C:\Windows\syswow64\svchost.exe
PID 2816 wrote to memory of 2120 N/A C:\Windows\syswow64\explorer.exe C:\Windows\syswow64\svchost.exe
PID 2816 wrote to memory of 2120 N/A C:\Windows\syswow64\explorer.exe C:\Windows\syswow64\svchost.exe
PID 2816 wrote to memory of 2668 N/A C:\Windows\syswow64\explorer.exe C:\Windows\syswow64\vssadmin.exe
PID 2816 wrote to memory of 2668 N/A C:\Windows\syswow64\explorer.exe C:\Windows\syswow64\vssadmin.exe
PID 2816 wrote to memory of 2668 N/A C:\Windows\syswow64\explorer.exe C:\Windows\syswow64\vssadmin.exe
PID 2816 wrote to memory of 2668 N/A C:\Windows\syswow64\explorer.exe C:\Windows\syswow64\vssadmin.exe

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\cryptowall.exe

"C:\Users\Admin\AppData\Local\Temp\cryptowall.exe"

C:\Users\Admin\AppData\Local\Temp\cryptowall.exe

"C:\Users\Admin\AppData\Local\Temp\cryptowall.exe"

C:\Windows\syswow64\explorer.exe

"C:\Windows\syswow64\explorer.exe"

C:\Windows\syswow64\svchost.exe

-k netsvcs

C:\Windows\syswow64\vssadmin.exe

vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\explorer.exe

"C:\Windows\explorer.exe"

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x4e8

Network

Country Destination Domain Proto
US 8.8.8.8:53 ip-addr.es udp
FR 188.165.164.184:80 ip-addr.es tcp
US 8.8.8.8:53 myexternalip.com udp
US 34.160.111.145:80 myexternalip.com tcp
FR 94.247.28.156:8081 tcp
US 209.148.85.151:8080 tcp
FR 91.121.12.127:4141 tcp
FR 94.247.28.26:2525 tcp
FR 94.247.31.19:8080 tcp
FR 188.165.164.184:80 ip-addr.es tcp
US 34.160.111.145:80 myexternalip.com tcp
FR 94.247.28.156:8081 tcp
US 209.148.85.151:8080 tcp

Files

memory/2644-0-0x00000000001C0000-0x00000000001D6000-memory.dmp

memory/2256-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2256-13-0x0000000000400000-0x0000000000425000-memory.dmp

memory/2256-14-0x0000000000400000-0x0000000000425000-memory.dmp

memory/2256-10-0x0000000000400000-0x0000000000425000-memory.dmp

memory/2256-1-0x0000000000400000-0x0000000000425000-memory.dmp

memory/2816-15-0x0000000000080000-0x00000000000A5000-memory.dmp

memory/2256-7-0x0000000000400000-0x0000000000425000-memory.dmp

memory/2256-5-0x0000000000400000-0x0000000000425000-memory.dmp

memory/2256-3-0x0000000000400000-0x0000000000425000-memory.dmp

memory/2120-21-0x0000000000080000-0x00000000000A5000-memory.dmp

Analysis: behavioral18

Detonation Overview

Submitted

2024-11-28 22:34

Reported

2024-11-28 22:36

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

152s

Command Line

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Ransomware-master\etc\Ransomware.Jigsaw.zip"

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: 35 N/A C:\Program Files\7-Zip\7zFM.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A

Processes

C:\Program Files\7-Zip\7zFM.exe

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Ransomware-master\etc\Ransomware.Jigsaw.zip"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 107.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 6.173.189.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral25

Detonation Overview

Submitted

2024-11-28 22:34

Reported

2024-11-28 22:37

Platform

win7-20240903-en

Max time kernel

118s

Max time network

123s

Command Line

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Ransomware-master\etc\Ransomware.Mamba.zip"

Signatures

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: 35 N/A C:\Program Files\7-Zip\7zFM.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A

Processes

C:\Program Files\7-Zip\7zFM.exe

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Ransomware-master\etc\Ransomware.Mamba.zip"

Network

N/A

Files

N/A

Analysis: behavioral26

Detonation Overview

Submitted

2024-11-28 22:34

Reported

2024-11-28 22:37

Platform

win10v2004-20241007-en

Max time kernel

92s

Max time network

152s

Command Line

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Ransomware-master\etc\Ransomware.Mamba.zip"

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: 35 N/A C:\Program Files\7-Zip\7zFM.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A

Processes

C:\Program Files\7-Zip\7zFM.exe

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Ransomware-master\etc\Ransomware.Mamba.zip"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 101.208.201.84.in-addr.arpa udp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 92.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 101.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 72.208.201.84.in-addr.arpa udp

Files

N/A

Analysis: behavioral28

Detonation Overview

Submitted

2024-11-28 22:34

Reported

2024-11-28 22:36

Platform

win10v2004-20241007-en

Max time kernel

94s

Max time network

134s

Command Line

"C:\Users\Admin\AppData\Local\Temp\131.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\131.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\131.exe

"C:\Users\Admin\AppData\Local\Temp\131.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 75.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 107.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 67.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-11-28 22:34

Reported

2024-11-28 22:37

Platform

win7-20240729-en

Max time kernel

90s

Max time network

20s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Ransomware-master\LICENSE

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Ransomware-master\LICENSE

Network

N/A

Files

N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-11-28 22:34

Reported

2024-11-28 22:36

Platform

win7-20240903-en

Max time kernel

117s

Max time network

118s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Ransomware-master\README.md

Signatures

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Ransomware-master\README.md

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Ransomware-master\README.md

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Ransomware-master\README.md"

Network

N/A

Files

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5 2267afa59012555bcd4e9cab10f59bf5
SHA1 15a0d44b1e293a091645622b1984a833aa8d5185
SHA256 61b5a78c9c56415659f52051042b330143164235dc9e1dc4d2bde4f59c0f4ed7
SHA512 386aeeb0da64b61e2b150f412c0ce4746102e9907e4ed1ad3b945c2dcece7643d6f2fae5ce6776ac6dd5614cc0ca84f02348e329fe34e6d5cd7ad07688b6a4a3

Analysis: behavioral31

Detonation Overview

Submitted

2024-11-28 22:34

Reported

2024-11-28 22:36

Platform

win7-20240903-en

Max time kernel

121s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Matsnu-MBRwipingRansomware_1B2D2A4B97C7C2727D571BBF9376F54F_Inkasso Rechnung vom 27.05.2013 .exe"

Signatures

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\xoufpjtenv.pre N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xoufpjtenv.pre N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xoufpjtenv.pre N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\knkztwev = "C:\\Users\\Admin\\AppData\\Roaming\\Mlzpryvbkst\\iwlchtwev.exe" C:\Windows\SysWOW64\explorer.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Matsnu-MBRwipingRansomware_1B2D2A4B97C7C2727D571BBF9376F54F_Inkasso Rechnung vom 27.05.2013 .exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Matsnu-MBRwipingRansomware_1B2D2A4B97C7C2727D571BBF9376F54F_Inkasso Rechnung vom 27.05.2013 .exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\xoufpjtenv.pre N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\xoufpjtenv.pre N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2340 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\Matsnu-MBRwipingRansomware_1B2D2A4B97C7C2727D571BBF9376F54F_Inkasso Rechnung vom 27.05.2013 .exe C:\Users\Admin\AppData\Local\Temp\Matsnu-MBRwipingRansomware_1B2D2A4B97C7C2727D571BBF9376F54F_Inkasso Rechnung vom 27.05.2013 .exe
PID 2340 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\Matsnu-MBRwipingRansomware_1B2D2A4B97C7C2727D571BBF9376F54F_Inkasso Rechnung vom 27.05.2013 .exe C:\Users\Admin\AppData\Local\Temp\Matsnu-MBRwipingRansomware_1B2D2A4B97C7C2727D571BBF9376F54F_Inkasso Rechnung vom 27.05.2013 .exe
PID 2340 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\Matsnu-MBRwipingRansomware_1B2D2A4B97C7C2727D571BBF9376F54F_Inkasso Rechnung vom 27.05.2013 .exe C:\Users\Admin\AppData\Local\Temp\Matsnu-MBRwipingRansomware_1B2D2A4B97C7C2727D571BBF9376F54F_Inkasso Rechnung vom 27.05.2013 .exe
PID 2340 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\Matsnu-MBRwipingRansomware_1B2D2A4B97C7C2727D571BBF9376F54F_Inkasso Rechnung vom 27.05.2013 .exe C:\Users\Admin\AppData\Local\Temp\Matsnu-MBRwipingRansomware_1B2D2A4B97C7C2727D571BBF9376F54F_Inkasso Rechnung vom 27.05.2013 .exe
PID 2340 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\Matsnu-MBRwipingRansomware_1B2D2A4B97C7C2727D571BBF9376F54F_Inkasso Rechnung vom 27.05.2013 .exe C:\Users\Admin\AppData\Local\Temp\Matsnu-MBRwipingRansomware_1B2D2A4B97C7C2727D571BBF9376F54F_Inkasso Rechnung vom 27.05.2013 .exe
PID 2340 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\Matsnu-MBRwipingRansomware_1B2D2A4B97C7C2727D571BBF9376F54F_Inkasso Rechnung vom 27.05.2013 .exe C:\Users\Admin\AppData\Local\Temp\Matsnu-MBRwipingRansomware_1B2D2A4B97C7C2727D571BBF9376F54F_Inkasso Rechnung vom 27.05.2013 .exe
PID 2340 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\Matsnu-MBRwipingRansomware_1B2D2A4B97C7C2727D571BBF9376F54F_Inkasso Rechnung vom 27.05.2013 .exe C:\Users\Admin\AppData\Local\Temp\Matsnu-MBRwipingRansomware_1B2D2A4B97C7C2727D571BBF9376F54F_Inkasso Rechnung vom 27.05.2013 .exe
PID 2340 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\Matsnu-MBRwipingRansomware_1B2D2A4B97C7C2727D571BBF9376F54F_Inkasso Rechnung vom 27.05.2013 .exe C:\Users\Admin\AppData\Local\Temp\Matsnu-MBRwipingRansomware_1B2D2A4B97C7C2727D571BBF9376F54F_Inkasso Rechnung vom 27.05.2013 .exe
PID 2060 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\Matsnu-MBRwipingRansomware_1B2D2A4B97C7C2727D571BBF9376F54F_Inkasso Rechnung vom 27.05.2013 .exe C:\Windows\SysWOW64\svchost.exe
PID 2060 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\Matsnu-MBRwipingRansomware_1B2D2A4B97C7C2727D571BBF9376F54F_Inkasso Rechnung vom 27.05.2013 .exe C:\Windows\SysWOW64\svchost.exe
PID 2060 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\Matsnu-MBRwipingRansomware_1B2D2A4B97C7C2727D571BBF9376F54F_Inkasso Rechnung vom 27.05.2013 .exe C:\Windows\SysWOW64\svchost.exe
PID 2060 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\Matsnu-MBRwipingRansomware_1B2D2A4B97C7C2727D571BBF9376F54F_Inkasso Rechnung vom 27.05.2013 .exe C:\Windows\SysWOW64\svchost.exe
PID 2060 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\Matsnu-MBRwipingRansomware_1B2D2A4B97C7C2727D571BBF9376F54F_Inkasso Rechnung vom 27.05.2013 .exe C:\Windows\SysWOW64\svchost.exe
PID 2240 wrote to memory of 2792 N/A C:\Windows\SysWOW64\svchost.exe C:\Users\Admin\AppData\Local\Temp\xoufpjtenv.pre
PID 2240 wrote to memory of 2792 N/A C:\Windows\SysWOW64\svchost.exe C:\Users\Admin\AppData\Local\Temp\xoufpjtenv.pre
PID 2240 wrote to memory of 2792 N/A C:\Windows\SysWOW64\svchost.exe C:\Users\Admin\AppData\Local\Temp\xoufpjtenv.pre
PID 2240 wrote to memory of 2792 N/A C:\Windows\SysWOW64\svchost.exe C:\Users\Admin\AppData\Local\Temp\xoufpjtenv.pre
PID 2792 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\xoufpjtenv.pre C:\Users\Admin\AppData\Local\Temp\xoufpjtenv.pre
PID 2792 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\xoufpjtenv.pre C:\Users\Admin\AppData\Local\Temp\xoufpjtenv.pre
PID 2792 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\xoufpjtenv.pre C:\Users\Admin\AppData\Local\Temp\xoufpjtenv.pre
PID 2792 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\xoufpjtenv.pre C:\Users\Admin\AppData\Local\Temp\xoufpjtenv.pre
PID 2792 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\xoufpjtenv.pre C:\Users\Admin\AppData\Local\Temp\xoufpjtenv.pre
PID 2792 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\xoufpjtenv.pre C:\Users\Admin\AppData\Local\Temp\xoufpjtenv.pre
PID 2792 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\xoufpjtenv.pre C:\Users\Admin\AppData\Local\Temp\xoufpjtenv.pre
PID 2792 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\xoufpjtenv.pre C:\Users\Admin\AppData\Local\Temp\xoufpjtenv.pre
PID 2836 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\xoufpjtenv.pre C:\Windows\SysWOW64\explorer.exe
PID 2836 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\xoufpjtenv.pre C:\Windows\SysWOW64\explorer.exe
PID 2836 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\xoufpjtenv.pre C:\Windows\SysWOW64\explorer.exe
PID 2836 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\xoufpjtenv.pre C:\Windows\SysWOW64\explorer.exe
PID 2836 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\xoufpjtenv.pre C:\Windows\SysWOW64\explorer.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Matsnu-MBRwipingRansomware_1B2D2A4B97C7C2727D571BBF9376F54F_Inkasso Rechnung vom 27.05.2013 .exe

"C:\Users\Admin\AppData\Local\Temp\Matsnu-MBRwipingRansomware_1B2D2A4B97C7C2727D571BBF9376F54F_Inkasso Rechnung vom 27.05.2013 .exe"

C:\Users\Admin\AppData\Local\Temp\Matsnu-MBRwipingRansomware_1B2D2A4B97C7C2727D571BBF9376F54F_Inkasso Rechnung vom 27.05.2013 .exe

"C:\Users\Admin\AppData\Local\Temp\Matsnu-MBRwipingRansomware_1B2D2A4B97C7C2727D571BBF9376F54F_Inkasso Rechnung vom 27.05.2013 .exe"

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Users\Admin\AppData\Local\Temp\xoufpjtenv.pre

C:\Users\Admin\AppData\Local\Temp\xoufpjtenv.pre

C:\Users\Admin\AppData\Local\Temp\xoufpjtenv.pre

C:\Users\Admin\AppData\Local\Temp\xoufpjtenv.pre

C:\Windows\SysWOW64\explorer.exe

explorer.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 nvufvwieg.com udp

Files

memory/2060-8-0x0000000000400000-0x0000000000414000-memory.dmp

memory/2060-6-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2060-13-0x0000000000400000-0x0000000000414000-memory.dmp

memory/2060-12-0x0000000000400000-0x0000000000414000-memory.dmp

memory/2060-11-0x0000000000400000-0x0000000000414000-memory.dmp

memory/2060-10-0x0000000000400000-0x0000000000414000-memory.dmp

memory/2060-4-0x0000000000400000-0x0000000000414000-memory.dmp

memory/2060-2-0x0000000000400000-0x0000000000414000-memory.dmp

memory/2060-0-0x0000000000400000-0x0000000000414000-memory.dmp

memory/2240-14-0x000000007EFA0000-0x000000007EFAE000-memory.dmp

memory/2240-19-0x000000007EFA0000-0x000000007EFAE000-memory.dmp

memory/2240-15-0x000000007EFA0000-0x000000007EFAE000-memory.dmp

\Users\Admin\AppData\Local\Temp\xoufpjtenv.pre

MD5 1b2d2a4b97c7c2727d571bbf9376f54f
SHA1 1fc29938ec5c209ba900247d2919069b320d33b0
SHA256 7634433f8fcf4d13fb46d680802e48eeb160e0f51e228cae058436845976381e
SHA512 506fc96423e5e2e38078806591e09a6eb3cf924eb748af528f7315aa0b929890823798a3ef2a5809c14023c3ff8a3db36277bc90c7b099218422aafa4e0c2ee0

memory/2836-44-0x0000000000400000-0x0000000000414000-memory.dmp

memory/2760-46-0x000000007EFA0000-0x000000007EFAE000-memory.dmp

memory/2760-49-0x000000007EFA0000-0x000000007EFAE000-memory.dmp

memory/2760-50-0x000000007EFA0000-0x000000007EFAE000-memory.dmp

memory/2760-55-0x000000007EFA0000-0x000000007EFAE000-memory.dmp

Analysis: behavioral22

Detonation Overview

Submitted

2024-11-28 22:34

Reported

2024-11-28 22:36

Platform

win10v2004-20241007-en

Max time kernel

92s

Max time network

142s

Command Line

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Ransomware-master\etc\Ransomware.Locky.zip"

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: 35 N/A C:\Program Files\7-Zip\7zFM.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A

Processes

C:\Program Files\7-Zip\7zFM.exe

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Ransomware-master\etc\Ransomware.Locky.zip"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 100.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 101.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 103.209.201.84.in-addr.arpa udp

Files

N/A

Analysis: behavioral32

Detonation Overview

Submitted

2024-11-28 22:34

Reported

2024-11-28 22:37

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

157s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Matsnu-MBRwipingRansomware_1B2D2A4B97C7C2727D571BBF9376F54F_Inkasso Rechnung vom 27.05.2013 .exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Matsnu-MBRwipingRansomware_1B2D2A4B97C7C2727D571BBF9376F54F_Inkasso Rechnung vom 27.05.2013 .exe N/A

System Network Configuration Discovery: Internet Connection Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Matsnu-MBRwipingRansomware_1B2D2A4B97C7C2727D571BBF9376F54F_Inkasso Rechnung vom 27.05.2013 .exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Matsnu-MBRwipingRansomware_1B2D2A4B97C7C2727D571BBF9376F54F_Inkasso Rechnung vom 27.05.2013 .exe

"C:\Users\Admin\AppData\Local\Temp\Matsnu-MBRwipingRansomware_1B2D2A4B97C7C2727D571BBF9376F54F_Inkasso Rechnung vom 27.05.2013 .exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3532 -ip 3532

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3532 -s 368

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 101.208.201.84.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 69.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 107.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 66.112.168.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-11-28 22:34

Reported

2024-11-28 22:37

Platform

win10v2004-20241007-en

Max time kernel

93s

Max time network

139s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Ransomware-master\LICENSE

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Ransomware-master\LICENSE

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 107.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral10

Detonation Overview

Submitted

2024-11-28 22:34

Reported

2024-11-28 22:36

Platform

win10v2004-20241007-en

Max time kernel

148s

Max time network

150s

Command Line

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Ransomware-master\etc\Ransomware.Cerber.zip"

Signatures

Cerber

ransomware cerber

Cerber family

cerber

Contacts a large (1100) amount of remote hosts

discovery

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A

Drops startup file

Description Indicator Process Target
File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\word\startup\ C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\outlook C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\steam C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\documents C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\excel C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\word C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\outlook C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\bitcoin C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\office C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\excel C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\steam C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\onenote C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\thunderbird C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft sql server C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\office C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\onenote C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\onenote C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\powerpoint C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\the bat! C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\the bat! C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\thunderbird C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\microsoft sql server C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\onenote C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\word C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\excel C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\office C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\outlook C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\outlook C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\powerpoint C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\powerpoint C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\bitcoin C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft sql server C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\word C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\office C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\powerpoint C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\word C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\desktop C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\excel C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\microsoft sql server C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp554A.bmp" C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification \??\c:\program files (x86)\outlook C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\program files\ C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\program files (x86)\bitcoin C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\program files (x86)\onenote C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\word C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\program files (x86)\powerpoint C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\program files (x86)\the bat! C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\program files (x86)\thunderbird C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\program files (x86)\excel C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\microsoft sql server C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\onenote C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\excel C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\powerpoint C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\program files (x86)\word C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\outlook C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\program files (x86)\office C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\program files (x86)\steam C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\program files (x86)\ C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft sql server C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\office C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft sql server C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\thunderbird C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\thunderbird C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\word C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\onenote C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\outlook C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\powerpoint C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\steam C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\ C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\office C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\onenote C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\onenote C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\steam C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\steam C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\bitcoin C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\microsoft sql server C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\office C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\powerpoint C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\word C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\word C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\microsoft sql server C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\onenote C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\office C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\outlook C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\excel C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\microsoft sql server C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\office C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\excel C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\outlook C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\office C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\powerpoint C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\documents C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\bitcoin C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\excel C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\outlook C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\word C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft sql server C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\microsoft sql server C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\powerpoint C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\the bat! C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\documents C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\office C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\powerpoint C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\outlook C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\the bat! C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft sql server C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\excel C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\onenote C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\steam C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\excel C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\thunderbird C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\word C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\bitcoin C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft sql server C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\outlook C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\thunderbird C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\bitcoin C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\word C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\onenote C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\outlook C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\the bat! C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\desktop C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\excel C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\office C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\PING.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mshta.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\NOTEPAD.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A

System Network Configuration Discovery: Internet Connection Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\NOTEPAD.EXE N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: 35 N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2256 wrote to memory of 4460 N/A C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe
PID 2256 wrote to memory of 4460 N/A C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe
PID 2256 wrote to memory of 4460 N/A C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe
PID 4460 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe C:\Windows\SysWOW64\netsh.exe
PID 4460 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe C:\Windows\SysWOW64\netsh.exe
PID 4460 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe C:\Windows\SysWOW64\netsh.exe
PID 4460 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe C:\Windows\SysWOW64\netsh.exe
PID 4460 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe C:\Windows\SysWOW64\netsh.exe
PID 4460 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe C:\Windows\SysWOW64\netsh.exe
PID 4460 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe C:\Windows\SysWOW64\mshta.exe
PID 4460 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe C:\Windows\SysWOW64\mshta.exe
PID 4460 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe C:\Windows\SysWOW64\mshta.exe
PID 4460 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe C:\Windows\SysWOW64\NOTEPAD.EXE
PID 4460 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe C:\Windows\SysWOW64\NOTEPAD.EXE
PID 4460 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe C:\Windows\SysWOW64\NOTEPAD.EXE
PID 4460 wrote to memory of 3436 N/A C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe C:\Windows\SysWOW64\cmd.exe
PID 4460 wrote to memory of 3436 N/A C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe C:\Windows\SysWOW64\cmd.exe
PID 4460 wrote to memory of 3436 N/A C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe C:\Windows\SysWOW64\cmd.exe
PID 3436 wrote to memory of 1268 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3436 wrote to memory of 1268 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3436 wrote to memory of 1268 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3436 wrote to memory of 844 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 3436 wrote to memory of 844 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 3436 wrote to memory of 844 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE

Processes

C:\Program Files\7-Zip\7zFM.exe

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Ransomware-master\etc\Ransomware.Cerber.zip"

C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe

"C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe"

C:\Windows\SysWOW64\netsh.exe

C:\Windows\system32\netsh.exe advfirewall set allprofiles state on

C:\Windows\SysWOW64\netsh.exe

C:\Windows\system32\netsh.exe advfirewall reset

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___HPSW_.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___94AF_.txt

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "cerber.exe"

C:\Windows\SysWOW64\PING.EXE

ping -n 1 127.0.0.1

Network

Country Destination Domain Proto
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 102.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
FR 178.33.158.0:6893 udp
FR 178.33.158.1:6893 udp
FR 178.33.158.2:6893 udp
FR 178.33.158.3:6893 udp
FR 178.33.158.4:6893 udp
FR 178.33.158.5:6893 udp
FR 178.33.158.6:6893 udp
FR 178.33.158.7:6893 udp
FR 178.33.158.8:6893 udp
FR 178.33.158.9:6893 udp
FR 178.33.158.10:6893 udp
FR 178.33.158.11:6893 udp
FR 178.33.158.12:6893 udp
FR 178.33.158.13:6893 udp
FR 178.33.158.14:6893 udp
FR 178.33.158.15:6893 udp
FR 178.33.158.16:6893 udp
FR 178.33.158.17:6893 udp
FR 178.33.158.18:6893 udp
FR 178.33.158.19:6893 udp
FR 178.33.158.20:6893 udp
FR 178.33.158.21:6893 udp
FR 178.33.158.22:6893 udp
FR 178.33.158.23:6893 udp
FR 178.33.158.24:6893 udp
FR 178.33.158.25:6893 udp
FR 178.33.158.26:6893 udp
FR 178.33.158.27:6893 udp
FR 178.33.158.28:6893 udp
FR 178.33.158.29:6893 udp
FR 178.33.158.30:6893 udp
FR 178.33.158.31:6893 udp
FR 178.33.159.0:6893 udp
FR 178.33.159.1:6893 udp
FR 178.33.159.2:6893 udp
FR 178.33.159.3:6893 udp
FR 178.33.159.4:6893 udp
FR 178.33.159.5:6893 udp
FR 178.33.159.6:6893 udp
FR 178.33.159.7:6893 udp
FR 178.33.159.8:6893 udp
FR 178.33.159.9:6893 udp
FR 178.33.159.10:6893 udp
FR 178.33.159.11:6893 udp
FR 178.33.159.12:6893 udp
FR 178.33.159.13:6893 udp
FR 178.33.159.14:6893 udp
FR 178.33.159.15:6893 udp
FR 178.33.159.16:6893 udp
FR 178.33.159.17:6893 udp
FR 178.33.159.18:6893 udp
FR 178.33.159.19:6893 udp
FR 178.33.159.20:6893 udp
FR 178.33.159.21:6893 udp
FR 178.33.159.22:6893 udp
FR 178.33.159.23:6893 udp
FR 178.33.159.24:6893 udp
FR 178.33.159.25:6893 udp
FR 178.33.159.26:6893 udp
FR 178.33.159.27:6893 udp
FR 178.33.159.28:6893 udp
FR 178.33.159.29:6893 udp
FR 178.33.159.30:6893 udp
FR 178.33.159.31:6893 udp
FR 178.33.160.0:6893 udp
FR 178.33.160.1:6893 udp
FR 178.33.160.2:6893 udp
FR 178.33.160.3:6893 udp
FR 178.33.160.4:6893 udp
FR 178.33.160.5:6893 udp
FR 178.33.160.6:6893 udp
FR 178.33.160.7:6893 udp
FR 178.33.160.8:6893 udp
FR 178.33.160.9:6893 udp
FR 178.33.160.10:6893 udp
FR 178.33.160.11:6893 udp
FR 178.33.160.12:6893 udp
FR 178.33.160.13:6893 udp
FR 178.33.160.14:6893 udp
FR 178.33.160.15:6893 udp
FR 178.33.160.16:6893 udp
FR 178.33.160.17:6893 udp
FR 178.33.160.18:6893 udp
FR 178.33.160.19:6893 udp
FR 178.33.160.20:6893 udp
FR 178.33.160.21:6893 udp
FR 178.33.160.22:6893 udp
FR 178.33.160.23:6893 udp
FR 178.33.160.24:6893 udp
FR 178.33.160.25:6893 udp
FR 178.33.160.26:6893 udp
FR 178.33.160.27:6893 udp
FR 178.33.160.28:6893 udp
FR 178.33.160.29:6893 udp
FR 178.33.160.30:6893 udp
FR 178.33.160.31:6893 udp
FR 178.33.160.32:6893 udp
FR 178.33.160.33:6893 udp
FR 178.33.160.34:6893 udp
FR 178.33.160.35:6893 udp
FR 178.33.160.36:6893 udp
FR 178.33.160.37:6893 udp
FR 178.33.160.38:6893 udp
FR 178.33.160.39:6893 udp
FR 178.33.160.40:6893 udp
FR 178.33.160.41:6893 udp
FR 178.33.160.42:6893 udp
FR 178.33.160.43:6893 udp
FR 178.33.160.44:6893 udp
FR 178.33.160.45:6893 udp
FR 178.33.160.46:6893 udp
FR 178.33.160.47:6893 udp
FR 178.33.160.48:6893 udp
FR 178.33.160.49:6893 udp
FR 178.33.160.50:6893 udp
FR 178.33.160.51:6893 udp
FR 178.33.160.52:6893 udp
FR 178.33.160.53:6893 udp
FR 178.33.160.54:6893 udp
FR 178.33.160.55:6893 udp
FR 178.33.160.56:6893 udp
FR 178.33.160.57:6893 udp
FR 178.33.160.58:6893 udp
FR 178.33.160.59:6893 udp
FR 178.33.160.60:6893 udp
FR 178.33.160.61:6893 udp
FR 178.33.160.62:6893 udp
FR 178.33.160.63:6893 udp
FR 178.33.160.64:6893 udp
FR 178.33.160.65:6893 udp
FR 178.33.160.66:6893 udp
FR 178.33.160.67:6893 udp
FR 178.33.160.68:6893 udp
FR 178.33.160.69:6893 udp
FR 178.33.160.70:6893 udp
FR 178.33.160.71:6893 udp
FR 178.33.160.72:6893 udp
FR 178.33.160.73:6893 udp
FR 178.33.160.74:6893 udp
FR 178.33.160.75:6893 udp
FR 178.33.160.76:6893 udp
FR 178.33.160.77:6893 udp
FR 178.33.160.78:6893 udp
FR 178.33.160.79:6893 udp
FR 178.33.160.80:6893 udp
FR 178.33.160.81:6893 udp
FR 178.33.160.82:6893 udp
FR 178.33.160.83:6893 udp
FR 178.33.160.84:6893 udp
FR 178.33.160.85:6893 udp
FR 178.33.160.86:6893 udp
FR 178.33.160.87:6893 udp
FR 178.33.160.88:6893 udp
FR 178.33.160.89:6893 udp
FR 178.33.160.90:6893 udp
FR 178.33.160.91:6893 udp
FR 178.33.160.92:6893 udp
FR 178.33.160.93:6893 udp
FR 178.33.160.94:6893 udp
FR 178.33.160.95:6893 udp
FR 178.33.160.96:6893 udp
FR 178.33.160.97:6893 udp
FR 178.33.160.98:6893 udp
FR 178.33.160.99:6893 udp
FR 178.33.160.100:6893 udp
FR 178.33.160.101:6893 udp
FR 178.33.160.102:6893 udp
FR 178.33.160.103:6893 udp
FR 178.33.160.104:6893 udp
FR 178.33.160.105:6893 udp
FR 178.33.160.106:6893 udp
FR 178.33.160.107:6893 udp
FR 178.33.160.108:6893 udp
FR 178.33.160.109:6893 udp
FR 178.33.160.110:6893 udp
FR 178.33.160.111:6893 udp
FR 178.33.160.112:6893 udp
FR 178.33.160.113:6893 udp
FR 178.33.160.114:6893 udp
FR 178.33.160.115:6893 udp
FR 178.33.160.116:6893 udp
FR 178.33.160.117:6893 udp
FR 178.33.160.118:6893 udp
FR 178.33.160.119:6893 udp
FR 178.33.160.120:6893 udp
FR 178.33.160.121:6893 udp
FR 178.33.160.122:6893 udp
FR 178.33.160.123:6893 udp
FR 178.33.160.124:6893 udp
FR 178.33.160.125:6893 udp
FR 178.33.160.126:6893 udp
FR 178.33.160.127:6893 udp
FR 178.33.160.128:6893 udp
FR 178.33.160.129:6893 udp
FR 178.33.160.130:6893 udp
FR 178.33.160.131:6893 udp
FR 178.33.160.132:6893 udp
FR 178.33.160.133:6893 udp
FR 178.33.160.134:6893 udp
FR 178.33.160.135:6893 udp
FR 178.33.160.136:6893 udp
FR 178.33.160.137:6893 udp
FR 178.33.160.138:6893 udp
FR 178.33.160.139:6893 udp
FR 178.33.160.140:6893 udp
FR 178.33.160.141:6893 udp
FR 178.33.160.142:6893 udp
FR 178.33.160.143:6893 udp
FR 178.33.160.144:6893 udp
FR 178.33.160.145:6893 udp
FR 178.33.160.146:6893 udp
FR 178.33.160.147:6893 udp
FR 178.33.160.148:6893 udp
FR 178.33.160.149:6893 udp
FR 178.33.160.150:6893 udp
FR 178.33.160.151:6893 udp
FR 178.33.160.152:6893 udp
FR 178.33.160.153:6893 udp
FR 178.33.160.154:6893 udp
FR 178.33.160.155:6893 udp
FR 178.33.160.156:6893 udp
FR 178.33.160.157:6893 udp
FR 178.33.160.158:6893 udp
FR 178.33.160.159:6893 udp
FR 178.33.160.160:6893 udp
FR 178.33.160.161:6893 udp
FR 178.33.160.162:6893 udp
FR 178.33.160.163:6893 udp
FR 178.33.160.164:6893 udp
FR 178.33.160.165:6893 udp
FR 178.33.160.166:6893 udp
FR 178.33.160.167:6893 udp
FR 178.33.160.168:6893 udp
FR 178.33.160.169:6893 udp
FR 178.33.160.170:6893 udp
FR 178.33.160.171:6893 udp
FR 178.33.160.172:6893 udp
FR 178.33.160.173:6893 udp
FR 178.33.160.174:6893 udp
FR 178.33.160.175:6893 udp
FR 178.33.160.176:6893 udp
FR 178.33.160.177:6893 udp
FR 178.33.160.178:6893 udp
FR 178.33.160.179:6893 udp
FR 178.33.160.180:6893 udp
FR 178.33.160.181:6893 udp
FR 178.33.160.182:6893 udp
FR 178.33.160.183:6893 udp
FR 178.33.160.184:6893 udp
FR 178.33.160.185:6893 udp
FR 178.33.160.186:6893 udp
FR 178.33.160.187:6893 udp
FR 178.33.160.188:6893 udp
FR 178.33.160.189:6893 udp
FR 178.33.160.190:6893 udp
FR 178.33.160.191:6893 udp
FR 178.33.160.192:6893 udp
FR 178.33.160.193:6893 udp
FR 178.33.160.194:6893 udp
FR 178.33.160.195:6893 udp
FR 178.33.160.196:6893 udp
FR 178.33.160.197:6893 udp
FR 178.33.160.198:6893 udp
FR 178.33.160.199:6893 udp
FR 178.33.160.200:6893 udp
FR 178.33.160.201:6893 udp
FR 178.33.160.202:6893 udp
FR 178.33.160.203:6893 udp
FR 178.33.160.204:6893 udp
FR 178.33.160.205:6893 udp
FR 178.33.160.206:6893 udp
FR 178.33.160.207:6893 udp
FR 178.33.160.208:6893 udp
FR 178.33.160.209:6893 udp
FR 178.33.160.210:6893 udp
FR 178.33.160.211:6893 udp
FR 178.33.160.212:6893 udp
FR 178.33.160.213:6893 udp
FR 178.33.160.214:6893 udp
FR 178.33.160.215:6893 udp
FR 178.33.160.216:6893 udp
FR 178.33.160.217:6893 udp
FR 178.33.160.218:6893 udp
FR 178.33.160.219:6893 udp
FR 178.33.160.220:6893 udp
FR 178.33.160.221:6893 udp
FR 178.33.160.222:6893 udp
FR 178.33.160.223:6893 udp
FR 178.33.160.224:6893 udp
FR 178.33.160.225:6893 udp
FR 178.33.160.226:6893 udp
FR 178.33.160.227:6893 udp
FR 178.33.160.228:6893 udp
FR 178.33.160.229:6893 udp
FR 178.33.160.230:6893 udp
FR 178.33.160.231:6893 udp
FR 178.33.160.232:6893 udp
FR 178.33.160.233:6893 udp
FR 178.33.160.234:6893 udp
FR 178.33.160.235:6893 udp
FR 178.33.160.236:6893 udp
FR 178.33.160.237:6893 udp
FR 178.33.160.238:6893 udp
FR 178.33.160.239:6893 udp
FR 178.33.160.240:6893 udp
FR 178.33.160.241:6893 udp
FR 178.33.160.242:6893 udp
FR 178.33.160.243:6893 udp
FR 178.33.160.244:6893 udp
FR 178.33.160.245:6893 udp
FR 178.33.160.246:6893 udp
FR 178.33.160.247:6893 udp
FR 178.33.160.248:6893 udp
FR 178.33.160.249:6893 udp
FR 178.33.160.250:6893 udp
FR 178.33.160.251:6893 udp
FR 178.33.160.252:6893 udp
FR 178.33.160.253:6893 udp
FR 178.33.160.254:6893 udp
US 8.8.8.8:53 0.158.33.178.in-addr.arpa udp
US 8.8.8.8:53 1.158.33.178.in-addr.arpa udp
US 8.8.8.8:53 2.158.33.178.in-addr.arpa udp
US 8.8.8.8:53 3.158.33.178.in-addr.arpa udp
US 8.8.8.8:53 4.158.33.178.in-addr.arpa udp
US 8.8.8.8:53 5.158.33.178.in-addr.arpa udp
US 8.8.8.8:53 6.158.33.178.in-addr.arpa udp
US 8.8.8.8:53 7.158.33.178.in-addr.arpa udp
US 8.8.8.8:53 8.158.33.178.in-addr.arpa udp
US 8.8.8.8:53 9.158.33.178.in-addr.arpa udp
US 8.8.8.8:53 10.158.33.178.in-addr.arpa udp
US 8.8.8.8:53 11.158.33.178.in-addr.arpa udp
US 8.8.8.8:53 12.158.33.178.in-addr.arpa udp
US 8.8.8.8:53 13.158.33.178.in-addr.arpa udp
US 8.8.8.8:53 15.158.33.178.in-addr.arpa udp
US 8.8.8.8:53 14.158.33.178.in-addr.arpa udp
US 8.8.8.8:53 16.158.33.178.in-addr.arpa udp
US 8.8.8.8:53 17.158.33.178.in-addr.arpa udp
US 8.8.8.8:53 18.158.33.178.in-addr.arpa udp
US 8.8.8.8:53 19.158.33.178.in-addr.arpa udp
US 8.8.8.8:53 20.158.33.178.in-addr.arpa udp
US 8.8.8.8:53 21.158.33.178.in-addr.arpa udp
US 8.8.8.8:53 23.158.33.178.in-addr.arpa udp
US 8.8.8.8:53 24.158.33.178.in-addr.arpa udp
US 8.8.8.8:53 22.158.33.178.in-addr.arpa udp
US 8.8.8.8:53 25.158.33.178.in-addr.arpa udp
US 8.8.8.8:53 26.158.33.178.in-addr.arpa udp
US 8.8.8.8:53 27.158.33.178.in-addr.arpa udp
US 8.8.8.8:53 28.158.33.178.in-addr.arpa udp
US 8.8.8.8:53 29.158.33.178.in-addr.arpa udp
US 8.8.8.8:53 30.158.33.178.in-addr.arpa udp
US 8.8.8.8:53 31.158.33.178.in-addr.arpa udp
US 8.8.8.8:53 0.159.33.178.in-addr.arpa udp
US 8.8.8.8:53 1.159.33.178.in-addr.arpa udp
US 8.8.8.8:53 3.159.33.178.in-addr.arpa udp
US 8.8.8.8:53 2.159.33.178.in-addr.arpa udp
US 8.8.8.8:53 4.159.33.178.in-addr.arpa udp
US 8.8.8.8:53 5.159.33.178.in-addr.arpa udp
US 8.8.8.8:53 6.159.33.178.in-addr.arpa udp
US 8.8.8.8:53 7.159.33.178.in-addr.arpa udp
US 8.8.8.8:53 8.159.33.178.in-addr.arpa udp
US 8.8.8.8:53 9.159.33.178.in-addr.arpa udp
US 8.8.8.8:53 10.159.33.178.in-addr.arpa udp
US 8.8.8.8:53 11.159.33.178.in-addr.arpa udp
US 8.8.8.8:53 12.159.33.178.in-addr.arpa udp
US 8.8.8.8:53 13.159.33.178.in-addr.arpa udp
US 8.8.8.8:53 14.159.33.178.in-addr.arpa udp
US 8.8.8.8:53 15.159.33.178.in-addr.arpa udp
US 8.8.8.8:53 16.159.33.178.in-addr.arpa udp
US 8.8.8.8:53 17.159.33.178.in-addr.arpa udp
US 8.8.8.8:53 18.159.33.178.in-addr.arpa udp
US 8.8.8.8:53 20.159.33.178.in-addr.arpa udp
US 8.8.8.8:53 19.159.33.178.in-addr.arpa udp
US 8.8.8.8:53 21.159.33.178.in-addr.arpa udp
US 8.8.8.8:53 22.159.33.178.in-addr.arpa udp
US 8.8.8.8:53 24.159.33.178.in-addr.arpa udp
US 8.8.8.8:53 23.159.33.178.in-addr.arpa udp
US 8.8.8.8:53 25.159.33.178.in-addr.arpa udp
US 8.8.8.8:53 26.159.33.178.in-addr.arpa udp
US 8.8.8.8:53 28.159.33.178.in-addr.arpa udp
US 8.8.8.8:53 27.159.33.178.in-addr.arpa udp
US 8.8.8.8:53 29.159.33.178.in-addr.arpa udp
US 8.8.8.8:53 30.159.33.178.in-addr.arpa udp
US 8.8.8.8:53 31.159.33.178.in-addr.arpa udp
US 8.8.8.8:53 0.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 1.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 2.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 3.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 4.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 5.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 6.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 7.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 8.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 9.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 10.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 11.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 12.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 13.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 14.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 15.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 16.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 17.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 18.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 19.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 20.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 21.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 22.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 23.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 24.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 25.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 26.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 27.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 28.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 29.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 30.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 31.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 32.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 33.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 34.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 35.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 36.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 37.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 38.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 40.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 39.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 41.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 42.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 43.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 44.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 45.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 46.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 47.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 48.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 49.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 50.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 51.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 52.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 53.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 54.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 55.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 56.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 57.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 58.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 59.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 60.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 61.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 62.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 63.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 65.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 64.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 66.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 67.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 68.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 69.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 70.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 71.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 72.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 73.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 74.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 75.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 76.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 77.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 78.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 79.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 80.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 81.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 82.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 83.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 85.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 84.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 86.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 87.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 88.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 89.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 90.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 91.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 93.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 92.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 94.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 95.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 96.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 97.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 98.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 99.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 100.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 101.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 102.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 103.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 104.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 105.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 107.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 106.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 108.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 110.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 111.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 112.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 113.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 114.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 115.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 116.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 117.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 118.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 119.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 120.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 121.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 122.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 123.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 124.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 125.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 126.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 127.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 129.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 128.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 130.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 131.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 132.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 134.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 133.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 135.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 136.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 137.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 138.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 139.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 140.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 141.160.33.178.in-addr.arpa udp
FR 178.33.160.255:6893 udp
FR 178.33.161.0:6893 udp
FR 178.33.161.1:6893 udp
FR 178.33.161.2:6893 udp
FR 178.33.161.3:6893 udp
FR 178.33.161.4:6893 udp
FR 178.33.161.5:6893 udp
FR 178.33.161.6:6893 udp
FR 178.33.161.7:6893 udp
FR 178.33.161.8:6893 udp
FR 178.33.161.9:6893 udp
FR 178.33.161.10:6893 udp
FR 178.33.161.11:6893 udp
FR 178.33.161.12:6893 udp
FR 178.33.161.13:6893 udp
FR 178.33.161.14:6893 udp
FR 178.33.161.15:6893 udp
FR 178.33.161.16:6893 udp
FR 178.33.161.17:6893 udp
FR 178.33.161.18:6893 udp
FR 178.33.161.19:6893 udp
FR 178.33.161.20:6893 udp
FR 178.33.161.21:6893 udp
FR 178.33.161.22:6893 udp
FR 178.33.161.23:6893 udp
FR 178.33.161.24:6893 udp
FR 178.33.161.25:6893 udp
FR 178.33.161.26:6893 udp
FR 178.33.161.27:6893 udp
FR 178.33.161.28:6893 udp
FR 178.33.161.29:6893 udp
FR 178.33.161.30:6893 udp
FR 178.33.161.31:6893 udp
FR 178.33.161.32:6893 udp
FR 178.33.161.33:6893 udp
FR 178.33.161.34:6893 udp
FR 178.33.161.35:6893 udp
FR 178.33.161.36:6893 udp
FR 178.33.161.37:6893 udp
FR 178.33.161.38:6893 udp
FR 178.33.161.39:6893 udp
FR 178.33.161.40:6893 udp
FR 178.33.161.41:6893 udp
FR 178.33.161.42:6893 udp
FR 178.33.161.43:6893 udp
FR 178.33.161.44:6893 udp
FR 178.33.161.45:6893 udp
FR 178.33.161.46:6893 udp
FR 178.33.161.47:6893 udp
FR 178.33.161.48:6893 udp
FR 178.33.161.49:6893 udp
FR 178.33.161.50:6893 udp
FR 178.33.161.51:6893 udp
FR 178.33.161.52:6893 udp
FR 178.33.161.53:6893 udp
FR 178.33.161.54:6893 udp
FR 178.33.161.55:6893 udp
FR 178.33.161.56:6893 udp
FR 178.33.161.57:6893 udp
FR 178.33.161.58:6893 udp
FR 178.33.161.59:6893 udp
FR 178.33.161.60:6893 udp
FR 178.33.161.61:6893 udp
FR 178.33.161.62:6893 udp
FR 178.33.161.63:6893 udp
FR 178.33.161.64:6893 udp
FR 178.33.161.65:6893 udp
FR 178.33.161.66:6893 udp
FR 178.33.161.67:6893 udp
FR 178.33.161.68:6893 udp
FR 178.33.161.69:6893 udp
FR 178.33.161.70:6893 udp
FR 178.33.161.71:6893 udp
FR 178.33.161.72:6893 udp
FR 178.33.161.73:6893 udp
FR 178.33.161.74:6893 udp
FR 178.33.161.75:6893 udp
FR 178.33.161.76:6893 udp
FR 178.33.161.77:6893 udp
FR 178.33.161.78:6893 udp
FR 178.33.161.79:6893 udp
FR 178.33.161.80:6893 udp
FR 178.33.161.81:6893 udp
FR 178.33.161.82:6893 udp
FR 178.33.161.83:6893 udp
FR 178.33.161.84:6893 udp
FR 178.33.161.85:6893 udp
FR 178.33.161.86:6893 udp
FR 178.33.161.87:6893 udp
FR 178.33.161.88:6893 udp
FR 178.33.161.89:6893 udp
FR 178.33.161.90:6893 udp
FR 178.33.161.91:6893 udp
FR 178.33.161.92:6893 udp
FR 178.33.161.93:6893 udp
FR 178.33.161.94:6893 udp
FR 178.33.161.95:6893 udp
FR 178.33.161.96:6893 udp
FR 178.33.161.97:6893 udp
FR 178.33.161.98:6893 udp
FR 178.33.161.99:6893 udp
FR 178.33.161.100:6893 udp
FR 178.33.161.101:6893 udp
FR 178.33.161.102:6893 udp
FR 178.33.161.103:6893 udp
FR 178.33.161.104:6893 udp
FR 178.33.161.105:6893 udp
FR 178.33.161.106:6893 udp
FR 178.33.161.107:6893 udp
FR 178.33.161.108:6893 udp
FR 178.33.161.109:6893 udp
FR 178.33.161.110:6893 udp
FR 178.33.161.111:6893 udp
FR 178.33.161.112:6893 udp
FR 178.33.161.113:6893 udp
FR 178.33.161.114:6893 udp
FR 178.33.161.115:6893 udp
FR 178.33.161.116:6893 udp
FR 178.33.161.117:6893 udp
FR 178.33.161.118:6893 udp
FR 178.33.161.119:6893 udp
FR 178.33.161.120:6893 udp
FR 178.33.161.121:6893 udp
FR 178.33.161.122:6893 udp
FR 178.33.161.123:6893 udp
FR 178.33.161.124:6893 udp
FR 178.33.161.125:6893 udp
FR 178.33.161.126:6893 udp
FR 178.33.161.127:6893 udp
FR 178.33.161.128:6893 udp
FR 178.33.161.129:6893 udp
FR 178.33.161.130:6893 udp
FR 178.33.161.131:6893 udp
FR 178.33.161.132:6893 udp
FR 178.33.161.133:6893 udp
FR 178.33.161.134:6893 udp
FR 178.33.161.135:6893 udp
FR 178.33.161.136:6893 udp
FR 178.33.161.137:6893 udp
FR 178.33.161.138:6893 udp
FR 178.33.161.139:6893 udp
FR 178.33.161.140:6893 udp
FR 178.33.161.141:6893 udp
FR 178.33.161.142:6893 udp
FR 178.33.161.143:6893 udp
FR 178.33.161.144:6893 udp
FR 178.33.161.145:6893 udp
FR 178.33.161.146:6893 udp
FR 178.33.161.147:6893 udp
FR 178.33.161.148:6893 udp
FR 178.33.161.149:6893 udp
FR 178.33.161.150:6893 udp
FR 178.33.161.151:6893 udp
FR 178.33.161.152:6893 udp
FR 178.33.161.153:6893 udp
FR 178.33.161.154:6893 udp
FR 178.33.161.155:6893 udp
FR 178.33.161.156:6893 udp
FR 178.33.161.157:6893 udp
FR 178.33.161.158:6893 udp
FR 178.33.161.159:6893 udp
FR 178.33.161.160:6893 udp
FR 178.33.161.161:6893 udp
FR 178.33.161.162:6893 udp
FR 178.33.161.163:6893 udp
FR 178.33.161.164:6893 udp
FR 178.33.161.165:6893 udp
FR 178.33.161.166:6893 udp
FR 178.33.161.167:6893 udp
FR 178.33.161.168:6893 udp
FR 178.33.161.169:6893 udp
FR 178.33.161.170:6893 udp
FR 178.33.161.171:6893 udp
FR 178.33.161.172:6893 udp
FR 178.33.161.173:6893 udp
FR 178.33.161.174:6893 udp
FR 178.33.161.175:6893 udp
FR 178.33.161.176:6893 udp
FR 178.33.161.177:6893 udp
FR 178.33.161.178:6893 udp
FR 178.33.161.179:6893 udp
FR 178.33.161.180:6893 udp
FR 178.33.161.181:6893 udp
FR 178.33.161.182:6893 udp
FR 178.33.161.183:6893 udp
FR 178.33.161.184:6893 udp
FR 178.33.161.185:6893 udp
FR 178.33.161.186:6893 udp
FR 178.33.161.187:6893 udp
FR 178.33.161.188:6893 udp
FR 178.33.161.189:6893 udp
FR 178.33.161.190:6893 udp
FR 178.33.161.191:6893 udp
FR 178.33.161.192:6893 udp
FR 178.33.161.193:6893 udp
FR 178.33.161.194:6893 udp
FR 178.33.161.195:6893 udp
FR 178.33.161.196:6893 udp
FR 178.33.161.197:6893 udp
FR 178.33.161.198:6893 udp
FR 178.33.161.199:6893 udp
FR 178.33.161.200:6893 udp
FR 178.33.161.201:6893 udp
FR 178.33.161.202:6893 udp
FR 178.33.161.203:6893 udp
FR 178.33.161.204:6893 udp
FR 178.33.161.205:6893 udp
FR 178.33.161.206:6893 udp
FR 178.33.161.207:6893 udp
FR 178.33.161.208:6893 udp
FR 178.33.161.209:6893 udp
FR 178.33.161.210:6893 udp
FR 178.33.161.211:6893 udp
FR 178.33.161.212:6893 udp
FR 178.33.161.213:6893 udp
FR 178.33.161.214:6893 udp
FR 178.33.161.215:6893 udp
FR 178.33.161.216:6893 udp
FR 178.33.161.217:6893 udp
FR 178.33.161.218:6893 udp
FR 178.33.161.219:6893 udp
FR 178.33.161.220:6893 udp
FR 178.33.161.221:6893 udp
FR 178.33.161.222:6893 udp
FR 178.33.161.223:6893 udp
FR 178.33.161.224:6893 udp
FR 178.33.161.225:6893 udp
FR 178.33.161.226:6893 udp
FR 178.33.161.227:6893 udp
FR 178.33.161.228:6893 udp
FR 178.33.161.229:6893 udp
FR 178.33.161.230:6893 udp
FR 178.33.161.231:6893 udp
FR 178.33.161.232:6893 udp
FR 178.33.161.233:6893 udp
FR 178.33.161.234:6893 udp
FR 178.33.161.235:6893 udp
FR 178.33.161.236:6893 udp
FR 178.33.161.237:6893 udp
FR 178.33.161.238:6893 udp
FR 178.33.161.239:6893 udp
FR 178.33.161.240:6893 udp
FR 178.33.161.241:6893 udp
FR 178.33.161.242:6893 udp
FR 178.33.161.243:6893 udp
FR 178.33.161.244:6893 udp
FR 178.33.161.245:6893 udp
FR 178.33.161.246:6893 udp
FR 178.33.161.247:6893 udp
FR 178.33.161.248:6893 udp
FR 178.33.161.249:6893 udp
FR 178.33.161.250:6893 udp
FR 178.33.161.251:6893 udp
FR 178.33.161.252:6893 udp
FR 178.33.161.253:6893 udp
FR 178.33.161.254:6893 udp
US 8.8.8.8:53 142.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 143.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 144.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 145.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 146.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 147.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 148.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 149.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 150.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 151.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 152.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 153.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 154.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 155.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 156.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 157.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 158.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 159.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 160.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 161.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 162.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 163.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 164.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 165.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 166.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 167.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 168.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 169.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 170.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 171.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 172.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 173.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 174.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 175.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 176.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 177.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 178.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 179.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 180.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 181.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 182.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 183.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 185.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 188.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 189.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 187.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 190.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 191.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 192.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 194.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 193.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 195.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 196.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 197.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 199.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 198.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 200.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 201.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 202.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 203.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 204.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 205.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 206.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 207.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 208.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 209.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 210.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 211.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 213.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 214.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 215.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 216.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 217.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 218.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 219.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 220.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 222.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 221.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 223.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 224.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 225.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 226.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 227.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 228.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 229.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 230.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 231.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 232.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 233.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 234.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 235.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 236.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 237.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 238.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 239.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 240.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 241.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 242.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 243.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 244.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 245.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 247.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 246.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 248.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 249.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 250.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 252.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 253.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 254.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 255.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 0.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 1.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 2.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 3.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 4.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 6.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 5.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 7.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 8.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 9.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 10.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 11.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 12.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 13.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 14.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 15.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 16.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 17.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 19.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 18.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 20.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 22.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 21.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 23.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 24.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 26.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 27.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 28.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 29.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 30.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 31.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 32.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 33.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 34.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 35.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 36.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 37.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 38.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 39.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 40.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 41.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 42.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 43.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 44.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 45.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 46.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 47.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 48.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 49.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 50.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 51.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 52.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 53.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 55.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 54.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 56.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 57.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 58.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 59.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 60.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 61.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 62.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 63.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 64.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 65.161.33.178.in-addr.arpa udp
FR 178.33.161.255:6893 udp
FR 178.33.162.0:6893 udp
FR 178.33.162.1:6893 udp
FR 178.33.162.2:6893 udp
FR 178.33.162.3:6893 udp
FR 178.33.162.4:6893 udp
FR 178.33.162.5:6893 udp
FR 178.33.162.6:6893 udp
FR 178.33.162.7:6893 udp
FR 178.33.162.8:6893 udp
FR 178.33.162.9:6893 udp
FR 178.33.162.10:6893 udp
FR 178.33.162.11:6893 udp
FR 178.33.162.12:6893 udp
FR 178.33.162.13:6893 udp
FR 178.33.162.14:6893 udp
FR 178.33.162.15:6893 udp
FR 178.33.162.16:6893 udp
FR 178.33.162.17:6893 udp
FR 178.33.162.18:6893 udp
FR 178.33.162.19:6893 udp
FR 178.33.162.20:6893 udp
FR 178.33.162.21:6893 udp
FR 178.33.162.22:6893 udp
FR 178.33.162.23:6893 udp
FR 178.33.162.24:6893 udp
FR 178.33.162.25:6893 udp
FR 178.33.162.26:6893 udp
FR 178.33.162.27:6893 udp
FR 178.33.162.28:6893 udp
FR 178.33.162.29:6893 udp
FR 178.33.162.30:6893 udp
FR 178.33.162.31:6893 udp
FR 178.33.162.32:6893 udp
FR 178.33.162.33:6893 udp
FR 178.33.162.34:6893 udp
FR 178.33.162.35:6893 udp
FR 178.33.162.36:6893 udp
FR 178.33.162.37:6893 udp
FR 178.33.162.38:6893 udp
FR 178.33.162.39:6893 udp
FR 178.33.162.40:6893 udp
FR 178.33.162.41:6893 udp
FR 178.33.162.42:6893 udp
FR 178.33.162.43:6893 udp
FR 178.33.162.44:6893 udp
FR 178.33.162.45:6893 udp
FR 178.33.162.46:6893 udp
FR 178.33.162.47:6893 udp
FR 178.33.162.48:6893 udp
FR 178.33.162.49:6893 udp
FR 178.33.162.50:6893 udp
FR 178.33.162.51:6893 udp
FR 178.33.162.52:6893 udp
FR 178.33.162.53:6893 udp
FR 178.33.162.54:6893 udp
FR 178.33.162.55:6893 udp
FR 178.33.162.56:6893 udp
FR 178.33.162.57:6893 udp
FR 178.33.162.58:6893 udp
FR 178.33.162.59:6893 udp
FR 178.33.162.60:6893 udp
FR 178.33.162.61:6893 udp
FR 178.33.162.62:6893 udp
FR 178.33.162.63:6893 udp
FR 178.33.162.64:6893 udp
FR 178.33.162.65:6893 udp
FR 178.33.162.66:6893 udp
FR 178.33.162.67:6893 udp
FR 178.33.162.68:6893 udp
FR 178.33.162.69:6893 udp
FR 178.33.162.70:6893 udp
FR 178.33.162.71:6893 udp
FR 178.33.162.72:6893 udp
FR 178.33.162.73:6893 udp
FR 178.33.162.74:6893 udp
FR 178.33.162.75:6893 udp
FR 178.33.162.76:6893 udp
FR 178.33.162.77:6893 udp
FR 178.33.162.78:6893 udp
FR 178.33.162.79:6893 udp
FR 178.33.162.80:6893 udp
FR 178.33.162.81:6893 udp
FR 178.33.162.82:6893 udp
FR 178.33.162.83:6893 udp
FR 178.33.162.84:6893 udp
FR 178.33.162.85:6893 udp
FR 178.33.162.86:6893 udp
FR 178.33.162.87:6893 udp
FR 178.33.162.88:6893 udp
FR 178.33.162.89:6893 udp
FR 178.33.162.90:6893 udp
FR 178.33.162.91:6893 udp
FR 178.33.162.92:6893 udp
FR 178.33.162.93:6893 udp
FR 178.33.162.94:6893 udp
FR 178.33.162.95:6893 udp
FR 178.33.162.96:6893 udp
FR 178.33.162.97:6893 udp
FR 178.33.162.98:6893 udp
FR 178.33.162.99:6893 udp
FR 178.33.162.100:6893 udp
FR 178.33.162.101:6893 udp
FR 178.33.162.102:6893 udp
FR 178.33.162.103:6893 udp
FR 178.33.162.104:6893 udp
FR 178.33.162.105:6893 udp
FR 178.33.162.106:6893 udp
FR 178.33.162.107:6893 udp
FR 178.33.162.108:6893 udp
FR 178.33.162.109:6893 udp
FR 178.33.162.110:6893 udp
FR 178.33.162.111:6893 udp
FR 178.33.162.112:6893 udp
FR 178.33.162.113:6893 udp
FR 178.33.162.114:6893 udp
FR 178.33.162.115:6893 udp
FR 178.33.162.116:6893 udp
FR 178.33.162.117:6893 udp
FR 178.33.162.118:6893 udp
FR 178.33.162.119:6893 udp
FR 178.33.162.120:6893 udp
FR 178.33.162.121:6893 udp
FR 178.33.162.122:6893 udp
FR 178.33.162.123:6893 udp
FR 178.33.162.124:6893 udp
FR 178.33.162.125:6893 udp
FR 178.33.162.126:6893 udp
FR 178.33.162.127:6893 udp
FR 178.33.162.128:6893 udp
FR 178.33.162.129:6893 udp
FR 178.33.162.130:6893 udp
FR 178.33.162.131:6893 udp
FR 178.33.162.132:6893 udp
FR 178.33.162.133:6893 udp
FR 178.33.162.134:6893 udp
FR 178.33.162.135:6893 udp
FR 178.33.162.136:6893 udp
FR 178.33.162.137:6893 udp
FR 178.33.162.138:6893 udp
FR 178.33.162.139:6893 udp
FR 178.33.162.140:6893 udp
FR 178.33.162.141:6893 udp
FR 178.33.162.142:6893 udp
FR 178.33.162.143:6893 udp
FR 178.33.162.144:6893 udp
FR 178.33.162.145:6893 udp
FR 178.33.162.146:6893 udp
FR 178.33.162.147:6893 udp
FR 178.33.162.148:6893 udp
FR 178.33.162.149:6893 udp
FR 178.33.162.150:6893 udp
FR 178.33.162.151:6893 udp
FR 178.33.162.152:6893 udp
FR 178.33.162.153:6893 udp
FR 178.33.162.154:6893 udp
FR 178.33.162.155:6893 udp
FR 178.33.162.156:6893 udp
FR 178.33.162.157:6893 udp
FR 178.33.162.158:6893 udp
FR 178.33.162.159:6893 udp
FR 178.33.162.160:6893 udp
FR 178.33.162.161:6893 udp
FR 178.33.162.162:6893 udp
FR 178.33.162.163:6893 udp
FR 178.33.162.164:6893 udp
FR 178.33.162.165:6893 udp
FR 178.33.162.166:6893 udp
FR 178.33.162.167:6893 udp
FR 178.33.162.168:6893 udp
FR 178.33.162.169:6893 udp
FR 178.33.162.170:6893 udp
FR 178.33.162.171:6893 udp
FR 178.33.162.172:6893 udp
FR 178.33.162.173:6893 udp
FR 178.33.162.174:6893 udp
FR 178.33.162.175:6893 udp
FR 178.33.162.176:6893 udp
FR 178.33.162.177:6893 udp
FR 178.33.162.178:6893 udp
FR 178.33.162.179:6893 udp
FR 178.33.162.180:6893 udp
FR 178.33.162.181:6893 udp
FR 178.33.162.182:6893 udp
FR 178.33.162.183:6893 udp
FR 178.33.162.184:6893 udp
FR 178.33.162.185:6893 udp
FR 178.33.162.186:6893 udp
FR 178.33.162.187:6893 udp
FR 178.33.162.188:6893 udp
FR 178.33.162.189:6893 udp
FR 178.33.162.190:6893 udp
FR 178.33.162.191:6893 udp
FR 178.33.162.192:6893 udp
FR 178.33.162.193:6893 udp
FR 178.33.162.194:6893 udp
FR 178.33.162.195:6893 udp
FR 178.33.162.196:6893 udp
FR 178.33.162.197:6893 udp
FR 178.33.162.198:6893 udp
FR 178.33.162.199:6893 udp
FR 178.33.162.200:6893 udp
FR 178.33.162.201:6893 udp
FR 178.33.162.202:6893 udp
FR 178.33.162.203:6893 udp
FR 178.33.162.204:6893 udp
FR 178.33.162.205:6893 udp
FR 178.33.162.206:6893 udp
FR 178.33.162.207:6893 udp
FR 178.33.162.208:6893 udp
FR 178.33.162.209:6893 udp
FR 178.33.162.210:6893 udp
FR 178.33.162.211:6893 udp
FR 178.33.162.212:6893 udp
FR 178.33.162.213:6893 udp
FR 178.33.162.214:6893 udp
FR 178.33.162.215:6893 udp
FR 178.33.162.216:6893 udp
FR 178.33.162.217:6893 udp
FR 178.33.162.218:6893 udp
FR 178.33.162.219:6893 udp
FR 178.33.162.220:6893 udp
FR 178.33.162.221:6893 udp
FR 178.33.162.222:6893 udp
FR 178.33.162.223:6893 udp
FR 178.33.162.224:6893 udp
FR 178.33.162.225:6893 udp
FR 178.33.162.226:6893 udp
FR 178.33.162.227:6893 udp
FR 178.33.162.228:6893 udp
FR 178.33.162.229:6893 udp
FR 178.33.162.230:6893 udp
FR 178.33.162.231:6893 udp
FR 178.33.162.232:6893 udp
FR 178.33.162.233:6893 udp
FR 178.33.162.234:6893 udp
FR 178.33.162.235:6893 udp
FR 178.33.162.236:6893 udp
FR 178.33.162.237:6893 udp
FR 178.33.162.238:6893 udp
FR 178.33.162.239:6893 udp
FR 178.33.162.240:6893 udp
FR 178.33.162.241:6893 udp
FR 178.33.162.242:6893 udp
FR 178.33.162.243:6893 udp
FR 178.33.162.244:6893 udp
FR 178.33.162.245:6893 udp
FR 178.33.162.246:6893 udp
FR 178.33.162.247:6893 udp
FR 178.33.162.248:6893 udp
FR 178.33.162.249:6893 udp
FR 178.33.162.250:6893 udp
FR 178.33.162.251:6893 udp
FR 178.33.162.252:6893 udp
FR 178.33.162.253:6893 udp
FR 178.33.162.254:6893 udp
US 8.8.8.8:53 66.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 67.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 68.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 69.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 70.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 71.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 72.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 73.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 75.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 76.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 77.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 78.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 79.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 80.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 81.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 82.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 83.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 84.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 85.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 86.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 87.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 88.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 89.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 90.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 91.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 92.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 93.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 95.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 94.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 96.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 97.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 98.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 99.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 100.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 101.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 102.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 103.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 104.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 105.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 106.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 107.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 108.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 109.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 110.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 111.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 113.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 114.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 115.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 116.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 117.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 118.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 119.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 120.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 121.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 122.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 123.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 124.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 125.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 126.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 127.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 129.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 130.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 131.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 132.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 134.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 135.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 136.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 137.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 139.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 140.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 141.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 142.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 143.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 144.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 145.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 146.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 147.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 148.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 149.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 150.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 152.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 151.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 153.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 154.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 155.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 156.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 157.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 158.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 159.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 160.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 161.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 162.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 163.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 164.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 165.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 166.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 167.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 168.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 170.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 171.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 172.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 173.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 174.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 175.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 177.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 176.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 178.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 179.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 180.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 181.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 182.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 183.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 184.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 185.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 186.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 187.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 188.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 189.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 190.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 191.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 192.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 193.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 194.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 195.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 196.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 197.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 198.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 199.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 200.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 202.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 203.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 204.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 205.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 206.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 207.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 208.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 209.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 210.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 211.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 212.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 213.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 214.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 215.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 216.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 217.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 219.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 218.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 220.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 221.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 222.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 223.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 224.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 225.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 226.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 227.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 228.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 229.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 230.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 231.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 232.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 233.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 234.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 235.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 236.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 237.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 238.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 239.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 240.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 241.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 242.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 243.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 244.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 245.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 246.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 247.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 248.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 249.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 250.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 251.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 252.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 253.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 254.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 255.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 0.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 1.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 2.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 3.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 4.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 5.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 6.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 7.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 8.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 9.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 10.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 11.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 12.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 13.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 14.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 15.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 16.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 17.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 18.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 19.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 20.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 21.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 22.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 23.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 24.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 26.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 27.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 25.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 28.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 29.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 30.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 31.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 32.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 33.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 34.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 35.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 36.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 37.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 39.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 38.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 40.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 42.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 41.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 43.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 44.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 45.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 46.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 47.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 48.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 49.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 50.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 51.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 52.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 53.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 54.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 56.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 55.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 57.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 58.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 59.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 61.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 62.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 63.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 64.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 65.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 66.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 68.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 67.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 70.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 69.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 71.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 72.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 73.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 74.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 75.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 76.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 77.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 78.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 79.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 80.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 81.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 82.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 83.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 84.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 85.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 86.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 87.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 89.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 88.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 90.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 91.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 92.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 93.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 94.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 95.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 96.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 98.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 99.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 100.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 101.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 102.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 103.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 104.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 105.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 107.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 108.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 109.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 110.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 111.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 112.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 114.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 115.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 116.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 117.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 118.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 120.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 119.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 121.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 122.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 123.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 125.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 126.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 127.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 128.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 129.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 131.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 130.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 132.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 133.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 134.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 135.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 136.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 137.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 138.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 139.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 140.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 141.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 142.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 143.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 144.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 145.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 146.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 147.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 148.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 149.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 150.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 151.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 152.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 153.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 156.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 158.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 160.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 159.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 161.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 162.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 163.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 164.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 165.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 166.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 167.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 168.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 169.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 170.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 171.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 173.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 172.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 174.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 175.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 176.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 177.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 178.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 179.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 180.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 181.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 182.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 183.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 184.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 185.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 186.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 187.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 188.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 189.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 190.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 191.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 192.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 194.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 195.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 196.162.33.178.in-addr.arpa udp
FR 178.33.162.255:6893 udp
US 8.8.8.8:53 197.162.33.178.in-addr.arpa udp
FR 178.33.163.0:6893 udp
US 8.8.8.8:53 198.162.33.178.in-addr.arpa udp
FR 178.33.163.1:6893 udp
FR 178.33.163.2:6893 udp
FR 178.33.163.3:6893 udp
FR 178.33.163.4:6893 udp
FR 178.33.163.5:6893 udp
FR 178.33.163.6:6893 udp
FR 178.33.163.7:6893 udp
FR 178.33.163.8:6893 udp
FR 178.33.163.9:6893 udp
FR 178.33.163.10:6893 udp
FR 178.33.163.11:6893 udp
FR 178.33.163.12:6893 udp
FR 178.33.163.13:6893 udp
FR 178.33.163.14:6893 udp
FR 178.33.163.15:6893 udp
FR 178.33.163.16:6893 udp
FR 178.33.163.17:6893 udp
FR 178.33.163.18:6893 udp
FR 178.33.163.19:6893 udp
FR 178.33.163.20:6893 udp
FR 178.33.163.21:6893 udp
FR 178.33.163.22:6893 udp
FR 178.33.163.23:6893 udp
FR 178.33.163.24:6893 udp
FR 178.33.163.25:6893 udp
FR 178.33.163.26:6893 udp
FR 178.33.163.27:6893 udp
FR 178.33.163.28:6893 udp
FR 178.33.163.29:6893 udp
FR 178.33.163.30:6893 udp
FR 178.33.163.31:6893 udp
FR 178.33.163.32:6893 udp
FR 178.33.163.33:6893 udp
FR 178.33.163.34:6893 udp
FR 178.33.163.35:6893 udp
FR 178.33.163.36:6893 udp
FR 178.33.163.37:6893 udp
FR 178.33.163.38:6893 udp
FR 178.33.163.39:6893 udp
FR 178.33.163.40:6893 udp
FR 178.33.163.41:6893 udp
FR 178.33.163.42:6893 udp
FR 178.33.163.43:6893 udp
FR 178.33.163.44:6893 udp
FR 178.33.163.45:6893 udp
FR 178.33.163.46:6893 udp
FR 178.33.163.47:6893 udp
FR 178.33.163.48:6893 udp
FR 178.33.163.49:6893 udp
FR 178.33.163.50:6893 udp
FR 178.33.163.51:6893 udp
FR 178.33.163.52:6893 udp
FR 178.33.163.53:6893 udp
FR 178.33.163.54:6893 udp
FR 178.33.163.55:6893 udp
FR 178.33.163.56:6893 udp
FR 178.33.163.57:6893 udp
FR 178.33.163.58:6893 udp
FR 178.33.163.59:6893 udp
FR 178.33.163.60:6893 udp
FR 178.33.163.61:6893 udp
FR 178.33.163.62:6893 udp
FR 178.33.163.63:6893 udp
FR 178.33.163.64:6893 udp
FR 178.33.163.65:6893 udp
FR 178.33.163.66:6893 udp
FR 178.33.163.67:6893 udp
FR 178.33.163.68:6893 udp
FR 178.33.163.69:6893 udp
FR 178.33.163.70:6893 udp
FR 178.33.163.71:6893 udp
FR 178.33.163.72:6893 udp
FR 178.33.163.73:6893 udp
FR 178.33.163.74:6893 udp
FR 178.33.163.75:6893 udp
FR 178.33.163.76:6893 udp
FR 178.33.163.77:6893 udp
FR 178.33.163.78:6893 udp
FR 178.33.163.79:6893 udp
FR 178.33.163.80:6893 udp
FR 178.33.163.81:6893 udp
FR 178.33.163.82:6893 udp
FR 178.33.163.83:6893 udp
FR 178.33.163.84:6893 udp
FR 178.33.163.85:6893 udp
FR 178.33.163.86:6893 udp
FR 178.33.163.87:6893 udp
FR 178.33.163.88:6893 udp
FR 178.33.163.89:6893 udp
FR 178.33.163.90:6893 udp
FR 178.33.163.91:6893 udp
FR 178.33.163.92:6893 udp
FR 178.33.163.93:6893 udp
FR 178.33.163.94:6893 udp
FR 178.33.163.95:6893 udp
FR 178.33.163.96:6893 udp
FR 178.33.163.97:6893 udp
FR 178.33.163.98:6893 udp
FR 178.33.163.99:6893 udp
FR 178.33.163.100:6893 udp
FR 178.33.163.101:6893 udp
FR 178.33.163.102:6893 udp
FR 178.33.163.103:6893 udp
FR 178.33.163.104:6893 udp
FR 178.33.163.105:6893 udp
FR 178.33.163.106:6893 udp
FR 178.33.163.107:6893 udp
FR 178.33.163.108:6893 udp
FR 178.33.163.109:6893 udp
FR 178.33.163.110:6893 udp
FR 178.33.163.111:6893 udp
FR 178.33.163.112:6893 udp
FR 178.33.163.113:6893 udp
FR 178.33.163.114:6893 udp
FR 178.33.163.115:6893 udp
FR 178.33.163.116:6893 udp
FR 178.33.163.117:6893 udp
FR 178.33.163.118:6893 udp
FR 178.33.163.119:6893 udp
FR 178.33.163.120:6893 udp
FR 178.33.163.121:6893 udp
FR 178.33.163.122:6893 udp
FR 178.33.163.123:6893 udp
FR 178.33.163.124:6893 udp
FR 178.33.163.125:6893 udp
FR 178.33.163.126:6893 udp
FR 178.33.163.127:6893 udp
FR 178.33.163.128:6893 udp
FR 178.33.163.129:6893 udp
FR 178.33.163.130:6893 udp
FR 178.33.163.131:6893 udp
FR 178.33.163.132:6893 udp
FR 178.33.163.133:6893 udp
FR 178.33.163.134:6893 udp
FR 178.33.163.135:6893 udp
FR 178.33.163.136:6893 udp
FR 178.33.163.137:6893 udp
FR 178.33.163.138:6893 udp
FR 178.33.163.139:6893 udp
FR 178.33.163.140:6893 udp
FR 178.33.163.141:6893 udp
FR 178.33.163.142:6893 udp
FR 178.33.163.143:6893 udp
FR 178.33.163.144:6893 udp
FR 178.33.163.145:6893 udp
FR 178.33.163.146:6893 udp
FR 178.33.163.147:6893 udp
FR 178.33.163.148:6893 udp
FR 178.33.163.149:6893 udp
FR 178.33.163.150:6893 udp
FR 178.33.163.151:6893 udp
FR 178.33.163.152:6893 udp
FR 178.33.163.153:6893 udp
FR 178.33.163.154:6893 udp
FR 178.33.163.155:6893 udp
FR 178.33.163.156:6893 udp
FR 178.33.163.157:6893 udp
FR 178.33.163.158:6893 udp
FR 178.33.163.159:6893 udp
FR 178.33.163.160:6893 udp
FR 178.33.163.161:6893 udp
FR 178.33.163.162:6893 udp
FR 178.33.163.163:6893 udp
FR 178.33.163.164:6893 udp
FR 178.33.163.165:6893 udp
FR 178.33.163.166:6893 udp
FR 178.33.163.167:6893 udp
FR 178.33.163.168:6893 udp
FR 178.33.163.169:6893 udp
FR 178.33.163.170:6893 udp
FR 178.33.163.171:6893 udp
FR 178.33.163.172:6893 udp
FR 178.33.163.173:6893 udp
FR 178.33.163.174:6893 udp
FR 178.33.163.175:6893 udp
FR 178.33.163.176:6893 udp
FR 178.33.163.177:6893 udp
FR 178.33.163.178:6893 udp
FR 178.33.163.179:6893 udp
FR 178.33.163.180:6893 udp
FR 178.33.163.181:6893 udp
FR 178.33.163.182:6893 udp
FR 178.33.163.183:6893 udp
FR 178.33.163.184:6893 udp
FR 178.33.163.185:6893 udp
FR 178.33.163.186:6893 udp
FR 178.33.163.187:6893 udp
FR 178.33.163.188:6893 udp
FR 178.33.163.189:6893 udp
FR 178.33.163.190:6893 udp
FR 178.33.163.191:6893 udp
FR 178.33.163.192:6893 udp
FR 178.33.163.193:6893 udp
FR 178.33.163.194:6893 udp
FR 178.33.163.195:6893 udp
FR 178.33.163.196:6893 udp
FR 178.33.163.197:6893 udp
FR 178.33.163.198:6893 udp
FR 178.33.163.199:6893 udp
FR 178.33.163.200:6893 udp
FR 178.33.163.201:6893 udp
FR 178.33.163.202:6893 udp
FR 178.33.163.203:6893 udp
FR 178.33.163.204:6893 udp
FR 178.33.163.205:6893 udp
FR 178.33.163.206:6893 udp
FR 178.33.163.207:6893 udp
FR 178.33.163.208:6893 udp
FR 178.33.163.209:6893 udp
FR 178.33.163.210:6893 udp
FR 178.33.163.211:6893 udp
FR 178.33.163.212:6893 udp
FR 178.33.163.213:6893 udp
FR 178.33.163.214:6893 udp
FR 178.33.163.215:6893 udp
FR 178.33.163.216:6893 udp
FR 178.33.163.217:6893 udp
FR 178.33.163.218:6893 udp
FR 178.33.163.219:6893 udp
FR 178.33.163.220:6893 udp
FR 178.33.163.221:6893 udp
FR 178.33.163.222:6893 udp
FR 178.33.163.223:6893 udp
FR 178.33.163.224:6893 udp
FR 178.33.163.225:6893 udp
FR 178.33.163.226:6893 udp
FR 178.33.163.227:6893 udp
FR 178.33.163.228:6893 udp
FR 178.33.163.229:6893 udp
FR 178.33.163.230:6893 udp
FR 178.33.163.231:6893 udp
FR 178.33.163.232:6893 udp
FR 178.33.163.233:6893 udp
FR 178.33.163.234:6893 udp
FR 178.33.163.235:6893 udp
FR 178.33.163.236:6893 udp
FR 178.33.163.237:6893 udp
FR 178.33.163.238:6893 udp
FR 178.33.163.239:6893 udp
FR 178.33.163.240:6893 udp
FR 178.33.163.241:6893 udp
FR 178.33.163.242:6893 udp
FR 178.33.163.243:6893 udp
FR 178.33.163.244:6893 udp
FR 178.33.163.245:6893 udp
FR 178.33.163.246:6893 udp
FR 178.33.163.247:6893 udp
FR 178.33.163.248:6893 udp
FR 178.33.163.249:6893 udp
FR 178.33.163.250:6893 udp
FR 178.33.163.251:6893 udp
FR 178.33.163.252:6893 udp
FR 178.33.163.253:6893 udp
FR 178.33.163.254:6893 udp
US 8.8.8.8:53 199.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 200.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 201.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 202.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 203.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 204.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 205.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 206.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 207.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 209.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 210.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 212.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 213.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 214.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 215.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 216.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 217.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 218.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 219.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 220.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 221.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 222.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 223.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 224.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 225.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 226.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 227.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 228.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 229.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 230.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 231.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 232.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 233.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 234.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 235.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 237.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 238.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 239.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 240.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 241.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 242.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 243.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 244.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 245.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 246.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 247.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 248.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 249.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 250.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 251.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 252.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 253.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 254.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 255.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 1.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 0.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 3.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 4.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 2.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 5.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 6.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 7.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 8.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 9.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 10.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 11.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 12.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 13.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 14.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 16.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 17.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 18.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 19.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 15.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 20.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 21.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 22.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 23.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 25.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 26.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 27.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 28.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 29.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 30.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 31.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 32.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 33.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 35.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 36.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 37.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 38.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 39.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 40.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 41.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 42.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 43.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 44.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 45.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 46.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 48.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 47.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 49.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 50.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 51.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 52.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 53.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 54.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 55.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 56.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 57.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 58.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 59.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 60.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 61.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 62.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 64.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 63.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 66.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 67.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 69.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 70.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 71.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 72.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 73.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 74.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 75.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 76.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 77.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 78.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 79.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 80.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 81.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 82.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 83.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 84.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 85.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 86.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 87.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 89.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 88.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 90.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 91.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 92.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 93.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 94.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 95.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 97.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 96.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 98.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 99.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 100.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 101.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 102.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 103.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 104.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 105.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 106.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 107.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 108.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 109.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 110.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 111.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 112.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 113.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 114.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 115.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 116.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 117.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 118.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 120.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 119.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 121.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 122.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 123.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 124.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 125.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 126.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 127.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 128.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 129.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 130.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 131.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 132.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 134.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 135.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 133.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 136.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 138.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 139.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 140.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 141.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 142.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 143.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 144.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 145.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 146.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 147.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 148.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 149.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 150.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 151.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 152.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 153.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 154.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 155.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 156.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 157.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 158.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 159.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 160.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 161.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 162.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 164.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 163.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 166.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 165.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 167.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 168.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 169.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 171.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 170.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 172.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 173.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 174.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 175.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 176.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 177.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 178.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 179.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 180.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 181.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 182.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 183.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 184.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 186.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 185.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 187.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 188.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 189.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 190.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 191.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 192.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 193.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 194.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 196.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 197.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 198.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 199.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 200.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 201.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 202.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 203.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 204.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 205.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 206.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 207.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 208.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 210.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 211.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 212.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 213.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 214.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 215.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 216.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 217.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 218.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 219.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 220.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 221.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 222.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 223.163.33.178.in-addr.arpa udp
FR 178.33.163.255:6893 udp
US 8.8.8.8:53 224.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 225.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 226.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 227.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 228.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 229.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 230.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 231.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 232.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 233.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 234.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 235.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 236.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 237.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 238.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 240.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 241.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 242.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 243.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 244.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 245.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 246.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 247.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 249.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 250.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 251.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 252.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 253.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 254.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 255.163.33.178.in-addr.arpa udp
FR 178.33.158.0:6893 udp
FR 178.33.158.1:6893 udp
FR 178.33.158.2:6893 udp
FR 178.33.158.3:6893 udp
FR 178.33.158.4:6893 udp
FR 178.33.158.5:6893 udp
FR 178.33.158.6:6893 udp
FR 178.33.158.7:6893 udp
FR 178.33.158.8:6893 udp
FR 178.33.158.9:6893 udp
FR 178.33.158.10:6893 udp
FR 178.33.158.11:6893 udp
FR 178.33.158.12:6893 udp
FR 178.33.158.13:6893 udp
FR 178.33.158.14:6893 udp
FR 178.33.158.15:6893 udp
FR 178.33.158.16:6893 udp
FR 178.33.158.17:6893 udp
FR 178.33.158.18:6893 udp
FR 178.33.158.19:6893 udp
FR 178.33.158.20:6893 udp
FR 178.33.158.21:6893 udp
FR 178.33.158.22:6893 udp
FR 178.33.158.23:6893 udp
FR 178.33.158.24:6893 udp
FR 178.33.158.25:6893 udp
FR 178.33.158.26:6893 udp
FR 178.33.158.27:6893 udp
FR 178.33.158.28:6893 udp
FR 178.33.158.29:6893 udp
FR 178.33.158.30:6893 udp
FR 178.33.158.31:6893 udp
FR 178.33.159.0:6893 udp
FR 178.33.159.1:6893 udp
FR 178.33.159.2:6893 udp
FR 178.33.159.3:6893 udp
FR 178.33.159.4:6893 udp
FR 178.33.159.5:6893 udp
FR 178.33.159.6:6893 udp
FR 178.33.159.7:6893 udp
FR 178.33.159.8:6893 udp
FR 178.33.159.9:6893 udp
FR 178.33.159.10:6893 udp
FR 178.33.159.11:6893 udp
FR 178.33.159.12:6893 udp
FR 178.33.159.13:6893 udp
FR 178.33.159.14:6893 udp
FR 178.33.159.15:6893 udp
FR 178.33.159.16:6893 udp
FR 178.33.159.17:6893 udp
FR 178.33.159.18:6893 udp
FR 178.33.159.19:6893 udp
FR 178.33.159.20:6893 udp
FR 178.33.159.21:6893 udp
FR 178.33.159.22:6893 udp
FR 178.33.159.23:6893 udp
FR 178.33.159.24:6893 udp
FR 178.33.159.25:6893 udp
FR 178.33.159.26:6893 udp
FR 178.33.159.27:6893 udp
FR 178.33.159.28:6893 udp
FR 178.33.159.29:6893 udp
FR 178.33.159.30:6893 udp
FR 178.33.159.31:6893 udp
FR 178.33.160.0:6893 udp
FR 178.33.160.1:6893 udp
FR 178.33.160.2:6893 udp
FR 178.33.160.3:6893 udp
FR 178.33.160.4:6893 udp
FR 178.33.160.5:6893 udp
FR 178.33.160.6:6893 udp
FR 178.33.160.7:6893 udp
FR 178.33.160.8:6893 udp
FR 178.33.160.9:6893 udp
FR 178.33.160.10:6893 udp
FR 178.33.160.11:6893 udp
FR 178.33.160.12:6893 udp
FR 178.33.160.13:6893 udp
FR 178.33.160.14:6893 udp
FR 178.33.160.15:6893 udp
FR 178.33.160.16:6893 udp
FR 178.33.160.17:6893 udp
FR 178.33.160.18:6893 udp
FR 178.33.160.19:6893 udp
FR 178.33.160.20:6893 udp
FR 178.33.160.21:6893 udp
FR 178.33.160.22:6893 udp
FR 178.33.160.23:6893 udp
FR 178.33.160.24:6893 udp
FR 178.33.160.25:6893 udp
FR 178.33.160.26:6893 udp
FR 178.33.160.27:6893 udp
FR 178.33.160.28:6893 udp
FR 178.33.160.29:6893 udp
FR 178.33.160.30:6893 udp
FR 178.33.160.31:6893 udp
FR 178.33.160.32:6893 udp
FR 178.33.160.33:6893 udp
FR 178.33.160.34:6893 udp
FR 178.33.160.35:6893 udp
FR 178.33.160.36:6893 udp
FR 178.33.160.37:6893 udp
FR 178.33.160.38:6893 udp
FR 178.33.160.39:6893 udp
FR 178.33.160.40:6893 udp
FR 178.33.160.41:6893 udp
FR 178.33.160.42:6893 udp
FR 178.33.160.43:6893 udp
FR 178.33.160.44:6893 udp
FR 178.33.160.45:6893 udp
FR 178.33.160.46:6893 udp
FR 178.33.160.47:6893 udp
FR 178.33.160.48:6893 udp
FR 178.33.160.49:6893 udp
FR 178.33.160.50:6893 udp
FR 178.33.160.51:6893 udp
FR 178.33.160.52:6893 udp
FR 178.33.160.53:6893 udp
FR 178.33.160.54:6893 udp
FR 178.33.160.55:6893 udp
FR 178.33.160.56:6893 udp
FR 178.33.160.57:6893 udp
FR 178.33.160.58:6893 udp
FR 178.33.160.59:6893 udp
FR 178.33.160.60:6893 udp
FR 178.33.160.61:6893 udp
FR 178.33.160.62:6893 udp
FR 178.33.160.63:6893 udp
FR 178.33.160.64:6893 udp
FR 178.33.160.65:6893 udp
FR 178.33.160.66:6893 udp
FR 178.33.160.67:6893 udp
FR 178.33.160.68:6893 udp
FR 178.33.160.69:6893 udp
FR 178.33.160.70:6893 udp
FR 178.33.160.71:6893 udp
FR 178.33.160.72:6893 udp
FR 178.33.160.73:6893 udp
FR 178.33.160.74:6893 udp
FR 178.33.160.75:6893 udp
FR 178.33.160.76:6893 udp
FR 178.33.160.77:6893 udp
FR 178.33.160.78:6893 udp
FR 178.33.160.79:6893 udp
FR 178.33.160.80:6893 udp
FR 178.33.160.81:6893 udp
FR 178.33.160.82:6893 udp
FR 178.33.160.83:6893 udp
FR 178.33.160.84:6893 udp
FR 178.33.160.85:6893 udp
FR 178.33.160.86:6893 udp
FR 178.33.160.87:6893 udp
FR 178.33.160.88:6893 udp
FR 178.33.160.89:6893 udp
FR 178.33.160.90:6893 udp
FR 178.33.160.91:6893 udp
FR 178.33.160.92:6893 udp
FR 178.33.160.93:6893 udp
FR 178.33.160.94:6893 udp
FR 178.33.160.95:6893 udp
FR 178.33.160.96:6893 udp
FR 178.33.160.97:6893 udp
FR 178.33.160.98:6893 udp
FR 178.33.160.99:6893 udp
FR 178.33.160.100:6893 udp
FR 178.33.160.101:6893 udp
FR 178.33.160.102:6893 udp
FR 178.33.160.103:6893 udp
FR 178.33.160.104:6893 udp
FR 178.33.160.105:6893 udp
FR 178.33.160.106:6893 udp
FR 178.33.160.107:6893 udp
FR 178.33.160.108:6893 udp
FR 178.33.160.109:6893 udp
FR 178.33.160.110:6893 udp
FR 178.33.160.111:6893 udp
FR 178.33.160.112:6893 udp
FR 178.33.160.113:6893 udp
FR 178.33.160.114:6893 udp
FR 178.33.160.115:6893 udp
FR 178.33.160.116:6893 udp
FR 178.33.160.117:6893 udp
FR 178.33.160.118:6893 udp
FR 178.33.160.119:6893 udp
FR 178.33.160.120:6893 udp
FR 178.33.160.121:6893 udp
FR 178.33.160.122:6893 udp
FR 178.33.160.123:6893 udp
FR 178.33.160.124:6893 udp
FR 178.33.160.125:6893 udp
FR 178.33.160.126:6893 udp
FR 178.33.160.127:6893 udp
FR 178.33.160.128:6893 udp
FR 178.33.160.129:6893 udp
FR 178.33.160.130:6893 udp
FR 178.33.160.131:6893 udp
FR 178.33.160.132:6893 udp
FR 178.33.160.133:6893 udp
FR 178.33.160.134:6893 udp
FR 178.33.160.135:6893 udp
FR 178.33.160.136:6893 udp
FR 178.33.160.137:6893 udp
FR 178.33.160.138:6893 udp
FR 178.33.160.139:6893 udp
FR 178.33.160.140:6893 udp
FR 178.33.160.141:6893 udp
FR 178.33.160.142:6893 udp
FR 178.33.160.143:6893 udp
FR 178.33.160.144:6893 udp
FR 178.33.160.145:6893 udp
FR 178.33.160.146:6893 udp
FR 178.33.160.147:6893 udp
FR 178.33.160.148:6893 udp
FR 178.33.160.149:6893 udp
FR 178.33.160.150:6893 udp
FR 178.33.160.151:6893 udp
FR 178.33.160.152:6893 udp
FR 178.33.160.153:6893 udp
FR 178.33.160.154:6893 udp
FR 178.33.160.155:6893 udp
FR 178.33.160.156:6893 udp
FR 178.33.160.157:6893 udp
FR 178.33.160.158:6893 udp
FR 178.33.160.159:6893 udp
FR 178.33.160.160:6893 udp
FR 178.33.160.161:6893 udp
FR 178.33.160.162:6893 udp
FR 178.33.160.163:6893 udp
FR 178.33.160.164:6893 udp
FR 178.33.160.165:6893 udp
FR 178.33.160.166:6893 udp
FR 178.33.160.167:6893 udp
FR 178.33.160.168:6893 udp
FR 178.33.160.169:6893 udp
FR 178.33.160.170:6893 udp
FR 178.33.160.171:6893 udp
FR 178.33.160.172:6893 udp
FR 178.33.160.173:6893 udp
FR 178.33.160.174:6893 udp
FR 178.33.160.175:6893 udp
FR 178.33.160.176:6893 udp
FR 178.33.160.177:6893 udp
FR 178.33.160.178:6893 udp
FR 178.33.160.179:6893 udp
FR 178.33.160.180:6893 udp
FR 178.33.160.181:6893 udp
FR 178.33.160.182:6893 udp
FR 178.33.160.183:6893 udp
FR 178.33.160.184:6893 udp
FR 178.33.160.185:6893 udp
FR 178.33.160.186:6893 udp
FR 178.33.160.187:6893 udp
FR 178.33.160.188:6893 udp
FR 178.33.160.189:6893 udp
FR 178.33.160.190:6893 udp
FR 178.33.160.191:6893 udp
FR 178.33.160.192:6893 udp
FR 178.33.160.193:6893 udp
FR 178.33.160.194:6893 udp
FR 178.33.160.195:6893 udp
FR 178.33.160.196:6893 udp
FR 178.33.160.197:6893 udp
FR 178.33.160.198:6893 udp
FR 178.33.160.199:6893 udp
FR 178.33.160.200:6893 udp
FR 178.33.160.201:6893 udp
FR 178.33.160.202:6893 udp
FR 178.33.160.203:6893 udp
FR 178.33.160.204:6893 udp
FR 178.33.160.205:6893 udp
FR 178.33.160.206:6893 udp
FR 178.33.160.207:6893 udp
FR 178.33.160.208:6893 udp
FR 178.33.160.209:6893 udp
FR 178.33.160.210:6893 udp
FR 178.33.160.211:6893 udp
FR 178.33.160.212:6893 udp
FR 178.33.160.213:6893 udp
FR 178.33.160.214:6893 udp
FR 178.33.160.215:6893 udp
FR 178.33.160.216:6893 udp
FR 178.33.160.217:6893 udp
FR 178.33.160.218:6893 udp
FR 178.33.160.219:6893 udp
FR 178.33.160.220:6893 udp
FR 178.33.160.221:6893 udp
FR 178.33.160.222:6893 udp
FR 178.33.160.223:6893 udp
FR 178.33.160.224:6893 udp
FR 178.33.160.225:6893 udp
FR 178.33.160.226:6893 udp
FR 178.33.160.227:6893 udp
FR 178.33.160.228:6893 udp
FR 178.33.160.229:6893 udp
FR 178.33.160.230:6893 udp
FR 178.33.160.231:6893 udp
FR 178.33.160.232:6893 udp
FR 178.33.160.233:6893 udp
FR 178.33.160.234:6893 udp
FR 178.33.160.235:6893 udp
FR 178.33.160.236:6893 udp
FR 178.33.160.237:6893 udp
FR 178.33.160.238:6893 udp
FR 178.33.160.239:6893 udp
FR 178.33.160.240:6893 udp
FR 178.33.160.241:6893 udp
FR 178.33.160.242:6893 udp
FR 178.33.160.243:6893 udp
FR 178.33.160.244:6893 udp
FR 178.33.160.245:6893 udp
FR 178.33.160.246:6893 udp
FR 178.33.160.247:6893 udp
FR 178.33.160.248:6893 udp
FR 178.33.160.249:6893 udp
FR 178.33.160.250:6893 udp
FR 178.33.160.251:6893 udp
FR 178.33.160.252:6893 udp
FR 178.33.160.253:6893 udp
FR 178.33.160.254:6893 udp
FR 178.33.160.255:6893 udp
FR 178.33.161.0:6893 udp
FR 178.33.161.1:6893 udp
FR 178.33.161.2:6893 udp
FR 178.33.161.3:6893 udp
FR 178.33.161.4:6893 udp
FR 178.33.161.5:6893 udp
FR 178.33.161.6:6893 udp
FR 178.33.161.7:6893 udp
FR 178.33.161.8:6893 udp
FR 178.33.161.9:6893 udp
FR 178.33.161.10:6893 udp
FR 178.33.161.11:6893 udp
FR 178.33.161.12:6893 udp
FR 178.33.161.13:6893 udp
FR 178.33.161.14:6893 udp
FR 178.33.161.15:6893 udp
FR 178.33.161.16:6893 udp
FR 178.33.161.17:6893 udp
FR 178.33.161.18:6893 udp
FR 178.33.161.19:6893 udp
FR 178.33.161.20:6893 udp
FR 178.33.161.21:6893 udp
FR 178.33.161.22:6893 udp
FR 178.33.161.23:6893 udp
FR 178.33.161.24:6893 udp
FR 178.33.161.25:6893 udp
FR 178.33.161.26:6893 udp
FR 178.33.161.27:6893 udp
FR 178.33.161.28:6893 udp
FR 178.33.161.29:6893 udp
FR 178.33.161.30:6893 udp
FR 178.33.161.31:6893 udp
FR 178.33.161.32:6893 udp
FR 178.33.161.33:6893 udp
FR 178.33.161.34:6893 udp
FR 178.33.161.35:6893 udp
FR 178.33.161.36:6893 udp
FR 178.33.161.37:6893 udp
FR 178.33.161.38:6893 udp
FR 178.33.161.39:6893 udp
FR 178.33.161.40:6893 udp
FR 178.33.161.41:6893 udp
FR 178.33.161.42:6893 udp
FR 178.33.161.43:6893 udp
FR 178.33.161.44:6893 udp
FR 178.33.161.45:6893 udp
FR 178.33.161.46:6893 udp
FR 178.33.161.47:6893 udp
FR 178.33.161.48:6893 udp
FR 178.33.161.49:6893 udp
FR 178.33.161.50:6893 udp
FR 178.33.161.51:6893 udp
FR 178.33.161.52:6893 udp
FR 178.33.161.53:6893 udp
FR 178.33.161.54:6893 udp
FR 178.33.161.55:6893 udp
FR 178.33.161.56:6893 udp
FR 178.33.161.57:6893 udp
FR 178.33.161.58:6893 udp
FR 178.33.161.59:6893 udp
FR 178.33.161.60:6893 udp
FR 178.33.161.61:6893 udp
FR 178.33.161.62:6893 udp
FR 178.33.161.63:6893 udp
FR 178.33.161.64:6893 udp
FR 178.33.161.65:6893 udp
FR 178.33.161.66:6893 udp
FR 178.33.161.67:6893 udp
FR 178.33.161.68:6893 udp
FR 178.33.161.69:6893 udp
FR 178.33.161.70:6893 udp
FR 178.33.161.71:6893 udp
FR 178.33.161.72:6893 udp
FR 178.33.161.73:6893 udp
FR 178.33.161.74:6893 udp
FR 178.33.161.75:6893 udp
FR 178.33.161.76:6893 udp
FR 178.33.161.77:6893 udp
FR 178.33.161.78:6893 udp
FR 178.33.161.79:6893 udp
FR 178.33.161.80:6893 udp
FR 178.33.161.81:6893 udp
FR 178.33.161.82:6893 udp
FR 178.33.161.83:6893 udp
FR 178.33.161.84:6893 udp
FR 178.33.161.85:6893 udp
FR 178.33.161.86:6893 udp
FR 178.33.161.87:6893 udp
FR 178.33.161.88:6893 udp
FR 178.33.161.89:6893 udp
FR 178.33.161.90:6893 udp
FR 178.33.161.91:6893 udp
FR 178.33.161.92:6893 udp
FR 178.33.161.93:6893 udp
FR 178.33.161.94:6893 udp
FR 178.33.161.95:6893 udp
FR 178.33.161.96:6893 udp
FR 178.33.161.97:6893 udp
FR 178.33.161.98:6893 udp
FR 178.33.161.99:6893 udp
FR 178.33.161.100:6893 udp
FR 178.33.161.101:6893 udp
FR 178.33.161.102:6893 udp
FR 178.33.161.103:6893 udp
FR 178.33.161.104:6893 udp
FR 178.33.161.105:6893 udp
FR 178.33.161.106:6893 udp
FR 178.33.161.107:6893 udp
FR 178.33.161.108:6893 udp
FR 178.33.161.109:6893 udp
FR 178.33.161.110:6893 udp
FR 178.33.161.111:6893 udp
FR 178.33.161.112:6893 udp
FR 178.33.161.113:6893 udp
FR 178.33.161.114:6893 udp
FR 178.33.161.115:6893 udp
FR 178.33.161.116:6893 udp
FR 178.33.161.117:6893 udp
FR 178.33.161.118:6893 udp
FR 178.33.161.119:6893 udp
FR 178.33.161.120:6893 udp
FR 178.33.161.121:6893 udp
FR 178.33.161.122:6893 udp
FR 178.33.161.123:6893 udp
FR 178.33.161.124:6893 udp
FR 178.33.161.125:6893 udp
FR 178.33.161.126:6893 udp
FR 178.33.161.127:6893 udp
FR 178.33.161.128:6893 udp
FR 178.33.161.129:6893 udp
FR 178.33.161.130:6893 udp
FR 178.33.161.131:6893 udp
FR 178.33.161.132:6893 udp
FR 178.33.161.133:6893 udp
FR 178.33.161.134:6893 udp
FR 178.33.161.135:6893 udp
FR 178.33.161.136:6893 udp
FR 178.33.161.137:6893 udp
FR 178.33.161.138:6893 udp
FR 178.33.161.139:6893 udp
FR 178.33.161.140:6893 udp
FR 178.33.161.141:6893 udp
FR 178.33.161.142:6893 udp
FR 178.33.161.143:6893 udp
FR 178.33.161.144:6893 udp
FR 178.33.161.145:6893 udp
FR 178.33.161.146:6893 udp
FR 178.33.161.147:6893 udp
FR 178.33.161.148:6893 udp
FR 178.33.161.149:6893 udp
FR 178.33.161.150:6893 udp
FR 178.33.161.151:6893 udp
FR 178.33.161.152:6893 udp
FR 178.33.161.153:6893 udp
FR 178.33.161.154:6893 udp
FR 178.33.161.155:6893 udp
FR 178.33.161.156:6893 udp
FR 178.33.161.157:6893 udp
FR 178.33.161.158:6893 udp
FR 178.33.161.159:6893 udp
FR 178.33.161.160:6893 udp
FR 178.33.161.161:6893 udp
FR 178.33.161.162:6893 udp
FR 178.33.161.163:6893 udp
FR 178.33.161.164:6893 udp
FR 178.33.161.165:6893 udp
FR 178.33.161.166:6893 udp
FR 178.33.161.167:6893 udp
FR 178.33.161.168:6893 udp
FR 178.33.161.169:6893 udp
FR 178.33.161.170:6893 udp
FR 178.33.161.171:6893 udp
FR 178.33.161.172:6893 udp
FR 178.33.161.173:6893 udp
FR 178.33.161.174:6893 udp
FR 178.33.161.175:6893 udp
FR 178.33.161.176:6893 udp
FR 178.33.161.177:6893 udp
FR 178.33.161.178:6893 udp
FR 178.33.161.179:6893 udp
FR 178.33.161.180:6893 udp
FR 178.33.161.181:6893 udp
FR 178.33.161.182:6893 udp
FR 178.33.161.183:6893 udp
FR 178.33.161.184:6893 udp
FR 178.33.161.185:6893 udp
FR 178.33.161.186:6893 udp
FR 178.33.161.187:6893 udp
FR 178.33.161.188:6893 udp
FR 178.33.161.189:6893 udp
FR 178.33.161.190:6893 udp
FR 178.33.161.191:6893 udp
FR 178.33.161.192:6893 udp
FR 178.33.161.193:6893 udp
FR 178.33.161.194:6893 udp
FR 178.33.161.195:6893 udp
FR 178.33.161.196:6893 udp
FR 178.33.161.197:6893 udp
FR 178.33.161.198:6893 udp
FR 178.33.161.199:6893 udp
FR 178.33.161.200:6893 udp
FR 178.33.161.201:6893 udp
FR 178.33.161.202:6893 udp
FR 178.33.161.203:6893 udp
FR 178.33.161.204:6893 udp
FR 178.33.161.205:6893 udp
FR 178.33.161.206:6893 udp
FR 178.33.161.207:6893 udp
FR 178.33.161.208:6893 udp
FR 178.33.161.209:6893 udp
FR 178.33.161.210:6893 udp
FR 178.33.161.211:6893 udp
FR 178.33.161.212:6893 udp
FR 178.33.161.213:6893 udp
FR 178.33.161.214:6893 udp
FR 178.33.161.215:6893 udp
FR 178.33.161.216:6893 udp
FR 178.33.161.217:6893 udp
FR 178.33.161.218:6893 udp
FR 178.33.161.219:6893 udp
FR 178.33.161.220:6893 udp
FR 178.33.161.221:6893 udp
FR 178.33.161.222:6893 udp
FR 178.33.161.223:6893 udp
FR 178.33.161.224:6893 udp
FR 178.33.161.225:6893 udp
FR 178.33.161.226:6893 udp
FR 178.33.161.227:6893 udp
FR 178.33.161.228:6893 udp
FR 178.33.161.229:6893 udp
FR 178.33.161.230:6893 udp
FR 178.33.161.231:6893 udp
FR 178.33.161.232:6893 udp
FR 178.33.161.233:6893 udp
FR 178.33.161.234:6893 udp
FR 178.33.161.235:6893 udp
FR 178.33.161.236:6893 udp
FR 178.33.161.237:6893 udp
FR 178.33.161.238:6893 udp
FR 178.33.161.239:6893 udp
FR 178.33.161.240:6893 udp
FR 178.33.161.241:6893 udp
FR 178.33.161.242:6893 udp
FR 178.33.161.243:6893 udp
FR 178.33.161.244:6893 udp
FR 178.33.161.245:6893 udp
FR 178.33.161.246:6893 udp
FR 178.33.161.247:6893 udp
FR 178.33.161.248:6893 udp
FR 178.33.161.249:6893 udp
FR 178.33.161.250:6893 udp
FR 178.33.161.251:6893 udp
FR 178.33.161.252:6893 udp
FR 178.33.161.253:6893 udp
FR 178.33.161.254:6893 udp
FR 178.33.161.255:6893 udp
FR 178.33.162.0:6893 udp
FR 178.33.162.1:6893 udp
FR 178.33.162.2:6893 udp
FR 178.33.162.3:6893 udp
FR 178.33.162.4:6893 udp
FR 178.33.162.5:6893 udp
FR 178.33.162.6:6893 udp
FR 178.33.162.7:6893 udp
FR 178.33.162.8:6893 udp
FR 178.33.162.9:6893 udp
FR 178.33.162.10:6893 udp
FR 178.33.162.11:6893 udp
FR 178.33.162.12:6893 udp
FR 178.33.162.13:6893 udp
FR 178.33.162.14:6893 udp
FR 178.33.162.15:6893 udp
FR 178.33.162.16:6893 udp
FR 178.33.162.17:6893 udp
FR 178.33.162.18:6893 udp
FR 178.33.162.19:6893 udp
FR 178.33.162.20:6893 udp
FR 178.33.162.21:6893 udp
FR 178.33.162.22:6893 udp
FR 178.33.162.23:6893 udp
FR 178.33.162.24:6893 udp
FR 178.33.162.25:6893 udp
FR 178.33.162.26:6893 udp
FR 178.33.162.27:6893 udp
FR 178.33.162.28:6893 udp
FR 178.33.162.29:6893 udp
FR 178.33.162.30:6893 udp
FR 178.33.162.31:6893 udp
FR 178.33.162.32:6893 udp
FR 178.33.162.33:6893 udp
FR 178.33.162.34:6893 udp
FR 178.33.162.35:6893 udp
FR 178.33.162.36:6893 udp
FR 178.33.162.37:6893 udp
FR 178.33.162.38:6893 udp
FR 178.33.162.39:6893 udp
FR 178.33.162.40:6893 udp
FR 178.33.162.41:6893 udp
FR 178.33.162.42:6893 udp
FR 178.33.162.43:6893 udp
FR 178.33.162.44:6893 udp
FR 178.33.162.45:6893 udp
FR 178.33.162.46:6893 udp
FR 178.33.162.47:6893 udp
FR 178.33.162.48:6893 udp
FR 178.33.162.49:6893 udp
FR 178.33.162.50:6893 udp
FR 178.33.162.51:6893 udp
FR 178.33.162.52:6893 udp
FR 178.33.162.53:6893 udp
FR 178.33.162.54:6893 udp
FR 178.33.162.55:6893 udp
FR 178.33.162.56:6893 udp
FR 178.33.162.57:6893 udp
FR 178.33.162.58:6893 udp
FR 178.33.162.59:6893 udp
FR 178.33.162.60:6893 udp
FR 178.33.162.61:6893 udp
FR 178.33.162.62:6893 udp
FR 178.33.162.63:6893 udp
FR 178.33.162.64:6893 udp
FR 178.33.162.65:6893 udp
FR 178.33.162.66:6893 udp
FR 178.33.162.67:6893 udp
FR 178.33.162.68:6893 udp
FR 178.33.162.69:6893 udp
FR 178.33.162.70:6893 udp
FR 178.33.162.71:6893 udp
FR 178.33.162.72:6893 udp
FR 178.33.162.73:6893 udp
FR 178.33.162.74:6893 udp
FR 178.33.162.75:6893 udp
FR 178.33.162.76:6893 udp
FR 178.33.162.77:6893 udp
FR 178.33.162.78:6893 udp
FR 178.33.162.79:6893 udp
FR 178.33.162.80:6893 udp
FR 178.33.162.81:6893 udp
FR 178.33.162.82:6893 udp
FR 178.33.162.83:6893 udp
FR 178.33.162.84:6893 udp
FR 178.33.162.85:6893 udp
FR 178.33.162.86:6893 udp
FR 178.33.162.87:6893 udp
FR 178.33.162.88:6893 udp
FR 178.33.162.89:6893 udp
FR 178.33.162.90:6893 udp
FR 178.33.162.91:6893 udp
FR 178.33.162.92:6893 udp
FR 178.33.162.93:6893 udp
FR 178.33.162.94:6893 udp
FR 178.33.162.95:6893 udp
FR 178.33.162.96:6893 udp
FR 178.33.162.97:6893 udp
FR 178.33.162.98:6893 udp
FR 178.33.162.99:6893 udp
FR 178.33.162.100:6893 udp
FR 178.33.162.101:6893 udp
FR 178.33.162.102:6893 udp
FR 178.33.162.103:6893 udp
FR 178.33.162.104:6893 udp
FR 178.33.162.105:6893 udp
FR 178.33.162.106:6893 udp
FR 178.33.162.107:6893 udp
FR 178.33.162.108:6893 udp
FR 178.33.162.109:6893 udp
FR 178.33.162.110:6893 udp
FR 178.33.162.111:6893 udp
FR 178.33.162.112:6893 udp
FR 178.33.162.113:6893 udp
FR 178.33.162.114:6893 udp
FR 178.33.162.115:6893 udp
FR 178.33.162.116:6893 udp
FR 178.33.162.117:6893 udp
FR 178.33.162.118:6893 udp
FR 178.33.162.119:6893 udp
FR 178.33.162.120:6893 udp
FR 178.33.162.121:6893 udp
FR 178.33.162.122:6893 udp
FR 178.33.162.123:6893 udp
FR 178.33.162.124:6893 udp
FR 178.33.162.125:6893 udp
FR 178.33.162.126:6893 udp
FR 178.33.162.127:6893 udp
FR 178.33.162.128:6893 udp
FR 178.33.162.129:6893 udp
FR 178.33.162.130:6893 udp
FR 178.33.162.131:6893 udp
FR 178.33.162.132:6893 udp
FR 178.33.162.133:6893 udp
FR 178.33.162.134:6893 udp
FR 178.33.162.135:6893 udp
FR 178.33.162.136:6893 udp
FR 178.33.162.137:6893 udp
FR 178.33.162.138:6893 udp
FR 178.33.162.139:6893 udp
FR 178.33.162.140:6893 udp
FR 178.33.162.141:6893 udp
FR 178.33.162.142:6893 udp
FR 178.33.162.143:6893 udp
FR 178.33.162.144:6893 udp
FR 178.33.162.145:6893 udp
FR 178.33.162.146:6893 udp
FR 178.33.162.147:6893 udp
FR 178.33.162.148:6893 udp
FR 178.33.162.149:6893 udp
FR 178.33.162.150:6893 udp
FR 178.33.162.151:6893 udp
FR 178.33.162.152:6893 udp
FR 178.33.162.153:6893 udp
FR 178.33.162.154:6893 udp
FR 178.33.162.155:6893 udp
FR 178.33.162.156:6893 udp
FR 178.33.162.157:6893 udp
FR 178.33.162.158:6893 udp
FR 178.33.162.159:6893 udp
FR 178.33.162.160:6893 udp
FR 178.33.162.161:6893 udp
FR 178.33.162.162:6893 udp
FR 178.33.162.163:6893 udp
FR 178.33.162.164:6893 udp
FR 178.33.162.165:6893 udp
FR 178.33.162.166:6893 udp
FR 178.33.162.167:6893 udp
FR 178.33.162.168:6893 udp
FR 178.33.162.169:6893 udp
FR 178.33.162.170:6893 udp
FR 178.33.162.171:6893 udp
FR 178.33.162.172:6893 udp
FR 178.33.162.173:6893 udp
FR 178.33.162.174:6893 udp
FR 178.33.162.175:6893 udp
FR 178.33.162.176:6893 udp
FR 178.33.162.177:6893 udp
FR 178.33.162.178:6893 udp
FR 178.33.162.179:6893 udp
FR 178.33.162.180:6893 udp
FR 178.33.162.181:6893 udp
FR 178.33.162.182:6893 udp
FR 178.33.162.183:6893 udp
FR 178.33.162.184:6893 udp
FR 178.33.162.185:6893 udp
FR 178.33.162.186:6893 udp
FR 178.33.162.187:6893 udp
FR 178.33.162.188:6893 udp
FR 178.33.162.189:6893 udp
FR 178.33.162.190:6893 udp
FR 178.33.162.191:6893 udp
FR 178.33.162.192:6893 udp
FR 178.33.162.193:6893 udp
FR 178.33.162.194:6893 udp
FR 178.33.162.195:6893 udp
FR 178.33.162.196:6893 udp
FR 178.33.162.197:6893 udp
FR 178.33.162.198:6893 udp
FR 178.33.162.199:6893 udp
FR 178.33.162.200:6893 udp
FR 178.33.162.201:6893 udp
FR 178.33.162.202:6893 udp
FR 178.33.162.203:6893 udp
FR 178.33.162.204:6893 udp
FR 178.33.162.205:6893 udp
FR 178.33.162.206:6893 udp
FR 178.33.162.207:6893 udp
FR 178.33.162.208:6893 udp
FR 178.33.162.209:6893 udp
FR 178.33.162.210:6893 udp
FR 178.33.162.211:6893 udp
FR 178.33.162.212:6893 udp
FR 178.33.162.213:6893 udp
FR 178.33.162.214:6893 udp
FR 178.33.162.215:6893 udp
FR 178.33.162.216:6893 udp
FR 178.33.162.217:6893 udp
FR 178.33.162.218:6893 udp
FR 178.33.162.219:6893 udp
FR 178.33.162.220:6893 udp
FR 178.33.162.221:6893 udp
FR 178.33.162.222:6893 udp
FR 178.33.162.223:6893 udp
FR 178.33.162.224:6893 udp
FR 178.33.162.225:6893 udp
FR 178.33.162.226:6893 udp
FR 178.33.162.227:6893 udp
FR 178.33.162.228:6893 udp
FR 178.33.162.229:6893 udp
FR 178.33.162.230:6893 udp
FR 178.33.162.231:6893 udp
FR 178.33.162.232:6893 udp
FR 178.33.162.233:6893 udp
FR 178.33.162.234:6893 udp
FR 178.33.162.235:6893 udp
FR 178.33.162.236:6893 udp
FR 178.33.162.237:6893 udp
FR 178.33.162.238:6893 udp
FR 178.33.162.239:6893 udp
FR 178.33.162.240:6893 udp
FR 178.33.162.241:6893 udp
FR 178.33.162.242:6893 udp
FR 178.33.162.243:6893 udp
FR 178.33.162.244:6893 udp
FR 178.33.162.245:6893 udp
FR 178.33.162.246:6893 udp
FR 178.33.162.247:6893 udp
FR 178.33.162.248:6893 udp
FR 178.33.162.249:6893 udp
FR 178.33.162.250:6893 udp
FR 178.33.162.251:6893 udp
FR 178.33.162.252:6893 udp
FR 178.33.162.253:6893 udp
FR 178.33.162.254:6893 udp
FR 178.33.162.255:6893 udp
FR 178.33.163.0:6893 udp
FR 178.33.163.1:6893 udp
FR 178.33.163.2:6893 udp
FR 178.33.163.3:6893 udp
FR 178.33.163.4:6893 udp
FR 178.33.163.5:6893 udp
FR 178.33.163.6:6893 udp
FR 178.33.163.7:6893 udp
FR 178.33.163.8:6893 udp
FR 178.33.163.9:6893 udp
FR 178.33.163.10:6893 udp
FR 178.33.163.11:6893 udp
FR 178.33.163.12:6893 udp
FR 178.33.163.13:6893 udp
FR 178.33.163.14:6893 udp
FR 178.33.163.15:6893 udp
FR 178.33.163.16:6893 udp
FR 178.33.163.17:6893 udp
FR 178.33.163.18:6893 udp
FR 178.33.163.19:6893 udp
FR 178.33.163.20:6893 udp
FR 178.33.163.21:6893 udp
FR 178.33.163.22:6893 udp
FR 178.33.163.23:6893 udp
FR 178.33.163.24:6893 udp
FR 178.33.163.25:6893 udp
FR 178.33.163.26:6893 udp
FR 178.33.163.27:6893 udp
FR 178.33.163.28:6893 udp
FR 178.33.163.29:6893 udp
FR 178.33.163.30:6893 udp
FR 178.33.163.31:6893 udp
FR 178.33.163.32:6893 udp
FR 178.33.163.33:6893 udp
FR 178.33.163.34:6893 udp
FR 178.33.163.35:6893 udp
FR 178.33.163.36:6893 udp
FR 178.33.163.37:6893 udp
FR 178.33.163.38:6893 udp
FR 178.33.163.39:6893 udp
FR 178.33.163.40:6893 udp
FR 178.33.163.41:6893 udp
FR 178.33.163.42:6893 udp
FR 178.33.163.43:6893 udp
FR 178.33.163.44:6893 udp
FR 178.33.163.45:6893 udp
FR 178.33.163.46:6893 udp
FR 178.33.163.47:6893 udp
FR 178.33.163.48:6893 udp
FR 178.33.163.49:6893 udp
FR 178.33.163.50:6893 udp
FR 178.33.163.51:6893 udp
FR 178.33.163.52:6893 udp
FR 178.33.163.53:6893 udp
FR 178.33.163.54:6893 udp
FR 178.33.163.55:6893 udp
FR 178.33.163.56:6893 udp
FR 178.33.163.57:6893 udp
FR 178.33.163.58:6893 udp
FR 178.33.163.59:6893 udp
FR 178.33.163.60:6893 udp
FR 178.33.163.61:6893 udp
FR 178.33.163.62:6893 udp
FR 178.33.163.63:6893 udp
FR 178.33.163.64:6893 udp
FR 178.33.163.65:6893 udp
FR 178.33.163.66:6893 udp
FR 178.33.163.67:6893 udp
FR 178.33.163.68:6893 udp
FR 178.33.163.69:6893 udp
FR 178.33.163.70:6893 udp
FR 178.33.163.71:6893 udp
FR 178.33.163.72:6893 udp
FR 178.33.163.73:6893 udp
FR 178.33.163.74:6893 udp
FR 178.33.163.75:6893 udp
FR 178.33.163.76:6893 udp
FR 178.33.163.77:6893 udp
FR 178.33.163.78:6893 udp
FR 178.33.163.79:6893 udp
FR 178.33.163.80:6893 udp
FR 178.33.163.81:6893 udp
FR 178.33.163.82:6893 udp
FR 178.33.163.83:6893 udp
FR 178.33.163.84:6893 udp
FR 178.33.163.85:6893 udp
FR 178.33.163.86:6893 udp
FR 178.33.163.87:6893 udp
FR 178.33.163.88:6893 udp
FR 178.33.163.89:6893 udp
FR 178.33.163.90:6893 udp
FR 178.33.163.91:6893 udp
FR 178.33.163.92:6893 udp
FR 178.33.163.93:6893 udp
FR 178.33.163.94:6893 udp
FR 178.33.163.95:6893 udp
FR 178.33.163.96:6893 udp
FR 178.33.163.97:6893 udp
FR 178.33.163.98:6893 udp
FR 178.33.163.99:6893 udp
FR 178.33.163.100:6893 udp
FR 178.33.163.101:6893 udp
FR 178.33.163.102:6893 udp
FR 178.33.163.103:6893 udp
FR 178.33.163.104:6893 udp
FR 178.33.163.105:6893 udp
FR 178.33.163.106:6893 udp
FR 178.33.163.107:6893 udp
FR 178.33.163.108:6893 udp
FR 178.33.163.109:6893 udp
FR 178.33.163.110:6893 udp
FR 178.33.163.111:6893 udp
FR 178.33.163.112:6893 udp
FR 178.33.163.113:6893 udp
FR 178.33.163.114:6893 udp
FR 178.33.163.115:6893 udp
FR 178.33.163.116:6893 udp
FR 178.33.163.117:6893 udp
FR 178.33.163.118:6893 udp
FR 178.33.163.119:6893 udp
FR 178.33.163.120:6893 udp
FR 178.33.163.121:6893 udp
FR 178.33.163.122:6893 udp
FR 178.33.163.123:6893 udp
FR 178.33.163.124:6893 udp
FR 178.33.163.125:6893 udp
FR 178.33.163.126:6893 udp
FR 178.33.163.127:6893 udp
FR 178.33.163.128:6893 udp
FR 178.33.163.129:6893 udp
FR 178.33.163.130:6893 udp
FR 178.33.163.131:6893 udp
FR 178.33.163.132:6893 udp
FR 178.33.163.133:6893 udp
FR 178.33.163.134:6893 udp
FR 178.33.163.135:6893 udp
FR 178.33.163.136:6893 udp
FR 178.33.163.137:6893 udp
FR 178.33.163.138:6893 udp
FR 178.33.163.139:6893 udp
FR 178.33.163.140:6893 udp
FR 178.33.163.141:6893 udp
FR 178.33.163.142:6893 udp
FR 178.33.163.143:6893 udp
FR 178.33.163.144:6893 udp
FR 178.33.163.145:6893 udp
FR 178.33.163.146:6893 udp
FR 178.33.163.147:6893 udp
FR 178.33.163.148:6893 udp
FR 178.33.163.149:6893 udp
FR 178.33.163.150:6893 udp
FR 178.33.163.151:6893 udp
FR 178.33.163.152:6893 udp
FR 178.33.163.153:6893 udp
FR 178.33.163.154:6893 udp
FR 178.33.163.155:6893 udp
FR 178.33.163.156:6893 udp
FR 178.33.163.157:6893 udp
FR 178.33.163.158:6893 udp
FR 178.33.163.159:6893 udp
FR 178.33.163.160:6893 udp
FR 178.33.163.161:6893 udp
FR 178.33.163.162:6893 udp
FR 178.33.163.163:6893 udp
FR 178.33.163.164:6893 udp
FR 178.33.163.165:6893 udp
FR 178.33.163.166:6893 udp
FR 178.33.163.167:6893 udp
FR 178.33.163.168:6893 udp
FR 178.33.163.169:6893 udp
FR 178.33.163.170:6893 udp
FR 178.33.163.171:6893 udp
FR 178.33.163.172:6893 udp
FR 178.33.163.173:6893 udp
FR 178.33.163.174:6893 udp
FR 178.33.163.175:6893 udp
FR 178.33.163.176:6893 udp
FR 178.33.163.177:6893 udp
FR 178.33.163.178:6893 udp
FR 178.33.163.179:6893 udp
FR 178.33.163.180:6893 udp
FR 178.33.163.181:6893 udp
FR 178.33.163.182:6893 udp
FR 178.33.163.183:6893 udp
FR 178.33.163.184:6893 udp
FR 178.33.163.185:6893 udp
FR 178.33.163.186:6893 udp
FR 178.33.163.187:6893 udp
FR 178.33.163.188:6893 udp
FR 178.33.163.189:6893 udp
FR 178.33.163.190:6893 udp
FR 178.33.163.191:6893 udp
FR 178.33.163.192:6893 udp
FR 178.33.163.193:6893 udp
FR 178.33.163.194:6893 udp
FR 178.33.163.195:6893 udp
FR 178.33.163.196:6893 udp
FR 178.33.163.197:6893 udp
FR 178.33.163.198:6893 udp
FR 178.33.163.199:6893 udp
FR 178.33.163.200:6893 udp
FR 178.33.163.201:6893 udp
FR 178.33.163.202:6893 udp
FR 178.33.163.203:6893 udp
FR 178.33.163.204:6893 udp
FR 178.33.163.205:6893 udp
FR 178.33.163.206:6893 udp
FR 178.33.163.207:6893 udp
FR 178.33.163.208:6893 udp
FR 178.33.163.209:6893 udp
FR 178.33.163.210:6893 udp
FR 178.33.163.211:6893 udp
FR 178.33.163.212:6893 udp
FR 178.33.163.213:6893 udp
FR 178.33.163.214:6893 udp
FR 178.33.163.215:6893 udp
FR 178.33.163.216:6893 udp
FR 178.33.163.217:6893 udp
FR 178.33.163.218:6893 udp
FR 178.33.163.219:6893 udp
FR 178.33.163.220:6893 udp
FR 178.33.163.221:6893 udp
FR 178.33.163.222:6893 udp
FR 178.33.163.223:6893 udp
FR 178.33.163.224:6893 udp
FR 178.33.163.225:6893 udp
FR 178.33.163.226:6893 udp
FR 178.33.163.227:6893 udp
FR 178.33.163.228:6893 udp
FR 178.33.163.229:6893 udp
FR 178.33.163.230:6893 udp
FR 178.33.163.231:6893 udp
FR 178.33.163.232:6893 udp
FR 178.33.163.233:6893 udp
FR 178.33.163.234:6893 udp
FR 178.33.163.235:6893 udp
FR 178.33.163.236:6893 udp
FR 178.33.163.237:6893 udp
FR 178.33.163.238:6893 udp
FR 178.33.163.239:6893 udp
FR 178.33.163.240:6893 udp
FR 178.33.163.241:6893 udp
FR 178.33.163.242:6893 udp
FR 178.33.163.243:6893 udp
FR 178.33.163.244:6893 udp
FR 178.33.163.245:6893 udp
FR 178.33.163.246:6893 udp
FR 178.33.163.247:6893 udp
FR 178.33.163.248:6893 udp
FR 178.33.163.249:6893 udp
FR 178.33.163.250:6893 udp
FR 178.33.163.251:6893 udp
FR 178.33.163.252:6893 udp
FR 178.33.163.253:6893 udp
FR 178.33.163.254:6893 udp
FR 178.33.163.255:6893 udp

Files

C:\Users\Admin\AppData\Local\Temp\7zO0D87F7C8\cerber.exe

MD5 8b6bc16fd137c09a08b02bbe1bb7d670
SHA1 c69a0f6c6f809c01db92ca658fcf1b643391a2b7
SHA256 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678
SHA512 b53d2cc0fe5fa52262ace9f6e6ea3f5ce84935009822a3394bfe49c4d15dfeaa96bfe10ce77ffa93dbf81e5428122aa739a94bc709f203bc346597004fd75a24

memory/4460-13-0x0000000000400000-0x0000000000435000-memory.dmp

memory/4460-12-0x00000000020A0000-0x00000000020D1000-memory.dmp

memory/4460-14-0x0000000000400000-0x0000000000435000-memory.dmp

memory/4460-15-0x0000000000400000-0x0000000000435000-memory.dmp

memory/4460-19-0x0000000000400000-0x0000000000435000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\_R_E_A_D___T_H_I_S___HLWGHXN_.txt

MD5 e77f6cc317ead28d6324f9c885a9020e
SHA1 58e8ae636018b7d158b9abc0238ac15318f4af01
SHA256 91469ae47a0b1fe48d6be5c1b19bab6ccfe7d714dc86926455ea6b15556557be
SHA512 2fcad5edcbcd4103a2b50a3e43b0f36eea47993a48c20ebb79a1977733e4d4162b7910c97e847159a6dbbfadaafc8da856a23f7684264626717adbca68d69167

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\_R_E_A_D___T_H_I_S___YPI8B5A6_.hta

MD5 8329a7a0a63ed69004e778104340a3cc
SHA1 bf8a8ae1f9b1b5ff7ebd07b0da3889251f4673ba
SHA256 8d999b23efb0a16432d6ed7e4e8be49f07a5e167fdf8385406713035f73484e5
SHA512 47af1ab4d1d2da1e18654253d08729d5b467332199bccc679cb74a584b5e5e6444abf7aba39f713a70a15ae085c713a766fafa5813f5115df669a9715a8f9715

memory/4460-393-0x0000000000400000-0x0000000000435000-memory.dmp

memory/4460-397-0x0000000000400000-0x0000000000435000-memory.dmp

memory/4460-401-0x0000000000400000-0x0000000000435000-memory.dmp

memory/4460-416-0x0000000000400000-0x0000000000435000-memory.dmp

Analysis: behavioral9

Detonation Overview

Submitted

2024-11-28 22:34

Reported

2024-11-28 22:37

Platform

win7-20240903-en

Max time kernel

117s

Max time network

122s

Command Line

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Ransomware-master\etc\Ransomware.Cerber.zip"

Signatures

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: 35 N/A C:\Program Files\7-Zip\7zFM.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A

Processes

C:\Program Files\7-Zip\7zFM.exe

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Ransomware-master\etc\Ransomware.Cerber.zip"

Network

N/A

Files

N/A

Analysis: behavioral27

Detonation Overview

Submitted

2024-11-28 22:34

Reported

2024-11-28 22:36

Platform

win7-20241010-en

Max time kernel

118s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\131.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\131.exe

"C:\Users\Admin\AppData\Local\Temp\131.exe"

Network

N/A

Files

N/A

Analysis: behavioral19

Detonation Overview

Submitted

2024-11-28 22:34

Reported

2024-11-28 22:36

Platform

win7-20240903-en

Max time kernel

122s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\jigsaw.exe"

Signatures

Jigsaw Ransomware

ransomware jigsaw

Jigsaw family

jigsaw

Renames multiple (2002) files with added filename extension

ransomware

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\firefox.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Frfx\\firefox.exe" C:\Users\Admin\AppData\Local\Temp\jigsaw.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\trad_s.png C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.databinding.nl_ja_4.4.0.v20140623020002.jar C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\org-openide-filesystems.jar C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-javahelp.jar C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsViewAttachmentIconsMask.bmp C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground.wmv C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\localizedStrings.js C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif.fun C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File created C:\Program Files\Mozilla Firefox\private_browsing.VisualElementsManifest.xml.fun C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.console_1.1.0.v20140131-1639.jar.fun C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-utilities.xml C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Discussion\DiscussionToolIconImagesMask.bmp C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-io.xml.fun C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-heapdump_zh_CN.jar C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\delete.avi C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\info.png C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\CommsOutgoingImage.jpg C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_GreenTea.gif.fun C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multitabs_zh_CN.jar C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Psychedelic.jpg C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\diner_m.png C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar.fun C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\js\picturePuzzle.js C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File created C:\Program Files\7-Zip\Lang\de.txt.fun C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-full.png C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.nl_ja_4.4.0.v20140623020002.jar.fun C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\js\calendar.js C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_Premium.gif C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-io_ja.jar.fun C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-api.xml C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-profiling.xml C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\Interface.zip.fun C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\ResourceInternal.zip C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\index.gif C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Grid.xml.fun C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-awt.jar C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\15x15dot.png C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_ru.jar C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_box_right.png C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-javahelp.xml.fun C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\StepWait.csv C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\HandPrints.jpg C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_SelectionSubpicture.png C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\dial_lrg_sml.png C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\30.png C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File created C:\Program Files\Java\jre7\lib\images\cursors\win32_CopyNoDrop32x32.gif.fun C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\js\settings.js C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gif.fun C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_SlateBlue.gif C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\macHandle.png C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color120.png C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-new_partly-cloudy.png C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\js\settings.js C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_box_bottom.png C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.ui.ja_5.5.0.165303.jar C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\currency.js C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-sendopts.xml C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\jfluid-server_zh_CN.jar C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\46.png C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiling_zh_CN.jar C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\1047x576black.png C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\es-ES\gadget.xml C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\40.png C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\11.png C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A

Enumerates physical storage devices

Processes

C:\Users\Admin\AppData\Local\Temp\jigsaw.exe

"C:\Users\Admin\AppData\Local\Temp\jigsaw.exe"

C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe

"C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe" C:\Users\Admin\AppData\Local\Temp\jigsaw.exe

Network

N/A

Files

memory/2312-0-0x000007FEF628E000-0x000007FEF628F000-memory.dmp

memory/2312-1-0x0000000000510000-0x0000000000548000-memory.dmp

memory/2312-2-0x000007FEF5FD0000-0x000007FEF696D000-memory.dmp

memory/2312-3-0x000007FEF5FD0000-0x000007FEF696D000-memory.dmp

C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe

MD5 2773e3dc59472296cb0024ba7715a64e
SHA1 27d99fbca067f478bb91cdbcb92f13a828b00859
SHA256 3ae96f73d805e1d3995253db4d910300d8442ea603737a1428b613061e7f61e7
SHA512 6ef530b209f8ec459cca66dbf2c31ec96c5f7d609f17fa3b877d276968032fbc6132ea4a45ed1450fb6c5d730a7c9349bf4481e28befaea6b119ec0ded842262

memory/2312-11-0x000007FEF5FD0000-0x000007FEF696D000-memory.dmp

memory/380-10-0x000007FEF5FD0000-0x000007FEF696D000-memory.dmp

memory/380-12-0x000007FEF5FD0000-0x000007FEF696D000-memory.dmp

memory/380-13-0x000007FEF5FD0000-0x000007FEF696D000-memory.dmp

memory/380-14-0x000007FEF5FD0000-0x000007FEF696D000-memory.dmp

C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\invalid32x32.gif.fun

MD5 580ee0344b7da2786da6a433a1e84893
SHA1 60f8c4dd5457e9834f5402cb326b1a2d3ca0ba7e
SHA256 98b6c2ddfefc628d03ceaef9d69688674a6bc32eb707f9ed86bc8c75675c4513
SHA512 356d2cdea3321e894b5b46ad1ea24c0e3c8be8e3c454b5bd300b7340cbb454e71fc89ca09ea0785b373b483e67c2f6f6bb408e489b0de4ff82d5ed69a75613ba

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\DNTException\container.dat.fun

MD5 8ebcc5ca5ac09a09376801ecdd6f3792
SHA1 81187142b138e0245d5d0bc511f7c46c30df3e14
SHA256 619e246fc0ac11320ff9e322a979948d949494b0c18217f4d794e1b398818880
SHA512 cec50bfc6ad2f57f16da99459f40f2d424c6d5691685fa1053284f46c8c8c8a975d7bcb1f3521c4f3fbdc310cf4714e29404aa23be6021e2e267c97b090dc650

memory/380-2024-0x000007FEF5FD0000-0x000007FEF696D000-memory.dmp

memory/380-2027-0x000007FEF5FD0000-0x000007FEF696D000-memory.dmp

Analysis: behavioral16

Detonation Overview

Submitted

2024-11-28 22:34

Reported

2024-11-28 22:36

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\cryptowall.exe"

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\cryptowall.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\cryptowall.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\cryptowall.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\cryptowall.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\cryptowall.exe

"C:\Users\Admin\AppData\Local\Temp\cryptowall.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2720 -ip 2720

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2720 -s 476

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 103.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 100.208.201.84.in-addr.arpa udp
US 8.8.8.8:53 71.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 udp

Files

N/A

Analysis: behavioral17

Detonation Overview

Submitted

2024-11-28 22:34

Reported

2024-11-28 22:36

Platform

win7-20240903-en

Max time kernel

121s

Max time network

124s

Command Line

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Ransomware-master\etc\Ransomware.Jigsaw.zip"

Signatures

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: 35 N/A C:\Program Files\7-Zip\7zFM.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A

Processes

C:\Program Files\7-Zip\7zFM.exe

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Ransomware-master\etc\Ransomware.Jigsaw.zip"

Network

N/A

Files

N/A

Analysis: behavioral24

Detonation Overview

Submitted

2024-11-28 22:34

Reported

2024-11-28 22:36

Platform

win10v2004-20241007-en

Max time kernel

145s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Locky.exe"

Signatures

Locky

ransomware locky

Locky family

locky

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Locky.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Locky.exe

"C:\Users\Admin\AppData\Local\Temp\Locky.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 frxdrjrjd.de udp
US 8.8.8.8:53 weaaspoo.in udp
US 8.8.8.8:53 ktwmpwuncbi.fr udp
US 8.8.8.8:53 cjpqsuatmo.tf udp
IE 86.104.134.144:80 tcp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 embavssrrfvukl.in udp
US 8.8.8.8:53 rcbquc.ru udp
US 8.8.8.8:53 frxdrjrjd.de udp
US 8.8.8.8:53 weaaspoo.in udp
US 8.8.8.8:53 ktwmpwuncbi.fr udp
US 8.8.8.8:53 72.208.201.84.in-addr.arpa udp
US 8.8.8.8:53 cjpqsuatmo.tf udp
IE 86.104.134.144:80 tcp
US 8.8.8.8:53 embavssrrfvukl.in udp
US 8.8.8.8:53 rcbquc.ru udp
US 8.8.8.8:53 frxdrjrjd.de udp
US 8.8.8.8:53 weaaspoo.in udp
US 8.8.8.8:53 ktwmpwuncbi.fr udp
US 8.8.8.8:53 cjpqsuatmo.tf udp
IE 86.104.134.144:80 tcp
US 8.8.8.8:53 103.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 embavssrrfvukl.in udp
US 8.8.8.8:53 rcbquc.ru udp
US 8.8.8.8:53 frxdrjrjd.de udp
US 8.8.8.8:53 weaaspoo.in udp
US 8.8.8.8:53 ktwmpwuncbi.fr udp
US 8.8.8.8:53 cjpqsuatmo.tf udp
IE 86.104.134.144:80 tcp
US 8.8.8.8:53 embavssrrfvukl.in udp
US 8.8.8.8:53 rcbquc.ru udp
US 8.8.8.8:53 frxdrjrjd.de udp
US 8.8.8.8:53 weaaspoo.in udp

Files

memory/4204-0-0x0000000002530000-0x0000000002534000-memory.dmp

memory/4204-1-0x0000000002530000-0x0000000002534000-memory.dmp

memory/4204-2-0x0000000000400000-0x00000000007D1000-memory.dmp

memory/4204-4-0x0000000000400000-0x00000000007D1000-memory.dmp

memory/4204-6-0x0000000000400000-0x00000000007D1000-memory.dmp

memory/4204-8-0x0000000000400000-0x00000000007D1000-memory.dmp

memory/4204-10-0x0000000000400000-0x00000000007D1000-memory.dmp

memory/4204-12-0x0000000000400000-0x00000000007D1000-memory.dmp

memory/4204-14-0x0000000000400000-0x00000000007D1000-memory.dmp

Analysis: behavioral30

Detonation Overview

Submitted

2024-11-28 22:34

Reported

2024-11-28 22:37

Platform

win10v2004-20241007-en

Max time kernel

94s

Max time network

154s

Command Line

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Ransomware-master\etc\Ransomware.Matsnu.zip"

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: 35 N/A C:\Program Files\7-Zip\7zFM.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A

Processes

C:\Program Files\7-Zip\7zFM.exe

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Ransomware-master\etc\Ransomware.Matsnu.zip"

Network

Country Destination Domain Proto
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 102.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 68.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 66.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral20

Detonation Overview

Submitted

2024-11-28 22:34

Reported

2024-11-28 22:36

Platform

win10v2004-20241007-en

Max time kernel

125s

Max time network

136s

Command Line

"C:\Users\Admin\AppData\Local\Temp\jigsaw.exe"

Signatures

Jigsaw Ransomware

ransomware jigsaw

Jigsaw family

jigsaw

Renames multiple (3735) files with added filename extension

ransomware

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\jigsaw.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\firefox.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Frfx\\firefox.exe" C:\Users\Admin\AppData\Local\Temp\jigsaw.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\illustrations.png.fun C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\[email protected] C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\fil-PH\View3d\3DViewerProductDescription-universal.xml C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Outlook.scale-125.png C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\en\LocalizedStrings.xml.fun C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\1851_40x40x32.png C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-48_altform-unplated_contrast-black.png C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\selector.js.fun C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\BadgeLogo.scale-125_contrast-white.png C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailMediumTile.scale-100.png C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\InsiderHubSmallTile.scale-100_contrast-white.png C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\no_get.svg.fun C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_CopyDrop32x32.gif C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\Back-48.png C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Standard.targetsize-16_contrast-white.png C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-32.png C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\StoreLogo.scale-100_contrast-black.png C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\PhotosAppList.contrast-white_scale-125.png C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-32_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-32.png C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_listview_selected.svg.fun C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fr-ma\ui-strings.js C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\notificationsUI\notificationCenter.js C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-il\ui-strings.js C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\da-dk\ui-strings.js.fun C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\fr-ma\ui-strings.js C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\LinkedInboxLargeTile.scale-150.png C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-32_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\eu-es\ui-strings.js.fun C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sv-se\ui-strings.js C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorWideTile.contrast-white_scale-200.png C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\Classic\Pyramid.Wide.png C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\7.jpg C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\license.txt C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\cstm_brand_preview2x.png C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNotebookMedTile.scale-400.png C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\LargeTile.scale-100_contrast-white.png C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Images\Ratings\Yelp2.scale-100.png C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ko-kr\ui-strings.js C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\HomeBanner-4x.png.fun C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\LargeTile.scale-150.png C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\AdjacencyResume.dotx C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.targetsize-24_altform-unplated.png C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\core_icons_retina.png C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.scale-100_contrast-black.png C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\OutlookMailMediumTile.scale-200.png C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\LibrarySquare71x71Logo.scale-125.png C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\mng.txt C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNotebookLargeTile.scale-400.png C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\StoreLogo.scale-400_contrast-black.png C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\MicrosoftSolitaireAppList.targetsize-256_altform-lightunplated_devicefamily-colorfulunplated.png C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\hu-hu\ui-strings.js.fun C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\contrast-black\SmallTile.scale-100.png C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Images\SkypeAppList.targetsize-32_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-48_contrast-black.png C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\AppPackageMedTile.scale-100_contrast-white.png C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_newfolder-default.svg.fun C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_sendforcomments_18.svg C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarSmallTile.scale-100.png C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\StoreLogo.scale-400_contrast-white.png C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\illustrations.png C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Yahoo-Dark.scale-200.png C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4180 wrote to memory of 548 N/A C:\Users\Admin\AppData\Local\Temp\jigsaw.exe C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe
PID 4180 wrote to memory of 548 N/A C:\Users\Admin\AppData\Local\Temp\jigsaw.exe C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe

Processes

C:\Users\Admin\AppData\Local\Temp\jigsaw.exe

"C:\Users\Admin\AppData\Local\Temp\jigsaw.exe"

C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe

"C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe" C:\Users\Admin\AppData\Local\Temp\jigsaw.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 66.208.201.84.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp

Files

memory/4180-0-0x00007FFEF1145000-0x00007FFEF1146000-memory.dmp

memory/4180-2-0x0000000001030000-0x0000000001068000-memory.dmp

memory/4180-1-0x00007FFEF0E90000-0x00007FFEF1831000-memory.dmp

memory/4180-3-0x00007FFEF0E90000-0x00007FFEF1831000-memory.dmp

memory/4180-4-0x000000001BDF0000-0x000000001C2BE000-memory.dmp

memory/4180-5-0x000000001C2C0000-0x000000001C35C000-memory.dmp

C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe

MD5 2773e3dc59472296cb0024ba7715a64e
SHA1 27d99fbca067f478bb91cdbcb92f13a828b00859
SHA256 3ae96f73d805e1d3995253db4d910300d8442ea603737a1428b613061e7f61e7
SHA512 6ef530b209f8ec459cca66dbf2c31ec96c5f7d609f17fa3b877d276968032fbc6132ea4a45ed1450fb6c5d730a7c9349bf4481e28befaea6b119ec0ded842262

memory/4180-20-0x00007FFEF0E90000-0x00007FFEF1831000-memory.dmp

memory/548-21-0x00007FFEF0E90000-0x00007FFEF1831000-memory.dmp

memory/548-19-0x00007FFEF0E90000-0x00007FFEF1831000-memory.dmp

memory/548-22-0x000000001B560000-0x000000001B568000-memory.dmp

memory/548-23-0x00007FFEF0E90000-0x00007FFEF1831000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\{1148644D-36F1-44F1-AC84-97F68AD36193} - OProcSessId.dat.fun

MD5 8ebcc5ca5ac09a09376801ecdd6f3792
SHA1 81187142b138e0245d5d0bc511f7c46c30df3e14
SHA256 619e246fc0ac11320ff9e322a979948d949494b0c18217f4d794e1b398818880
SHA512 cec50bfc6ad2f57f16da99459f40f2d424c6d5691685fa1053284f46c8c8c8a975d7bcb1f3521c4f3fbdc310cf4714e29404aa23be6021e2e267c97b090dc650

C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\invalid32x32.gif.fun

MD5 580ee0344b7da2786da6a433a1e84893
SHA1 60f8c4dd5457e9834f5402cb326b1a2d3ca0ba7e
SHA256 98b6c2ddfefc628d03ceaef9d69688674a6bc32eb707f9ed86bc8c75675c4513
SHA512 356d2cdea3321e894b5b46ad1ea24c0e3c8be8e3c454b5bd300b7340cbb454e71fc89ca09ea0785b373b483e67c2f6f6bb408e489b0de4ff82d5ed69a75613ba

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt.fun

MD5 829165ca0fd145de3c2c8051b321734f
SHA1 f5cc3af85ab27c3ea2c2f7cbb8295b28a76a459e
SHA256 a193ee2673e0ba5ebc5ea6e65665b8a28bd7611f06d2b0174ec2076e22d94356
SHA512 7d380cda12b342a770def9d4e9c078c97874f3a30cd9f531355e3744a8fef2308f79878ffeb12ce26953325cb6a17bc7e54237dfdc2ee72b140ec295676adbcb

C:\Users\Admin\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\Settings\settings.dat.fun

MD5 f22599af9343cac74a6c5412104d748c
SHA1 e2ac4c57fa38f9d99f3d38c2f6582b4334331df5
SHA256 36537e56d60910ab6aa548e64ca4adafdcabde9d60739013993e12ba061dfd65
SHA512 5c8afc025e1d8342d93b7842dc7ef22eca61085857a80a08ba9b3f156ee3b814606bb32bc244bd525a7913e7915bdf3a86771d39577f4a1176ade04dc381c6d4

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727658826891613.txt.fun

MD5 b67ca8d25d3437a1ad002074baece55d
SHA1 8fe23a3d38fd21c57253a718fb2593d923812d66
SHA256 abb2c10c8980689378827432d3dcc2504aa625a366ad5223dc17d14e88d22893
SHA512 61c8a329f388720e5375c96caa9d5dd44ba35bb6218a1e196245cec188b7e6e97ad4c89052e3d98c47dbdb59be15882e9bdd65cee87b51e1fabebfba8d44b41d

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727660257997193.txt.fun

MD5 bbfa9fa834b66ff7fbc9605ec0546241
SHA1 232968612725fa1deb3233fc9ceff804a137793d
SHA256 4744a5a2dc3b4f77339c3ce8ab4d331c932ce0ae188c6035aa20b12c42964e48
SHA512 4183c331327061a0cd16814dfd1ca7e72907df7add728000f570770fbafdb058fd030ee075a2768673718aafb632d570332b9fd0402c52e6194b1fe5963bddcf

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727666145703406.txt.fun

MD5 ba2bbe2cda90e55b7457b8c6d6db9d1a
SHA1 e4742f659fd4453bf11ef860c06095944747f9bf
SHA256 5ef6411e9b665dc62915e501e7c9c83e959b37fb848b19c220a0a3626217c394
SHA512 4b87ceff65e205e1e0bca7dbf0bec88ca478ff9ad2510e4b7079cdf4dbae762f310de52a4584e707a972c0a365570b4c4e1fbb98368562515ee6db9fd19628ff

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133773068854566269.txt.fun

MD5 67bc2a33189ce9172ed9016da6b3966b
SHA1 1acf62cbeb3d2f68ef8b87a57ec22c30273df718
SHA256 9e80aff11f75851ca04db9975a246ff86e35389029f81f16e039b24823ccefa4
SHA512 ff1254d93f2ff62416b98c6529cef212963d1ced8a22377c3385ba4f0245029ecad5146f6f0c3c8f97a19dd3da367ee5b9f7a3e9ef06fb970ef5236599585680

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_remove_18.svg.fun

MD5 75a585c1b60bd6c75d496d3b042738d5
SHA1 02c310d7bf79b32a43acd367d031b6a88c7e95ed
SHA256 5ebbfc6df60e21044486a5df3cb47ccdcd7a4d5f197804555715ffd9bf6c5834
SHA512 663a302e651b9167f4c4e6ae30028307b4d8da0dda3a0e5fd414104951d50419862fc9396c5b39fe5c4b696efd3efbf0b575688983b1d341f3ef38becf500505

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_2x.png.fun

MD5 409a8070b50ad164eda5691adf5a2345
SHA1 e84e10471f3775d5d706a3b7e361100c9fbfaf74
SHA256 a91790b778026db625c9dedfe1c6d94b884818b33d7977e86b2f9c2f3c500796
SHA512 767a75edd37d29b3433040ce21cda849cd11ba549f27581f7edc6416c433ba7047c56908d40956422393ab0f35ede61617d4bd2aad0bde3d1ebd276584c858c7

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon.png.fun

MD5 880833ad1399589728c877f0ebf9dce0
SHA1 0a98c8a78b48c4b1b4165a2c6b612084d9d26dce
SHA256 7a27d891097df183fbf0031e3894bdac0ce77aef15d666ddd9f6a04e9836fb27
SHA512 0ddf247892a72a390437390d535debf6e41d12e51b31eb4f0353b710ec380c5fbc531a48e76935088063a41aca843287d3def9c1cd46be05b8dcb69f5017a464

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover.png.fun

MD5 2884524604c89632ebbf595e1d905df9
SHA1 b6053c85110b0364766e18daab579ac048b36545
SHA256 ae2facd997527426fc4def82e0db68be29b44499bfff86a28c36f7c31b177d4f
SHA512 0b506397627823a1768796129c6b37d146821471b89338b5f2d0fd3aea707fd46a8e197ee0e298ddfb3b50eef0a0b064946006346b060f733ef19cbd5d24fc90

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover_2x.png.fun

MD5 e092d14d26938d98728ce4698ee49bc3
SHA1 9f8ee037664b4871ec02ed6bba11a5317b9e784a
SHA256 5e8ec278a273be22199884d519a79f748801baa3a45b76e57569fdfffe96e7fb
SHA512 b2fcb5d46339cdf6b5a954f2a083cf913779e57cb6e8699bc5da1fba1c370c41117b7ddefb50075622067eb7b02a20268bc047171bd883bcda4a497c2ec64ea4

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\example_icons.png.fun

MD5 65368c6dd915332ad36d061e55d02d6f
SHA1 fb4bc0862b192ad322fcb8215a33bd06c4077c6b
SHA256 6f9c7ebec5a707de439e3fd2e278fdfa07a39465d56157b70b24f091509bf76f
SHA512 8bb9a7690aeb3c0b9e14e1a6ebc5741536d354cf2324fd74ee0c3e4ef511718f7795039a94c8d2df94b6e6d0fb1762191cb649089d1def12abdf34003f0cdd0f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\example_icons2x.png.fun

MD5 0d35b2591dc256d3575b38c748338021
SHA1 313f42a267f483e16e9dd223202c6679f243f02d
SHA256 1ca0cfc2df0354c8d886285ae5e743d9c7cc030e1afd68ac113c0f2ce43ad5fa
SHA512 f6c58c27bbde7508a866bd0e7fabadb13a4f020378cd8b8cfc0c9fa23f645d811d6cdea04b81afdf30c064c6248152e74b3e6a78ec7a3d1d19037a0db8897d7e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ui-strings.js.fun

MD5 433755fcc2552446eb1345dd28c924eb
SHA1 23863f5257bdc268015f31ab22434728e5982019
SHA256 d6c290e942ee665d71e288229423a1f1866842988eac01f886910b0ec383aa9b
SHA512 de83b580ce27012a7677e1da867c91e2a42dbc6b5872dcf756ace51c2862801814665ecca997171f2e550e8b9a3de19994d2516a4e5d4d57e16c7b4b823236c0

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ui-strings.js.fun

MD5 781ed8cdd7186821383d43d770d2e357
SHA1 99638b49b4cfec881688b025467df9f6f15371e8
SHA256 a955039cd9e53674395f4b758218e4d59c89e99a0c4d2a909e49f6008b8f5dd4
SHA512 87cb9c4288586df232200f7bbacee3dee04f31c9444902dd369ad5c392d71e9837ebf8b3bb0fcb4a5db8a879cf757e97ce248939e3316c6bf3a3fe7cbe579534

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\icons.png.fun

MD5 72269cd78515bde3812a44fa4c1c028c
SHA1 87cada599a01acf0a43692f07a58f62f5d90d22c
SHA256 7c78b3da50c1135a9e1ecace9aea4ea7ac8622d2a87b952fc917c81010c953f7
SHA512 3834b7a8866e8656bbdbf711fc400956e9b7a14e192758f26ccf31d8f6ab8e34f7b1983c1845dc84e45ff70555e423d54a475f6a668511d3bcbdd1d460eeb4b0

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\icons_ie8.gif.fun

MD5 eda4add7a17cc3d53920dd85d5987a5f
SHA1 863dcc28a16e16f66f607790807299b4578e6319
SHA256 97f6348eaa48800e603d11fa22c62e10682ad919e7af2b2e59d6bd53937618f2
SHA512 d59fa9648dc7cb76a5163014f91b6d65d33aaa86fc9d9c73bf147943a3254b4c4f77f06b2e95bb8f94246a982ea466eb33dac9573dd62f40953fd23de1c1b498

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\icons_retina.png.fun

MD5 7dbb12df8a1a7faae12a7df93b48a7aa
SHA1 07800ce598bee0825598ad6f5513e2ba60d56645
SHA256 aecde4eb94a19095495d76ef3189a9abd45bcfd41acbed7705d22b4c7d00aa77
SHA512 96e454ebb4c96573e8edc6822290c22d425f4c7f7adbab35e6dc4b3ce04a5916ae9254c2c312c98299835ecbf3c5aa95da2939b8408ac25fbae44ba87a3795dc

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\new_icons.png.fun

MD5 82a2e835674d50f1a9388aaf1b935002
SHA1 e09d0577da42a15ec1b71a887ff3e48cfbfeff1a
SHA256 904372666ca3c40f92b20317d92ca531678958affbc34591401e338146fe0ecb
SHA512 b10a8e384d0bd088443a5085f5c22a296f6f4d295a053d4526690ba65846e887daec47d01cf18fdf1160db98061a8b7c4040de56e6e604451a821fadccf32698

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\new_icons_retina.png.fun

MD5 150c9a9ed69b12d54ada958fcdbb1d8a
SHA1 804c540a51a8d14c6019d3886ece68f32f1631d5
SHA256 2dee41184747742fbdc527b2023d67fecec1ccdfdf258439a06cd75d4fd33f43
SHA512 70193ee6f0919eb14311f43b5a5da041deacb568db55fc43290ee76e17af902ac468435b37a150630ea3b7871c724073915ae5dcba3c301ac42f2d68dd598e2f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png.fun

MD5 ad091690b979144c795c59933373ea3f
SHA1 5d9e481bc96e6f53b6ff148b0da8417f63962ada
SHA256 7805ac9d0e05d560023e5aabed960d842e4f3ec2aa3db45a9cfb541688e2edb1
SHA512 23b4c799a7b25f70962e8dd0ec7286ba7150053cab7c88f5fb1efc1095c2987bd6f3572e7fb3ee4b2238958e52a763de2c84a74615df7a6d3a19a034584fd687

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png.fun

MD5 2de4e157bf747db92c978efce8754951
SHA1 c8d31effbb9621aefac55cf3d4ecf8db5e77f53d
SHA256 341976b4fe312824d02512d74770a6df9e1c37123781655532bd9cd97ea65fa9
SHA512 3042a742c38434ae3ee4fe10f7137462cdebad5cae0f9a85fb61063d15a30e1b54ac878b1af65f699c6ca1a9d2c3e58d245e54bdebfadc460cbd060836734e11

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon.png.fun

MD5 0c680b0b1e428ebc7bff87da2553d512
SHA1 f801dedfc3796d7ec52ee8ba85f26f24bbd2627c
SHA256 9433084e61062d2b709c1390e298ddaf3fb0226656662c04c0b7026a44dee750
SHA512 2d1399a6bf225b048d2b12656e941ad912636acae2dec387f92f33ac80629a1e504bca63580ba73a8ed073788f697274d5eb76ea1b089f0555fd397a8f5cbbff

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png.fun

MD5 be26a499465cfbb09a281f34012eada0
SHA1 b8544b9f569724a863e85209f81cd952acdea561
SHA256 9095e9b4759e823e96984981af41b7a9915a5ecaa6be769f89c13484cef9e0f5
SHA512 28196e5de9670e9f63adcf648368bd3ea5926a03e28a13adc2fb69c567fba2f84e4f162637c487acb64eda2e30993f849806f2313820ba693c7e70303542d04f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\bg_patterns_header.png.fun

MD5 6e333be79ea4454e2ae4a0649edc420d
SHA1 95a545127e10daea20fd38b29dcc66029bd3b8bc
SHA256 112f72ef2bc57de697b82b731775fba3f518d1ae072120cd11b732bf4a782e36
SHA512 bed5906c7373814acc8a54c1631428a17f0aa69282920447a1575d8db826afd5dab262301dc6da610ff8bb81d24ec6babd3d9fb99fd6945f1aca9cb9c76ec2c9

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\bg_pattern_RHP.png.fun

MD5 b8454390c3402747f7c5e46c69bea782
SHA1 e922c30891ff05939441d839bfe8e71ad9805ec0
SHA256 76f8ed1dd50e50c7d62b804a0d6901a93e5534787d7b38467933d4c12ce98a0d
SHA512 22b26c62473e80d17c1f78df14757ccfb6c7175faa541705edc153c02baa7ab0982b5daabe8dd2c8c9efb92af81f55ccaeeecffe8ed9a0b3c26e89135ca50923

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\illustrations.png.fun

MD5 3ae8789eb89621255cfd5708f5658dea
SHA1 6c3b530412474f62b91fd4393b636012c29217df
SHA256 7c5b1d8469e232a58359ccbcb89e619c81c20e6d2c7579e4292eb9a19849bc5a
SHA512 f6998dbae1a2fa56f962045261a11a50b8e03573d9d4cf39083da3be341cc104e0ecf5908076f03961bcdb1356d05a7450d69940ec3aaab73623a6fe180e7051

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\illustrations_retina.png.fun

MD5 b7c62677ce78fbd3fb9c047665223fea
SHA1 3218c7b6fd8be5e0a8b67d3953d37d5dbd0c71d8
SHA256 aa638be6e1107ed1f14e8430abedd6f6d0a837a31b1b63e6a7741d6d417eddc2
SHA512 9e0cc29835845f2a0260a6989c1b362bac22a8e0c2825bc18f1dde812ce7868503881d2deaf951429a80b5017b6ce31e785ff524883e08d730aa38b36a2fb074

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-gb\ui-strings.js.fun

MD5 117d6f863b5406cd4f2ac4ceaa4ba2c6
SHA1 5cac25f217399ea050182d28b08301fd819f2b2e
SHA256 73acdc730d8a9ec8f340c724b4db96fc222bb1eaf836cec69dfe3fab8d6ac362
SHA512 e10883029c1e0fbc64bec9aac0a6957a8499af255e1790843717212077926474e02b2870c5dd04b057c956b97ad4bb1747fe73e731ea61b891f4b38dd80494d7

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\bun.png.fun

MD5 51da980061401d9a49494b58225b2753
SHA1 3445ffbf33f012ff638c1435f0834db9858f16d3
SHA256 3fb25ddd378ab756ec9faa56f16b76691cf6d9c7405bb9a09ce542a6f5b94e44
SHA512 ecc5eb2a045ce2508d461b999f16caba6cce55aa0c00b34bd73a33e0458795f93a77caff5026212912684164057be016f51dc57ec83821c2a1f2e27417c47b2c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview.png.fun

MD5 2863e8df6fbbe35b81b590817dd42a04
SHA1 562824deb05e2bfe1b57cd0abd3fc7fbec141b7c
SHA256 7f1238332901b740cde70db622abcfb533fc02f71e93101340073552f4820dad
SHA512 7b2d95465ea66951ea05c341549535a0a939d26dbde365b212e3983e4047fa6912c37d737cb8054c41bb1a7d92586d968a0154c666572a70ebc59a4776897f38

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview2x.png.fun

MD5 79f6f006c95a4eb4141d6cedc7b2ebeb
SHA1 012ca3de08fb304f022f4ea9565ae465f53ab9e8
SHA256 e9847d0839d3cf1039bebdc49820ee7813d70941347ce420990592e5e3bd998e
SHA512 c143a4cf1ccfa98039b73214978722408188535ee4aa3dac08a34760b94bdf6d36ad0ff0de893da5b17fd69c96a6dfb25098ab7fec219fad1a77532113d0353e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small2x.png.fun

MD5 f77086a1d20bca6ba75b8f2fef2f0247
SHA1 db7c58faaecd10e4b3473b74c1277603a75d6624
SHA256 cf10d2a22b638cf0978cf30ecaf39ecb5bb0e3ad78cd920afa433ad60cc1290d
SHA512 a77a897c0b41f4052cb9546d4cfd6e0856b288b6b8583a86d6c7e79059a05b19cc2593599251581e79107235e9d5cd589c392bf490452be04ff57e944cd19df3

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small.png.fun

MD5 b88e3983f77632fa21f1d11ac7e27a64
SHA1 03a2b008cc3fe914910b0250ed4d49bd6b021393
SHA256 8469b8a64e80d662eec71c50513f6d295ef4a3a9992763dbcac9d81253cef9d5
SHA512 5bf93d4f4250ca96169f3d27d4e648cc5d6e00b7558a3ef32e07edcbae36dadb8008d7ba5f83ac3ed812b72c9d52730e866191b4de7a339df57b5697e00df50d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\nub.png.fun

MD5 e03c9cd255f1d8d6c03b52fee7273894
SHA1 d0e9a9e6efd1746bc9ccb4eb8e7701c1cd707e2e
SHA256 22a34c8321384fc7682102e40d082e7812232a9109e4d4e8fa2152fda3f260f6
SHA512 d4bd002197b725316e1f1f2dd0a70ee44a82a53ac0dafa8c6b1166343adc406e147d0c4cca30d65a32aa545f1b327c6b69c0ec1d15330af48a6faa234dc4b5ac

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons.png.fun

MD5 62b1443d82968878c773a1414de23c82
SHA1 192bbf788c31bc7e6fe840c0ea113992a8d8621c
SHA256 4e96529c023168df8dde241a9acdbf4788ea65bc35605e18febff2b2071f1e24
SHA512 75c8604ea65e0cdd9ea74b4802930444dd16a945da1e7f0af4a9a3762259ee9eb41ea96973555d06f4814ee2f6b73ab662c6b314b97876e9628fa5d4536e771c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons2x.png.fun

MD5 bca915870ae4ad0d86fcaba08a10f1fa
SHA1 7531259f5edae780e684a25635292bf4b2bb1aac
SHA256 d153ed6c5ea8c2c2f1839f8dadcc730f61bd8cd86ad732bab002a258dea1d037
SHA512 03f23de6b0ae10e63c41e73308b3844d49379c55d2df75fa1dc00771b26253d832c21081d8289f04260369df996e31273b7c0788cf3b5c78a27ec909f14a283a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\nl-nl\ui-strings.js.fun

MD5 14145467d1e7bd96f1ffe21e0ae79199
SHA1 5db5fbd88779a088fd1c4319ff26beb284ad0ff3
SHA256 7a75b8ec8809c460301f30e1960b13c518680792e5c743ce7e9a7f691cfafc38
SHA512 762d499c54c5a25aba4357a50bb4e6b47451babeda84fa62cfbd649f8350bca55204ad002883b9147e78dda3dbabaae8da1dc94b716204226bb53326030772b7

memory/548-3764-0x00007FFEF0E90000-0x00007FFEF1831000-memory.dmp

memory/548-3765-0x00007FFEF0E90000-0x00007FFEF1831000-memory.dmp

memory/548-3766-0x00007FFEF0E90000-0x00007FFEF1831000-memory.dmp

memory/548-3769-0x00007FFEF0E90000-0x00007FFEF1831000-memory.dmp

memory/548-3770-0x00007FFEF0E90000-0x00007FFEF1831000-memory.dmp

Analysis: behavioral23

Detonation Overview

Submitted

2024-11-28 22:34

Reported

2024-11-28 22:36

Platform

win7-20240903-en

Max time kernel

144s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Locky.exe"

Signatures

Locky

ransomware locky

Locky family

locky

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Locky.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Locky.exe

"C:\Users\Admin\AppData\Local\Temp\Locky.exe"

Network

Country Destination Domain Proto
IE 86.104.134.144:80 tcp
US 8.8.8.8:53 embavssrrfvukl.in udp
US 8.8.8.8:53 rcbquc.ru udp
US 8.8.8.8:53 frxdrjrjd.de udp
US 8.8.8.8:53 weaaspoo.in udp
US 8.8.8.8:53 ktwmpwuncbi.fr udp
US 8.8.8.8:53 cjpqsuatmo.tf udp
IE 86.104.134.144:80 tcp
IE 86.104.134.144:80 tcp

Files

memory/2340-0-0x0000000000220000-0x0000000000224000-memory.dmp

memory/2340-1-0x0000000000220000-0x0000000000224000-memory.dmp

memory/2340-2-0x0000000000400000-0x00000000007D1000-memory.dmp

memory/2340-4-0x0000000000400000-0x00000000007D1000-memory.dmp

memory/2340-6-0x0000000000400000-0x00000000007D1000-memory.dmp

memory/2340-8-0x0000000000400000-0x00000000007D1000-memory.dmp

memory/2340-10-0x0000000000400000-0x00000000007D1000-memory.dmp

memory/2340-12-0x0000000000400000-0x00000000007D1000-memory.dmp

memory/2340-13-0x0000000000400000-0x00000000007D1000-memory.dmp

memory/2340-15-0x0000000000400000-0x00000000007D1000-memory.dmp

Analysis: behavioral8

Detonation Overview

Submitted

2024-11-28 22:34

Reported

2024-11-28 22:36

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

152s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Ransomware-master\Ransomware

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Ransomware-master\Ransomware

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 71.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 73.208.201.84.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 92.16.208.104.in-addr.arpa udp

Files

N/A

Analysis: behavioral21

Detonation Overview

Submitted

2024-11-28 22:34

Reported

2024-11-28 22:36

Platform

win7-20240903-en

Max time kernel

121s

Max time network

124s

Command Line

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Ransomware-master\etc\Ransomware.Locky.zip"

Signatures

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: 35 N/A C:\Program Files\7-Zip\7zFM.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A

Processes

C:\Program Files\7-Zip\7zFM.exe

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Ransomware-master\etc\Ransomware.Locky.zip"

Network

N/A

Files

N/A

Analysis: behavioral7

Detonation Overview

Submitted

2024-11-28 22:34

Reported

2024-11-28 22:36

Platform

win7-20240903-en

Max time kernel

119s

Max time network

121s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Ransomware-master\Ransomware

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Ransomware-master\Ransomware

Network

N/A

Files

N/A

Analysis: behavioral11

Detonation Overview

Submitted

2024-11-28 22:34

Reported

2024-11-28 22:36

Platform

win7-20241023-en

Max time kernel

119s

Max time network

132s

Command Line

"C:\Users\Admin\AppData\Local\Temp\cerber.exe"

Signatures

Cerber

ransomware cerber

Cerber family

cerber

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A

Contacts a large (1096) amount of remote hosts

discovery

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Drops startup file

Description Indicator Process Target
File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\word\startup\ C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\outlook C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\thunderbird C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\bitcoin C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\excel C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft sql server C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\office C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\office C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\office C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft sql server C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\excel C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\powerpoint C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\steam C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\documents C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\office C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\outlook C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\onenote C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\powerpoint C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\excel C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\onenote C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\steam C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\desktop C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\outlook C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\powerpoint C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\powerpoint C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\word C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\onenote C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\word C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\word C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\excel C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\onenote C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\word C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\outlook C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\the bat! C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\thunderbird C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\bitcoin C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\microsoft sql server C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\microsoft sql server C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\the bat! C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpDA29.bmp" C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification \??\c:\program files (x86)\microsoft\outlook C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\program files (x86)\steam C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\program files (x86)\the bat! C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\program files (x86)\bitcoin C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\excel C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\powerpoint C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\program files (x86)\thunderbird C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\program files\ C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\microsoft sql server C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\onenote C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\word C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\program files (x86)\office C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\program files (x86)\outlook C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\program files (x86)\word C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\program files (x86)\ C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\program files (x86)\excel C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft sql server C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\office C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\program files (x86)\onenote C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\program files (x86)\powerpoint C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\powerpoint C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\powerpoint C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\steam C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\excel C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\onenote C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\desktop C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\thunderbird C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\thunderbird C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\word C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\office C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\onenote C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\office C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\onenote C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\outlook C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\the bat! C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\word C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\bitcoin C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft sql server C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\outlook C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\ C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\microsoft sql server C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\excel C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\microsoft sql server C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\onenote C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\onenote C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\outlook C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\bitcoin C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\excel C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\excel C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\excel C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\powerpoint C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\word C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\outlook C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\steam C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\the bat! C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\word C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\office C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\onenote C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\word C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\documents C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\word C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\office C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft sql server C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\outlook C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\onenote C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\excel C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\powerpoint C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\powerpoint C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\the bat! C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\bitcoin C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\outlook C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\outlook C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\steam C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\powerpoint C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\word C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\word C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\the bat! C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\thunderbird C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\desktop C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft sql server C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\microsoft sql server C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\powerpoint C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\office C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\onenote C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mshta.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\NOTEPAD.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\PING.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A

System Network Configuration Discovery: Internet Connection Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\NOTEPAD.EXE N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\NOTEPAD.EXE N/A

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2396 wrote to memory of 2384 N/A C:\Users\Admin\AppData\Local\Temp\cerber.exe C:\Windows\SysWOW64\netsh.exe
PID 2396 wrote to memory of 2384 N/A C:\Users\Admin\AppData\Local\Temp\cerber.exe C:\Windows\SysWOW64\netsh.exe
PID 2396 wrote to memory of 2384 N/A C:\Users\Admin\AppData\Local\Temp\cerber.exe C:\Windows\SysWOW64\netsh.exe
PID 2396 wrote to memory of 2384 N/A C:\Users\Admin\AppData\Local\Temp\cerber.exe C:\Windows\SysWOW64\netsh.exe
PID 2396 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\cerber.exe C:\Windows\SysWOW64\netsh.exe
PID 2396 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\cerber.exe C:\Windows\SysWOW64\netsh.exe
PID 2396 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\cerber.exe C:\Windows\SysWOW64\netsh.exe
PID 2396 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\cerber.exe C:\Windows\SysWOW64\netsh.exe
PID 2396 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\cerber.exe C:\Windows\SysWOW64\mshta.exe
PID 2396 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\cerber.exe C:\Windows\SysWOW64\mshta.exe
PID 2396 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\cerber.exe C:\Windows\SysWOW64\mshta.exe
PID 2396 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\cerber.exe C:\Windows\SysWOW64\mshta.exe
PID 2396 wrote to memory of 868 N/A C:\Users\Admin\AppData\Local\Temp\cerber.exe C:\Windows\SysWOW64\NOTEPAD.EXE
PID 2396 wrote to memory of 868 N/A C:\Users\Admin\AppData\Local\Temp\cerber.exe C:\Windows\SysWOW64\NOTEPAD.EXE
PID 2396 wrote to memory of 868 N/A C:\Users\Admin\AppData\Local\Temp\cerber.exe C:\Windows\SysWOW64\NOTEPAD.EXE
PID 2396 wrote to memory of 868 N/A C:\Users\Admin\AppData\Local\Temp\cerber.exe C:\Windows\SysWOW64\NOTEPAD.EXE
PID 2396 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\cerber.exe C:\Windows\SysWOW64\cmd.exe
PID 2396 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\cerber.exe C:\Windows\SysWOW64\cmd.exe
PID 2396 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\cerber.exe C:\Windows\SysWOW64\cmd.exe
PID 2396 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\cerber.exe C:\Windows\SysWOW64\cmd.exe
PID 1488 wrote to memory of 1616 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1488 wrote to memory of 1616 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1488 wrote to memory of 1616 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1488 wrote to memory of 1616 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1488 wrote to memory of 1044 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1488 wrote to memory of 1044 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1488 wrote to memory of 1044 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1488 wrote to memory of 1044 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\cerber.exe

"C:\Users\Admin\AppData\Local\Temp\cerber.exe"

C:\Windows\SysWOW64\netsh.exe

C:\Windows\system32\netsh.exe advfirewall set allprofiles state on

C:\Windows\SysWOW64\netsh.exe

C:\Windows\system32\netsh.exe advfirewall reset

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___T5E5HTXX_.hta"

C:\Windows\SysWOW64\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___9OUB2_.txt

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "cerber.exe"

C:\Windows\SysWOW64\PING.EXE

ping -n 1 127.0.0.1

Network

Country Destination Domain Proto
FR 178.33.158.0:6893 udp
FR 178.33.158.1:6893 udp
FR 178.33.158.2:6893 udp
FR 178.33.158.3:6893 udp
FR 178.33.158.4:6893 udp
FR 178.33.158.5:6893 udp
FR 178.33.158.6:6893 udp
FR 178.33.158.7:6893 udp
FR 178.33.158.8:6893 udp
FR 178.33.158.9:6893 udp
FR 178.33.158.10:6893 udp
FR 178.33.158.11:6893 udp
FR 178.33.158.12:6893 udp
FR 178.33.158.13:6893 udp
FR 178.33.158.14:6893 udp
FR 178.33.158.15:6893 udp
FR 178.33.158.16:6893 udp
FR 178.33.158.17:6893 udp
FR 178.33.158.18:6893 udp
FR 178.33.158.19:6893 udp
FR 178.33.158.20:6893 udp
FR 178.33.158.21:6893 udp
FR 178.33.158.22:6893 udp
FR 178.33.158.23:6893 udp
FR 178.33.158.24:6893 udp
FR 178.33.158.25:6893 udp
FR 178.33.158.26:6893 udp
FR 178.33.158.27:6893 udp
FR 178.33.158.28:6893 udp
FR 178.33.158.29:6893 udp
FR 178.33.158.30:6893 udp
FR 178.33.158.31:6893 udp
FR 178.33.159.0:6893 udp
FR 178.33.159.1:6893 udp
FR 178.33.159.2:6893 udp
FR 178.33.159.3:6893 udp
FR 178.33.159.4:6893 udp
FR 178.33.159.5:6893 udp
FR 178.33.159.6:6893 udp
FR 178.33.159.7:6893 udp
FR 178.33.159.8:6893 udp
FR 178.33.159.9:6893 udp
FR 178.33.159.10:6893 udp
FR 178.33.159.11:6893 udp
FR 178.33.159.12:6893 udp
FR 178.33.159.13:6893 udp
FR 178.33.159.14:6893 udp
FR 178.33.159.15:6893 udp
FR 178.33.159.16:6893 udp
FR 178.33.159.17:6893 udp
FR 178.33.159.18:6893 udp
FR 178.33.159.19:6893 udp
FR 178.33.159.20:6893 udp
FR 178.33.159.21:6893 udp
FR 178.33.159.22:6893 udp
FR 178.33.159.23:6893 udp
FR 178.33.159.24:6893 udp
FR 178.33.159.25:6893 udp
FR 178.33.159.26:6893 udp
FR 178.33.159.27:6893 udp
FR 178.33.159.28:6893 udp
FR 178.33.159.29:6893 udp
FR 178.33.159.30:6893 udp
FR 178.33.159.31:6893 udp
FR 178.33.160.0:6893 udp
FR 178.33.160.1:6893 udp
FR 178.33.160.2:6893 udp
FR 178.33.160.3:6893 udp
FR 178.33.160.4:6893 udp
FR 178.33.160.5:6893 udp
FR 178.33.160.6:6893 udp
FR 178.33.160.7:6893 udp
FR 178.33.160.8:6893 udp
FR 178.33.160.9:6893 udp
FR 178.33.160.10:6893 udp
FR 178.33.160.11:6893 udp
FR 178.33.160.12:6893 udp
FR 178.33.160.13:6893 udp
FR 178.33.160.14:6893 udp
FR 178.33.160.15:6893 udp
FR 178.33.160.16:6893 udp
FR 178.33.160.17:6893 udp
FR 178.33.160.18:6893 udp
FR 178.33.160.19:6893 udp
FR 178.33.160.20:6893 udp
FR 178.33.160.21:6893 udp
FR 178.33.160.22:6893 udp
FR 178.33.160.23:6893 udp
FR 178.33.160.24:6893 udp
FR 178.33.160.25:6893 udp
FR 178.33.160.26:6893 udp
FR 178.33.160.27:6893 udp
FR 178.33.160.28:6893 udp
FR 178.33.160.29:6893 udp
FR 178.33.160.30:6893 udp
FR 178.33.160.31:6893 udp
FR 178.33.160.32:6893 udp
FR 178.33.160.33:6893 udp
FR 178.33.160.34:6893 udp
FR 178.33.160.35:6893 udp
FR 178.33.160.36:6893 udp
FR 178.33.160.37:6893 udp
FR 178.33.160.38:6893 udp
FR 178.33.160.39:6893 udp
FR 178.33.160.40:6893 udp
FR 178.33.160.41:6893 udp
FR 178.33.160.42:6893 udp
FR 178.33.160.43:6893 udp
FR 178.33.160.44:6893 udp
FR 178.33.160.45:6893 udp
FR 178.33.160.46:6893 udp
FR 178.33.160.47:6893 udp
FR 178.33.160.48:6893 udp
FR 178.33.160.49:6893 udp
FR 178.33.160.50:6893 udp
FR 178.33.160.51:6893 udp
FR 178.33.160.52:6893 udp
FR 178.33.160.53:6893 udp
FR 178.33.160.54:6893 udp
FR 178.33.160.55:6893 udp
FR 178.33.160.56:6893 udp
FR 178.33.160.57:6893 udp
FR 178.33.160.58:6893 udp
FR 178.33.160.59:6893 udp
FR 178.33.160.60:6893 udp
FR 178.33.160.61:6893 udp
FR 178.33.160.62:6893 udp
FR 178.33.160.63:6893 udp
FR 178.33.160.64:6893 udp
FR 178.33.160.65:6893 udp
FR 178.33.160.66:6893 udp
FR 178.33.160.67:6893 udp
FR 178.33.160.68:6893 udp
FR 178.33.160.69:6893 udp
FR 178.33.160.70:6893 udp
FR 178.33.160.71:6893 udp
FR 178.33.160.72:6893 udp
FR 178.33.160.73:6893 udp
FR 178.33.160.74:6893 udp
FR 178.33.160.75:6893 udp
FR 178.33.160.76:6893 udp
FR 178.33.160.77:6893 udp
FR 178.33.160.78:6893 udp
FR 178.33.160.79:6893 udp
FR 178.33.160.80:6893 udp
FR 178.33.160.81:6893 udp
FR 178.33.160.82:6893 udp
FR 178.33.160.83:6893 udp
FR 178.33.160.84:6893 udp
FR 178.33.160.85:6893 udp
FR 178.33.160.86:6893 udp
FR 178.33.160.87:6893 udp
FR 178.33.160.88:6893 udp
FR 178.33.160.89:6893 udp
FR 178.33.160.90:6893 udp
FR 178.33.160.91:6893 udp
FR 178.33.160.92:6893 udp
FR 178.33.160.93:6893 udp
FR 178.33.160.94:6893 udp
FR 178.33.160.95:6893 udp
FR 178.33.160.96:6893 udp
FR 178.33.160.97:6893 udp
FR 178.33.160.98:6893 udp
FR 178.33.160.99:6893 udp
FR 178.33.160.100:6893 udp
FR 178.33.160.101:6893 udp
FR 178.33.160.102:6893 udp
FR 178.33.160.103:6893 udp
FR 178.33.160.104:6893 udp
FR 178.33.160.105:6893 udp
FR 178.33.160.106:6893 udp
FR 178.33.160.107:6893 udp
FR 178.33.160.108:6893 udp
FR 178.33.160.109:6893 udp
FR 178.33.160.110:6893 udp
FR 178.33.160.111:6893 udp
FR 178.33.160.112:6893 udp
FR 178.33.160.113:6893 udp
FR 178.33.160.114:6893 udp
FR 178.33.160.115:6893 udp
FR 178.33.160.116:6893 udp
FR 178.33.160.117:6893 udp
FR 178.33.160.118:6893 udp
FR 178.33.160.119:6893 udp
FR 178.33.160.120:6893 udp
FR 178.33.160.121:6893 udp
FR 178.33.160.122:6893 udp
FR 178.33.160.123:6893 udp
FR 178.33.160.124:6893 udp
FR 178.33.160.125:6893 udp
FR 178.33.160.126:6893 udp
FR 178.33.160.127:6893 udp
FR 178.33.160.128:6893 udp
FR 178.33.160.129:6893 udp
FR 178.33.160.130:6893 udp
FR 178.33.160.131:6893 udp
FR 178.33.160.132:6893 udp
FR 178.33.160.133:6893 udp
FR 178.33.160.134:6893 udp
FR 178.33.160.135:6893 udp
FR 178.33.160.136:6893 udp
FR 178.33.160.137:6893 udp
FR 178.33.160.138:6893 udp
FR 178.33.160.139:6893 udp
FR 178.33.160.140:6893 udp
FR 178.33.160.141:6893 udp
FR 178.33.160.142:6893 udp
FR 178.33.160.143:6893 udp
FR 178.33.160.144:6893 udp
FR 178.33.160.145:6893 udp
FR 178.33.160.146:6893 udp
FR 178.33.160.147:6893 udp
FR 178.33.160.148:6893 udp
FR 178.33.160.149:6893 udp
FR 178.33.160.150:6893 udp
FR 178.33.160.151:6893 udp
FR 178.33.160.152:6893 udp
FR 178.33.160.153:6893 udp
FR 178.33.160.154:6893 udp
FR 178.33.160.155:6893 udp
FR 178.33.160.156:6893 udp
FR 178.33.160.157:6893 udp
FR 178.33.160.158:6893 udp
FR 178.33.160.159:6893 udp
FR 178.33.160.160:6893 udp
FR 178.33.160.161:6893 udp
FR 178.33.160.162:6893 udp
FR 178.33.160.163:6893 udp
FR 178.33.160.164:6893 udp
FR 178.33.160.165:6893 udp
FR 178.33.160.166:6893 udp
FR 178.33.160.167:6893 udp
FR 178.33.160.168:6893 udp
FR 178.33.160.169:6893 udp
FR 178.33.160.170:6893 udp
FR 178.33.160.171:6893 udp
FR 178.33.160.172:6893 udp
FR 178.33.160.173:6893 udp
FR 178.33.160.174:6893 udp
FR 178.33.160.175:6893 udp
FR 178.33.160.176:6893 udp
FR 178.33.160.177:6893 udp
FR 178.33.160.178:6893 udp
FR 178.33.160.179:6893 udp
FR 178.33.160.180:6893 udp
FR 178.33.160.181:6893 udp
FR 178.33.160.182:6893 udp
FR 178.33.160.183:6893 udp
FR 178.33.160.184:6893 udp
FR 178.33.160.185:6893 udp
FR 178.33.160.186:6893 udp
FR 178.33.160.187:6893 udp
FR 178.33.160.188:6893 udp
FR 178.33.160.189:6893 udp
FR 178.33.160.190:6893 udp
FR 178.33.160.191:6893 udp
FR 178.33.160.192:6893 udp
FR 178.33.160.193:6893 udp
FR 178.33.160.194:6893 udp
FR 178.33.160.195:6893 udp
FR 178.33.160.196:6893 udp
FR 178.33.160.197:6893 udp
FR 178.33.160.198:6893 udp
FR 178.33.160.199:6893 udp
FR 178.33.160.200:6893 udp
FR 178.33.160.201:6893 udp
FR 178.33.160.202:6893 udp
FR 178.33.160.203:6893 udp
FR 178.33.160.204:6893 udp
FR 178.33.160.205:6893 udp
FR 178.33.160.206:6893 udp
FR 178.33.160.207:6893 udp
FR 178.33.160.208:6893 udp
FR 178.33.160.209:6893 udp
FR 178.33.160.210:6893 udp
FR 178.33.160.211:6893 udp
FR 178.33.160.212:6893 udp
FR 178.33.160.213:6893 udp
FR 178.33.160.214:6893 udp
FR 178.33.160.215:6893 udp
FR 178.33.160.216:6893 udp
FR 178.33.160.217:6893 udp
FR 178.33.160.218:6893 udp
FR 178.33.160.219:6893 udp
FR 178.33.160.220:6893 udp
FR 178.33.160.221:6893 udp
FR 178.33.160.222:6893 udp
FR 178.33.160.223:6893 udp
FR 178.33.160.224:6893 udp
FR 178.33.160.225:6893 udp
FR 178.33.160.226:6893 udp
FR 178.33.160.227:6893 udp
FR 178.33.160.228:6893 udp
FR 178.33.160.229:6893 udp
FR 178.33.160.230:6893 udp
FR 178.33.160.231:6893 udp
FR 178.33.160.232:6893 udp
FR 178.33.160.233:6893 udp
FR 178.33.160.234:6893 udp
FR 178.33.160.235:6893 udp
FR 178.33.160.236:6893 udp
FR 178.33.160.237:6893 udp
FR 178.33.160.238:6893 udp
FR 178.33.160.239:6893 udp
FR 178.33.160.240:6893 udp
FR 178.33.160.241:6893 udp
FR 178.33.160.242:6893 udp
FR 178.33.160.243:6893 udp
FR 178.33.160.244:6893 udp
FR 178.33.160.245:6893 udp
FR 178.33.160.246:6893 udp
FR 178.33.160.247:6893 udp
FR 178.33.160.248:6893 udp
FR 178.33.160.249:6893 udp
FR 178.33.160.250:6893 udp
FR 178.33.160.251:6893 udp
FR 178.33.160.252:6893 udp
FR 178.33.160.253:6893 udp
FR 178.33.160.254:6893 udp
FR 178.33.160.255:6893 udp
FR 178.33.161.0:6893 udp
FR 178.33.161.1:6893 udp
FR 178.33.161.2:6893 udp
FR 178.33.161.3:6893 udp
FR 178.33.161.4:6893 udp
FR 178.33.161.5:6893 udp
FR 178.33.161.6:6893 udp
FR 178.33.161.7:6893 udp
FR 178.33.161.8:6893 udp
FR 178.33.161.9:6893 udp
FR 178.33.161.10:6893 udp
FR 178.33.161.11:6893 udp
FR 178.33.161.12:6893 udp
FR 178.33.161.13:6893 udp
FR 178.33.161.14:6893 udp
FR 178.33.161.15:6893 udp
FR 178.33.161.16:6893 udp
FR 178.33.161.17:6893 udp
FR 178.33.161.18:6893 udp
FR 178.33.161.19:6893 udp
FR 178.33.161.20:6893 udp
FR 178.33.161.21:6893 udp
FR 178.33.161.22:6893 udp
FR 178.33.161.23:6893 udp
FR 178.33.161.24:6893 udp
FR 178.33.161.25:6893 udp
FR 178.33.161.26:6893 udp
FR 178.33.161.27:6893 udp
FR 178.33.161.28:6893 udp
FR 178.33.161.29:6893 udp
FR 178.33.161.30:6893 udp
FR 178.33.161.31:6893 udp
FR 178.33.161.32:6893 udp
FR 178.33.161.33:6893 udp
FR 178.33.161.34:6893 udp
FR 178.33.161.35:6893 udp
FR 178.33.161.36:6893 udp
FR 178.33.161.37:6893 udp
FR 178.33.161.38:6893 udp
FR 178.33.161.39:6893 udp
FR 178.33.161.40:6893 udp
FR 178.33.161.41:6893 udp
FR 178.33.161.42:6893 udp
FR 178.33.161.43:6893 udp
FR 178.33.161.44:6893 udp
FR 178.33.161.45:6893 udp
FR 178.33.161.46:6893 udp
FR 178.33.161.47:6893 udp
FR 178.33.161.48:6893 udp
FR 178.33.161.49:6893 udp
FR 178.33.161.50:6893 udp
FR 178.33.161.51:6893 udp
FR 178.33.161.52:6893 udp
FR 178.33.161.53:6893 udp
FR 178.33.161.54:6893 udp
FR 178.33.161.55:6893 udp
FR 178.33.161.56:6893 udp
FR 178.33.161.57:6893 udp
FR 178.33.161.58:6893 udp
FR 178.33.161.59:6893 udp
FR 178.33.161.60:6893 udp
FR 178.33.161.61:6893 udp
FR 178.33.161.62:6893 udp
FR 178.33.161.63:6893 udp
FR 178.33.161.64:6893 udp
FR 178.33.161.65:6893 udp
FR 178.33.161.66:6893 udp
FR 178.33.161.67:6893 udp
FR 178.33.161.68:6893 udp
FR 178.33.161.69:6893 udp
FR 178.33.161.70:6893 udp
FR 178.33.161.71:6893 udp
FR 178.33.161.72:6893 udp
FR 178.33.161.73:6893 udp
FR 178.33.161.74:6893 udp
FR 178.33.161.75:6893 udp
FR 178.33.161.76:6893 udp
FR 178.33.161.77:6893 udp
FR 178.33.161.78:6893 udp
FR 178.33.161.79:6893 udp
FR 178.33.161.80:6893 udp
FR 178.33.161.81:6893 udp
FR 178.33.161.82:6893 udp
FR 178.33.161.83:6893 udp
FR 178.33.161.84:6893 udp
FR 178.33.161.85:6893 udp
FR 178.33.161.86:6893 udp
FR 178.33.161.87:6893 udp
FR 178.33.161.88:6893 udp
FR 178.33.161.89:6893 udp
FR 178.33.161.90:6893 udp
FR 178.33.161.91:6893 udp
FR 178.33.161.92:6893 udp
FR 178.33.161.93:6893 udp
FR 178.33.161.94:6893 udp
FR 178.33.161.95:6893 udp
FR 178.33.161.96:6893 udp
FR 178.33.161.97:6893 udp
FR 178.33.161.98:6893 udp
FR 178.33.161.99:6893 udp
FR 178.33.161.100:6893 udp
FR 178.33.161.101:6893 udp
FR 178.33.161.102:6893 udp
FR 178.33.161.103:6893 udp
FR 178.33.161.104:6893 udp
FR 178.33.161.105:6893 udp
FR 178.33.161.106:6893 udp
FR 178.33.161.107:6893 udp
FR 178.33.161.108:6893 udp
FR 178.33.161.109:6893 udp
FR 178.33.161.110:6893 udp
FR 178.33.161.111:6893 udp
FR 178.33.161.112:6893 udp
FR 178.33.161.113:6893 udp
FR 178.33.161.114:6893 udp
FR 178.33.161.115:6893 udp
FR 178.33.161.116:6893 udp
FR 178.33.161.117:6893 udp
FR 178.33.161.118:6893 udp
FR 178.33.161.119:6893 udp
FR 178.33.161.120:6893 udp
FR 178.33.161.121:6893 udp
FR 178.33.161.122:6893 udp
FR 178.33.161.123:6893 udp
FR 178.33.161.124:6893 udp
FR 178.33.161.125:6893 udp
FR 178.33.161.126:6893 udp
FR 178.33.161.127:6893 udp
FR 178.33.161.128:6893 udp
FR 178.33.161.129:6893 udp
FR 178.33.161.130:6893 udp
FR 178.33.161.131:6893 udp
FR 178.33.161.132:6893 udp
FR 178.33.161.133:6893 udp
FR 178.33.161.134:6893 udp
FR 178.33.161.135:6893 udp
FR 178.33.161.136:6893 udp
FR 178.33.161.137:6893 udp
FR 178.33.161.138:6893 udp
FR 178.33.161.139:6893 udp
FR 178.33.161.140:6893 udp
FR 178.33.161.141:6893 udp
FR 178.33.161.142:6893 udp
FR 178.33.161.143:6893 udp
FR 178.33.161.144:6893 udp
FR 178.33.161.145:6893 udp
FR 178.33.161.146:6893 udp
FR 178.33.161.147:6893 udp
FR 178.33.161.148:6893 udp
FR 178.33.161.149:6893 udp
FR 178.33.161.150:6893 udp
FR 178.33.161.151:6893 udp
FR 178.33.161.152:6893 udp
FR 178.33.161.153:6893 udp
FR 178.33.161.154:6893 udp
FR 178.33.161.155:6893 udp
FR 178.33.161.156:6893 udp
FR 178.33.161.157:6893 udp
FR 178.33.161.158:6893 udp
FR 178.33.161.159:6893 udp
FR 178.33.161.160:6893 udp
FR 178.33.161.161:6893 udp
FR 178.33.161.162:6893 udp
FR 178.33.161.163:6893 udp
FR 178.33.161.164:6893 udp
FR 178.33.161.165:6893 udp
FR 178.33.161.166:6893 udp
FR 178.33.161.167:6893 udp
FR 178.33.161.168:6893 udp
FR 178.33.161.169:6893 udp
FR 178.33.161.170:6893 udp
FR 178.33.161.171:6893 udp
FR 178.33.161.172:6893 udp
FR 178.33.161.173:6893 udp
FR 178.33.161.174:6893 udp
FR 178.33.161.175:6893 udp
FR 178.33.161.176:6893 udp
FR 178.33.161.177:6893 udp
FR 178.33.161.178:6893 udp
FR 178.33.161.179:6893 udp
FR 178.33.161.180:6893 udp
FR 178.33.161.181:6893 udp
FR 178.33.161.182:6893 udp
FR 178.33.161.183:6893 udp
FR 178.33.161.184:6893 udp
FR 178.33.161.185:6893 udp
FR 178.33.161.186:6893 udp
FR 178.33.161.187:6893 udp
FR 178.33.161.188:6893 udp
FR 178.33.161.189:6893 udp
FR 178.33.161.190:6893 udp
FR 178.33.161.191:6893 udp
FR 178.33.161.192:6893 udp
FR 178.33.161.193:6893 udp
FR 178.33.161.194:6893 udp
FR 178.33.161.195:6893 udp
FR 178.33.161.196:6893 udp
FR 178.33.161.197:6893 udp
FR 178.33.161.198:6893 udp
FR 178.33.161.199:6893 udp
FR 178.33.161.200:6893 udp
FR 178.33.161.201:6893 udp
FR 178.33.161.202:6893 udp
FR 178.33.161.203:6893 udp
FR 178.33.161.204:6893 udp
FR 178.33.161.205:6893 udp
FR 178.33.161.206:6893 udp
FR 178.33.161.207:6893 udp
FR 178.33.161.208:6893 udp
FR 178.33.161.209:6893 udp
FR 178.33.161.210:6893 udp
FR 178.33.161.211:6893 udp
FR 178.33.161.212:6893 udp
FR 178.33.161.213:6893 udp
FR 178.33.161.214:6893 udp
FR 178.33.161.215:6893 udp
FR 178.33.161.216:6893 udp
FR 178.33.161.217:6893 udp
FR 178.33.161.218:6893 udp
FR 178.33.161.219:6893 udp
FR 178.33.161.220:6893 udp
FR 178.33.161.221:6893 udp
FR 178.33.161.222:6893 udp
FR 178.33.161.223:6893 udp
FR 178.33.161.224:6893 udp
FR 178.33.161.225:6893 udp
FR 178.33.161.226:6893 udp
FR 178.33.161.227:6893 udp
FR 178.33.161.228:6893 udp
FR 178.33.161.229:6893 udp
FR 178.33.161.230:6893 udp
FR 178.33.161.231:6893 udp
FR 178.33.161.232:6893 udp
FR 178.33.161.233:6893 udp
FR 178.33.161.234:6893 udp
FR 178.33.161.235:6893 udp
FR 178.33.161.236:6893 udp
FR 178.33.161.237:6893 udp
FR 178.33.161.238:6893 udp
FR 178.33.161.239:6893 udp
FR 178.33.161.240:6893 udp
FR 178.33.161.241:6893 udp
FR 178.33.161.242:6893 udp
FR 178.33.161.243:6893 udp
FR 178.33.161.244:6893 udp
FR 178.33.161.245:6893 udp
FR 178.33.161.246:6893 udp
FR 178.33.161.247:6893 udp
FR 178.33.161.248:6893 udp
FR 178.33.161.249:6893 udp
FR 178.33.161.250:6893 udp
FR 178.33.161.251:6893 udp
FR 178.33.161.252:6893 udp
FR 178.33.161.253:6893 udp
FR 178.33.161.254:6893 udp
FR 178.33.161.255:6893 udp
FR 178.33.162.0:6893 udp
FR 178.33.162.1:6893 udp
FR 178.33.162.2:6893 udp
FR 178.33.162.3:6893 udp
FR 178.33.162.4:6893 udp
FR 178.33.162.5:6893 udp
FR 178.33.162.6:6893 udp
FR 178.33.162.7:6893 udp
FR 178.33.162.8:6893 udp
FR 178.33.162.9:6893 udp
FR 178.33.162.10:6893 udp
FR 178.33.162.11:6893 udp
FR 178.33.162.12:6893 udp
FR 178.33.162.13:6893 udp
FR 178.33.162.14:6893 udp
FR 178.33.162.15:6893 udp
FR 178.33.162.16:6893 udp
FR 178.33.162.17:6893 udp
FR 178.33.162.18:6893 udp
FR 178.33.162.19:6893 udp
FR 178.33.162.20:6893 udp
FR 178.33.162.21:6893 udp
FR 178.33.162.22:6893 udp
FR 178.33.162.23:6893 udp
FR 178.33.162.24:6893 udp
FR 178.33.162.25:6893 udp
FR 178.33.162.26:6893 udp
FR 178.33.162.27:6893 udp
FR 178.33.162.28:6893 udp
FR 178.33.162.29:6893 udp
FR 178.33.162.30:6893 udp
FR 178.33.162.31:6893 udp
FR 178.33.162.32:6893 udp
FR 178.33.162.33:6893 udp
FR 178.33.162.34:6893 udp
FR 178.33.162.35:6893 udp
FR 178.33.162.36:6893 udp
FR 178.33.162.37:6893 udp
FR 178.33.162.38:6893 udp
FR 178.33.162.39:6893 udp
FR 178.33.162.40:6893 udp
FR 178.33.162.41:6893 udp
FR 178.33.162.42:6893 udp
FR 178.33.162.43:6893 udp
FR 178.33.162.44:6893 udp
FR 178.33.162.45:6893 udp
FR 178.33.162.46:6893 udp
FR 178.33.162.47:6893 udp
FR 178.33.162.48:6893 udp
FR 178.33.162.49:6893 udp
FR 178.33.162.50:6893 udp
FR 178.33.162.51:6893 udp
FR 178.33.162.52:6893 udp
FR 178.33.162.53:6893 udp
FR 178.33.162.54:6893 udp
FR 178.33.162.55:6893 udp
FR 178.33.162.56:6893 udp
FR 178.33.162.57:6893 udp
FR 178.33.162.58:6893 udp
FR 178.33.162.59:6893 udp
FR 178.33.162.60:6893 udp
FR 178.33.162.61:6893 udp
FR 178.33.162.62:6893 udp
FR 178.33.162.63:6893 udp
FR 178.33.162.64:6893 udp
FR 178.33.162.65:6893 udp
FR 178.33.162.66:6893 udp
FR 178.33.162.67:6893 udp
FR 178.33.162.68:6893 udp
FR 178.33.162.69:6893 udp
FR 178.33.162.70:6893 udp
FR 178.33.162.71:6893 udp
FR 178.33.162.72:6893 udp
FR 178.33.162.73:6893 udp
FR 178.33.162.74:6893 udp
FR 178.33.162.75:6893 udp
FR 178.33.162.76:6893 udp
FR 178.33.162.77:6893 udp
FR 178.33.162.78:6893 udp
FR 178.33.162.79:6893 udp
FR 178.33.162.80:6893 udp
FR 178.33.162.81:6893 udp
FR 178.33.162.82:6893 udp
FR 178.33.162.83:6893 udp
FR 178.33.162.84:6893 udp
FR 178.33.162.85:6893 udp
FR 178.33.162.86:6893 udp
FR 178.33.162.87:6893 udp
FR 178.33.162.88:6893 udp
FR 178.33.162.89:6893 udp
FR 178.33.162.90:6893 udp
FR 178.33.162.91:6893 udp
FR 178.33.162.92:6893 udp
FR 178.33.162.93:6893 udp
FR 178.33.162.94:6893 udp
FR 178.33.162.95:6893 udp
FR 178.33.162.96:6893 udp
FR 178.33.162.97:6893 udp
FR 178.33.162.98:6893 udp
FR 178.33.162.99:6893 udp
FR 178.33.162.100:6893 udp
FR 178.33.162.101:6893 udp
FR 178.33.162.102:6893 udp
FR 178.33.162.103:6893 udp
FR 178.33.162.104:6893 udp
FR 178.33.162.105:6893 udp
FR 178.33.162.106:6893 udp
FR 178.33.162.107:6893 udp
FR 178.33.162.108:6893 udp
FR 178.33.162.109:6893 udp
FR 178.33.162.110:6893 udp
FR 178.33.162.111:6893 udp
FR 178.33.162.112:6893 udp
FR 178.33.162.113:6893 udp
FR 178.33.162.114:6893 udp
FR 178.33.162.115:6893 udp
FR 178.33.162.116:6893 udp
FR 178.33.162.117:6893 udp
FR 178.33.162.118:6893 udp
FR 178.33.162.119:6893 udp
FR 178.33.162.120:6893 udp
FR 178.33.162.121:6893 udp
FR 178.33.162.122:6893 udp
FR 178.33.162.123:6893 udp
FR 178.33.162.124:6893 udp
FR 178.33.162.125:6893 udp
FR 178.33.162.126:6893 udp
FR 178.33.162.127:6893 udp
FR 178.33.162.128:6893 udp
FR 178.33.162.129:6893 udp
FR 178.33.162.130:6893 udp
FR 178.33.162.131:6893 udp
FR 178.33.162.132:6893 udp
FR 178.33.162.133:6893 udp
FR 178.33.162.134:6893 udp
FR 178.33.162.135:6893 udp
FR 178.33.162.136:6893 udp
FR 178.33.162.137:6893 udp
FR 178.33.162.138:6893 udp
FR 178.33.162.139:6893 udp
FR 178.33.162.140:6893 udp
FR 178.33.162.141:6893 udp
FR 178.33.162.142:6893 udp
FR 178.33.162.143:6893 udp
FR 178.33.162.144:6893 udp
FR 178.33.162.145:6893 udp
FR 178.33.162.146:6893 udp
FR 178.33.162.147:6893 udp
FR 178.33.162.148:6893 udp
FR 178.33.162.149:6893 udp
FR 178.33.162.150:6893 udp
FR 178.33.162.151:6893 udp
FR 178.33.162.152:6893 udp
FR 178.33.162.153:6893 udp
FR 178.33.162.154:6893 udp
FR 178.33.162.155:6893 udp
FR 178.33.162.156:6893 udp
FR 178.33.162.157:6893 udp
FR 178.33.162.158:6893 udp
FR 178.33.162.159:6893 udp
FR 178.33.162.160:6893 udp
FR 178.33.162.161:6893 udp
FR 178.33.162.162:6893 udp
FR 178.33.162.163:6893 udp
FR 178.33.162.164:6893 udp
FR 178.33.162.165:6893 udp
FR 178.33.162.166:6893 udp
FR 178.33.162.167:6893 udp
FR 178.33.162.168:6893 udp
FR 178.33.162.169:6893 udp
FR 178.33.162.170:6893 udp
FR 178.33.162.171:6893 udp
FR 178.33.162.172:6893 udp
FR 178.33.162.173:6893 udp
FR 178.33.162.174:6893 udp
FR 178.33.162.175:6893 udp
FR 178.33.162.176:6893 udp
FR 178.33.162.177:6893 udp
FR 178.33.162.178:6893 udp
FR 178.33.162.179:6893 udp
FR 178.33.162.180:6893 udp
FR 178.33.162.181:6893 udp
FR 178.33.162.182:6893 udp
FR 178.33.162.183:6893 udp
FR 178.33.162.184:6893 udp
FR 178.33.162.185:6893 udp
FR 178.33.162.186:6893 udp
FR 178.33.162.187:6893 udp
FR 178.33.162.188:6893 udp
FR 178.33.162.189:6893 udp
FR 178.33.162.190:6893 udp
FR 178.33.162.191:6893 udp
FR 178.33.162.192:6893 udp
FR 178.33.162.193:6893 udp
FR 178.33.162.194:6893 udp
FR 178.33.162.195:6893 udp
FR 178.33.162.196:6893 udp
FR 178.33.162.197:6893 udp
FR 178.33.162.198:6893 udp
FR 178.33.162.199:6893 udp
FR 178.33.162.200:6893 udp
FR 178.33.162.201:6893 udp
FR 178.33.162.202:6893 udp
FR 178.33.162.203:6893 udp
FR 178.33.162.204:6893 udp
FR 178.33.162.205:6893 udp
FR 178.33.162.206:6893 udp
FR 178.33.162.207:6893 udp
FR 178.33.162.208:6893 udp
FR 178.33.162.209:6893 udp
FR 178.33.162.210:6893 udp
FR 178.33.162.211:6893 udp
FR 178.33.162.212:6893 udp
FR 178.33.162.213:6893 udp
FR 178.33.162.214:6893 udp
FR 178.33.162.215:6893 udp
FR 178.33.162.216:6893 udp
FR 178.33.162.217:6893 udp
FR 178.33.162.218:6893 udp
FR 178.33.162.219:6893 udp
FR 178.33.162.220:6893 udp
FR 178.33.162.221:6893 udp
FR 178.33.162.222:6893 udp
FR 178.33.162.223:6893 udp
FR 178.33.162.224:6893 udp
FR 178.33.162.225:6893 udp
FR 178.33.162.226:6893 udp
FR 178.33.162.227:6893 udp
FR 178.33.162.228:6893 udp
FR 178.33.162.229:6893 udp
FR 178.33.162.230:6893 udp
FR 178.33.162.231:6893 udp
FR 178.33.162.232:6893 udp
FR 178.33.162.233:6893 udp
FR 178.33.162.234:6893 udp
FR 178.33.162.235:6893 udp
FR 178.33.162.236:6893 udp
FR 178.33.162.237:6893 udp
FR 178.33.162.238:6893 udp
FR 178.33.162.239:6893 udp
FR 178.33.162.240:6893 udp
FR 178.33.162.241:6893 udp
FR 178.33.162.242:6893 udp
FR 178.33.162.243:6893 udp
FR 178.33.162.244:6893 udp
FR 178.33.162.245:6893 udp
FR 178.33.162.246:6893 udp
FR 178.33.162.247:6893 udp
FR 178.33.162.248:6893 udp
FR 178.33.162.249:6893 udp
FR 178.33.162.250:6893 udp
FR 178.33.162.251:6893 udp
FR 178.33.162.252:6893 udp
FR 178.33.162.253:6893 udp
FR 178.33.162.254:6893 udp
FR 178.33.162.255:6893 udp
FR 178.33.163.0:6893 udp
FR 178.33.163.1:6893 udp
FR 178.33.163.2:6893 udp
FR 178.33.163.3:6893 udp
FR 178.33.163.4:6893 udp
FR 178.33.163.5:6893 udp
FR 178.33.163.6:6893 udp
FR 178.33.163.7:6893 udp
FR 178.33.163.8:6893 udp
FR 178.33.163.9:6893 udp
FR 178.33.163.10:6893 udp
FR 178.33.163.11:6893 udp
FR 178.33.163.12:6893 udp
FR 178.33.163.13:6893 udp
FR 178.33.163.14:6893 udp
FR 178.33.163.15:6893 udp
FR 178.33.163.16:6893 udp
FR 178.33.163.17:6893 udp
FR 178.33.163.18:6893 udp
FR 178.33.163.19:6893 udp
FR 178.33.163.20:6893 udp
FR 178.33.163.21:6893 udp
FR 178.33.163.22:6893 udp
FR 178.33.163.23:6893 udp
FR 178.33.163.24:6893 udp
FR 178.33.163.25:6893 udp
FR 178.33.163.26:6893 udp
FR 178.33.163.27:6893 udp
FR 178.33.163.28:6893 udp
FR 178.33.163.29:6893 udp
FR 178.33.163.30:6893 udp
FR 178.33.163.31:6893 udp
FR 178.33.163.32:6893 udp
FR 178.33.163.33:6893 udp
FR 178.33.163.34:6893 udp
FR 178.33.163.35:6893 udp
FR 178.33.163.36:6893 udp
FR 178.33.163.37:6893 udp
FR 178.33.163.38:6893 udp
FR 178.33.163.39:6893 udp
FR 178.33.163.40:6893 udp
FR 178.33.163.41:6893 udp
FR 178.33.163.42:6893 udp
FR 178.33.163.43:6893 udp
FR 178.33.163.44:6893 udp
FR 178.33.163.45:6893 udp
FR 178.33.163.46:6893 udp
FR 178.33.163.47:6893 udp
FR 178.33.163.48:6893 udp
FR 178.33.163.49:6893 udp
FR 178.33.163.50:6893 udp
FR 178.33.163.51:6893 udp
FR 178.33.163.52:6893 udp
FR 178.33.163.53:6893 udp
FR 178.33.163.54:6893 udp
FR 178.33.163.55:6893 udp
FR 178.33.163.56:6893 udp
FR 178.33.163.57:6893 udp
FR 178.33.163.58:6893 udp
FR 178.33.163.59:6893 udp
FR 178.33.163.60:6893 udp
FR 178.33.163.61:6893 udp
FR 178.33.163.62:6893 udp
FR 178.33.163.63:6893 udp
FR 178.33.163.64:6893 udp
FR 178.33.163.65:6893 udp
FR 178.33.163.66:6893 udp
FR 178.33.163.67:6893 udp
FR 178.33.163.68:6893 udp
FR 178.33.163.69:6893 udp
FR 178.33.163.70:6893 udp
FR 178.33.163.71:6893 udp
FR 178.33.163.72:6893 udp
FR 178.33.163.73:6893 udp
FR 178.33.163.74:6893 udp
FR 178.33.163.75:6893 udp
FR 178.33.163.76:6893 udp
FR 178.33.163.77:6893 udp
FR 178.33.163.78:6893 udp
FR 178.33.163.79:6893 udp
FR 178.33.163.80:6893 udp
FR 178.33.163.81:6893 udp
FR 178.33.163.82:6893 udp
FR 178.33.163.83:6893 udp
FR 178.33.163.84:6893 udp
FR 178.33.163.85:6893 udp
FR 178.33.163.86:6893 udp
FR 178.33.163.87:6893 udp
FR 178.33.163.88:6893 udp
FR 178.33.163.89:6893 udp
FR 178.33.163.90:6893 udp
FR 178.33.163.91:6893 udp
FR 178.33.163.92:6893 udp
FR 178.33.163.93:6893 udp
FR 178.33.163.94:6893 udp
FR 178.33.163.95:6893 udp
FR 178.33.163.96:6893 udp
FR 178.33.163.97:6893 udp
FR 178.33.163.98:6893 udp
FR 178.33.163.99:6893 udp
FR 178.33.163.100:6893 udp
FR 178.33.163.101:6893 udp
FR 178.33.163.102:6893 udp
FR 178.33.163.103:6893 udp
FR 178.33.163.104:6893 udp
FR 178.33.163.105:6893 udp
FR 178.33.163.106:6893 udp
FR 178.33.163.107:6893 udp
FR 178.33.163.108:6893 udp
FR 178.33.163.109:6893 udp
FR 178.33.163.110:6893 udp
FR 178.33.163.111:6893 udp
FR 178.33.163.112:6893 udp
FR 178.33.163.113:6893 udp
FR 178.33.163.114:6893 udp
FR 178.33.163.115:6893 udp
FR 178.33.163.116:6893 udp
FR 178.33.163.117:6893 udp
FR 178.33.163.118:6893 udp
FR 178.33.163.119:6893 udp
FR 178.33.163.120:6893 udp
FR 178.33.163.121:6893 udp
FR 178.33.163.122:6893 udp
FR 178.33.163.123:6893 udp
FR 178.33.163.124:6893 udp
FR 178.33.163.125:6893 udp
FR 178.33.163.126:6893 udp
FR 178.33.163.127:6893 udp
FR 178.33.163.128:6893 udp
FR 178.33.163.129:6893 udp
FR 178.33.163.130:6893 udp
FR 178.33.163.131:6893 udp
FR 178.33.163.132:6893 udp
FR 178.33.163.133:6893 udp
FR 178.33.163.134:6893 udp
FR 178.33.163.135:6893 udp
FR 178.33.163.136:6893 udp
FR 178.33.163.137:6893 udp
FR 178.33.163.138:6893 udp
FR 178.33.163.139:6893 udp
FR 178.33.163.140:6893 udp
FR 178.33.163.141:6893 udp
FR 178.33.163.142:6893 udp
FR 178.33.163.143:6893 udp
FR 178.33.163.144:6893 udp
FR 178.33.163.145:6893 udp
FR 178.33.163.146:6893 udp
FR 178.33.163.147:6893 udp
FR 178.33.163.148:6893 udp
FR 178.33.163.149:6893 udp
FR 178.33.163.150:6893 udp
FR 178.33.163.151:6893 udp
FR 178.33.163.152:6893 udp
FR 178.33.163.153:6893 udp
FR 178.33.163.154:6893 udp
FR 178.33.163.155:6893 udp
FR 178.33.163.156:6893 udp
FR 178.33.163.157:6893 udp
FR 178.33.163.158:6893 udp
FR 178.33.163.159:6893 udp
FR 178.33.163.160:6893 udp
FR 178.33.163.161:6893 udp
FR 178.33.163.162:6893 udp
FR 178.33.163.163:6893 udp
FR 178.33.163.164:6893 udp
FR 178.33.163.165:6893 udp
FR 178.33.163.166:6893 udp
FR 178.33.163.167:6893 udp
FR 178.33.163.168:6893 udp
FR 178.33.163.169:6893 udp
FR 178.33.163.170:6893 udp
FR 178.33.163.171:6893 udp
FR 178.33.163.172:6893 udp
FR 178.33.163.173:6893 udp
FR 178.33.163.174:6893 udp
FR 178.33.163.175:6893 udp
FR 178.33.163.176:6893 udp
FR 178.33.163.177:6893 udp
FR 178.33.163.178:6893 udp
FR 178.33.163.179:6893 udp
FR 178.33.163.180:6893 udp
FR 178.33.163.181:6893 udp
FR 178.33.163.182:6893 udp
FR 178.33.163.183:6893 udp
FR 178.33.163.184:6893 udp
FR 178.33.163.185:6893 udp
FR 178.33.163.186:6893 udp
FR 178.33.163.187:6893 udp
FR 178.33.163.188:6893 udp
FR 178.33.163.189:6893 udp
FR 178.33.163.190:6893 udp
FR 178.33.163.191:6893 udp
FR 178.33.163.192:6893 udp
FR 178.33.163.193:6893 udp
FR 178.33.163.194:6893 udp
FR 178.33.163.195:6893 udp
FR 178.33.163.196:6893 udp
FR 178.33.163.197:6893 udp
FR 178.33.163.198:6893 udp
FR 178.33.163.199:6893 udp
FR 178.33.163.200:6893 udp
FR 178.33.163.201:6893 udp
FR 178.33.163.202:6893 udp
FR 178.33.163.203:6893 udp
FR 178.33.163.204:6893 udp
FR 178.33.163.205:6893 udp
FR 178.33.163.206:6893 udp
FR 178.33.163.207:6893 udp
FR 178.33.163.208:6893 udp
FR 178.33.163.209:6893 udp
FR 178.33.163.210:6893 udp
FR 178.33.163.211:6893 udp
FR 178.33.163.212:6893 udp
FR 178.33.163.213:6893 udp
FR 178.33.163.214:6893 udp
FR 178.33.163.215:6893 udp
FR 178.33.163.216:6893 udp
FR 178.33.163.217:6893 udp
FR 178.33.163.218:6893 udp
FR 178.33.163.219:6893 udp
FR 178.33.163.220:6893 udp
FR 178.33.163.221:6893 udp
FR 178.33.163.222:6893 udp
FR 178.33.163.223:6893 udp
FR 178.33.163.224:6893 udp
FR 178.33.163.225:6893 udp
FR 178.33.163.226:6893 udp
FR 178.33.163.227:6893 udp
FR 178.33.163.228:6893 udp
FR 178.33.163.229:6893 udp
FR 178.33.163.230:6893 udp
FR 178.33.163.231:6893 udp
FR 178.33.163.232:6893 udp
FR 178.33.163.233:6893 udp
FR 178.33.163.234:6893 udp
FR 178.33.163.235:6893 udp
FR 178.33.163.236:6893 udp
FR 178.33.163.237:6893 udp
FR 178.33.163.238:6893 udp
FR 178.33.163.239:6893 udp
FR 178.33.163.240:6893 udp
FR 178.33.163.241:6893 udp
FR 178.33.163.242:6893 udp
FR 178.33.163.243:6893 udp
FR 178.33.163.244:6893 udp
FR 178.33.163.245:6893 udp
FR 178.33.163.246:6893 udp
FR 178.33.163.247:6893 udp
FR 178.33.163.248:6893 udp
FR 178.33.163.249:6893 udp
FR 178.33.163.250:6893 udp
FR 178.33.163.251:6893 udp
FR 178.33.163.252:6893 udp
FR 178.33.163.253:6893 udp
FR 178.33.163.254:6893 udp
FR 178.33.163.255:6893 udp
FR 178.33.158.0:6893 udp
FR 178.33.158.1:6893 udp
FR 178.33.158.2:6893 udp
FR 178.33.158.3:6893 udp
FR 178.33.158.4:6893 udp
FR 178.33.158.5:6893 udp
FR 178.33.158.6:6893 udp
FR 178.33.158.7:6893 udp
FR 178.33.158.8:6893 udp
FR 178.33.158.9:6893 udp
FR 178.33.158.10:6893 udp
FR 178.33.158.11:6893 udp
FR 178.33.158.12:6893 udp
FR 178.33.158.13:6893 udp
FR 178.33.158.14:6893 udp
FR 178.33.158.15:6893 udp
FR 178.33.158.16:6893 udp
FR 178.33.158.17:6893 udp
FR 178.33.158.18:6893 udp
FR 178.33.158.19:6893 udp
FR 178.33.158.20:6893 udp
FR 178.33.158.21:6893 udp
FR 178.33.158.22:6893 udp
FR 178.33.158.23:6893 udp
FR 178.33.158.24:6893 udp
FR 178.33.158.25:6893 udp
FR 178.33.158.26:6893 udp
FR 178.33.158.27:6893 udp
FR 178.33.158.28:6893 udp
FR 178.33.158.29:6893 udp
FR 178.33.158.30:6893 udp
FR 178.33.158.31:6893 udp
FR 178.33.159.0:6893 udp
FR 178.33.159.1:6893 udp
FR 178.33.159.2:6893 udp
FR 178.33.159.3:6893 udp
FR 178.33.159.4:6893 udp
FR 178.33.159.5:6893 udp
FR 178.33.159.6:6893 udp
FR 178.33.159.7:6893 udp
FR 178.33.159.8:6893 udp
FR 178.33.159.9:6893 udp
FR 178.33.159.10:6893 udp
FR 178.33.159.11:6893 udp
FR 178.33.159.12:6893 udp
FR 178.33.159.13:6893 udp
FR 178.33.159.14:6893 udp
FR 178.33.159.15:6893 udp
FR 178.33.159.16:6893 udp
FR 178.33.159.17:6893 udp
FR 178.33.159.18:6893 udp
FR 178.33.159.19:6893 udp
FR 178.33.159.20:6893 udp
FR 178.33.159.21:6893 udp
FR 178.33.159.22:6893 udp
FR 178.33.159.23:6893 udp
FR 178.33.159.24:6893 udp
FR 178.33.159.25:6893 udp
FR 178.33.159.26:6893 udp
FR 178.33.159.27:6893 udp
FR 178.33.159.28:6893 udp
FR 178.33.159.29:6893 udp
FR 178.33.159.30:6893 udp
FR 178.33.159.31:6893 udp
FR 178.33.160.0:6893 udp
FR 178.33.160.1:6893 udp
FR 178.33.160.2:6893 udp
FR 178.33.160.3:6893 udp
FR 178.33.160.4:6893 udp
FR 178.33.160.5:6893 udp
FR 178.33.160.6:6893 udp
FR 178.33.160.7:6893 udp
FR 178.33.160.8:6893 udp
FR 178.33.160.9:6893 udp
FR 178.33.160.10:6893 udp
FR 178.33.160.11:6893 udp
FR 178.33.160.12:6893 udp
FR 178.33.160.13:6893 udp
FR 178.33.160.14:6893 udp
FR 178.33.160.15:6893 udp
FR 178.33.160.16:6893 udp
FR 178.33.160.17:6893 udp
FR 178.33.160.18:6893 udp
FR 178.33.160.19:6893 udp
FR 178.33.160.20:6893 udp
FR 178.33.160.21:6893 udp
FR 178.33.160.22:6893 udp
FR 178.33.160.23:6893 udp
FR 178.33.160.24:6893 udp
FR 178.33.160.25:6893 udp
FR 178.33.160.26:6893 udp
FR 178.33.160.27:6893 udp
FR 178.33.160.28:6893 udp
FR 178.33.160.29:6893 udp
FR 178.33.160.30:6893 udp
FR 178.33.160.31:6893 udp
FR 178.33.160.32:6893 udp
FR 178.33.160.33:6893 udp
FR 178.33.160.34:6893 udp
FR 178.33.160.35:6893 udp
FR 178.33.160.36:6893 udp
FR 178.33.160.37:6893 udp
FR 178.33.160.38:6893 udp
FR 178.33.160.39:6893 udp
FR 178.33.160.40:6893 udp
FR 178.33.160.41:6893 udp
FR 178.33.160.42:6893 udp
FR 178.33.160.43:6893 udp
FR 178.33.160.44:6893 udp
FR 178.33.160.45:6893 udp
FR 178.33.160.46:6893 udp
FR 178.33.160.47:6893 udp
FR 178.33.160.48:6893 udp
FR 178.33.160.49:6893 udp
FR 178.33.160.50:6893 udp
FR 178.33.160.51:6893 udp
FR 178.33.160.52:6893 udp
FR 178.33.160.53:6893 udp
FR 178.33.160.54:6893 udp
FR 178.33.160.55:6893 udp
FR 178.33.160.56:6893 udp
FR 178.33.160.57:6893 udp
FR 178.33.160.58:6893 udp
FR 178.33.160.59:6893 udp
FR 178.33.160.60:6893 udp
FR 178.33.160.61:6893 udp
FR 178.33.160.62:6893 udp
FR 178.33.160.63:6893 udp
FR 178.33.160.64:6893 udp
FR 178.33.160.65:6893 udp
FR 178.33.160.66:6893 udp
FR 178.33.160.67:6893 udp
FR 178.33.160.68:6893 udp
FR 178.33.160.69:6893 udp
FR 178.33.160.70:6893 udp
FR 178.33.160.71:6893 udp
FR 178.33.160.72:6893 udp
FR 178.33.160.73:6893 udp
FR 178.33.160.74:6893 udp
FR 178.33.160.75:6893 udp
FR 178.33.160.76:6893 udp
FR 178.33.160.77:6893 udp
FR 178.33.160.78:6893 udp
FR 178.33.160.79:6893 udp
FR 178.33.160.80:6893 udp
FR 178.33.160.81:6893 udp
FR 178.33.160.82:6893 udp
FR 178.33.160.83:6893 udp
FR 178.33.160.84:6893 udp
FR 178.33.160.85:6893 udp
FR 178.33.160.86:6893 udp
FR 178.33.160.87:6893 udp
FR 178.33.160.88:6893 udp
FR 178.33.160.89:6893 udp
FR 178.33.160.90:6893 udp
FR 178.33.160.91:6893 udp
FR 178.33.160.92:6893 udp
FR 178.33.160.93:6893 udp
FR 178.33.160.94:6893 udp
FR 178.33.160.95:6893 udp
FR 178.33.160.96:6893 udp
FR 178.33.160.97:6893 udp
FR 178.33.160.98:6893 udp
FR 178.33.160.99:6893 udp
FR 178.33.160.100:6893 udp
FR 178.33.160.101:6893 udp
FR 178.33.160.102:6893 udp
FR 178.33.160.103:6893 udp
FR 178.33.160.104:6893 udp
FR 178.33.160.105:6893 udp
FR 178.33.160.106:6893 udp
FR 178.33.160.107:6893 udp
FR 178.33.160.108:6893 udp
FR 178.33.160.109:6893 udp
FR 178.33.160.110:6893 udp
FR 178.33.160.111:6893 udp
FR 178.33.160.112:6893 udp
FR 178.33.160.113:6893 udp
FR 178.33.160.114:6893 udp
FR 178.33.160.115:6893 udp
FR 178.33.160.116:6893 udp
FR 178.33.160.117:6893 udp
FR 178.33.160.118:6893 udp
FR 178.33.160.119:6893 udp
FR 178.33.160.120:6893 udp
FR 178.33.160.121:6893 udp
FR 178.33.160.122:6893 udp
FR 178.33.160.123:6893 udp
FR 178.33.160.124:6893 udp
FR 178.33.160.125:6893 udp
FR 178.33.160.126:6893 udp
FR 178.33.160.127:6893 udp
FR 178.33.160.128:6893 udp
FR 178.33.160.129:6893 udp
FR 178.33.160.130:6893 udp
FR 178.33.160.131:6893 udp
FR 178.33.160.132:6893 udp
FR 178.33.160.133:6893 udp
FR 178.33.160.134:6893 udp
FR 178.33.160.135:6893 udp
FR 178.33.160.136:6893 udp
FR 178.33.160.137:6893 udp
FR 178.33.160.138:6893 udp
FR 178.33.160.139:6893 udp
FR 178.33.160.140:6893 udp
FR 178.33.160.141:6893 udp
FR 178.33.160.142:6893 udp
FR 178.33.160.143:6893 udp
FR 178.33.160.144:6893 udp
FR 178.33.160.145:6893 udp
FR 178.33.160.146:6893 udp
FR 178.33.160.147:6893 udp
FR 178.33.160.148:6893 udp
FR 178.33.160.149:6893 udp
FR 178.33.160.150:6893 udp
FR 178.33.160.151:6893 udp
FR 178.33.160.152:6893 udp
FR 178.33.160.153:6893 udp
FR 178.33.160.154:6893 udp
FR 178.33.160.155:6893 udp
FR 178.33.160.156:6893 udp
FR 178.33.160.157:6893 udp
FR 178.33.160.158:6893 udp
FR 178.33.160.159:6893 udp
FR 178.33.160.160:6893 udp
FR 178.33.160.161:6893 udp
FR 178.33.160.162:6893 udp
FR 178.33.160.163:6893 udp
FR 178.33.160.164:6893 udp
FR 178.33.160.165:6893 udp
FR 178.33.160.166:6893 udp
FR 178.33.160.167:6893 udp
FR 178.33.160.168:6893 udp
FR 178.33.160.169:6893 udp
FR 178.33.160.170:6893 udp
FR 178.33.160.171:6893 udp
FR 178.33.160.172:6893 udp
FR 178.33.160.173:6893 udp
FR 178.33.160.174:6893 udp
FR 178.33.160.175:6893 udp
FR 178.33.160.176:6893 udp
FR 178.33.160.177:6893 udp
FR 178.33.160.178:6893 udp
FR 178.33.160.179:6893 udp
FR 178.33.160.180:6893 udp
FR 178.33.160.181:6893 udp
FR 178.33.160.182:6893 udp
FR 178.33.160.183:6893 udp
FR 178.33.160.184:6893 udp
FR 178.33.160.185:6893 udp
FR 178.33.160.186:6893 udp
FR 178.33.160.187:6893 udp
FR 178.33.160.188:6893 udp
FR 178.33.160.189:6893 udp
FR 178.33.160.190:6893 udp
FR 178.33.160.191:6893 udp
FR 178.33.160.192:6893 udp
FR 178.33.160.193:6893 udp
FR 178.33.160.194:6893 udp
FR 178.33.160.195:6893 udp
FR 178.33.160.196:6893 udp
FR 178.33.160.197:6893 udp
FR 178.33.160.198:6893 udp
FR 178.33.160.199:6893 udp
FR 178.33.160.200:6893 udp
FR 178.33.160.201:6893 udp
FR 178.33.160.202:6893 udp
FR 178.33.160.203:6893 udp
FR 178.33.160.204:6893 udp
FR 178.33.160.205:6893 udp
FR 178.33.160.206:6893 udp
FR 178.33.160.207:6893 udp
FR 178.33.160.208:6893 udp
FR 178.33.160.209:6893 udp
FR 178.33.160.210:6893 udp
FR 178.33.160.211:6893 udp
FR 178.33.160.212:6893 udp
FR 178.33.160.213:6893 udp
FR 178.33.160.214:6893 udp
FR 178.33.160.215:6893 udp
FR 178.33.160.216:6893 udp
FR 178.33.160.217:6893 udp
FR 178.33.160.218:6893 udp
FR 178.33.160.219:6893 udp
FR 178.33.160.220:6893 udp
FR 178.33.160.221:6893 udp
FR 178.33.160.222:6893 udp
FR 178.33.160.223:6893 udp
FR 178.33.160.224:6893 udp
FR 178.33.160.225:6893 udp
FR 178.33.160.226:6893 udp
FR 178.33.160.227:6893 udp
FR 178.33.160.228:6893 udp
FR 178.33.160.229:6893 udp
FR 178.33.160.230:6893 udp
FR 178.33.160.231:6893 udp
FR 178.33.160.232:6893 udp
FR 178.33.160.233:6893 udp
FR 178.33.160.234:6893 udp
FR 178.33.160.235:6893 udp
FR 178.33.160.236:6893 udp
FR 178.33.160.237:6893 udp
FR 178.33.160.238:6893 udp
FR 178.33.160.239:6893 udp
FR 178.33.160.240:6893 udp
FR 178.33.160.241:6893 udp
FR 178.33.160.242:6893 udp
FR 178.33.160.243:6893 udp
FR 178.33.160.244:6893 udp
FR 178.33.160.245:6893 udp
FR 178.33.160.246:6893 udp
FR 178.33.160.247:6893 udp
FR 178.33.160.248:6893 udp
FR 178.33.160.249:6893 udp
FR 178.33.160.250:6893 udp
FR 178.33.160.251:6893 udp
FR 178.33.160.252:6893 udp
FR 178.33.160.253:6893 udp
FR 178.33.160.254:6893 udp
FR 178.33.160.255:6893 udp
FR 178.33.161.0:6893 udp
FR 178.33.161.1:6893 udp
FR 178.33.161.2:6893 udp
FR 178.33.161.3:6893 udp
FR 178.33.161.4:6893 udp
FR 178.33.161.5:6893 udp
FR 178.33.161.6:6893 udp
FR 178.33.161.7:6893 udp
FR 178.33.161.8:6893 udp
FR 178.33.161.9:6893 udp
FR 178.33.161.10:6893 udp
FR 178.33.161.11:6893 udp
FR 178.33.161.12:6893 udp
FR 178.33.161.13:6893 udp
FR 178.33.161.14:6893 udp
FR 178.33.161.15:6893 udp
FR 178.33.161.16:6893 udp
FR 178.33.161.17:6893 udp
FR 178.33.161.18:6893 udp
FR 178.33.161.19:6893 udp
FR 178.33.161.20:6893 udp
FR 178.33.161.21:6893 udp
FR 178.33.161.22:6893 udp
FR 178.33.161.23:6893 udp
FR 178.33.161.24:6893 udp
FR 178.33.161.25:6893 udp
FR 178.33.161.26:6893 udp
FR 178.33.161.27:6893 udp
FR 178.33.161.28:6893 udp
FR 178.33.161.29:6893 udp
FR 178.33.161.30:6893 udp
FR 178.33.161.31:6893 udp
FR 178.33.161.32:6893 udp
FR 178.33.161.33:6893 udp
FR 178.33.161.34:6893 udp
FR 178.33.161.35:6893 udp
FR 178.33.161.36:6893 udp
FR 178.33.161.37:6893 udp
FR 178.33.161.38:6893 udp
FR 178.33.161.39:6893 udp
FR 178.33.161.40:6893 udp
FR 178.33.161.41:6893 udp
FR 178.33.161.42:6893 udp
FR 178.33.161.43:6893 udp
FR 178.33.161.44:6893 udp
FR 178.33.161.45:6893 udp
FR 178.33.161.46:6893 udp
FR 178.33.161.47:6893 udp
FR 178.33.161.48:6893 udp
FR 178.33.161.49:6893 udp
FR 178.33.161.50:6893 udp
FR 178.33.161.51:6893 udp
FR 178.33.161.52:6893 udp
FR 178.33.161.53:6893 udp
FR 178.33.161.54:6893 udp
FR 178.33.161.55:6893 udp
FR 178.33.161.56:6893 udp
FR 178.33.161.57:6893 udp
FR 178.33.161.58:6893 udp
FR 178.33.161.59:6893 udp
FR 178.33.161.60:6893 udp
FR 178.33.161.61:6893 udp
FR 178.33.161.62:6893 udp
FR 178.33.161.63:6893 udp
FR 178.33.161.64:6893 udp
FR 178.33.161.65:6893 udp
FR 178.33.161.66:6893 udp
FR 178.33.161.67:6893 udp
FR 178.33.161.68:6893 udp
FR 178.33.161.69:6893 udp
FR 178.33.161.70:6893 udp
FR 178.33.161.71:6893 udp
FR 178.33.161.72:6893 udp
FR 178.33.161.73:6893 udp
FR 178.33.161.74:6893 udp
FR 178.33.161.75:6893 udp
FR 178.33.161.76:6893 udp
FR 178.33.161.77:6893 udp
FR 178.33.161.78:6893 udp
FR 178.33.161.79:6893 udp
FR 178.33.161.80:6893 udp
FR 178.33.161.81:6893 udp
FR 178.33.161.82:6893 udp
FR 178.33.161.83:6893 udp
FR 178.33.161.84:6893 udp
FR 178.33.161.85:6893 udp
FR 178.33.161.86:6893 udp
FR 178.33.161.87:6893 udp
FR 178.33.161.88:6893 udp
FR 178.33.161.89:6893 udp
FR 178.33.161.90:6893 udp
FR 178.33.161.91:6893 udp
FR 178.33.161.92:6893 udp
FR 178.33.161.93:6893 udp
FR 178.33.161.94:6893 udp
FR 178.33.161.95:6893 udp
FR 178.33.161.96:6893 udp
FR 178.33.161.97:6893 udp
FR 178.33.161.98:6893 udp
FR 178.33.161.99:6893 udp
FR 178.33.161.100:6893 udp
FR 178.33.161.101:6893 udp
FR 178.33.161.102:6893 udp
FR 178.33.161.103:6893 udp
FR 178.33.161.104:6893 udp
FR 178.33.161.105:6893 udp
FR 178.33.161.106:6893 udp
FR 178.33.161.107:6893 udp
FR 178.33.161.108:6893 udp
FR 178.33.161.109:6893 udp
FR 178.33.161.110:6893 udp
FR 178.33.161.111:6893 udp
FR 178.33.161.112:6893 udp
FR 178.33.161.113:6893 udp
FR 178.33.161.114:6893 udp
FR 178.33.161.115:6893 udp
FR 178.33.161.116:6893 udp
FR 178.33.161.117:6893 udp
FR 178.33.161.118:6893 udp
FR 178.33.161.119:6893 udp
FR 178.33.161.120:6893 udp
FR 178.33.161.121:6893 udp
FR 178.33.161.122:6893 udp
FR 178.33.161.123:6893 udp
FR 178.33.161.124:6893 udp
FR 178.33.161.125:6893 udp
FR 178.33.161.126:6893 udp
FR 178.33.161.127:6893 udp
FR 178.33.161.128:6893 udp
FR 178.33.161.129:6893 udp
FR 178.33.161.130:6893 udp
FR 178.33.161.131:6893 udp
FR 178.33.161.132:6893 udp
FR 178.33.161.133:6893 udp
FR 178.33.161.134:6893 udp
FR 178.33.161.135:6893 udp
FR 178.33.161.136:6893 udp
FR 178.33.161.137:6893 udp
FR 178.33.161.138:6893 udp
FR 178.33.161.139:6893 udp
FR 178.33.161.140:6893 udp
FR 178.33.161.141:6893 udp
FR 178.33.161.142:6893 udp
FR 178.33.161.143:6893 udp
FR 178.33.161.144:6893 udp
FR 178.33.161.145:6893 udp
FR 178.33.161.146:6893 udp
FR 178.33.161.147:6893 udp
FR 178.33.161.148:6893 udp
FR 178.33.161.149:6893 udp
FR 178.33.161.150:6893 udp
FR 178.33.161.151:6893 udp
FR 178.33.161.152:6893 udp
FR 178.33.161.153:6893 udp
FR 178.33.161.154:6893 udp
FR 178.33.161.155:6893 udp
FR 178.33.161.156:6893 udp
FR 178.33.161.157:6893 udp
FR 178.33.161.158:6893 udp
FR 178.33.161.159:6893 udp
FR 178.33.161.160:6893 udp
FR 178.33.161.161:6893 udp
FR 178.33.161.162:6893 udp
FR 178.33.161.163:6893 udp
FR 178.33.161.164:6893 udp
FR 178.33.161.165:6893 udp
FR 178.33.161.166:6893 udp
FR 178.33.161.167:6893 udp
FR 178.33.161.168:6893 udp
FR 178.33.161.169:6893 udp
FR 178.33.161.170:6893 udp
FR 178.33.161.171:6893 udp
FR 178.33.161.172:6893 udp
FR 178.33.161.173:6893 udp
FR 178.33.161.174:6893 udp
FR 178.33.161.175:6893 udp
FR 178.33.161.176:6893 udp
FR 178.33.161.177:6893 udp
FR 178.33.161.178:6893 udp
FR 178.33.161.179:6893 udp
FR 178.33.161.180:6893 udp
FR 178.33.161.181:6893 udp
FR 178.33.161.182:6893 udp
FR 178.33.161.183:6893 udp
FR 178.33.161.184:6893 udp
FR 178.33.161.185:6893 udp
FR 178.33.161.186:6893 udp
FR 178.33.161.187:6893 udp
FR 178.33.161.188:6893 udp
FR 178.33.161.189:6893 udp
FR 178.33.161.190:6893 udp
FR 178.33.161.191:6893 udp
FR 178.33.161.192:6893 udp
FR 178.33.161.193:6893 udp
FR 178.33.161.194:6893 udp
FR 178.33.161.195:6893 udp
FR 178.33.161.196:6893 udp
FR 178.33.161.197:6893 udp
FR 178.33.161.198:6893 udp
FR 178.33.161.199:6893 udp
FR 178.33.161.200:6893 udp
FR 178.33.161.201:6893 udp
FR 178.33.161.202:6893 udp
FR 178.33.161.203:6893 udp
FR 178.33.161.204:6893 udp
FR 178.33.161.205:6893 udp
FR 178.33.161.206:6893 udp
FR 178.33.161.207:6893 udp
FR 178.33.161.208:6893 udp
FR 178.33.161.209:6893 udp
FR 178.33.161.210:6893 udp
FR 178.33.161.211:6893 udp
FR 178.33.161.212:6893 udp
FR 178.33.161.213:6893 udp
FR 178.33.161.214:6893 udp
FR 178.33.161.215:6893 udp
FR 178.33.161.216:6893 udp
FR 178.33.161.217:6893 udp
FR 178.33.161.218:6893 udp
FR 178.33.161.219:6893 udp
FR 178.33.161.220:6893 udp
FR 178.33.161.221:6893 udp
FR 178.33.161.222:6893 udp
FR 178.33.161.223:6893 udp
FR 178.33.161.224:6893 udp
FR 178.33.161.225:6893 udp
FR 178.33.161.226:6893 udp
FR 178.33.161.227:6893 udp
FR 178.33.161.228:6893 udp
FR 178.33.161.229:6893 udp
FR 178.33.161.230:6893 udp
FR 178.33.161.231:6893 udp
FR 178.33.161.232:6893 udp
FR 178.33.161.233:6893 udp
FR 178.33.161.234:6893 udp
FR 178.33.161.235:6893 udp
FR 178.33.161.236:6893 udp
FR 178.33.161.237:6893 udp
FR 178.33.161.238:6893 udp
FR 178.33.161.239:6893 udp
FR 178.33.161.240:6893 udp
FR 178.33.161.241:6893 udp
FR 178.33.161.242:6893 udp
FR 178.33.161.243:6893 udp
FR 178.33.161.244:6893 udp
FR 178.33.161.245:6893 udp
FR 178.33.161.246:6893 udp
FR 178.33.161.247:6893 udp
FR 178.33.161.248:6893 udp
FR 178.33.161.249:6893 udp
FR 178.33.161.250:6893 udp
FR 178.33.161.251:6893 udp
FR 178.33.161.252:6893 udp
FR 178.33.161.253:6893 udp
FR 178.33.161.254:6893 udp
FR 178.33.161.255:6893 udp
FR 178.33.162.0:6893 udp
FR 178.33.162.1:6893 udp
FR 178.33.162.2:6893 udp
FR 178.33.162.3:6893 udp
FR 178.33.162.4:6893 udp
FR 178.33.162.5:6893 udp
FR 178.33.162.6:6893 udp
FR 178.33.162.7:6893 udp
FR 178.33.162.8:6893 udp
FR 178.33.162.9:6893 udp
FR 178.33.162.10:6893 udp
FR 178.33.162.11:6893 udp
FR 178.33.162.12:6893 udp
FR 178.33.162.13:6893 udp
FR 178.33.162.14:6893 udp
FR 178.33.162.15:6893 udp
FR 178.33.162.16:6893 udp
FR 178.33.162.17:6893 udp
FR 178.33.162.18:6893 udp
FR 178.33.162.19:6893 udp
FR 178.33.162.20:6893 udp
FR 178.33.162.21:6893 udp
FR 178.33.162.22:6893 udp
FR 178.33.162.23:6893 udp
FR 178.33.162.24:6893 udp
FR 178.33.162.25:6893 udp
FR 178.33.162.26:6893 udp
FR 178.33.162.27:6893 udp
FR 178.33.162.28:6893 udp
FR 178.33.162.29:6893 udp
FR 178.33.162.30:6893 udp
FR 178.33.162.31:6893 udp
FR 178.33.162.32:6893 udp
FR 178.33.162.33:6893 udp
FR 178.33.162.34:6893 udp
FR 178.33.162.35:6893 udp
FR 178.33.162.36:6893 udp
FR 178.33.162.37:6893 udp
FR 178.33.162.38:6893 udp
FR 178.33.162.39:6893 udp
FR 178.33.162.40:6893 udp
FR 178.33.162.41:6893 udp
FR 178.33.162.42:6893 udp
FR 178.33.162.43:6893 udp
FR 178.33.162.44:6893 udp
FR 178.33.162.45:6893 udp
FR 178.33.162.46:6893 udp
FR 178.33.162.47:6893 udp
FR 178.33.162.48:6893 udp
FR 178.33.162.49:6893 udp
FR 178.33.162.50:6893 udp
FR 178.33.162.51:6893 udp
FR 178.33.162.52:6893 udp
FR 178.33.162.53:6893 udp
FR 178.33.162.54:6893 udp
FR 178.33.162.55:6893 udp
FR 178.33.162.56:6893 udp
FR 178.33.162.57:6893 udp
FR 178.33.162.58:6893 udp
FR 178.33.162.59:6893 udp
FR 178.33.162.60:6893 udp
FR 178.33.162.61:6893 udp
FR 178.33.162.62:6893 udp
FR 178.33.162.63:6893 udp
FR 178.33.162.64:6893 udp
FR 178.33.162.65:6893 udp
FR 178.33.162.66:6893 udp
FR 178.33.162.67:6893 udp
FR 178.33.162.68:6893 udp
FR 178.33.162.69:6893 udp
FR 178.33.162.70:6893 udp
FR 178.33.162.71:6893 udp
FR 178.33.162.72:6893 udp
FR 178.33.162.73:6893 udp
FR 178.33.162.74:6893 udp
FR 178.33.162.75:6893 udp
FR 178.33.162.76:6893 udp
FR 178.33.162.77:6893 udp
FR 178.33.162.78:6893 udp
FR 178.33.162.79:6893 udp
FR 178.33.162.80:6893 udp
FR 178.33.162.81:6893 udp
FR 178.33.162.82:6893 udp
FR 178.33.162.83:6893 udp
FR 178.33.162.84:6893 udp
FR 178.33.162.85:6893 udp
FR 178.33.162.86:6893 udp
FR 178.33.162.87:6893 udp
FR 178.33.162.88:6893 udp
FR 178.33.162.89:6893 udp
FR 178.33.162.90:6893 udp
FR 178.33.162.91:6893 udp
FR 178.33.162.92:6893 udp
FR 178.33.162.93:6893 udp
FR 178.33.162.94:6893 udp
FR 178.33.162.95:6893 udp
FR 178.33.162.96:6893 udp
FR 178.33.162.97:6893 udp
FR 178.33.162.98:6893 udp
FR 178.33.162.99:6893 udp
FR 178.33.162.100:6893 udp
FR 178.33.162.101:6893 udp
FR 178.33.162.102:6893 udp
FR 178.33.162.103:6893 udp
FR 178.33.162.104:6893 udp
FR 178.33.162.105:6893 udp
FR 178.33.162.106:6893 udp
FR 178.33.162.107:6893 udp
FR 178.33.162.108:6893 udp
FR 178.33.162.109:6893 udp
FR 178.33.162.110:6893 udp
FR 178.33.162.111:6893 udp
FR 178.33.162.112:6893 udp
FR 178.33.162.113:6893 udp
FR 178.33.162.114:6893 udp
FR 178.33.162.115:6893 udp
FR 178.33.162.116:6893 udp
FR 178.33.162.117:6893 udp
FR 178.33.162.118:6893 udp
FR 178.33.162.119:6893 udp
FR 178.33.162.120:6893 udp
FR 178.33.162.121:6893 udp
FR 178.33.162.122:6893 udp
FR 178.33.162.123:6893 udp
FR 178.33.162.124:6893 udp
FR 178.33.162.125:6893 udp
FR 178.33.162.126:6893 udp
FR 178.33.162.127:6893 udp
FR 178.33.162.128:6893 udp
FR 178.33.162.129:6893 udp
FR 178.33.162.130:6893 udp
FR 178.33.162.131:6893 udp
FR 178.33.162.132:6893 udp
FR 178.33.162.133:6893 udp
FR 178.33.162.134:6893 udp
FR 178.33.162.135:6893 udp
FR 178.33.162.136:6893 udp
FR 178.33.162.137:6893 udp
FR 178.33.162.138:6893 udp
FR 178.33.162.139:6893 udp
FR 178.33.162.140:6893 udp
FR 178.33.162.141:6893 udp
FR 178.33.162.142:6893 udp
FR 178.33.162.143:6893 udp
FR 178.33.162.144:6893 udp
FR 178.33.162.145:6893 udp
FR 178.33.162.146:6893 udp
FR 178.33.162.147:6893 udp
FR 178.33.162.148:6893 udp
FR 178.33.162.149:6893 udp
FR 178.33.162.150:6893 udp
FR 178.33.162.151:6893 udp
FR 178.33.162.152:6893 udp
FR 178.33.162.153:6893 udp
FR 178.33.162.154:6893 udp
FR 178.33.162.155:6893 udp
FR 178.33.162.156:6893 udp
FR 178.33.162.157:6893 udp
FR 178.33.162.158:6893 udp
FR 178.33.162.159:6893 udp
FR 178.33.162.160:6893 udp
FR 178.33.162.161:6893 udp
FR 178.33.162.162:6893 udp
FR 178.33.162.163:6893 udp
FR 178.33.162.164:6893 udp
FR 178.33.162.165:6893 udp
FR 178.33.162.166:6893 udp
FR 178.33.162.167:6893 udp
FR 178.33.162.168:6893 udp
FR 178.33.162.169:6893 udp
FR 178.33.162.170:6893 udp
FR 178.33.162.171:6893 udp
FR 178.33.162.172:6893 udp
FR 178.33.162.173:6893 udp
FR 178.33.162.174:6893 udp
FR 178.33.162.175:6893 udp
FR 178.33.162.176:6893 udp
FR 178.33.162.177:6893 udp
FR 178.33.162.178:6893 udp
FR 178.33.162.179:6893 udp
FR 178.33.162.180:6893 udp
FR 178.33.162.181:6893 udp
FR 178.33.162.182:6893 udp
FR 178.33.162.183:6893 udp
FR 178.33.162.184:6893 udp
FR 178.33.162.185:6893 udp
FR 178.33.162.186:6893 udp
FR 178.33.162.187:6893 udp
FR 178.33.162.188:6893 udp
FR 178.33.162.189:6893 udp
FR 178.33.162.190:6893 udp
FR 178.33.162.191:6893 udp
FR 178.33.162.192:6893 udp
FR 178.33.162.193:6893 udp
FR 178.33.162.194:6893 udp
FR 178.33.162.195:6893 udp
FR 178.33.162.196:6893 udp
FR 178.33.162.197:6893 udp
FR 178.33.162.198:6893 udp
FR 178.33.162.199:6893 udp
FR 178.33.162.200:6893 udp
FR 178.33.162.201:6893 udp
FR 178.33.162.202:6893 udp
FR 178.33.162.203:6893 udp
FR 178.33.162.204:6893 udp
FR 178.33.162.205:6893 udp
FR 178.33.162.206:6893 udp
FR 178.33.162.207:6893 udp
FR 178.33.162.208:6893 udp
FR 178.33.162.209:6893 udp
FR 178.33.162.210:6893 udp
FR 178.33.162.211:6893 udp
FR 178.33.162.212:6893 udp
FR 178.33.162.213:6893 udp
FR 178.33.162.214:6893 udp
FR 178.33.162.215:6893 udp
FR 178.33.162.216:6893 udp
FR 178.33.162.217:6893 udp
FR 178.33.162.218:6893 udp
FR 178.33.162.219:6893 udp
FR 178.33.162.220:6893 udp
FR 178.33.162.221:6893 udp
FR 178.33.162.222:6893 udp
FR 178.33.162.223:6893 udp
FR 178.33.162.224:6893 udp
FR 178.33.162.225:6893 udp
FR 178.33.162.226:6893 udp
FR 178.33.162.227:6893 udp
FR 178.33.162.228:6893 udp
FR 178.33.162.229:6893 udp
FR 178.33.162.230:6893 udp
FR 178.33.162.231:6893 udp
FR 178.33.162.232:6893 udp
FR 178.33.162.233:6893 udp
FR 178.33.162.234:6893 udp
FR 178.33.162.235:6893 udp
FR 178.33.162.236:6893 udp
FR 178.33.162.237:6893 udp
FR 178.33.162.238:6893 udp
FR 178.33.162.239:6893 udp
FR 178.33.162.240:6893 udp
FR 178.33.162.241:6893 udp
FR 178.33.162.242:6893 udp
FR 178.33.162.243:6893 udp
FR 178.33.162.244:6893 udp
FR 178.33.162.245:6893 udp
FR 178.33.162.246:6893 udp
FR 178.33.162.247:6893 udp
FR 178.33.162.248:6893 udp
FR 178.33.162.249:6893 udp
FR 178.33.162.250:6893 udp
FR 178.33.162.251:6893 udp
FR 178.33.162.252:6893 udp
FR 178.33.162.253:6893 udp
FR 178.33.162.254:6893 udp
FR 178.33.162.255:6893 udp
FR 178.33.163.0:6893 udp
FR 178.33.163.1:6893 udp
FR 178.33.163.2:6893 udp
FR 178.33.163.3:6893 udp
FR 178.33.163.4:6893 udp
FR 178.33.163.5:6893 udp
FR 178.33.163.6:6893 udp
FR 178.33.163.7:6893 udp
FR 178.33.163.8:6893 udp
FR 178.33.163.9:6893 udp
FR 178.33.163.10:6893 udp
FR 178.33.163.11:6893 udp
FR 178.33.163.12:6893 udp
FR 178.33.163.13:6893 udp
FR 178.33.163.14:6893 udp
FR 178.33.163.15:6893 udp
FR 178.33.163.16:6893 udp
FR 178.33.163.17:6893 udp
FR 178.33.163.18:6893 udp
FR 178.33.163.19:6893 udp
FR 178.33.163.20:6893 udp
FR 178.33.163.21:6893 udp
FR 178.33.163.22:6893 udp
FR 178.33.163.23:6893 udp
FR 178.33.163.24:6893 udp
FR 178.33.163.25:6893 udp
FR 178.33.163.26:6893 udp
FR 178.33.163.27:6893 udp
FR 178.33.163.28:6893 udp
FR 178.33.163.29:6893 udp
FR 178.33.163.30:6893 udp
FR 178.33.163.31:6893 udp
FR 178.33.163.32:6893 udp
FR 178.33.163.33:6893 udp
FR 178.33.163.34:6893 udp
FR 178.33.163.35:6893 udp
FR 178.33.163.36:6893 udp
FR 178.33.163.37:6893 udp
FR 178.33.163.38:6893 udp
FR 178.33.163.39:6893 udp
FR 178.33.163.40:6893 udp
FR 178.33.163.41:6893 udp
FR 178.33.163.42:6893 udp
FR 178.33.163.43:6893 udp
FR 178.33.163.44:6893 udp
FR 178.33.163.45:6893 udp
FR 178.33.163.46:6893 udp
FR 178.33.163.47:6893 udp
FR 178.33.163.48:6893 udp
FR 178.33.163.49:6893 udp
FR 178.33.163.50:6893 udp
FR 178.33.163.51:6893 udp
FR 178.33.163.52:6893 udp
FR 178.33.163.53:6893 udp
FR 178.33.163.54:6893 udp
FR 178.33.163.55:6893 udp
FR 178.33.163.56:6893 udp
FR 178.33.163.57:6893 udp
FR 178.33.163.58:6893 udp
FR 178.33.163.59:6893 udp
FR 178.33.163.60:6893 udp
FR 178.33.163.61:6893 udp
FR 178.33.163.62:6893 udp
FR 178.33.163.63:6893 udp
FR 178.33.163.64:6893 udp
FR 178.33.163.65:6893 udp
FR 178.33.163.66:6893 udp
FR 178.33.163.67:6893 udp
FR 178.33.163.68:6893 udp
FR 178.33.163.69:6893 udp
FR 178.33.163.70:6893 udp
FR 178.33.163.71:6893 udp
FR 178.33.163.72:6893 udp
FR 178.33.163.73:6893 udp
FR 178.33.163.74:6893 udp
FR 178.33.163.75:6893 udp
FR 178.33.163.76:6893 udp
FR 178.33.163.77:6893 udp
FR 178.33.163.78:6893 udp
FR 178.33.163.79:6893 udp
FR 178.33.163.80:6893 udp
FR 178.33.163.81:6893 udp
FR 178.33.163.82:6893 udp
FR 178.33.163.83:6893 udp
FR 178.33.163.84:6893 udp
FR 178.33.163.85:6893 udp
FR 178.33.163.86:6893 udp
FR 178.33.163.87:6893 udp
FR 178.33.163.88:6893 udp
FR 178.33.163.89:6893 udp
FR 178.33.163.90:6893 udp
FR 178.33.163.91:6893 udp
FR 178.33.163.92:6893 udp
FR 178.33.163.93:6893 udp
FR 178.33.163.94:6893 udp
FR 178.33.163.95:6893 udp
FR 178.33.163.96:6893 udp
FR 178.33.163.97:6893 udp
FR 178.33.163.98:6893 udp
FR 178.33.163.99:6893 udp
FR 178.33.163.100:6893 udp
FR 178.33.163.101:6893 udp
FR 178.33.163.102:6893 udp
FR 178.33.163.103:6893 udp
FR 178.33.163.104:6893 udp
FR 178.33.163.105:6893 udp
FR 178.33.163.106:6893 udp
FR 178.33.163.107:6893 udp
FR 178.33.163.108:6893 udp
FR 178.33.163.109:6893 udp
FR 178.33.163.110:6893 udp
FR 178.33.163.111:6893 udp
FR 178.33.163.112:6893 udp
FR 178.33.163.113:6893 udp
FR 178.33.163.114:6893 udp
FR 178.33.163.115:6893 udp
FR 178.33.163.116:6893 udp
FR 178.33.163.117:6893 udp
FR 178.33.163.118:6893 udp
FR 178.33.163.119:6893 udp
FR 178.33.163.120:6893 udp
FR 178.33.163.121:6893 udp
FR 178.33.163.122:6893 udp
FR 178.33.163.123:6893 udp
FR 178.33.163.124:6893 udp
FR 178.33.163.125:6893 udp
FR 178.33.163.126:6893 udp
FR 178.33.163.127:6893 udp
FR 178.33.163.128:6893 udp
FR 178.33.163.129:6893 udp
FR 178.33.163.130:6893 udp
FR 178.33.163.131:6893 udp
FR 178.33.163.132:6893 udp
FR 178.33.163.133:6893 udp
FR 178.33.163.134:6893 udp
FR 178.33.163.135:6893 udp
FR 178.33.163.136:6893 udp
FR 178.33.163.137:6893 udp
FR 178.33.163.138:6893 udp
FR 178.33.163.139:6893 udp
FR 178.33.163.140:6893 udp
FR 178.33.163.141:6893 udp
FR 178.33.163.142:6893 udp
FR 178.33.163.143:6893 udp
FR 178.33.163.144:6893 udp
FR 178.33.163.145:6893 udp
FR 178.33.163.146:6893 udp
FR 178.33.163.147:6893 udp
FR 178.33.163.148:6893 udp
FR 178.33.163.149:6893 udp
FR 178.33.163.150:6893 udp
FR 178.33.163.151:6893 udp
FR 178.33.163.152:6893 udp
FR 178.33.163.153:6893 udp
FR 178.33.163.154:6893 udp
FR 178.33.163.155:6893 udp
FR 178.33.163.156:6893 udp
FR 178.33.163.157:6893 udp
FR 178.33.163.158:6893 udp
FR 178.33.163.159:6893 udp
FR 178.33.163.160:6893 udp
FR 178.33.163.161:6893 udp
FR 178.33.163.162:6893 udp
FR 178.33.163.163:6893 udp
FR 178.33.163.164:6893 udp
FR 178.33.163.165:6893 udp
FR 178.33.163.166:6893 udp
FR 178.33.163.167:6893 udp
FR 178.33.163.168:6893 udp
FR 178.33.163.169:6893 udp
FR 178.33.163.170:6893 udp
FR 178.33.163.171:6893 udp
FR 178.33.163.172:6893 udp
FR 178.33.163.173:6893 udp
FR 178.33.163.174:6893 udp
FR 178.33.163.175:6893 udp
FR 178.33.163.176:6893 udp
FR 178.33.163.177:6893 udp
FR 178.33.163.178:6893 udp
FR 178.33.163.179:6893 udp
FR 178.33.163.180:6893 udp
FR 178.33.163.181:6893 udp
FR 178.33.163.182:6893 udp
FR 178.33.163.183:6893 udp
FR 178.33.163.184:6893 udp
FR 178.33.163.185:6893 udp
FR 178.33.163.186:6893 udp
FR 178.33.163.187:6893 udp
FR 178.33.163.188:6893 udp
FR 178.33.163.189:6893 udp
FR 178.33.163.190:6893 udp
FR 178.33.163.191:6893 udp
FR 178.33.163.192:6893 udp
FR 178.33.163.193:6893 udp
FR 178.33.163.194:6893 udp
FR 178.33.163.195:6893 udp
FR 178.33.163.196:6893 udp
FR 178.33.163.197:6893 udp
FR 178.33.163.198:6893 udp
FR 178.33.163.199:6893 udp
FR 178.33.163.200:6893 udp
FR 178.33.163.201:6893 udp
FR 178.33.163.202:6893 udp
FR 178.33.163.203:6893 udp
FR 178.33.163.204:6893 udp
FR 178.33.163.205:6893 udp
FR 178.33.163.206:6893 udp
FR 178.33.163.207:6893 udp
FR 178.33.163.208:6893 udp
FR 178.33.163.209:6893 udp
FR 178.33.163.210:6893 udp
FR 178.33.163.211:6893 udp
FR 178.33.163.212:6893 udp
FR 178.33.163.213:6893 udp
FR 178.33.163.214:6893 udp
FR 178.33.163.215:6893 udp
FR 178.33.163.216:6893 udp
FR 178.33.163.217:6893 udp
FR 178.33.163.218:6893 udp
FR 178.33.163.219:6893 udp
FR 178.33.163.220:6893 udp
FR 178.33.163.221:6893 udp
FR 178.33.163.222:6893 udp
FR 178.33.163.223:6893 udp
FR 178.33.163.224:6893 udp
FR 178.33.163.225:6893 udp
FR 178.33.163.226:6893 udp
FR 178.33.163.227:6893 udp
FR 178.33.163.228:6893 udp
FR 178.33.163.229:6893 udp
FR 178.33.163.230:6893 udp
FR 178.33.163.231:6893 udp
FR 178.33.163.232:6893 udp
FR 178.33.163.233:6893 udp
FR 178.33.163.234:6893 udp
FR 178.33.163.235:6893 udp
FR 178.33.163.236:6893 udp
FR 178.33.163.237:6893 udp
FR 178.33.163.238:6893 udp
FR 178.33.163.239:6893 udp
FR 178.33.163.240:6893 udp
FR 178.33.163.241:6893 udp
FR 178.33.163.242:6893 udp
FR 178.33.163.243:6893 udp
FR 178.33.163.244:6893 udp
FR 178.33.163.245:6893 udp
FR 178.33.163.246:6893 udp
FR 178.33.163.247:6893 udp
FR 178.33.163.248:6893 udp
FR 178.33.163.249:6893 udp
FR 178.33.163.250:6893 udp
FR 178.33.163.251:6893 udp
FR 178.33.163.252:6893 udp
FR 178.33.163.253:6893 udp
FR 178.33.163.254:6893 udp
FR 178.33.163.255:6893 udp
US 8.8.8.8:53 api.blockcypher.com udp
US 104.20.98.10:80 api.blockcypher.com tcp
US 8.8.8.8:53 btc.blockr.io udp
US 8.8.8.8:53 bitaps.com udp
NL 178.128.255.179:443 bitaps.com tcp
US 8.8.8.8:53 chain.so udp
US 104.22.64.108:443 chain.so tcp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.200.3:80 c.pki.goog tcp
US 8.8.8.8:53 www.microsoft.com udp
GB 95.100.245.144:80 www.microsoft.com tcp

Files

memory/2396-1-0x0000000000400000-0x0000000000435000-memory.dmp

memory/2396-0-0x0000000000220000-0x0000000000251000-memory.dmp

memory/2396-2-0x0000000000400000-0x0000000000435000-memory.dmp

memory/2396-5-0x0000000000400000-0x0000000000435000-memory.dmp

memory/2396-96-0x0000000000400000-0x0000000000435000-memory.dmp

memory/2396-106-0x0000000000400000-0x0000000000435000-memory.dmp

memory/2396-117-0x0000000000400000-0x0000000000435000-memory.dmp

C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___9OUB2_.txt

MD5 48ae37d684656c7dd0917c5254396cfb
SHA1 1b962330249e6b56dae1af39381c6a68870eb0d4
SHA256 aeefe76320415aaecf5c54c6f9af20cda5bbf9c6d1b376c2b536bd452f5b0a0e
SHA512 17b4148535a50de97638fe82257cd4ef0c9126da49dfb11e576e0aa7b9a78cabff9bcf247c4c429f2d017b04bd462e331d41fa3008b46c1a01f106f3899d46d1

C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___T5E5HTXX_.hta

MD5 7095e2540fb86ef9231b5fc3edca8fc0
SHA1 ccbfa1259639487ef25ca339961fdcce9160ada2
SHA256 11aa46bab940e4d0ce88cbd63760fc09d552d37539a567e649c4e3943ec4f3d3
SHA512 c0a06d012fdef54d0a078af766ea68744b03add07ed3ece89f3db60384055eeb32c4f03d5f1d8d7d5e09748cbf3d9e320bf4e67c95d417256430bc1e69ef83dd

C:\Users\Admin\AppData\Local\Temp\Cab447.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar469.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-28 22:34

Reported

2024-11-28 22:36

Platform

win7-20241010-en

Max time kernel

118s

Max time network

119s

Command Line

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Ransomware-master.zip"

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: 35 N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2192 wrote to memory of 2660 N/A C:\Program Files\7-Zip\7zFM.exe C:\Windows\system32\rundll32.exe
PID 2192 wrote to memory of 2660 N/A C:\Program Files\7-Zip\7zFM.exe C:\Windows\system32\rundll32.exe
PID 2192 wrote to memory of 2660 N/A C:\Program Files\7-Zip\7zFM.exe C:\Windows\system32\rundll32.exe
PID 2192 wrote to memory of 1952 N/A C:\Program Files\7-Zip\7zFM.exe C:\Windows\system32\rundll32.exe
PID 2192 wrote to memory of 1952 N/A C:\Program Files\7-Zip\7zFM.exe C:\Windows\system32\rundll32.exe
PID 2192 wrote to memory of 1952 N/A C:\Program Files\7-Zip\7zFM.exe C:\Windows\system32\rundll32.exe

Processes

C:\Program Files\7-Zip\7zFM.exe

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Ransomware-master.zip"

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\7zO098781D6\Ransomware

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\7zO09802B38\warna.py

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\Ransomware-master\Ransomware

MD5 d54b447020c50a74fefeeacd7be46733
SHA1 96f347b8545bde22d52e36d95779dceff0401697
SHA256 d1ebf588dbbcca6b21d20ef37d368d48bf6d7a9cdb6636245010fe87e4533f70
SHA512 415825c912210b5115dab8f2388631120eab7ee98bd7cba04705b700d10e325e1b42b6f8dbe5ff37a3b411a203ae436915d4dd6b655750f354817382d31f0954

C:\Users\Admin\AppData\Local\Temp\7zO09802B38\warna.py

MD5 19522678240a7e6d1e5531ed275b6a64
SHA1 01653b2ca19505c7e9a7972df2e7d6784cc627b6
SHA256 6986bfb870797a56611749719d8aabfdfcf272392765692a15c065c42f88c3cf
SHA512 8f2d1efd81a4bafa8d3a50fce740514469a7ccdb2d68f908b9e86d1714ca605525e75a5f0f5ac9dd798299db75810bdf0d06f88e0103609b4d0843ff12d24292

Analysis: behavioral6

Detonation Overview

Submitted

2024-11-28 22:34

Reported

2024-11-28 22:37

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

156s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Ransomware-master\README.md

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Ransomware-master\README.md

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 92.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 120.150.79.40.in-addr.arpa udp

Files

N/A

Analysis: behavioral12

Detonation Overview

Submitted

2024-11-28 22:34

Reported

2024-11-28 22:36

Platform

win10v2004-20241007-en

Max time kernel

118s

Max time network

143s

Command Line

"C:\Users\Admin\AppData\Local\Temp\cerber.exe"

Signatures

Cerber

ransomware cerber

Cerber family

cerber

Contacts a large (1101) amount of remote hosts

discovery

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A

Drops startup file

Description Indicator Process Target
File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\word\startup\ C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\excel C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\outlook C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\powerpoint C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft sql server C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\word C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\onenote C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\outlook C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\steam C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\documents C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\desktop C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\office C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\powerpoint C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\word C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\onenote C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\excel C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\office C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\onenote C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\onenote C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\outlook C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\powerpoint C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\word C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\thunderbird C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\bitcoin C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\excel C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\the bat! C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\thunderbird C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\microsoft sql server C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\the bat! C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\bitcoin C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\microsoft sql server C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\outlook C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\powerpoint C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft sql server C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\excel C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\office C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\office C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\steam C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\word C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpB239.bmp" C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification \??\c:\program files (x86)\excel C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\program files (x86)\onenote C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\program files (x86)\thunderbird C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\office C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\onenote C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\program files (x86)\word C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\program files\ C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\program files (x86)\ C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\excel C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\outlook C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\powerpoint C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\program files (x86)\outlook C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\program files (x86)\the bat! C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\program files (x86)\bitcoin C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft sql server C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\microsoft sql server C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\word C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\program files (x86)\office C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\program files (x86)\powerpoint C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\program files (x86)\steam C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\onenote C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\thunderbird C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\documents C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\bitcoin C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\excel C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\outlook C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\word C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\steam C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\desktop C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\onenote C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\office C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\powerpoint C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\powerpoint C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\the bat! C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\desktop C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\word C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\onenote C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\outlook C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\powerpoint C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\powerpoint C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\excel C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\onenote C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\outlook C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\excel C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\outlook C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\word C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\outlook C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\bitcoin C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft sql server C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\excel C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\thunderbird C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\powerpoint C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\word C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\outlook C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\steam C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft sql server C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\onenote C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\powerpoint C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\office C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\powerpoint C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\the bat! C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\word C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\bitcoin C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\microsoft sql server C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\outlook C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\word C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\word C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\office C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\office C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\office C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\thunderbird C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\bitcoin C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft sql server C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\outlook C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\office C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\the bat! C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\thunderbird C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\documents C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\microsoft sql server C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\microsoft sql server C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\powerpoint C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\excel C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\onenote C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
File opened for modification \??\c:\windows\ C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mshta.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\NOTEPAD.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\PING.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A

System Network Configuration Discovery: Internet Connection Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\NOTEPAD.EXE N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\cerber.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3980 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\cerber.exe C:\Windows\SysWOW64\netsh.exe
PID 3980 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\cerber.exe C:\Windows\SysWOW64\netsh.exe
PID 3980 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\cerber.exe C:\Windows\SysWOW64\netsh.exe
PID 3980 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\cerber.exe C:\Windows\SysWOW64\netsh.exe
PID 3980 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\cerber.exe C:\Windows\SysWOW64\netsh.exe
PID 3980 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\cerber.exe C:\Windows\SysWOW64\netsh.exe
PID 3980 wrote to memory of 4580 N/A C:\Users\Admin\AppData\Local\Temp\cerber.exe C:\Windows\SysWOW64\mshta.exe
PID 3980 wrote to memory of 4580 N/A C:\Users\Admin\AppData\Local\Temp\cerber.exe C:\Windows\SysWOW64\mshta.exe
PID 3980 wrote to memory of 4580 N/A C:\Users\Admin\AppData\Local\Temp\cerber.exe C:\Windows\SysWOW64\mshta.exe
PID 3980 wrote to memory of 4652 N/A C:\Users\Admin\AppData\Local\Temp\cerber.exe C:\Windows\SysWOW64\NOTEPAD.EXE
PID 3980 wrote to memory of 4652 N/A C:\Users\Admin\AppData\Local\Temp\cerber.exe C:\Windows\SysWOW64\NOTEPAD.EXE
PID 3980 wrote to memory of 4652 N/A C:\Users\Admin\AppData\Local\Temp\cerber.exe C:\Windows\SysWOW64\NOTEPAD.EXE
PID 3980 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Local\Temp\cerber.exe C:\Windows\SysWOW64\cmd.exe
PID 3980 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Local\Temp\cerber.exe C:\Windows\SysWOW64\cmd.exe
PID 3980 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Local\Temp\cerber.exe C:\Windows\SysWOW64\cmd.exe
PID 1372 wrote to memory of 3220 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1372 wrote to memory of 3220 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1372 wrote to memory of 3220 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1372 wrote to memory of 816 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1372 wrote to memory of 816 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1372 wrote to memory of 816 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\cerber.exe

"C:\Users\Admin\AppData\Local\Temp\cerber.exe"

C:\Windows\SysWOW64\netsh.exe

C:\Windows\system32\netsh.exe advfirewall set allprofiles state on

C:\Windows\SysWOW64\netsh.exe

C:\Windows\system32\netsh.exe advfirewall reset

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___BTE1115E_.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___JZPQ2XM_.txt

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "cerber.exe"

C:\Windows\SysWOW64\PING.EXE

ping -n 1 127.0.0.1

Network

Country Destination Domain Proto
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 101.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
FR 178.33.158.0:6893 udp
FR 178.33.158.1:6893 udp
FR 178.33.158.2:6893 udp
FR 178.33.158.3:6893 udp
FR 178.33.158.4:6893 udp
FR 178.33.158.5:6893 udp
FR 178.33.158.6:6893 udp
FR 178.33.158.7:6893 udp
FR 178.33.158.8:6893 udp
FR 178.33.158.9:6893 udp
FR 178.33.158.10:6893 udp
FR 178.33.158.11:6893 udp
FR 178.33.158.12:6893 udp
FR 178.33.158.13:6893 udp
FR 178.33.158.14:6893 udp
FR 178.33.158.15:6893 udp
FR 178.33.158.16:6893 udp
FR 178.33.158.17:6893 udp
FR 178.33.158.18:6893 udp
FR 178.33.158.19:6893 udp
FR 178.33.158.20:6893 udp
FR 178.33.158.21:6893 udp
FR 178.33.158.22:6893 udp
FR 178.33.158.23:6893 udp
FR 178.33.158.24:6893 udp
FR 178.33.158.25:6893 udp
FR 178.33.158.26:6893 udp
FR 178.33.158.27:6893 udp
FR 178.33.158.28:6893 udp
FR 178.33.158.29:6893 udp
FR 178.33.158.30:6893 udp
FR 178.33.158.31:6893 udp
FR 178.33.159.0:6893 udp
FR 178.33.159.1:6893 udp
FR 178.33.159.2:6893 udp
FR 178.33.159.3:6893 udp
FR 178.33.159.4:6893 udp
FR 178.33.159.5:6893 udp
FR 178.33.159.6:6893 udp
FR 178.33.159.7:6893 udp
FR 178.33.159.8:6893 udp
FR 178.33.159.9:6893 udp
FR 178.33.159.10:6893 udp
FR 178.33.159.11:6893 udp
FR 178.33.159.12:6893 udp
FR 178.33.159.13:6893 udp
FR 178.33.159.14:6893 udp
FR 178.33.159.15:6893 udp
FR 178.33.159.16:6893 udp
FR 178.33.159.17:6893 udp
FR 178.33.159.18:6893 udp
FR 178.33.159.19:6893 udp
FR 178.33.159.20:6893 udp
FR 178.33.159.21:6893 udp
FR 178.33.159.22:6893 udp
FR 178.33.159.23:6893 udp
FR 178.33.159.24:6893 udp
FR 178.33.159.25:6893 udp
FR 178.33.159.26:6893 udp
FR 178.33.159.27:6893 udp
FR 178.33.159.28:6893 udp
FR 178.33.159.29:6893 udp
FR 178.33.159.30:6893 udp
FR 178.33.159.31:6893 udp
FR 178.33.160.0:6893 udp
FR 178.33.160.1:6893 udp
FR 178.33.160.2:6893 udp
FR 178.33.160.3:6893 udp
FR 178.33.160.4:6893 udp
FR 178.33.160.5:6893 udp
FR 178.33.160.6:6893 udp
FR 178.33.160.7:6893 udp
FR 178.33.160.8:6893 udp
FR 178.33.160.9:6893 udp
FR 178.33.160.10:6893 udp
FR 178.33.160.11:6893 udp
FR 178.33.160.12:6893 udp
FR 178.33.160.13:6893 udp
FR 178.33.160.14:6893 udp
FR 178.33.160.15:6893 udp
FR 178.33.160.16:6893 udp
FR 178.33.160.17:6893 udp
FR 178.33.160.18:6893 udp
FR 178.33.160.19:6893 udp
FR 178.33.160.20:6893 udp
FR 178.33.160.21:6893 udp
FR 178.33.160.22:6893 udp
FR 178.33.160.23:6893 udp
FR 178.33.160.24:6893 udp
FR 178.33.160.25:6893 udp
FR 178.33.160.26:6893 udp
FR 178.33.160.27:6893 udp
FR 178.33.160.28:6893 udp
FR 178.33.160.29:6893 udp
FR 178.33.160.30:6893 udp
FR 178.33.160.31:6893 udp
FR 178.33.160.32:6893 udp
FR 178.33.160.33:6893 udp
FR 178.33.160.34:6893 udp
FR 178.33.160.35:6893 udp
FR 178.33.160.36:6893 udp
FR 178.33.160.37:6893 udp
FR 178.33.160.38:6893 udp
FR 178.33.160.39:6893 udp
FR 178.33.160.40:6893 udp
FR 178.33.160.41:6893 udp
FR 178.33.160.42:6893 udp
FR 178.33.160.43:6893 udp
FR 178.33.160.44:6893 udp
FR 178.33.160.45:6893 udp
FR 178.33.160.46:6893 udp
FR 178.33.160.47:6893 udp
FR 178.33.160.48:6893 udp
FR 178.33.160.49:6893 udp
FR 178.33.160.50:6893 udp
FR 178.33.160.51:6893 udp
FR 178.33.160.52:6893 udp
FR 178.33.160.53:6893 udp
FR 178.33.160.54:6893 udp
FR 178.33.160.55:6893 udp
FR 178.33.160.56:6893 udp
FR 178.33.160.57:6893 udp
FR 178.33.160.58:6893 udp
FR 178.33.160.59:6893 udp
FR 178.33.160.60:6893 udp
FR 178.33.160.61:6893 udp
FR 178.33.160.62:6893 udp
FR 178.33.160.63:6893 udp
FR 178.33.160.64:6893 udp
FR 178.33.160.65:6893 udp
FR 178.33.160.66:6893 udp
FR 178.33.160.67:6893 udp
FR 178.33.160.68:6893 udp
FR 178.33.160.69:6893 udp
FR 178.33.160.70:6893 udp
FR 178.33.160.71:6893 udp
FR 178.33.160.72:6893 udp
FR 178.33.160.73:6893 udp
FR 178.33.160.74:6893 udp
FR 178.33.160.75:6893 udp
FR 178.33.160.76:6893 udp
FR 178.33.160.77:6893 udp
FR 178.33.160.78:6893 udp
FR 178.33.160.79:6893 udp
FR 178.33.160.80:6893 udp
FR 178.33.160.81:6893 udp
FR 178.33.160.82:6893 udp
FR 178.33.160.83:6893 udp
FR 178.33.160.84:6893 udp
FR 178.33.160.85:6893 udp
FR 178.33.160.86:6893 udp
FR 178.33.160.87:6893 udp
FR 178.33.160.88:6893 udp
FR 178.33.160.89:6893 udp
FR 178.33.160.90:6893 udp
FR 178.33.160.91:6893 udp
FR 178.33.160.92:6893 udp
FR 178.33.160.93:6893 udp
FR 178.33.160.94:6893 udp
FR 178.33.160.95:6893 udp
FR 178.33.160.96:6893 udp
FR 178.33.160.97:6893 udp
FR 178.33.160.98:6893 udp
FR 178.33.160.99:6893 udp
FR 178.33.160.100:6893 udp
FR 178.33.160.101:6893 udp
FR 178.33.160.102:6893 udp
FR 178.33.160.103:6893 udp
FR 178.33.160.104:6893 udp
FR 178.33.160.105:6893 udp
FR 178.33.160.106:6893 udp
FR 178.33.160.107:6893 udp
FR 178.33.160.108:6893 udp
FR 178.33.160.109:6893 udp
FR 178.33.160.110:6893 udp
FR 178.33.160.111:6893 udp
FR 178.33.160.112:6893 udp
FR 178.33.160.113:6893 udp
FR 178.33.160.114:6893 udp
FR 178.33.160.115:6893 udp
FR 178.33.160.116:6893 udp
FR 178.33.160.117:6893 udp
FR 178.33.160.118:6893 udp
FR 178.33.160.119:6893 udp
FR 178.33.160.120:6893 udp
FR 178.33.160.121:6893 udp
FR 178.33.160.122:6893 udp
FR 178.33.160.123:6893 udp
FR 178.33.160.124:6893 udp
FR 178.33.160.125:6893 udp
FR 178.33.160.126:6893 udp
FR 178.33.160.127:6893 udp
FR 178.33.160.128:6893 udp
FR 178.33.160.129:6893 udp
FR 178.33.160.130:6893 udp
FR 178.33.160.131:6893 udp
FR 178.33.160.132:6893 udp
FR 178.33.160.133:6893 udp
FR 178.33.160.134:6893 udp
FR 178.33.160.135:6893 udp
FR 178.33.160.136:6893 udp
FR 178.33.160.137:6893 udp
FR 178.33.160.138:6893 udp
FR 178.33.160.139:6893 udp
FR 178.33.160.140:6893 udp
FR 178.33.160.141:6893 udp
FR 178.33.160.142:6893 udp
FR 178.33.160.143:6893 udp
FR 178.33.160.144:6893 udp
FR 178.33.160.145:6893 udp
FR 178.33.160.146:6893 udp
FR 178.33.160.147:6893 udp
FR 178.33.160.148:6893 udp
FR 178.33.160.149:6893 udp
FR 178.33.160.150:6893 udp
FR 178.33.160.151:6893 udp
FR 178.33.160.152:6893 udp
FR 178.33.160.153:6893 udp
FR 178.33.160.154:6893 udp
FR 178.33.160.155:6893 udp
FR 178.33.160.156:6893 udp
FR 178.33.160.157:6893 udp
FR 178.33.160.158:6893 udp
FR 178.33.160.159:6893 udp
FR 178.33.160.160:6893 udp
FR 178.33.160.161:6893 udp
FR 178.33.160.162:6893 udp
FR 178.33.160.163:6893 udp
FR 178.33.160.164:6893 udp
FR 178.33.160.165:6893 udp
FR 178.33.160.166:6893 udp
FR 178.33.160.167:6893 udp
FR 178.33.160.168:6893 udp
FR 178.33.160.169:6893 udp
FR 178.33.160.170:6893 udp
FR 178.33.160.171:6893 udp
FR 178.33.160.172:6893 udp
FR 178.33.160.173:6893 udp
FR 178.33.160.174:6893 udp
FR 178.33.160.175:6893 udp
FR 178.33.160.176:6893 udp
FR 178.33.160.177:6893 udp
FR 178.33.160.178:6893 udp
FR 178.33.160.179:6893 udp
FR 178.33.160.180:6893 udp
FR 178.33.160.181:6893 udp
FR 178.33.160.182:6893 udp
FR 178.33.160.183:6893 udp
FR 178.33.160.184:6893 udp
FR 178.33.160.185:6893 udp
FR 178.33.160.186:6893 udp
FR 178.33.160.187:6893 udp
FR 178.33.160.188:6893 udp
FR 178.33.160.189:6893 udp
FR 178.33.160.190:6893 udp
FR 178.33.160.191:6893 udp
FR 178.33.160.192:6893 udp
FR 178.33.160.193:6893 udp
FR 178.33.160.194:6893 udp
FR 178.33.160.195:6893 udp
FR 178.33.160.196:6893 udp
FR 178.33.160.197:6893 udp
FR 178.33.160.198:6893 udp
FR 178.33.160.199:6893 udp
FR 178.33.160.200:6893 udp
FR 178.33.160.201:6893 udp
FR 178.33.160.202:6893 udp
FR 178.33.160.203:6893 udp
FR 178.33.160.204:6893 udp
FR 178.33.160.205:6893 udp
FR 178.33.160.206:6893 udp
FR 178.33.160.207:6893 udp
FR 178.33.160.208:6893 udp
FR 178.33.160.209:6893 udp
FR 178.33.160.210:6893 udp
FR 178.33.160.211:6893 udp
FR 178.33.160.212:6893 udp
FR 178.33.160.213:6893 udp
FR 178.33.160.214:6893 udp
FR 178.33.160.215:6893 udp
FR 178.33.160.216:6893 udp
FR 178.33.160.217:6893 udp
FR 178.33.160.218:6893 udp
FR 178.33.160.219:6893 udp
FR 178.33.160.220:6893 udp
FR 178.33.160.221:6893 udp
FR 178.33.160.222:6893 udp
FR 178.33.160.223:6893 udp
FR 178.33.160.224:6893 udp
FR 178.33.160.225:6893 udp
FR 178.33.160.226:6893 udp
FR 178.33.160.227:6893 udp
FR 178.33.160.228:6893 udp
FR 178.33.160.229:6893 udp
FR 178.33.160.230:6893 udp
FR 178.33.160.231:6893 udp
FR 178.33.160.232:6893 udp
FR 178.33.160.233:6893 udp
FR 178.33.160.234:6893 udp
FR 178.33.160.235:6893 udp
FR 178.33.160.236:6893 udp
FR 178.33.160.237:6893 udp
FR 178.33.160.238:6893 udp
FR 178.33.160.239:6893 udp
FR 178.33.160.240:6893 udp
FR 178.33.160.241:6893 udp
FR 178.33.160.242:6893 udp
FR 178.33.160.243:6893 udp
FR 178.33.160.244:6893 udp
FR 178.33.160.245:6893 udp
FR 178.33.160.246:6893 udp
FR 178.33.160.247:6893 udp
FR 178.33.160.248:6893 udp
FR 178.33.160.249:6893 udp
FR 178.33.160.250:6893 udp
FR 178.33.160.251:6893 udp
FR 178.33.160.252:6893 udp
FR 178.33.160.253:6893 udp
FR 178.33.160.254:6893 udp
US 8.8.8.8:53 0.158.33.178.in-addr.arpa udp
US 8.8.8.8:53 1.158.33.178.in-addr.arpa udp
US 8.8.8.8:53 2.158.33.178.in-addr.arpa udp
US 8.8.8.8:53 3.158.33.178.in-addr.arpa udp
US 8.8.8.8:53 4.158.33.178.in-addr.arpa udp
US 8.8.8.8:53 5.158.33.178.in-addr.arpa udp
US 8.8.8.8:53 6.158.33.178.in-addr.arpa udp
US 8.8.8.8:53 8.158.33.178.in-addr.arpa udp
US 8.8.8.8:53 7.158.33.178.in-addr.arpa udp
US 8.8.8.8:53 9.158.33.178.in-addr.arpa udp
US 8.8.8.8:53 10.158.33.178.in-addr.arpa udp
US 8.8.8.8:53 11.158.33.178.in-addr.arpa udp
US 8.8.8.8:53 12.158.33.178.in-addr.arpa udp
US 8.8.8.8:53 13.158.33.178.in-addr.arpa udp
US 8.8.8.8:53 15.158.33.178.in-addr.arpa udp
US 8.8.8.8:53 14.158.33.178.in-addr.arpa udp
US 8.8.8.8:53 16.158.33.178.in-addr.arpa udp
US 8.8.8.8:53 17.158.33.178.in-addr.arpa udp
US 8.8.8.8:53 18.158.33.178.in-addr.arpa udp
US 8.8.8.8:53 19.158.33.178.in-addr.arpa udp
US 8.8.8.8:53 20.158.33.178.in-addr.arpa udp
US 8.8.8.8:53 21.158.33.178.in-addr.arpa udp
US 8.8.8.8:53 22.158.33.178.in-addr.arpa udp
US 8.8.8.8:53 24.158.33.178.in-addr.arpa udp
US 8.8.8.8:53 23.158.33.178.in-addr.arpa udp
US 8.8.8.8:53 25.158.33.178.in-addr.arpa udp
US 8.8.8.8:53 26.158.33.178.in-addr.arpa udp
US 8.8.8.8:53 27.158.33.178.in-addr.arpa udp
US 8.8.8.8:53 28.158.33.178.in-addr.arpa udp
US 8.8.8.8:53 29.158.33.178.in-addr.arpa udp
US 8.8.8.8:53 30.158.33.178.in-addr.arpa udp
US 8.8.8.8:53 31.158.33.178.in-addr.arpa udp
US 8.8.8.8:53 0.159.33.178.in-addr.arpa udp
US 8.8.8.8:53 1.159.33.178.in-addr.arpa udp
US 8.8.8.8:53 2.159.33.178.in-addr.arpa udp
US 8.8.8.8:53 3.159.33.178.in-addr.arpa udp
US 8.8.8.8:53 4.159.33.178.in-addr.arpa udp
US 8.8.8.8:53 5.159.33.178.in-addr.arpa udp
US 8.8.8.8:53 6.159.33.178.in-addr.arpa udp
US 8.8.8.8:53 8.159.33.178.in-addr.arpa udp
US 8.8.8.8:53 7.159.33.178.in-addr.arpa udp
US 8.8.8.8:53 9.159.33.178.in-addr.arpa udp
US 8.8.8.8:53 10.159.33.178.in-addr.arpa udp
US 8.8.8.8:53 11.159.33.178.in-addr.arpa udp
US 8.8.8.8:53 12.159.33.178.in-addr.arpa udp
US 8.8.8.8:53 13.159.33.178.in-addr.arpa udp
US 8.8.8.8:53 14.159.33.178.in-addr.arpa udp
US 8.8.8.8:53 15.159.33.178.in-addr.arpa udp
US 8.8.8.8:53 16.159.33.178.in-addr.arpa udp
US 8.8.8.8:53 17.159.33.178.in-addr.arpa udp
US 8.8.8.8:53 18.159.33.178.in-addr.arpa udp
US 8.8.8.8:53 19.159.33.178.in-addr.arpa udp
US 8.8.8.8:53 20.159.33.178.in-addr.arpa udp
US 8.8.8.8:53 21.159.33.178.in-addr.arpa udp
US 8.8.8.8:53 22.159.33.178.in-addr.arpa udp
US 8.8.8.8:53 23.159.33.178.in-addr.arpa udp
US 8.8.8.8:53 24.159.33.178.in-addr.arpa udp
US 8.8.8.8:53 25.159.33.178.in-addr.arpa udp
US 8.8.8.8:53 26.159.33.178.in-addr.arpa udp
US 8.8.8.8:53 27.159.33.178.in-addr.arpa udp
US 8.8.8.8:53 28.159.33.178.in-addr.arpa udp
US 8.8.8.8:53 29.159.33.178.in-addr.arpa udp
US 8.8.8.8:53 30.159.33.178.in-addr.arpa udp
US 8.8.8.8:53 31.159.33.178.in-addr.arpa udp
US 8.8.8.8:53 0.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 1.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 2.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 3.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 4.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 5.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 6.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 7.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 8.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 9.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 10.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 11.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 12.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 13.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 14.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 15.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 16.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 17.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 18.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 19.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 20.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 21.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 23.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 22.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 25.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 24.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 27.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 26.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 30.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 28.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 29.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 31.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 32.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 34.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 33.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 35.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 36.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 37.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 38.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 39.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 41.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 40.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 42.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 43.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 44.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 45.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 46.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 47.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 48.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 49.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 50.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 51.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 52.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 53.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 54.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 55.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 56.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 57.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 58.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 59.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 60.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 61.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 62.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 64.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 63.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 65.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 66.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 68.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 67.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 70.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 69.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 71.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 72.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 73.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 74.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 75.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 76.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 77.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 78.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 79.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 80.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 81.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 82.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 83.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 84.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 85.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 87.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 86.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 88.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 89.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 90.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 91.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 92.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 93.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 94.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 95.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 96.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 97.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 98.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 99.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 100.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 101.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 102.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 103.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 104.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 106.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 105.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 107.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 108.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 109.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 110.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 111.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 112.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 113.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 114.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 115.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 116.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 117.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 118.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 119.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 121.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 120.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 122.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 123.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 124.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 125.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 126.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 128.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 127.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 129.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 130.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 131.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 132.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 133.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 135.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 134.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 136.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 137.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 138.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 139.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 140.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 141.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 142.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 143.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 144.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 145.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 146.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 147.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 149.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 148.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 150.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 151.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 152.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 153.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 154.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 155.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 156.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 157.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 158.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 159.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 160.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 161.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 162.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 164.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 163.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 165.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 166.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 167.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 168.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 169.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 170.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 171.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 172.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 173.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 174.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 175.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 177.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 176.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 178.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 179.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 180.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 181.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 182.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 183.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 184.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 185.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 186.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 187.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 188.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 189.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 190.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 191.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 192.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 193.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 194.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 195.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 197.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 196.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 198.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 199.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 200.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 201.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 202.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 203.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 204.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 205.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 206.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 207.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 208.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 209.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 210.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 211.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 212.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 213.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 214.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 215.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 216.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 217.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 218.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 220.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 219.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 221.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 222.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 223.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 224.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 225.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 226.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 227.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 228.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 229.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 230.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 231.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 232.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 233.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 234.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 235.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 236.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 237.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 238.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 240.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 239.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 241.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 242.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 243.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 244.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 245.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 246.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 247.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 248.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 249.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 250.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 251.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 252.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 253.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 254.160.33.178.in-addr.arpa udp
FR 178.33.160.255:6893 udp
FR 178.33.161.0:6893 udp
FR 178.33.161.1:6893 udp
FR 178.33.161.2:6893 udp
FR 178.33.161.3:6893 udp
FR 178.33.161.4:6893 udp
FR 178.33.161.5:6893 udp
FR 178.33.161.6:6893 udp
FR 178.33.161.7:6893 udp
FR 178.33.161.8:6893 udp
FR 178.33.161.9:6893 udp
FR 178.33.161.10:6893 udp
FR 178.33.161.11:6893 udp
FR 178.33.161.12:6893 udp
FR 178.33.161.13:6893 udp
FR 178.33.161.14:6893 udp
FR 178.33.161.15:6893 udp
FR 178.33.161.16:6893 udp
FR 178.33.161.17:6893 udp
FR 178.33.161.18:6893 udp
FR 178.33.161.19:6893 udp
FR 178.33.161.20:6893 udp
FR 178.33.161.21:6893 udp
FR 178.33.161.22:6893 udp
FR 178.33.161.23:6893 udp
FR 178.33.161.24:6893 udp
FR 178.33.161.25:6893 udp
FR 178.33.161.26:6893 udp
FR 178.33.161.27:6893 udp
FR 178.33.161.28:6893 udp
FR 178.33.161.29:6893 udp
FR 178.33.161.30:6893 udp
FR 178.33.161.31:6893 udp
FR 178.33.161.32:6893 udp
FR 178.33.161.33:6893 udp
FR 178.33.161.34:6893 udp
FR 178.33.161.35:6893 udp
FR 178.33.161.36:6893 udp
FR 178.33.161.37:6893 udp
FR 178.33.161.38:6893 udp
FR 178.33.161.39:6893 udp
FR 178.33.161.40:6893 udp
FR 178.33.161.41:6893 udp
FR 178.33.161.42:6893 udp
FR 178.33.161.43:6893 udp
FR 178.33.161.44:6893 udp
FR 178.33.161.45:6893 udp
FR 178.33.161.46:6893 udp
FR 178.33.161.47:6893 udp
FR 178.33.161.48:6893 udp
FR 178.33.161.49:6893 udp
FR 178.33.161.50:6893 udp
FR 178.33.161.51:6893 udp
FR 178.33.161.52:6893 udp
FR 178.33.161.53:6893 udp
FR 178.33.161.54:6893 udp
FR 178.33.161.55:6893 udp
FR 178.33.161.56:6893 udp
FR 178.33.161.57:6893 udp
FR 178.33.161.58:6893 udp
FR 178.33.161.59:6893 udp
FR 178.33.161.60:6893 udp
FR 178.33.161.61:6893 udp
FR 178.33.161.62:6893 udp
FR 178.33.161.63:6893 udp
FR 178.33.161.64:6893 udp
FR 178.33.161.65:6893 udp
FR 178.33.161.66:6893 udp
FR 178.33.161.67:6893 udp
FR 178.33.161.68:6893 udp
FR 178.33.161.69:6893 udp
FR 178.33.161.70:6893 udp
FR 178.33.161.71:6893 udp
FR 178.33.161.72:6893 udp
FR 178.33.161.73:6893 udp
FR 178.33.161.74:6893 udp
FR 178.33.161.75:6893 udp
FR 178.33.161.76:6893 udp
FR 178.33.161.77:6893 udp
FR 178.33.161.78:6893 udp
FR 178.33.161.79:6893 udp
FR 178.33.161.80:6893 udp
FR 178.33.161.81:6893 udp
FR 178.33.161.82:6893 udp
FR 178.33.161.83:6893 udp
FR 178.33.161.84:6893 udp
FR 178.33.161.85:6893 udp
FR 178.33.161.86:6893 udp
FR 178.33.161.87:6893 udp
FR 178.33.161.88:6893 udp
FR 178.33.161.89:6893 udp
FR 178.33.161.90:6893 udp
FR 178.33.161.91:6893 udp
FR 178.33.161.92:6893 udp
FR 178.33.161.93:6893 udp
FR 178.33.161.94:6893 udp
FR 178.33.161.95:6893 udp
FR 178.33.161.96:6893 udp
FR 178.33.161.97:6893 udp
FR 178.33.161.98:6893 udp
FR 178.33.161.99:6893 udp
FR 178.33.161.100:6893 udp
FR 178.33.161.101:6893 udp
FR 178.33.161.102:6893 udp
FR 178.33.161.103:6893 udp
FR 178.33.161.104:6893 udp
FR 178.33.161.105:6893 udp
FR 178.33.161.106:6893 udp
FR 178.33.161.107:6893 udp
FR 178.33.161.108:6893 udp
FR 178.33.161.109:6893 udp
FR 178.33.161.110:6893 udp
FR 178.33.161.111:6893 udp
FR 178.33.161.112:6893 udp
FR 178.33.161.113:6893 udp
FR 178.33.161.114:6893 udp
FR 178.33.161.115:6893 udp
FR 178.33.161.116:6893 udp
FR 178.33.161.117:6893 udp
FR 178.33.161.118:6893 udp
FR 178.33.161.119:6893 udp
FR 178.33.161.120:6893 udp
FR 178.33.161.121:6893 udp
FR 178.33.161.122:6893 udp
FR 178.33.161.123:6893 udp
FR 178.33.161.124:6893 udp
FR 178.33.161.125:6893 udp
FR 178.33.161.126:6893 udp
FR 178.33.161.127:6893 udp
FR 178.33.161.128:6893 udp
FR 178.33.161.129:6893 udp
FR 178.33.161.130:6893 udp
FR 178.33.161.131:6893 udp
FR 178.33.161.132:6893 udp
FR 178.33.161.133:6893 udp
FR 178.33.161.134:6893 udp
FR 178.33.161.135:6893 udp
FR 178.33.161.136:6893 udp
FR 178.33.161.137:6893 udp
FR 178.33.161.138:6893 udp
FR 178.33.161.139:6893 udp
FR 178.33.161.140:6893 udp
FR 178.33.161.141:6893 udp
FR 178.33.161.142:6893 udp
FR 178.33.161.143:6893 udp
FR 178.33.161.144:6893 udp
FR 178.33.161.145:6893 udp
FR 178.33.161.146:6893 udp
FR 178.33.161.147:6893 udp
FR 178.33.161.148:6893 udp
FR 178.33.161.149:6893 udp
FR 178.33.161.150:6893 udp
FR 178.33.161.151:6893 udp
FR 178.33.161.152:6893 udp
FR 178.33.161.153:6893 udp
FR 178.33.161.154:6893 udp
FR 178.33.161.155:6893 udp
FR 178.33.161.156:6893 udp
FR 178.33.161.157:6893 udp
FR 178.33.161.158:6893 udp
FR 178.33.161.159:6893 udp
FR 178.33.161.160:6893 udp
FR 178.33.161.161:6893 udp
FR 178.33.161.162:6893 udp
FR 178.33.161.163:6893 udp
FR 178.33.161.164:6893 udp
FR 178.33.161.165:6893 udp
FR 178.33.161.166:6893 udp
FR 178.33.161.167:6893 udp
FR 178.33.161.168:6893 udp
FR 178.33.161.169:6893 udp
FR 178.33.161.170:6893 udp
FR 178.33.161.171:6893 udp
FR 178.33.161.172:6893 udp
FR 178.33.161.173:6893 udp
FR 178.33.161.174:6893 udp
FR 178.33.161.175:6893 udp
FR 178.33.161.176:6893 udp
FR 178.33.161.177:6893 udp
FR 178.33.161.178:6893 udp
FR 178.33.161.179:6893 udp
FR 178.33.161.180:6893 udp
FR 178.33.161.181:6893 udp
FR 178.33.161.182:6893 udp
FR 178.33.161.183:6893 udp
FR 178.33.161.184:6893 udp
FR 178.33.161.185:6893 udp
FR 178.33.161.186:6893 udp
FR 178.33.161.187:6893 udp
FR 178.33.161.188:6893 udp
FR 178.33.161.189:6893 udp
FR 178.33.161.190:6893 udp
FR 178.33.161.191:6893 udp
FR 178.33.161.192:6893 udp
FR 178.33.161.193:6893 udp
FR 178.33.161.194:6893 udp
FR 178.33.161.195:6893 udp
FR 178.33.161.196:6893 udp
FR 178.33.161.197:6893 udp
FR 178.33.161.198:6893 udp
FR 178.33.161.199:6893 udp
FR 178.33.161.200:6893 udp
FR 178.33.161.201:6893 udp
FR 178.33.161.202:6893 udp
FR 178.33.161.203:6893 udp
FR 178.33.161.204:6893 udp
FR 178.33.161.205:6893 udp
FR 178.33.161.206:6893 udp
FR 178.33.161.207:6893 udp
FR 178.33.161.208:6893 udp
FR 178.33.161.209:6893 udp
FR 178.33.161.210:6893 udp
FR 178.33.161.211:6893 udp
FR 178.33.161.212:6893 udp
FR 178.33.161.213:6893 udp
FR 178.33.161.214:6893 udp
FR 178.33.161.215:6893 udp
FR 178.33.161.216:6893 udp
FR 178.33.161.217:6893 udp
FR 178.33.161.218:6893 udp
FR 178.33.161.219:6893 udp
FR 178.33.161.220:6893 udp
FR 178.33.161.221:6893 udp
FR 178.33.161.222:6893 udp
FR 178.33.161.223:6893 udp
FR 178.33.161.224:6893 udp
FR 178.33.161.225:6893 udp
FR 178.33.161.226:6893 udp
FR 178.33.161.227:6893 udp
FR 178.33.161.228:6893 udp
FR 178.33.161.229:6893 udp
FR 178.33.161.230:6893 udp
FR 178.33.161.231:6893 udp
FR 178.33.161.232:6893 udp
FR 178.33.161.233:6893 udp
FR 178.33.161.234:6893 udp
FR 178.33.161.235:6893 udp
FR 178.33.161.236:6893 udp
FR 178.33.161.237:6893 udp
FR 178.33.161.238:6893 udp
FR 178.33.161.239:6893 udp
FR 178.33.161.240:6893 udp
FR 178.33.161.241:6893 udp
FR 178.33.161.242:6893 udp
FR 178.33.161.243:6893 udp
FR 178.33.161.244:6893 udp
FR 178.33.161.245:6893 udp
FR 178.33.161.246:6893 udp
FR 178.33.161.247:6893 udp
FR 178.33.161.248:6893 udp
FR 178.33.161.249:6893 udp
FR 178.33.161.250:6893 udp
FR 178.33.161.251:6893 udp
FR 178.33.161.252:6893 udp
FR 178.33.161.253:6893 udp
FR 178.33.161.254:6893 udp
US 8.8.8.8:53 255.160.33.178.in-addr.arpa udp
US 8.8.8.8:53 0.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 1.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 2.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 3.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 4.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 5.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 6.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 7.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 8.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 9.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 11.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 12.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 13.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 14.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 15.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 16.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 18.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 10.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 21.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 17.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 23.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 20.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 25.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 24.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 22.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 19.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 26.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 27.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 28.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 29.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 30.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 31.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 32.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 34.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 33.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 35.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 36.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 37.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 38.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 39.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 40.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 41.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 43.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 44.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 45.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 46.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 47.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 48.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 42.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 49.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 50.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 51.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 52.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 53.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 54.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 55.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 56.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 57.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 58.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 59.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 60.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 61.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 62.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 63.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 64.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 65.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 66.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 67.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 68.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 69.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 70.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 71.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 72.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 73.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 74.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 75.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 76.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 77.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 78.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 79.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 80.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 81.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 82.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 83.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 85.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 84.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 86.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 87.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 88.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 89.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 91.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 92.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 93.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 94.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 95.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 96.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 97.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 98.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 99.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 100.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 101.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 102.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 104.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 103.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 105.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 107.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 108.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 109.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 106.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 110.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 111.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 112.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 113.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 114.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 115.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 116.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 117.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 118.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 119.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 120.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 121.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 122.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 123.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 124.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 125.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 126.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 127.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 128.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 129.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 130.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 131.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 132.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 133.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 134.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 135.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 136.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 137.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 138.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 139.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 140.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 141.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 142.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 143.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 144.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 145.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 146.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 147.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 148.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 149.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 150.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 151.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 152.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 153.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 154.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 155.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 156.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 157.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 158.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 159.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 160.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 162.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 163.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 164.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 161.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 165.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 167.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 166.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 169.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 168.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 171.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 170.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 172.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 173.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 174.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 175.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 176.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 177.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 178.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 179.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 181.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 180.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 182.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 183.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 184.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 185.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 187.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 188.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 189.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 190.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 191.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 192.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 193.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 194.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 195.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 196.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 197.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 198.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 199.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 200.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 201.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 202.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 203.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 204.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 205.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 206.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 207.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 208.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 209.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 210.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 211.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 212.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 214.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 215.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 216.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 217.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 218.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 219.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 220.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 221.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 222.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 223.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 224.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 225.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 226.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 227.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 228.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 229.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 230.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 231.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 232.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 233.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 234.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 235.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 236.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 237.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 238.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 239.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 241.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 242.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 243.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 244.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 245.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 246.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 247.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 248.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 249.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 251.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 250.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 252.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 253.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 254.161.33.178.in-addr.arpa udp
FR 178.33.161.255:6893 udp
FR 178.33.162.0:6893 udp
FR 178.33.162.1:6893 udp
FR 178.33.162.2:6893 udp
FR 178.33.162.3:6893 udp
FR 178.33.162.4:6893 udp
FR 178.33.162.5:6893 udp
FR 178.33.162.6:6893 udp
FR 178.33.162.7:6893 udp
FR 178.33.162.8:6893 udp
FR 178.33.162.9:6893 udp
FR 178.33.162.10:6893 udp
FR 178.33.162.11:6893 udp
FR 178.33.162.12:6893 udp
FR 178.33.162.13:6893 udp
FR 178.33.162.14:6893 udp
FR 178.33.162.15:6893 udp
FR 178.33.162.16:6893 udp
FR 178.33.162.17:6893 udp
FR 178.33.162.18:6893 udp
FR 178.33.162.19:6893 udp
FR 178.33.162.20:6893 udp
FR 178.33.162.21:6893 udp
FR 178.33.162.22:6893 udp
FR 178.33.162.23:6893 udp
FR 178.33.162.24:6893 udp
FR 178.33.162.25:6893 udp
FR 178.33.162.26:6893 udp
FR 178.33.162.27:6893 udp
FR 178.33.162.28:6893 udp
FR 178.33.162.29:6893 udp
FR 178.33.162.30:6893 udp
FR 178.33.162.31:6893 udp
FR 178.33.162.32:6893 udp
FR 178.33.162.33:6893 udp
FR 178.33.162.34:6893 udp
FR 178.33.162.35:6893 udp
FR 178.33.162.36:6893 udp
FR 178.33.162.37:6893 udp
FR 178.33.162.38:6893 udp
FR 178.33.162.39:6893 udp
FR 178.33.162.40:6893 udp
FR 178.33.162.41:6893 udp
FR 178.33.162.42:6893 udp
FR 178.33.162.43:6893 udp
FR 178.33.162.44:6893 udp
FR 178.33.162.45:6893 udp
FR 178.33.162.46:6893 udp
FR 178.33.162.47:6893 udp
FR 178.33.162.48:6893 udp
FR 178.33.162.49:6893 udp
FR 178.33.162.50:6893 udp
FR 178.33.162.51:6893 udp
FR 178.33.162.52:6893 udp
FR 178.33.162.53:6893 udp
FR 178.33.162.54:6893 udp
FR 178.33.162.55:6893 udp
FR 178.33.162.56:6893 udp
FR 178.33.162.57:6893 udp
FR 178.33.162.58:6893 udp
FR 178.33.162.59:6893 udp
FR 178.33.162.60:6893 udp
FR 178.33.162.61:6893 udp
FR 178.33.162.62:6893 udp
FR 178.33.162.63:6893 udp
FR 178.33.162.64:6893 udp
FR 178.33.162.65:6893 udp
FR 178.33.162.66:6893 udp
FR 178.33.162.67:6893 udp
FR 178.33.162.68:6893 udp
FR 178.33.162.69:6893 udp
FR 178.33.162.70:6893 udp
FR 178.33.162.71:6893 udp
FR 178.33.162.72:6893 udp
FR 178.33.162.73:6893 udp
FR 178.33.162.74:6893 udp
FR 178.33.162.75:6893 udp
FR 178.33.162.76:6893 udp
FR 178.33.162.77:6893 udp
FR 178.33.162.78:6893 udp
FR 178.33.162.79:6893 udp
FR 178.33.162.80:6893 udp
FR 178.33.162.81:6893 udp
FR 178.33.162.82:6893 udp
FR 178.33.162.83:6893 udp
FR 178.33.162.84:6893 udp
FR 178.33.162.85:6893 udp
FR 178.33.162.86:6893 udp
FR 178.33.162.87:6893 udp
FR 178.33.162.88:6893 udp
FR 178.33.162.89:6893 udp
FR 178.33.162.90:6893 udp
FR 178.33.162.91:6893 udp
FR 178.33.162.92:6893 udp
FR 178.33.162.93:6893 udp
FR 178.33.162.94:6893 udp
FR 178.33.162.95:6893 udp
FR 178.33.162.96:6893 udp
FR 178.33.162.97:6893 udp
FR 178.33.162.98:6893 udp
FR 178.33.162.99:6893 udp
FR 178.33.162.100:6893 udp
FR 178.33.162.101:6893 udp
FR 178.33.162.102:6893 udp
FR 178.33.162.103:6893 udp
FR 178.33.162.104:6893 udp
FR 178.33.162.105:6893 udp
FR 178.33.162.106:6893 udp
FR 178.33.162.107:6893 udp
FR 178.33.162.108:6893 udp
FR 178.33.162.109:6893 udp
FR 178.33.162.110:6893 udp
FR 178.33.162.111:6893 udp
FR 178.33.162.112:6893 udp
FR 178.33.162.113:6893 udp
FR 178.33.162.114:6893 udp
FR 178.33.162.115:6893 udp
FR 178.33.162.116:6893 udp
FR 178.33.162.117:6893 udp
FR 178.33.162.118:6893 udp
FR 178.33.162.119:6893 udp
FR 178.33.162.120:6893 udp
FR 178.33.162.121:6893 udp
FR 178.33.162.122:6893 udp
FR 178.33.162.123:6893 udp
FR 178.33.162.124:6893 udp
FR 178.33.162.125:6893 udp
FR 178.33.162.126:6893 udp
FR 178.33.162.127:6893 udp
FR 178.33.162.128:6893 udp
FR 178.33.162.129:6893 udp
FR 178.33.162.130:6893 udp
FR 178.33.162.131:6893 udp
FR 178.33.162.132:6893 udp
FR 178.33.162.133:6893 udp
FR 178.33.162.134:6893 udp
FR 178.33.162.135:6893 udp
FR 178.33.162.136:6893 udp
FR 178.33.162.137:6893 udp
FR 178.33.162.138:6893 udp
FR 178.33.162.139:6893 udp
FR 178.33.162.140:6893 udp
FR 178.33.162.141:6893 udp
FR 178.33.162.142:6893 udp
FR 178.33.162.143:6893 udp
FR 178.33.162.144:6893 udp
FR 178.33.162.145:6893 udp
FR 178.33.162.146:6893 udp
FR 178.33.162.147:6893 udp
FR 178.33.162.148:6893 udp
FR 178.33.162.149:6893 udp
FR 178.33.162.150:6893 udp
FR 178.33.162.151:6893 udp
FR 178.33.162.152:6893 udp
FR 178.33.162.153:6893 udp
FR 178.33.162.154:6893 udp
FR 178.33.162.155:6893 udp
FR 178.33.162.156:6893 udp
FR 178.33.162.157:6893 udp
FR 178.33.162.158:6893 udp
FR 178.33.162.159:6893 udp
FR 178.33.162.160:6893 udp
FR 178.33.162.161:6893 udp
FR 178.33.162.162:6893 udp
FR 178.33.162.163:6893 udp
FR 178.33.162.164:6893 udp
FR 178.33.162.165:6893 udp
FR 178.33.162.166:6893 udp
FR 178.33.162.167:6893 udp
FR 178.33.162.168:6893 udp
FR 178.33.162.169:6893 udp
FR 178.33.162.170:6893 udp
FR 178.33.162.171:6893 udp
FR 178.33.162.172:6893 udp
FR 178.33.162.173:6893 udp
FR 178.33.162.174:6893 udp
FR 178.33.162.175:6893 udp
FR 178.33.162.176:6893 udp
FR 178.33.162.177:6893 udp
FR 178.33.162.178:6893 udp
FR 178.33.162.179:6893 udp
FR 178.33.162.180:6893 udp
FR 178.33.162.181:6893 udp
FR 178.33.162.182:6893 udp
FR 178.33.162.183:6893 udp
FR 178.33.162.184:6893 udp
FR 178.33.162.185:6893 udp
FR 178.33.162.186:6893 udp
FR 178.33.162.187:6893 udp
FR 178.33.162.188:6893 udp
FR 178.33.162.189:6893 udp
FR 178.33.162.190:6893 udp
FR 178.33.162.191:6893 udp
FR 178.33.162.192:6893 udp
FR 178.33.162.193:6893 udp
FR 178.33.162.194:6893 udp
FR 178.33.162.195:6893 udp
FR 178.33.162.196:6893 udp
FR 178.33.162.197:6893 udp
FR 178.33.162.198:6893 udp
FR 178.33.162.199:6893 udp
FR 178.33.162.200:6893 udp
FR 178.33.162.201:6893 udp
FR 178.33.162.202:6893 udp
FR 178.33.162.203:6893 udp
FR 178.33.162.204:6893 udp
FR 178.33.162.205:6893 udp
FR 178.33.162.206:6893 udp
FR 178.33.162.207:6893 udp
FR 178.33.162.208:6893 udp
FR 178.33.162.209:6893 udp
FR 178.33.162.210:6893 udp
FR 178.33.162.211:6893 udp
FR 178.33.162.212:6893 udp
FR 178.33.162.213:6893 udp
FR 178.33.162.214:6893 udp
FR 178.33.162.215:6893 udp
FR 178.33.162.216:6893 udp
FR 178.33.162.217:6893 udp
FR 178.33.162.218:6893 udp
FR 178.33.162.219:6893 udp
FR 178.33.162.220:6893 udp
FR 178.33.162.221:6893 udp
FR 178.33.162.222:6893 udp
FR 178.33.162.223:6893 udp
FR 178.33.162.224:6893 udp
FR 178.33.162.225:6893 udp
FR 178.33.162.226:6893 udp
FR 178.33.162.227:6893 udp
FR 178.33.162.228:6893 udp
FR 178.33.162.229:6893 udp
FR 178.33.162.230:6893 udp
FR 178.33.162.231:6893 udp
FR 178.33.162.232:6893 udp
FR 178.33.162.233:6893 udp
FR 178.33.162.234:6893 udp
FR 178.33.162.235:6893 udp
FR 178.33.162.236:6893 udp
FR 178.33.162.237:6893 udp
FR 178.33.162.238:6893 udp
FR 178.33.162.239:6893 udp
FR 178.33.162.240:6893 udp
FR 178.33.162.241:6893 udp
FR 178.33.162.242:6893 udp
FR 178.33.162.243:6893 udp
FR 178.33.162.244:6893 udp
FR 178.33.162.245:6893 udp
FR 178.33.162.246:6893 udp
FR 178.33.162.247:6893 udp
FR 178.33.162.248:6893 udp
FR 178.33.162.249:6893 udp
FR 178.33.162.250:6893 udp
FR 178.33.162.251:6893 udp
FR 178.33.162.252:6893 udp
FR 178.33.162.253:6893 udp
FR 178.33.162.254:6893 udp
US 8.8.8.8:53 255.161.33.178.in-addr.arpa udp
US 8.8.8.8:53 1.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 0.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 2.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 3.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 5.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 4.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 6.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 7.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 8.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 9.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 10.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 12.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 11.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 15.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 14.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 16.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 17.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 18.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 19.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 20.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 21.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 22.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 23.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 24.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 25.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 26.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 27.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 28.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 29.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 31.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 30.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 33.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 32.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 34.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 36.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 35.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 37.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 38.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 39.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 40.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 41.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 42.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 43.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 44.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 46.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 45.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 47.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 48.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 49.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 50.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 51.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 52.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 53.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 54.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 55.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 56.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 57.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 58.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 59.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 60.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 61.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 62.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 63.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 64.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 65.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 66.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 67.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 68.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 69.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 70.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 72.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 73.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 71.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 75.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 76.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 77.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 78.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 79.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 80.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 81.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 82.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 83.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 84.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 85.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 86.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 87.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 88.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 89.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 90.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 91.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 92.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 93.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 94.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 95.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 96.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 97.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 98.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 99.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 100.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 101.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 102.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 103.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 104.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 105.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 106.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 107.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 108.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 109.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 110.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 111.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 112.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 113.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 114.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 115.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 116.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 117.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 118.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 119.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 120.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 121.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 122.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 123.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 124.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 125.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 126.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 127.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 128.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 129.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 130.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 131.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 132.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 133.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 134.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 136.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 135.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 137.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 138.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 139.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 140.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 141.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 142.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 143.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 144.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 145.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 146.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 147.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 148.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 149.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 150.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 151.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 152.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 153.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 154.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 155.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 156.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 157.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 158.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 159.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 160.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 161.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 162.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 163.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 164.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 165.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 166.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 167.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 168.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 169.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 170.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 171.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 172.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 173.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 174.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 175.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 176.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 177.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 178.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 179.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 180.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 181.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 182.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 183.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 184.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 185.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 186.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 187.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 188.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 189.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 191.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 192.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 193.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 194.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 195.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 196.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 197.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 198.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 199.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 200.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 201.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 202.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 203.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 204.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 205.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 207.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 206.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 208.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 209.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 210.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 211.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 212.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 213.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 214.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 215.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 216.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 217.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 218.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 219.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 220.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 221.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 222.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 223.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 224.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 225.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 226.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 227.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 228.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 229.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 230.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 231.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 232.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 233.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 234.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 235.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 236.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 238.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 239.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 240.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 241.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 242.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 243.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 244.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 245.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 246.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 247.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 248.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 249.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 250.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 251.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 252.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 253.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 254.162.33.178.in-addr.arpa udp
FR 178.33.162.255:6893 udp
FR 178.33.163.0:6893 udp
FR 178.33.163.1:6893 udp
FR 178.33.163.2:6893 udp
FR 178.33.163.3:6893 udp
FR 178.33.163.4:6893 udp
FR 178.33.163.5:6893 udp
FR 178.33.163.6:6893 udp
FR 178.33.163.7:6893 udp
FR 178.33.163.8:6893 udp
FR 178.33.163.9:6893 udp
FR 178.33.163.10:6893 udp
FR 178.33.163.11:6893 udp
FR 178.33.163.12:6893 udp
FR 178.33.163.13:6893 udp
FR 178.33.163.14:6893 udp
FR 178.33.163.15:6893 udp
FR 178.33.163.16:6893 udp
FR 178.33.163.17:6893 udp
FR 178.33.163.18:6893 udp
FR 178.33.163.19:6893 udp
FR 178.33.163.20:6893 udp
FR 178.33.163.21:6893 udp
FR 178.33.163.22:6893 udp
FR 178.33.163.23:6893 udp
FR 178.33.163.24:6893 udp
FR 178.33.163.25:6893 udp
FR 178.33.163.26:6893 udp
FR 178.33.163.27:6893 udp
FR 178.33.163.28:6893 udp
FR 178.33.163.29:6893 udp
FR 178.33.163.30:6893 udp
FR 178.33.163.31:6893 udp
FR 178.33.163.32:6893 udp
FR 178.33.163.33:6893 udp
FR 178.33.163.34:6893 udp
FR 178.33.163.35:6893 udp
FR 178.33.163.36:6893 udp
FR 178.33.163.37:6893 udp
FR 178.33.163.38:6893 udp
FR 178.33.163.39:6893 udp
FR 178.33.163.40:6893 udp
FR 178.33.163.41:6893 udp
FR 178.33.163.42:6893 udp
FR 178.33.163.43:6893 udp
FR 178.33.163.44:6893 udp
FR 178.33.163.45:6893 udp
FR 178.33.163.46:6893 udp
FR 178.33.163.47:6893 udp
FR 178.33.163.48:6893 udp
FR 178.33.163.49:6893 udp
FR 178.33.163.50:6893 udp
FR 178.33.163.51:6893 udp
FR 178.33.163.52:6893 udp
FR 178.33.163.53:6893 udp
FR 178.33.163.54:6893 udp
FR 178.33.163.55:6893 udp
FR 178.33.163.56:6893 udp
FR 178.33.163.57:6893 udp
FR 178.33.163.58:6893 udp
FR 178.33.163.59:6893 udp
FR 178.33.163.60:6893 udp
FR 178.33.163.61:6893 udp
FR 178.33.163.62:6893 udp
FR 178.33.163.63:6893 udp
FR 178.33.163.64:6893 udp
FR 178.33.163.65:6893 udp
FR 178.33.163.66:6893 udp
FR 178.33.163.67:6893 udp
FR 178.33.163.68:6893 udp
FR 178.33.163.69:6893 udp
FR 178.33.163.70:6893 udp
FR 178.33.163.71:6893 udp
FR 178.33.163.72:6893 udp
FR 178.33.163.73:6893 udp
FR 178.33.163.74:6893 udp
FR 178.33.163.75:6893 udp
FR 178.33.163.76:6893 udp
FR 178.33.163.77:6893 udp
FR 178.33.163.78:6893 udp
FR 178.33.163.79:6893 udp
FR 178.33.163.80:6893 udp
FR 178.33.163.81:6893 udp
FR 178.33.163.82:6893 udp
FR 178.33.163.83:6893 udp
FR 178.33.163.84:6893 udp
FR 178.33.163.85:6893 udp
FR 178.33.163.86:6893 udp
FR 178.33.163.87:6893 udp
FR 178.33.163.88:6893 udp
FR 178.33.163.89:6893 udp
FR 178.33.163.90:6893 udp
FR 178.33.163.91:6893 udp
FR 178.33.163.92:6893 udp
FR 178.33.163.93:6893 udp
FR 178.33.163.94:6893 udp
FR 178.33.163.95:6893 udp
FR 178.33.163.96:6893 udp
FR 178.33.163.97:6893 udp
FR 178.33.163.98:6893 udp
FR 178.33.163.99:6893 udp
FR 178.33.163.100:6893 udp
FR 178.33.163.101:6893 udp
FR 178.33.163.102:6893 udp
FR 178.33.163.103:6893 udp
FR 178.33.163.104:6893 udp
FR 178.33.163.105:6893 udp
FR 178.33.163.106:6893 udp
FR 178.33.163.107:6893 udp
FR 178.33.163.108:6893 udp
FR 178.33.163.109:6893 udp
FR 178.33.163.110:6893 udp
FR 178.33.163.111:6893 udp
FR 178.33.163.112:6893 udp
FR 178.33.163.113:6893 udp
FR 178.33.163.114:6893 udp
FR 178.33.163.115:6893 udp
FR 178.33.163.116:6893 udp
FR 178.33.163.117:6893 udp
FR 178.33.163.118:6893 udp
FR 178.33.163.119:6893 udp
FR 178.33.163.120:6893 udp
FR 178.33.163.121:6893 udp
FR 178.33.163.122:6893 udp
FR 178.33.163.123:6893 udp
FR 178.33.163.124:6893 udp
FR 178.33.163.125:6893 udp
FR 178.33.163.126:6893 udp
FR 178.33.163.127:6893 udp
FR 178.33.163.128:6893 udp
FR 178.33.163.129:6893 udp
FR 178.33.163.130:6893 udp
FR 178.33.163.131:6893 udp
FR 178.33.163.132:6893 udp
FR 178.33.163.133:6893 udp
FR 178.33.163.134:6893 udp
FR 178.33.163.135:6893 udp
FR 178.33.163.136:6893 udp
FR 178.33.163.137:6893 udp
FR 178.33.163.138:6893 udp
FR 178.33.163.139:6893 udp
FR 178.33.163.140:6893 udp
FR 178.33.163.141:6893 udp
FR 178.33.163.142:6893 udp
FR 178.33.163.143:6893 udp
FR 178.33.163.144:6893 udp
FR 178.33.163.145:6893 udp
FR 178.33.163.146:6893 udp
FR 178.33.163.147:6893 udp
FR 178.33.163.148:6893 udp
FR 178.33.163.149:6893 udp
FR 178.33.163.150:6893 udp
FR 178.33.163.151:6893 udp
FR 178.33.163.152:6893 udp
FR 178.33.163.153:6893 udp
FR 178.33.163.154:6893 udp
FR 178.33.163.155:6893 udp
FR 178.33.163.156:6893 udp
FR 178.33.163.157:6893 udp
FR 178.33.163.158:6893 udp
FR 178.33.163.159:6893 udp
FR 178.33.163.160:6893 udp
FR 178.33.163.161:6893 udp
FR 178.33.163.162:6893 udp
FR 178.33.163.163:6893 udp
FR 178.33.163.164:6893 udp
FR 178.33.163.165:6893 udp
FR 178.33.163.166:6893 udp
FR 178.33.163.167:6893 udp
FR 178.33.163.168:6893 udp
FR 178.33.163.169:6893 udp
FR 178.33.163.170:6893 udp
FR 178.33.163.171:6893 udp
FR 178.33.163.172:6893 udp
FR 178.33.163.173:6893 udp
FR 178.33.163.174:6893 udp
FR 178.33.163.175:6893 udp
FR 178.33.163.176:6893 udp
FR 178.33.163.177:6893 udp
FR 178.33.163.178:6893 udp
FR 178.33.163.179:6893 udp
FR 178.33.163.180:6893 udp
FR 178.33.163.181:6893 udp
FR 178.33.163.182:6893 udp
FR 178.33.163.183:6893 udp
FR 178.33.163.184:6893 udp
FR 178.33.163.185:6893 udp
FR 178.33.163.186:6893 udp
FR 178.33.163.187:6893 udp
FR 178.33.163.188:6893 udp
FR 178.33.163.189:6893 udp
FR 178.33.163.190:6893 udp
FR 178.33.163.191:6893 udp
FR 178.33.163.192:6893 udp
FR 178.33.163.193:6893 udp
FR 178.33.163.194:6893 udp
FR 178.33.163.195:6893 udp
FR 178.33.163.196:6893 udp
FR 178.33.163.197:6893 udp
FR 178.33.163.198:6893 udp
FR 178.33.163.199:6893 udp
FR 178.33.163.200:6893 udp
FR 178.33.163.201:6893 udp
FR 178.33.163.202:6893 udp
FR 178.33.163.203:6893 udp
FR 178.33.163.204:6893 udp
FR 178.33.163.205:6893 udp
FR 178.33.163.206:6893 udp
FR 178.33.163.207:6893 udp
FR 178.33.163.208:6893 udp
FR 178.33.163.209:6893 udp
FR 178.33.163.210:6893 udp
FR 178.33.163.211:6893 udp
FR 178.33.163.212:6893 udp
FR 178.33.163.213:6893 udp
FR 178.33.163.214:6893 udp
FR 178.33.163.215:6893 udp
FR 178.33.163.216:6893 udp
FR 178.33.163.217:6893 udp
FR 178.33.163.218:6893 udp
FR 178.33.163.219:6893 udp
FR 178.33.163.220:6893 udp
FR 178.33.163.221:6893 udp
FR 178.33.163.222:6893 udp
FR 178.33.163.223:6893 udp
FR 178.33.163.224:6893 udp
FR 178.33.163.225:6893 udp
FR 178.33.163.226:6893 udp
FR 178.33.163.227:6893 udp
FR 178.33.163.228:6893 udp
FR 178.33.163.229:6893 udp
FR 178.33.163.230:6893 udp
FR 178.33.163.231:6893 udp
FR 178.33.163.232:6893 udp
FR 178.33.163.233:6893 udp
FR 178.33.163.234:6893 udp
FR 178.33.163.235:6893 udp
FR 178.33.163.236:6893 udp
FR 178.33.163.237:6893 udp
FR 178.33.163.238:6893 udp
FR 178.33.163.239:6893 udp
FR 178.33.163.240:6893 udp
FR 178.33.163.241:6893 udp
FR 178.33.163.242:6893 udp
FR 178.33.163.243:6893 udp
FR 178.33.163.244:6893 udp
FR 178.33.163.245:6893 udp
FR 178.33.163.246:6893 udp
FR 178.33.163.247:6893 udp
FR 178.33.163.248:6893 udp
FR 178.33.163.249:6893 udp
FR 178.33.163.250:6893 udp
FR 178.33.163.251:6893 udp
FR 178.33.163.252:6893 udp
FR 178.33.163.253:6893 udp
FR 178.33.163.254:6893 udp
US 8.8.8.8:53 255.162.33.178.in-addr.arpa udp
US 8.8.8.8:53 0.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 1.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 2.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 3.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 4.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 5.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 6.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 7.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 9.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 8.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 10.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 11.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 12.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 13.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 14.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 16.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 17.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 20.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 19.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 18.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 23.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 22.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 24.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 26.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 29.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 27.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 28.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 30.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 33.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 32.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 34.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 31.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 36.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 35.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 37.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 38.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 40.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 41.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 43.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 42.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 44.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 45.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 47.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 48.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 46.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 50.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 51.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 52.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 53.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 54.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 55.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 56.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 57.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 58.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 59.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 60.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 61.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 62.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 63.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 64.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 65.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 67.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 68.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 66.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 69.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 70.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 72.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 71.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 73.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 74.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 75.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 77.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 76.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 78.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 79.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 80.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 82.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 81.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 84.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 83.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 85.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 86.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 88.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 89.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 90.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 91.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 93.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 92.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 94.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 95.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 96.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 97.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 98.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 99.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 100.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 101.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 102.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 103.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 104.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 105.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 106.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 107.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 108.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 109.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 110.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 111.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 112.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 113.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 115.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 117.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 118.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 119.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 120.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 121.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 122.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 123.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 124.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 126.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 127.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 128.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 129.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 130.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 131.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 132.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 133.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 134.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 135.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 136.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 137.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 138.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 139.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 140.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 141.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 142.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 143.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 144.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 145.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 146.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 147.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 148.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 149.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 150.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 151.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 152.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 153.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 154.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 155.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 156.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 157.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 158.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 160.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 159.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 161.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 163.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 162.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 164.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 165.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 166.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 167.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 169.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 171.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 172.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 173.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 174.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 175.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 176.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 177.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 178.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 179.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 180.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 181.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 182.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 183.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 184.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 185.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 186.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 187.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 188.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 189.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 190.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 191.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 192.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 193.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 195.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 194.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 196.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 197.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 198.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 200.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 201.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 202.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 203.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 204.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 205.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 207.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 208.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 209.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 210.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 212.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 211.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 213.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 214.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 215.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 216.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 217.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 218.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 219.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 220.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 221.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 222.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 223.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 224.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 225.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 226.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 227.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 229.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 230.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 231.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 232.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 233.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 234.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 235.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 236.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 237.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 238.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 239.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 240.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 241.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 242.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 243.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 244.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 245.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 246.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 247.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 248.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 249.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 251.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 252.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 253.163.33.178.in-addr.arpa udp
US 8.8.8.8:53 254.163.33.178.in-addr.arpa udp
FR 178.33.163.255:6893 udp
US 8.8.8.8:53 255.163.33.178.in-addr.arpa udp
FR 178.33.158.0:6893 udp
FR 178.33.158.1:6893 udp
FR 178.33.158.2:6893 udp
FR 178.33.158.3:6893 udp
FR 178.33.158.4:6893 udp
FR 178.33.158.5:6893 udp
FR 178.33.158.6:6893 udp
FR 178.33.158.7:6893 udp
FR 178.33.158.8:6893 udp
FR 178.33.158.9:6893 udp
FR 178.33.158.10:6893 udp
FR 178.33.158.11:6893 udp
FR 178.33.158.12:6893 udp
FR 178.33.158.13:6893 udp
FR 178.33.158.14:6893 udp
FR 178.33.158.15:6893 udp
FR 178.33.158.16:6893 udp
FR 178.33.158.17:6893 udp
FR 178.33.158.18:6893 udp
FR 178.33.158.19:6893 udp
FR 178.33.158.20:6893 udp
FR 178.33.158.21:6893 udp
FR 178.33.158.22:6893 udp
FR 178.33.158.23:6893 udp
FR 178.33.158.24:6893 udp
FR 178.33.158.25:6893 udp
FR 178.33.158.26:6893 udp
FR 178.33.158.27:6893 udp
FR 178.33.158.28:6893 udp
FR 178.33.158.29:6893 udp
FR 178.33.158.30:6893 udp
FR 178.33.158.31:6893 udp
FR 178.33.159.0:6893 udp
FR 178.33.159.1:6893 udp
FR 178.33.159.2:6893 udp
FR 178.33.159.3:6893 udp
FR 178.33.159.4:6893 udp
FR 178.33.159.5:6893 udp
FR 178.33.159.6:6893 udp
FR 178.33.159.7:6893 udp
FR 178.33.159.8:6893 udp
FR 178.33.159.9:6893 udp
FR 178.33.159.10:6893 udp
FR 178.33.159.11:6893 udp
FR 178.33.159.12:6893 udp
FR 178.33.159.13:6893 udp
FR 178.33.159.14:6893 udp
FR 178.33.159.15:6893 udp
FR 178.33.159.16:6893 udp
FR 178.33.159.17:6893 udp
FR 178.33.159.18:6893 udp
FR 178.33.159.19:6893 udp
FR 178.33.159.20:6893 udp
FR 178.33.159.21:6893 udp
FR 178.33.159.22:6893 udp
FR 178.33.159.23:6893 udp
FR 178.33.159.24:6893 udp
FR 178.33.159.25:6893 udp
FR 178.33.159.26:6893 udp
FR 178.33.159.27:6893 udp
FR 178.33.159.28:6893 udp
FR 178.33.159.29:6893 udp
FR 178.33.159.30:6893 udp
FR 178.33.159.31:6893 udp
FR 178.33.160.0:6893 udp
FR 178.33.160.1:6893 udp
FR 178.33.160.2:6893 udp
FR 178.33.160.3:6893 udp
FR 178.33.160.4:6893 udp
FR 178.33.160.5:6893 udp
FR 178.33.160.6:6893 udp
FR 178.33.160.7:6893 udp
FR 178.33.160.8:6893 udp
FR 178.33.160.9:6893 udp
FR 178.33.160.10:6893 udp
FR 178.33.160.11:6893 udp
FR 178.33.160.12:6893 udp
FR 178.33.160.13:6893 udp
FR 178.33.160.14:6893 udp
FR 178.33.160.15:6893 udp
FR 178.33.160.16:6893 udp
FR 178.33.160.17:6893 udp
FR 178.33.160.18:6893 udp
FR 178.33.160.19:6893 udp
FR 178.33.160.20:6893 udp
FR 178.33.160.21:6893 udp
FR 178.33.160.22:6893 udp
FR 178.33.160.23:6893 udp
FR 178.33.160.24:6893 udp
FR 178.33.160.25:6893 udp
FR 178.33.160.26:6893 udp
FR 178.33.160.27:6893 udp
FR 178.33.160.28:6893 udp
FR 178.33.160.29:6893 udp
FR 178.33.160.30:6893 udp
FR 178.33.160.31:6893 udp
FR 178.33.160.32:6893 udp
FR 178.33.160.33:6893 udp
FR 178.33.160.34:6893 udp
FR 178.33.160.35:6893 udp
FR 178.33.160.36:6893 udp
FR 178.33.160.37:6893 udp
FR 178.33.160.38:6893 udp
FR 178.33.160.39:6893 udp
FR 178.33.160.40:6893 udp
FR 178.33.160.41:6893 udp
FR 178.33.160.42:6893 udp
FR 178.33.160.43:6893 udp
FR 178.33.160.44:6893 udp
FR 178.33.160.45:6893 udp
FR 178.33.160.46:6893 udp
FR 178.33.160.47:6893 udp
FR 178.33.160.48:6893 udp
FR 178.33.160.49:6893 udp
FR 178.33.160.50:6893 udp
FR 178.33.160.51:6893 udp
FR 178.33.160.52:6893 udp
FR 178.33.160.53:6893 udp
FR 178.33.160.54:6893 udp
FR 178.33.160.55:6893 udp
FR 178.33.160.56:6893 udp
FR 178.33.160.57:6893 udp
FR 178.33.160.58:6893 udp
FR 178.33.160.59:6893 udp
FR 178.33.160.60:6893 udp
FR 178.33.160.61:6893 udp
FR 178.33.160.62:6893 udp
FR 178.33.160.63:6893 udp
FR 178.33.160.64:6893 udp
FR 178.33.160.65:6893 udp
FR 178.33.160.66:6893 udp
FR 178.33.160.67:6893 udp
FR 178.33.160.68:6893 udp
FR 178.33.160.69:6893 udp
FR 178.33.160.70:6893 udp
FR 178.33.160.71:6893 udp
FR 178.33.160.72:6893 udp
FR 178.33.160.73:6893 udp
FR 178.33.160.74:6893 udp
FR 178.33.160.75:6893 udp
FR 178.33.160.76:6893 udp
FR 178.33.160.77:6893 udp
FR 178.33.160.78:6893 udp
FR 178.33.160.79:6893 udp
FR 178.33.160.80:6893 udp
FR 178.33.160.81:6893 udp
FR 178.33.160.82:6893 udp
FR 178.33.160.83:6893 udp
FR 178.33.160.84:6893 udp
FR 178.33.160.85:6893 udp
FR 178.33.160.86:6893 udp
FR 178.33.160.87:6893 udp
FR 178.33.160.88:6893 udp
FR 178.33.160.89:6893 udp
FR 178.33.160.90:6893 udp
FR 178.33.160.91:6893 udp
FR 178.33.160.92:6893 udp
FR 178.33.160.93:6893 udp
FR 178.33.160.94:6893 udp
FR 178.33.160.95:6893 udp
FR 178.33.160.96:6893 udp
FR 178.33.160.97:6893 udp
FR 178.33.160.98:6893 udp
FR 178.33.160.99:6893 udp
FR 178.33.160.100:6893 udp
FR 178.33.160.101:6893 udp
FR 178.33.160.102:6893 udp
FR 178.33.160.103:6893 udp
FR 178.33.160.104:6893 udp
FR 178.33.160.105:6893 udp
FR 178.33.160.106:6893 udp
FR 178.33.160.107:6893 udp
FR 178.33.160.108:6893 udp
FR 178.33.160.109:6893 udp
FR 178.33.160.110:6893 udp
FR 178.33.160.111:6893 udp
FR 178.33.160.112:6893 udp
FR 178.33.160.113:6893 udp
FR 178.33.160.114:6893 udp
FR 178.33.160.115:6893 udp
FR 178.33.160.116:6893 udp
FR 178.33.160.117:6893 udp
FR 178.33.160.118:6893 udp
FR 178.33.160.119:6893 udp
FR 178.33.160.120:6893 udp
FR 178.33.160.121:6893 udp
FR 178.33.160.122:6893 udp
FR 178.33.160.123:6893 udp
FR 178.33.160.124:6893 udp
FR 178.33.160.125:6893 udp
FR 178.33.160.126:6893 udp
FR 178.33.160.127:6893 udp
FR 178.33.160.128:6893 udp
FR 178.33.160.129:6893 udp
FR 178.33.160.130:6893 udp
FR 178.33.160.131:6893 udp
FR 178.33.160.132:6893 udp
FR 178.33.160.133:6893 udp
FR 178.33.160.134:6893 udp
FR 178.33.160.135:6893 udp
FR 178.33.160.136:6893 udp
FR 178.33.160.137:6893 udp
FR 178.33.160.138:6893 udp
FR 178.33.160.139:6893 udp
FR 178.33.160.140:6893 udp
FR 178.33.160.141:6893 udp
FR 178.33.160.142:6893 udp
FR 178.33.160.143:6893 udp
FR 178.33.160.144:6893 udp
FR 178.33.160.145:6893 udp
FR 178.33.160.146:6893 udp
FR 178.33.160.147:6893 udp
FR 178.33.160.148:6893 udp
FR 178.33.160.149:6893 udp
FR 178.33.160.150:6893 udp
FR 178.33.160.151:6893 udp
FR 178.33.160.152:6893 udp
FR 178.33.160.153:6893 udp
FR 178.33.160.154:6893 udp
FR 178.33.160.155:6893 udp
FR 178.33.160.156:6893 udp
FR 178.33.160.157:6893 udp
FR 178.33.160.158:6893 udp
FR 178.33.160.159:6893 udp
FR 178.33.160.160:6893 udp
FR 178.33.160.161:6893 udp
FR 178.33.160.162:6893 udp
FR 178.33.160.163:6893 udp
FR 178.33.160.164:6893 udp
FR 178.33.160.165:6893 udp
FR 178.33.160.166:6893 udp
FR 178.33.160.167:6893 udp
FR 178.33.160.168:6893 udp
FR 178.33.160.169:6893 udp
FR 178.33.160.170:6893 udp
FR 178.33.160.171:6893 udp
FR 178.33.160.172:6893 udp
FR 178.33.160.173:6893 udp
FR 178.33.160.174:6893 udp
FR 178.33.160.175:6893 udp
FR 178.33.160.176:6893 udp
FR 178.33.160.177:6893 udp
FR 178.33.160.178:6893 udp
FR 178.33.160.179:6893 udp
FR 178.33.160.180:6893 udp
FR 178.33.160.181:6893 udp
FR 178.33.160.182:6893 udp
FR 178.33.160.183:6893 udp
FR 178.33.160.184:6893 udp
FR 178.33.160.185:6893 udp
FR 178.33.160.186:6893 udp
FR 178.33.160.187:6893 udp
FR 178.33.160.188:6893 udp
FR 178.33.160.189:6893 udp
FR 178.33.160.190:6893 udp
FR 178.33.160.191:6893 udp
FR 178.33.160.192:6893 udp
FR 178.33.160.193:6893 udp
FR 178.33.160.194:6893 udp
FR 178.33.160.195:6893 udp
FR 178.33.160.196:6893 udp
FR 178.33.160.197:6893 udp
FR 178.33.160.198:6893 udp
FR 178.33.160.199:6893 udp
FR 178.33.160.200:6893 udp
FR 178.33.160.201:6893 udp
FR 178.33.160.202:6893 udp
FR 178.33.160.203:6893 udp
FR 178.33.160.204:6893 udp
FR 178.33.160.205:6893 udp
FR 178.33.160.206:6893 udp
FR 178.33.160.207:6893 udp
FR 178.33.160.208:6893 udp
FR 178.33.160.209:6893 udp
FR 178.33.160.210:6893 udp
FR 178.33.160.211:6893 udp
FR 178.33.160.212:6893 udp
FR 178.33.160.213:6893 udp
FR 178.33.160.214:6893 udp
FR 178.33.160.215:6893 udp
FR 178.33.160.216:6893 udp
FR 178.33.160.217:6893 udp
FR 178.33.160.218:6893 udp
FR 178.33.160.219:6893 udp
FR 178.33.160.220:6893 udp
FR 178.33.160.221:6893 udp
FR 178.33.160.222:6893 udp
FR 178.33.160.223:6893 udp
FR 178.33.160.224:6893 udp
FR 178.33.160.225:6893 udp
FR 178.33.160.226:6893 udp
FR 178.33.160.227:6893 udp
FR 178.33.160.228:6893 udp
FR 178.33.160.229:6893 udp
FR 178.33.160.230:6893 udp
FR 178.33.160.231:6893 udp
FR 178.33.160.232:6893 udp
FR 178.33.160.233:6893 udp
FR 178.33.160.234:6893 udp
FR 178.33.160.235:6893 udp
FR 178.33.160.236:6893 udp
FR 178.33.160.237:6893 udp
FR 178.33.160.238:6893 udp
FR 178.33.160.239:6893 udp
FR 178.33.160.240:6893 udp
FR 178.33.160.241:6893 udp
FR 178.33.160.242:6893 udp
FR 178.33.160.243:6893 udp
FR 178.33.160.244:6893 udp
FR 178.33.160.245:6893 udp
FR 178.33.160.246:6893 udp
FR 178.33.160.247:6893 udp
FR 178.33.160.248:6893 udp
FR 178.33.160.249:6893 udp
FR 178.33.160.250:6893 udp
FR 178.33.160.251:6893 udp
FR 178.33.160.252:6893 udp
FR 178.33.160.253:6893 udp
FR 178.33.160.254:6893 udp
FR 178.33.160.255:6893 udp
FR 178.33.161.0:6893 udp
FR 178.33.161.1:6893 udp
FR 178.33.161.2:6893 udp
FR 178.33.161.3:6893 udp
FR 178.33.161.4:6893 udp
FR 178.33.161.5:6893 udp
FR 178.33.161.6:6893 udp
FR 178.33.161.7:6893 udp
FR 178.33.161.8:6893 udp
FR 178.33.161.9:6893 udp
FR 178.33.161.10:6893 udp
FR 178.33.161.11:6893 udp
FR 178.33.161.12:6893 udp
FR 178.33.161.13:6893 udp
FR 178.33.161.14:6893 udp
FR 178.33.161.15:6893 udp
FR 178.33.161.16:6893 udp
FR 178.33.161.17:6893 udp
FR 178.33.161.18:6893 udp
FR 178.33.161.19:6893 udp
FR 178.33.161.20:6893 udp
FR 178.33.161.21:6893 udp
FR 178.33.161.22:6893 udp
FR 178.33.161.23:6893 udp
FR 178.33.161.24:6893 udp
FR 178.33.161.25:6893 udp
FR 178.33.161.26:6893 udp
FR 178.33.161.27:6893 udp
FR 178.33.161.28:6893 udp
FR 178.33.161.29:6893 udp
FR 178.33.161.30:6893 udp
FR 178.33.161.31:6893 udp
FR 178.33.161.32:6893 udp
FR 178.33.161.33:6893 udp
FR 178.33.161.34:6893 udp
FR 178.33.161.35:6893 udp
FR 178.33.161.36:6893 udp
FR 178.33.161.37:6893 udp
FR 178.33.161.38:6893 udp
FR 178.33.161.39:6893 udp
FR 178.33.161.40:6893 udp
FR 178.33.161.41:6893 udp
FR 178.33.161.42:6893 udp
FR 178.33.161.43:6893 udp
FR 178.33.161.44:6893 udp
FR 178.33.161.45:6893 udp
FR 178.33.161.46:6893 udp
FR 178.33.161.47:6893 udp
FR 178.33.161.48:6893 udp
FR 178.33.161.49:6893 udp
FR 178.33.161.50:6893 udp
FR 178.33.161.51:6893 udp
FR 178.33.161.52:6893 udp
FR 178.33.161.53:6893 udp
FR 178.33.161.54:6893 udp
FR 178.33.161.55:6893 udp
FR 178.33.161.56:6893 udp
FR 178.33.161.57:6893 udp
FR 178.33.161.58:6893 udp
FR 178.33.161.59:6893 udp
FR 178.33.161.60:6893 udp
FR 178.33.161.61:6893 udp
FR 178.33.161.62:6893 udp
FR 178.33.161.63:6893 udp
FR 178.33.161.64:6893 udp
FR 178.33.161.65:6893 udp
FR 178.33.161.66:6893 udp
FR 178.33.161.67:6893 udp
FR 178.33.161.68:6893 udp
FR 178.33.161.69:6893 udp
FR 178.33.161.70:6893 udp
FR 178.33.161.71:6893 udp
FR 178.33.161.72:6893 udp
FR 178.33.161.73:6893 udp
FR 178.33.161.74:6893 udp
FR 178.33.161.75:6893 udp
FR 178.33.161.76:6893 udp
FR 178.33.161.77:6893 udp
FR 178.33.161.78:6893 udp
FR 178.33.161.79:6893 udp
FR 178.33.161.80:6893 udp
FR 178.33.161.81:6893 udp
FR 178.33.161.82:6893 udp
FR 178.33.161.83:6893 udp
FR 178.33.161.84:6893 udp
FR 178.33.161.85:6893 udp
FR 178.33.161.86:6893 udp
FR 178.33.161.87:6893 udp
FR 178.33.161.88:6893 udp
FR 178.33.161.89:6893 udp
FR 178.33.161.90:6893 udp
FR 178.33.161.91:6893 udp
FR 178.33.161.92:6893 udp
FR 178.33.161.93:6893 udp
FR 178.33.161.94:6893 udp
FR 178.33.161.95:6893 udp
FR 178.33.161.96:6893 udp
FR 178.33.161.97:6893 udp
FR 178.33.161.98:6893 udp
FR 178.33.161.99:6893 udp
FR 178.33.161.100:6893 udp
FR 178.33.161.101:6893 udp
FR 178.33.161.102:6893 udp
FR 178.33.161.103:6893 udp
FR 178.33.161.104:6893 udp
FR 178.33.161.105:6893 udp
FR 178.33.161.106:6893 udp
FR 178.33.161.107:6893 udp
FR 178.33.161.108:6893 udp
FR 178.33.161.109:6893 udp
FR 178.33.161.110:6893 udp
FR 178.33.161.111:6893 udp
FR 178.33.161.112:6893 udp
FR 178.33.161.113:6893 udp
FR 178.33.161.114:6893 udp
FR 178.33.161.115:6893 udp
FR 178.33.161.116:6893 udp
FR 178.33.161.117:6893 udp
FR 178.33.161.118:6893 udp
FR 178.33.161.119:6893 udp
FR 178.33.161.120:6893 udp
FR 178.33.161.121:6893 udp
FR 178.33.161.122:6893 udp
FR 178.33.161.123:6893 udp
FR 178.33.161.124:6893 udp
FR 178.33.161.125:6893 udp
FR 178.33.161.126:6893 udp
FR 178.33.161.127:6893 udp
FR 178.33.161.128:6893 udp
FR 178.33.161.129:6893 udp
FR 178.33.161.130:6893 udp
FR 178.33.161.131:6893 udp
FR 178.33.161.132:6893 udp
FR 178.33.161.133:6893 udp
FR 178.33.161.134:6893 udp
FR 178.33.161.135:6893 udp
FR 178.33.161.136:6893 udp
FR 178.33.161.137:6893 udp
FR 178.33.161.138:6893 udp
FR 178.33.161.139:6893 udp
FR 178.33.161.140:6893 udp
FR 178.33.161.141:6893 udp
FR 178.33.161.142:6893 udp
FR 178.33.161.143:6893 udp
FR 178.33.161.144:6893 udp
FR 178.33.161.145:6893 udp
FR 178.33.161.146:6893 udp
FR 178.33.161.147:6893 udp
FR 178.33.161.148:6893 udp
FR 178.33.161.149:6893 udp
FR 178.33.161.150:6893 udp
FR 178.33.161.151:6893 udp
FR 178.33.161.152:6893 udp
FR 178.33.161.153:6893 udp
FR 178.33.161.154:6893 udp
FR 178.33.161.155:6893 udp
FR 178.33.161.156:6893 udp
FR 178.33.161.157:6893 udp
FR 178.33.161.158:6893 udp
FR 178.33.161.159:6893 udp
FR 178.33.161.160:6893 udp
FR 178.33.161.161:6893 udp
FR 178.33.161.162:6893 udp
FR 178.33.161.163:6893 udp
FR 178.33.161.164:6893 udp
FR 178.33.161.165:6893 udp
FR 178.33.161.166:6893 udp
FR 178.33.161.167:6893 udp
FR 178.33.161.168:6893 udp
FR 178.33.161.169:6893 udp
FR 178.33.161.170:6893 udp
FR 178.33.161.171:6893 udp
FR 178.33.161.172:6893 udp
FR 178.33.161.173:6893 udp
FR 178.33.161.174:6893 udp
FR 178.33.161.175:6893 udp
FR 178.33.161.176:6893 udp
FR 178.33.161.177:6893 udp
FR 178.33.161.178:6893 udp
FR 178.33.161.179:6893 udp
FR 178.33.161.180:6893 udp
FR 178.33.161.181:6893 udp
FR 178.33.161.182:6893 udp
FR 178.33.161.183:6893 udp
FR 178.33.161.184:6893 udp
FR 178.33.161.185:6893 udp
FR 178.33.161.186:6893 udp
FR 178.33.161.187:6893 udp
FR 178.33.161.188:6893 udp
FR 178.33.161.189:6893 udp
FR 178.33.161.190:6893 udp
FR 178.33.161.191:6893 udp
FR 178.33.161.192:6893 udp
FR 178.33.161.193:6893 udp
FR 178.33.161.194:6893 udp
FR 178.33.161.195:6893 udp
FR 178.33.161.196:6893 udp
FR 178.33.161.197:6893 udp
FR 178.33.161.198:6893 udp
FR 178.33.161.199:6893 udp
FR 178.33.161.200:6893 udp
FR 178.33.161.201:6893 udp
FR 178.33.161.202:6893 udp
FR 178.33.161.203:6893 udp
FR 178.33.161.204:6893 udp
FR 178.33.161.205:6893 udp
FR 178.33.161.206:6893 udp
FR 178.33.161.207:6893 udp
FR 178.33.161.208:6893 udp
FR 178.33.161.209:6893 udp
FR 178.33.161.210:6893 udp
FR 178.33.161.211:6893 udp
FR 178.33.161.212:6893 udp
FR 178.33.161.213:6893 udp
FR 178.33.161.214:6893 udp
FR 178.33.161.215:6893 udp
FR 178.33.161.216:6893 udp
FR 178.33.161.217:6893 udp
FR 178.33.161.218:6893 udp
FR 178.33.161.219:6893 udp
FR 178.33.161.220:6893 udp
FR 178.33.161.221:6893 udp
FR 178.33.161.222:6893 udp
FR 178.33.161.223:6893 udp
FR 178.33.161.224:6893 udp
FR 178.33.161.225:6893 udp
FR 178.33.161.226:6893 udp
FR 178.33.161.227:6893 udp
FR 178.33.161.228:6893 udp
FR 178.33.161.229:6893 udp
FR 178.33.161.230:6893 udp
FR 178.33.161.231:6893 udp
FR 178.33.161.232:6893 udp
FR 178.33.161.233:6893 udp
FR 178.33.161.234:6893 udp
FR 178.33.161.235:6893 udp
FR 178.33.161.236:6893 udp
FR 178.33.161.237:6893 udp
FR 178.33.161.238:6893 udp
FR 178.33.161.239:6893 udp
FR 178.33.161.240:6893 udp
FR 178.33.161.241:6893 udp
FR 178.33.161.242:6893 udp
FR 178.33.161.243:6893 udp
FR 178.33.161.244:6893 udp
FR 178.33.161.245:6893 udp
FR 178.33.161.246:6893 udp
FR 178.33.161.247:6893 udp
FR 178.33.161.248:6893 udp
FR 178.33.161.249:6893 udp
FR 178.33.161.250:6893 udp
FR 178.33.161.251:6893 udp
FR 178.33.161.252:6893 udp
FR 178.33.161.253:6893 udp
FR 178.33.161.254:6893 udp
FR 178.33.161.255:6893 udp
FR 178.33.162.0:6893 udp
FR 178.33.162.1:6893 udp
FR 178.33.162.2:6893 udp
FR 178.33.162.3:6893 udp
FR 178.33.162.4:6893 udp
FR 178.33.162.5:6893 udp
FR 178.33.162.6:6893 udp
FR 178.33.162.7:6893 udp
FR 178.33.162.8:6893 udp
FR 178.33.162.9:6893 udp
FR 178.33.162.10:6893 udp
FR 178.33.162.11:6893 udp
FR 178.33.162.12:6893 udp
FR 178.33.162.13:6893 udp
FR 178.33.162.14:6893 udp
FR 178.33.162.15:6893 udp
FR 178.33.162.16:6893 udp
FR 178.33.162.17:6893 udp
FR 178.33.162.18:6893 udp
FR 178.33.162.19:6893 udp
FR 178.33.162.20:6893 udp
FR 178.33.162.21:6893 udp
FR 178.33.162.22:6893 udp
FR 178.33.162.23:6893 udp
FR 178.33.162.24:6893 udp
FR 178.33.162.25:6893 udp
FR 178.33.162.26:6893 udp
FR 178.33.162.27:6893 udp
FR 178.33.162.28:6893 udp
FR 178.33.162.29:6893 udp
FR 178.33.162.30:6893 udp
FR 178.33.162.31:6893 udp
FR 178.33.162.32:6893 udp
FR 178.33.162.33:6893 udp
FR 178.33.162.34:6893 udp
FR 178.33.162.35:6893 udp
FR 178.33.162.36:6893 udp
FR 178.33.162.37:6893 udp
FR 178.33.162.38:6893 udp
FR 178.33.162.39:6893 udp
FR 178.33.162.40:6893 udp
FR 178.33.162.41:6893 udp
FR 178.33.162.42:6893 udp
FR 178.33.162.43:6893 udp
FR 178.33.162.44:6893 udp
FR 178.33.162.45:6893 udp
FR 178.33.162.46:6893 udp
FR 178.33.162.47:6893 udp
FR 178.33.162.48:6893 udp
FR 178.33.162.49:6893 udp
FR 178.33.162.50:6893 udp
FR 178.33.162.51:6893 udp
FR 178.33.162.52:6893 udp
FR 178.33.162.53:6893 udp
FR 178.33.162.54:6893 udp
FR 178.33.162.55:6893 udp
FR 178.33.162.56:6893 udp
FR 178.33.162.57:6893 udp
FR 178.33.162.58:6893 udp
FR 178.33.162.59:6893 udp
FR 178.33.162.60:6893 udp
FR 178.33.162.61:6893 udp
FR 178.33.162.62:6893 udp
FR 178.33.162.63:6893 udp
FR 178.33.162.64:6893 udp
FR 178.33.162.65:6893 udp
FR 178.33.162.66:6893 udp
FR 178.33.162.67:6893 udp
FR 178.33.162.68:6893 udp
FR 178.33.162.69:6893 udp
FR 178.33.162.70:6893 udp
FR 178.33.162.71:6893 udp
FR 178.33.162.72:6893 udp
FR 178.33.162.73:6893 udp
FR 178.33.162.74:6893 udp
FR 178.33.162.75:6893 udp
FR 178.33.162.76:6893 udp
FR 178.33.162.77:6893 udp
FR 178.33.162.78:6893 udp
FR 178.33.162.79:6893 udp
FR 178.33.162.80:6893 udp
FR 178.33.162.81:6893 udp
FR 178.33.162.82:6893 udp
FR 178.33.162.83:6893 udp
FR 178.33.162.84:6893 udp
FR 178.33.162.85:6893 udp
FR 178.33.162.86:6893 udp
FR 178.33.162.87:6893 udp
FR 178.33.162.88:6893 udp
FR 178.33.162.89:6893 udp
FR 178.33.162.90:6893 udp
FR 178.33.162.91:6893 udp
FR 178.33.162.92:6893 udp
FR 178.33.162.93:6893 udp
FR 178.33.162.94:6893 udp
FR 178.33.162.95:6893 udp
FR 178.33.162.96:6893 udp
FR 178.33.162.97:6893 udp
FR 178.33.162.98:6893 udp
FR 178.33.162.99:6893 udp
FR 178.33.162.100:6893 udp
FR 178.33.162.101:6893 udp
FR 178.33.162.102:6893 udp
FR 178.33.162.103:6893 udp
FR 178.33.162.104:6893 udp
FR 178.33.162.105:6893 udp
FR 178.33.162.106:6893 udp
FR 178.33.162.107:6893 udp
FR 178.33.162.108:6893 udp
FR 178.33.162.109:6893 udp
FR 178.33.162.110:6893 udp
FR 178.33.162.111:6893 udp
FR 178.33.162.112:6893 udp
FR 178.33.162.113:6893 udp
FR 178.33.162.114:6893 udp
FR 178.33.162.115:6893 udp
FR 178.33.162.116:6893 udp
FR 178.33.162.117:6893 udp
FR 178.33.162.118:6893 udp
FR 178.33.162.119:6893 udp
FR 178.33.162.120:6893 udp
FR 178.33.162.121:6893 udp
FR 178.33.162.122:6893 udp
FR 178.33.162.123:6893 udp
FR 178.33.162.124:6893 udp
FR 178.33.162.125:6893 udp
FR 178.33.162.126:6893 udp
FR 178.33.162.127:6893 udp
FR 178.33.162.128:6893 udp
FR 178.33.162.129:6893 udp
FR 178.33.162.130:6893 udp
FR 178.33.162.131:6893 udp
FR 178.33.162.132:6893 udp
FR 178.33.162.133:6893 udp
FR 178.33.162.134:6893 udp
FR 178.33.162.135:6893 udp
FR 178.33.162.136:6893 udp
FR 178.33.162.137:6893 udp
FR 178.33.162.138:6893 udp
FR 178.33.162.139:6893 udp
FR 178.33.162.140:6893 udp
FR 178.33.162.141:6893 udp
FR 178.33.162.142:6893 udp
FR 178.33.162.143:6893 udp
FR 178.33.162.144:6893 udp
FR 178.33.162.145:6893 udp
FR 178.33.162.146:6893 udp
FR 178.33.162.147:6893 udp
FR 178.33.162.148:6893 udp
FR 178.33.162.149:6893 udp
FR 178.33.162.150:6893 udp
FR 178.33.162.151:6893 udp
FR 178.33.162.152:6893 udp
FR 178.33.162.153:6893 udp
FR 178.33.162.154:6893 udp
FR 178.33.162.155:6893 udp
FR 178.33.162.156:6893 udp
FR 178.33.162.157:6893 udp
FR 178.33.162.158:6893 udp
FR 178.33.162.159:6893 udp
FR 178.33.162.160:6893 udp
FR 178.33.162.161:6893 udp
FR 178.33.162.162:6893 udp
FR 178.33.162.163:6893 udp
FR 178.33.162.164:6893 udp
FR 178.33.162.165:6893 udp
FR 178.33.162.166:6893 udp
FR 178.33.162.167:6893 udp
FR 178.33.162.168:6893 udp
FR 178.33.162.169:6893 udp
FR 178.33.162.170:6893 udp
FR 178.33.162.171:6893 udp
FR 178.33.162.172:6893 udp
FR 178.33.162.173:6893 udp
FR 178.33.162.174:6893 udp
FR 178.33.162.175:6893 udp
FR 178.33.162.176:6893 udp
FR 178.33.162.177:6893 udp
FR 178.33.162.178:6893 udp
FR 178.33.162.179:6893 udp
FR 178.33.162.180:6893 udp
FR 178.33.162.181:6893 udp
FR 178.33.162.182:6893 udp
FR 178.33.162.183:6893 udp
FR 178.33.162.184:6893 udp
FR 178.33.162.185:6893 udp
FR 178.33.162.186:6893 udp
FR 178.33.162.187:6893 udp
FR 178.33.162.188:6893 udp
FR 178.33.162.189:6893 udp
FR 178.33.162.190:6893 udp
FR 178.33.162.191:6893 udp
FR 178.33.162.192:6893 udp
FR 178.33.162.193:6893 udp
FR 178.33.162.194:6893 udp
FR 178.33.162.195:6893 udp
FR 178.33.162.196:6893 udp
FR 178.33.162.197:6893 udp
FR 178.33.162.198:6893 udp
FR 178.33.162.199:6893 udp
FR 178.33.162.200:6893 udp
FR 178.33.162.201:6893 udp
FR 178.33.162.202:6893 udp
FR 178.33.162.203:6893 udp
FR 178.33.162.204:6893 udp
FR 178.33.162.205:6893 udp
FR 178.33.162.206:6893 udp
FR 178.33.162.207:6893 udp
FR 178.33.162.208:6893 udp
FR 178.33.162.209:6893 udp
FR 178.33.162.210:6893 udp
FR 178.33.162.211:6893 udp
FR 178.33.162.212:6893 udp
FR 178.33.162.213:6893 udp
FR 178.33.162.214:6893 udp
FR 178.33.162.215:6893 udp
FR 178.33.162.216:6893 udp
FR 178.33.162.217:6893 udp
FR 178.33.162.218:6893 udp
FR 178.33.162.219:6893 udp
FR 178.33.162.220:6893 udp
FR 178.33.162.221:6893 udp
FR 178.33.162.222:6893 udp
FR 178.33.162.223:6893 udp
FR 178.33.162.224:6893 udp
FR 178.33.162.225:6893 udp
FR 178.33.162.226:6893 udp
FR 178.33.162.227:6893 udp
FR 178.33.162.228:6893 udp
FR 178.33.162.229:6893 udp
FR 178.33.162.230:6893 udp
FR 178.33.162.231:6893 udp
FR 178.33.162.232:6893 udp
FR 178.33.162.233:6893 udp
FR 178.33.162.234:6893 udp
FR 178.33.162.235:6893 udp
FR 178.33.162.236:6893 udp
FR 178.33.162.237:6893 udp
FR 178.33.162.238:6893 udp
FR 178.33.162.239:6893 udp
FR 178.33.162.240:6893 udp
FR 178.33.162.241:6893 udp
FR 178.33.162.242:6893 udp
FR 178.33.162.243:6893 udp
FR 178.33.162.244:6893 udp
FR 178.33.162.245:6893 udp
FR 178.33.162.246:6893 udp
FR 178.33.162.247:6893 udp
FR 178.33.162.248:6893 udp
FR 178.33.162.249:6893 udp
FR 178.33.162.250:6893 udp
FR 178.33.162.251:6893 udp
FR 178.33.162.252:6893 udp
FR 178.33.162.253:6893 udp
FR 178.33.162.254:6893 udp
FR 178.33.162.255:6893 udp
FR 178.33.163.0:6893 udp
FR 178.33.163.1:6893 udp
FR 178.33.163.2:6893 udp
FR 178.33.163.3:6893 udp
FR 178.33.163.4:6893 udp
FR 178.33.163.5:6893 udp
FR 178.33.163.6:6893 udp
FR 178.33.163.7:6893 udp
FR 178.33.163.8:6893 udp
FR 178.33.163.9:6893 udp
FR 178.33.163.10:6893 udp
FR 178.33.163.11:6893 udp
FR 178.33.163.12:6893 udp
FR 178.33.163.13:6893 udp
FR 178.33.163.14:6893 udp
FR 178.33.163.15:6893 udp
FR 178.33.163.16:6893 udp
FR 178.33.163.17:6893 udp
FR 178.33.163.18:6893 udp
FR 178.33.163.19:6893 udp
FR 178.33.163.20:6893 udp
FR 178.33.163.21:6893 udp
FR 178.33.163.22:6893 udp
FR 178.33.163.23:6893 udp
FR 178.33.163.24:6893 udp
FR 178.33.163.25:6893 udp
FR 178.33.163.26:6893 udp
FR 178.33.163.27:6893 udp
FR 178.33.163.28:6893 udp
FR 178.33.163.29:6893 udp
FR 178.33.163.30:6893 udp
FR 178.33.163.31:6893 udp
FR 178.33.163.32:6893 udp
FR 178.33.163.33:6893 udp
FR 178.33.163.34:6893 udp
FR 178.33.163.35:6893 udp
FR 178.33.163.36:6893 udp
FR 178.33.163.37:6893 udp
FR 178.33.163.38:6893 udp
FR 178.33.163.39:6893 udp
FR 178.33.163.40:6893 udp
FR 178.33.163.41:6893 udp
FR 178.33.163.42:6893 udp
FR 178.33.163.43:6893 udp
FR 178.33.163.44:6893 udp
FR 178.33.163.45:6893 udp
FR 178.33.163.46:6893 udp
FR 178.33.163.47:6893 udp
FR 178.33.163.48:6893 udp
FR 178.33.163.49:6893 udp
FR 178.33.163.50:6893 udp
FR 178.33.163.51:6893 udp
FR 178.33.163.52:6893 udp
FR 178.33.163.53:6893 udp
FR 178.33.163.54:6893 udp
FR 178.33.163.55:6893 udp
FR 178.33.163.56:6893 udp
FR 178.33.163.57:6893 udp
FR 178.33.163.58:6893 udp
FR 178.33.163.59:6893 udp
FR 178.33.163.60:6893 udp
FR 178.33.163.61:6893 udp
FR 178.33.163.62:6893 udp
FR 178.33.163.63:6893 udp
FR 178.33.163.64:6893 udp
FR 178.33.163.65:6893 udp
FR 178.33.163.66:6893 udp
FR 178.33.163.67:6893 udp
FR 178.33.163.68:6893 udp
FR 178.33.163.69:6893 udp
FR 178.33.163.70:6893 udp
FR 178.33.163.71:6893 udp
FR 178.33.163.72:6893 udp
FR 178.33.163.73:6893 udp
FR 178.33.163.74:6893 udp
FR 178.33.163.75:6893 udp
FR 178.33.163.76:6893 udp
FR 178.33.163.77:6893 udp
FR 178.33.163.78:6893 udp
FR 178.33.163.79:6893 udp
FR 178.33.163.80:6893 udp
FR 178.33.163.81:6893 udp
FR 178.33.163.82:6893 udp
FR 178.33.163.83:6893 udp
FR 178.33.163.84:6893 udp
FR 178.33.163.85:6893 udp
FR 178.33.163.86:6893 udp
FR 178.33.163.87:6893 udp
FR 178.33.163.88:6893 udp
FR 178.33.163.89:6893 udp
FR 178.33.163.90:6893 udp
FR 178.33.163.91:6893 udp
FR 178.33.163.92:6893 udp
FR 178.33.163.93:6893 udp
FR 178.33.163.94:6893 udp
FR 178.33.163.95:6893 udp
FR 178.33.163.96:6893 udp
FR 178.33.163.97:6893 udp
FR 178.33.163.98:6893 udp
FR 178.33.163.99:6893 udp
FR 178.33.163.100:6893 udp
FR 178.33.163.101:6893 udp
FR 178.33.163.102:6893 udp
FR 178.33.163.103:6893 udp
FR 178.33.163.104:6893 udp
FR 178.33.163.105:6893 udp
FR 178.33.163.106:6893 udp
FR 178.33.163.107:6893 udp
FR 178.33.163.108:6893 udp
FR 178.33.163.109:6893 udp
FR 178.33.163.110:6893 udp
FR 178.33.163.111:6893 udp
FR 178.33.163.112:6893 udp
FR 178.33.163.113:6893 udp
FR 178.33.163.114:6893 udp
FR 178.33.163.115:6893 udp
FR 178.33.163.116:6893 udp
FR 178.33.163.117:6893 udp
FR 178.33.163.118:6893 udp
FR 178.33.163.119:6893 udp
FR 178.33.163.120:6893 udp
FR 178.33.163.121:6893 udp
FR 178.33.163.122:6893 udp
FR 178.33.163.123:6893 udp
FR 178.33.163.124:6893 udp
FR 178.33.163.125:6893 udp
FR 178.33.163.126:6893 udp
FR 178.33.163.127:6893 udp
FR 178.33.163.128:6893 udp
FR 178.33.163.129:6893 udp
FR 178.33.163.130:6893 udp
FR 178.33.163.131:6893 udp
FR 178.33.163.132:6893 udp
FR 178.33.163.133:6893 udp
FR 178.33.163.134:6893 udp
FR 178.33.163.135:6893 udp
FR 178.33.163.136:6893 udp
FR 178.33.163.137:6893 udp
FR 178.33.163.138:6893 udp
FR 178.33.163.139:6893 udp
FR 178.33.163.140:6893 udp
FR 178.33.163.141:6893 udp
FR 178.33.163.142:6893 udp
FR 178.33.163.143:6893 udp
FR 178.33.163.144:6893 udp
FR 178.33.163.145:6893 udp
FR 178.33.163.146:6893 udp
FR 178.33.163.147:6893 udp
FR 178.33.163.148:6893 udp
FR 178.33.163.149:6893 udp
FR 178.33.163.150:6893 udp
FR 178.33.163.151:6893 udp
FR 178.33.163.152:6893 udp
FR 178.33.163.153:6893 udp
FR 178.33.163.154:6893 udp
FR 178.33.163.155:6893 udp
FR 178.33.163.156:6893 udp
FR 178.33.163.157:6893 udp
FR 178.33.163.158:6893 udp
FR 178.33.163.159:6893 udp
FR 178.33.163.160:6893 udp
FR 178.33.163.161:6893 udp
FR 178.33.163.162:6893 udp
FR 178.33.163.163:6893 udp
FR 178.33.163.164:6893 udp
FR 178.33.163.165:6893 udp
FR 178.33.163.166:6893 udp
FR 178.33.163.167:6893 udp
FR 178.33.163.168:6893 udp
FR 178.33.163.169:6893 udp
FR 178.33.163.170:6893 udp
FR 178.33.163.171:6893 udp
FR 178.33.163.172:6893 udp
FR 178.33.163.173:6893 udp
FR 178.33.163.174:6893 udp
FR 178.33.163.175:6893 udp
FR 178.33.163.176:6893 udp
FR 178.33.163.177:6893 udp
FR 178.33.163.178:6893 udp
FR 178.33.163.179:6893 udp
FR 178.33.163.180:6893 udp
FR 178.33.163.181:6893 udp
FR 178.33.163.182:6893 udp
FR 178.33.163.183:6893 udp
FR 178.33.163.184:6893 udp
FR 178.33.163.185:6893 udp
FR 178.33.163.186:6893 udp
FR 178.33.163.187:6893 udp
FR 178.33.163.188:6893 udp
FR 178.33.163.189:6893 udp
FR 178.33.163.190:6893 udp
FR 178.33.163.191:6893 udp
FR 178.33.163.192:6893 udp
FR 178.33.163.193:6893 udp
FR 178.33.163.194:6893 udp
FR 178.33.163.195:6893 udp
FR 178.33.163.196:6893 udp
FR 178.33.163.197:6893 udp
FR 178.33.163.198:6893 udp
FR 178.33.163.199:6893 udp
FR 178.33.163.200:6893 udp
FR 178.33.163.201:6893 udp
FR 178.33.163.202:6893 udp
FR 178.33.163.203:6893 udp
FR 178.33.163.204:6893 udp
FR 178.33.163.205:6893 udp
FR 178.33.163.206:6893 udp
FR 178.33.163.207:6893 udp
FR 178.33.163.208:6893 udp
FR 178.33.163.209:6893 udp
FR 178.33.163.210:6893 udp
FR 178.33.163.211:6893 udp
FR 178.33.163.212:6893 udp
FR 178.33.163.213:6893 udp
FR 178.33.163.214:6893 udp
FR 178.33.163.215:6893 udp
FR 178.33.163.216:6893 udp
FR 178.33.163.217:6893 udp
FR 178.33.163.218:6893 udp
FR 178.33.163.219:6893 udp
FR 178.33.163.220:6893 udp
FR 178.33.163.221:6893 udp
FR 178.33.163.222:6893 udp
FR 178.33.163.223:6893 udp
FR 178.33.163.224:6893 udp
FR 178.33.163.225:6893 udp
FR 178.33.163.226:6893 udp
FR 178.33.163.227:6893 udp
FR 178.33.163.228:6893 udp
FR 178.33.163.229:6893 udp
FR 178.33.163.230:6893 udp
FR 178.33.163.231:6893 udp
FR 178.33.163.232:6893 udp
FR 178.33.163.233:6893 udp
FR 178.33.163.234:6893 udp
FR 178.33.163.235:6893 udp
FR 178.33.163.236:6893 udp
FR 178.33.163.237:6893 udp
FR 178.33.163.238:6893 udp
FR 178.33.163.239:6893 udp
FR 178.33.163.240:6893 udp
FR 178.33.163.241:6893 udp
FR 178.33.163.242:6893 udp
FR 178.33.163.243:6893 udp
FR 178.33.163.244:6893 udp
FR 178.33.163.245:6893 udp
FR 178.33.163.246:6893 udp
FR 178.33.163.247:6893 udp
FR 178.33.163.248:6893 udp
FR 178.33.163.249:6893 udp
FR 178.33.163.250:6893 udp
FR 178.33.163.251:6893 udp
FR 178.33.163.252:6893 udp
FR 178.33.163.253:6893 udp
FR 178.33.163.254:6893 udp
FR 178.33.163.255:6893 udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 107.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 104.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp

Files

memory/3980-0-0x00000000021E0000-0x0000000002211000-memory.dmp

memory/3980-1-0x0000000000400000-0x0000000000435000-memory.dmp

memory/3980-2-0x0000000000400000-0x0000000000435000-memory.dmp

memory/3980-4-0x0000000000400000-0x0000000000435000-memory.dmp

memory/3980-7-0x0000000000400000-0x0000000000435000-memory.dmp

memory/3980-11-0x0000000000400000-0x0000000000435000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\_R_E_A_D___T_H_I_S___K65C14I_.txt

MD5 50b9dcf0f5456879e8ff188739384a1f
SHA1 355edf9eed7107a82aca5ef9e1991cf85042ec30
SHA256 c2b4faca3eb5fc36446f6dc8b7bf0b58511df62c181bcbc8a7aa7efdc10ec082
SHA512 48e8f0274e4760b3d7651fbdfc5e2962ac5501b1bfa856d7b41939cf978222a402a4eebf46f519cf89efb02cafd47669648cb1b5fc2d6bf625dab8520e018132

C:\Users\Admin\AppData\Roaming\Microsoft\OneNote\16.0\_R_E_A_D___T_H_I_S___A2QQC8GU_.hta

MD5 ee702421bf9ab3bf3c7ae5f7a54ccdc6
SHA1 a0cd92bd399de1db6166d14e1e9f8a3be82d659d
SHA256 4ee0648296e5d3a34b83c88a9ef6d6401efd3dbefc1f02790e2f3655b348fb87
SHA512 4eb58e45cfa6edeb625c586ddfd78eeb5439b5639146bc6a6d3d21f9262bf6b8c568cc595849e8c5f1046d9da40b1169458ff824952043467372ce82ea61c9e6

memory/3980-369-0x0000000000400000-0x0000000000435000-memory.dmp

memory/3980-396-0x0000000000400000-0x0000000000435000-memory.dmp

Analysis: behavioral13

Detonation Overview

Submitted

2024-11-28 22:34

Reported

2024-11-28 22:37

Platform

win7-20240903-en

Max time kernel

123s

Max time network

127s

Command Line

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Ransomware-master\etc\Ransomware.Cryptowall.zip"

Signatures

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: 35 N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A

Processes

C:\Program Files\7-Zip\7zFM.exe

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Ransomware-master\etc\Ransomware.Cryptowall.zip"

Network

N/A

Files

N/A

Analysis: behavioral29

Detonation Overview

Submitted

2024-11-28 22:34

Reported

2024-11-28 22:36

Platform

win7-20240903-en

Max time kernel

117s

Max time network

118s

Command Line

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Ransomware-master\etc\Ransomware.Matsnu.zip"

Signatures

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: 35 N/A C:\Program Files\7-Zip\7zFM.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A

Processes

C:\Program Files\7-Zip\7zFM.exe

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Ransomware-master\etc\Ransomware.Matsnu.zip"

Network

N/A

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-28 22:34

Reported

2024-11-28 22:36

Platform

win10v2004-20241007-en

Max time kernel

93s

Max time network

139s

Command Line

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Ransomware-master.zip"

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: 35 N/A C:\Program Files\7-Zip\7zFM.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A

Processes

C:\Program Files\7-Zip\7zFM.exe

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Ransomware-master.zip"

Network

Country Destination Domain Proto
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 107.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp

Files

N/A