Analysis Overview
SHA256
9abffaee18a87032e9db459d1309da167460acdd98dfc4c7fc4c3941f2cbbaf9
Threat Level: Known bad
The file bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118 was found to be: Known bad.
Malicious Activity Summary
Cerber
Cerber family
Adds policy Run key to start application
Contacts a large (523) amount of remote hosts
Contacts a large (529) amount of remote hosts
Checks computer location settings
Reads user/profile data of web browsers
Executes dropped EXE
Drops startup file
Deletes itself
Loads dropped DLL
Adds Run key to start application
Looks up external IP address via web service
Checks whether UAC is enabled
Suspicious use of SetThreadContext
Sets desktop wallpaper using registry
Drops file in Program Files directory
Drops file in Windows directory
System Location Discovery: System Language Discovery
Program crash
System Network Configuration Discovery: Internet Connection Discovery
Command and Scripting Interpreter: JavaScript
Unsigned PE
Enumerates physical storage devices
Browser Information Discovery
NSIS installer
Enumerates system info in registry
Kills process with taskkill
Suspicious use of SetWindowsHookEx
Modifies Control Panel
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious use of SendNotifyMessage
Suspicious use of FindShellTrayWindow
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Runs ping.exe
Modifies registry class
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-12-03 20:41
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
NSIS installer
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Analysis: behavioral4
Detonation Overview
Submitted
2024-12-03 20:41
Reported
2024-12-03 20:44
Platform
win10v2004-20241007-en
Max time kernel
148s
Max time network
149s
Command Line
Signatures
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Windows\SysWOW64\rundll32.exe |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\rundll32.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 1168 wrote to memory of 4808 | N/A | C:\Windows\system32\rundll32.exe | C:\Windows\SysWOW64\rundll32.exe |
| PID 1168 wrote to memory of 4808 | N/A | C:\Windows\system32\rundll32.exe | C:\Windows\SysWOW64\rundll32.exe |
| PID 1168 wrote to memory of 4808 | N/A | C:\Windows\system32\rundll32.exe | C:\Windows\SysWOW64\rundll32.exe |
Processes
C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4808 -ip 4808
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4808 -s 612
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 154.239.44.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 101.210.23.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 134.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 58.55.71.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 228.249.119.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 50.23.12.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.42.69.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 66.209.201.84.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 83.210.23.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 88.210.23.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 23.236.111.52.in-addr.arpa | udp |
Files
Analysis: behavioral6
Detonation Overview
Submitted
2024-12-03 20:41
Reported
2024-12-03 20:44
Platform
win10v2004-20241007-en
Max time kernel
148s
Max time network
152s
Command Line
Signatures
Browser Information Discovery
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Processes
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\405.htm
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd8ec646f8,0x7ffd8ec64708,0x7ffd8ec64718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,12741643458444750575,17904007624266062971,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,12741643458444750575,17904007624266062971,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,12741643458444750575,17904007624266062971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12741643458444750575,17904007624266062971,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12741643458444750575,17904007624266062971,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,12741643458444750575,17904007624266062971,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4956 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,12741643458444750575,17904007624266062971,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4956 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12741643458444750575,17904007624266062971,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12741643458444750575,17904007624266062971,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12741643458444750575,17904007624266062971,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12741643458444750575,17904007624266062971,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,12741643458444750575,17904007624266062971,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=904 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 228.249.119.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 73.31.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 88.210.23.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | 154.239.44.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 50.23.12.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 137.190.18.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 22.236.111.52.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 36988ca14952e1848e81a959880ea217 |
| SHA1 | a0482ef725657760502c2d1a5abe0bb37aebaadb |
| SHA256 | d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6 |
| SHA512 | d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173 |
\??\pipe\LOCAL\crashpad_3076_PCWJKOMIJTNEJAWZ
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | fab8d8d865e33fe195732aa7dcb91c30 |
| SHA1 | 2637e832f38acc70af3e511f5eba80fbd7461f2c |
| SHA256 | 1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea |
| SHA512 | 39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | ccb78f8278cbf169d37c0a8d8b5becc7 |
| SHA1 | f1c543dca76f3c416f2f025cc329c745f667cd47 |
| SHA256 | ad64e8151c900afe5be01341ba54b376615680815d9ec71583149e4afa077b84 |
| SHA512 | b8d031a4625df5cc7f79db6ca2e64d82ec52fcf68856655e650d46dc050a43e913b444a59821d9acc7fbbe49073cecac0b08daa7f75c445feb1c1bc2b88569dc |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 6752a1d65b201c13b62ea44016eb221f |
| SHA1 | 58ecf154d01a62233ed7fb494ace3c3d4ffce08b |
| SHA256 | 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd |
| SHA512 | 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | 114dffce3ae1710d6539f5c1cbad9a10 |
| SHA1 | ad565308645b5c2e36612a5abe7f2405b6f8edde |
| SHA256 | 9488ebf5d86ac2481558c48ef33e6a62c849fd98e556ae5beca32896dd1fe5f1 |
| SHA512 | ff607e5ab55d841d2ceb31e97a720b2538efb2da10efb25e7fe871428a0cf420110d24fb36dab9ff5b4d164a91b2e8b5f5327fa1d16bb65536e935e86a34422f |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 4846437d2942b9e602e98b6cc5fd9044 |
| SHA1 | 551c47a35bd705ceac6e3fc8ccbe8b271f833b52 |
| SHA256 | 1ed2487a259e14d8ad8884880f11977bd7d9b037a31c07d4b24f09544283c06b |
| SHA512 | 76315c81a624e659f88f651e559335ee5e203e8e085e3e485f2ed3247ca9836033c5566499b7d7295d6511cb23ba419b14012cfb35425907c446a6ca7df14020 |
Analysis: behavioral8
Detonation Overview
Submitted
2024-12-03 20:41
Reported
2024-12-03 20:44
Platform
win10v2004-20241007-en
Max time kernel
95s
Max time network
145s
Command Line
Signatures
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Windows\SysWOW64\rundll32.exe |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\rundll32.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2816 wrote to memory of 3420 | N/A | C:\Windows\system32\rundll32.exe | C:\Windows\SysWOW64\rundll32.exe |
| PID 2816 wrote to memory of 3420 | N/A | C:\Windows\system32\rundll32.exe | C:\Windows\SysWOW64\rundll32.exe |
| PID 2816 wrote to memory of 3420 | N/A | C:\Windows\system32\rundll32.exe | C:\Windows\SysWOW64\rundll32.exe |
Processes
C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SetCursor.dll,#1
C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SetCursor.dll,#1
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3420 -ip 3420
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3420 -s 544
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 228.249.119.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 4.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 88.210.23.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.86.106.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.42.69.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 56.163.245.4.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 106.209.201.84.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 83.210.23.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 69.209.201.84.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 22.236.111.52.in-addr.arpa | udp |
Files
Analysis: behavioral9
Detonation Overview
Submitted
2024-12-03 20:41
Reported
2024-12-03 20:44
Platform
win7-20240903-en
Max time kernel
117s
Max time network
120s
Command Line
Signatures
Command and Scripting Interpreter: JavaScript
Processes
C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\getOpenDocumentIDs.js
Network
Files
Analysis: behavioral1
Detonation Overview
Submitted
2024-12-03 20:41
Reported
2024-12-03 20:44
Platform
win7-20240903-en
Max time kernel
130s
Max time network
131s
Command Line
Signatures
Cerber
Cerber family
Adds policy Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{1591EC7F-A229-1145-B746-F357D6852359}\\resmon.exe\"" | C:\Users\Admin\AppData\Local\Temp\bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{1591EC7F-A229-1145-B746-F357D6852359}\\resmon.exe\"" | C:\Users\Admin\AppData\Roaming\{1591EC7F-A229-1145-B746-F357D6852359}\resmon.exe | N/A |
Contacts a large (523) amount of remote hosts
Deletes itself
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\cmd.exe | N/A |
Drops startup file
| Description | Indicator | Process | Target |
| File created | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\resmon.lnk | C:\Users\Admin\AppData\Local\Temp\bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\resmon.lnk | C:\Users\Admin\AppData\Roaming\{1591EC7F-A229-1145-B746-F357D6852359}\resmon.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\{1591EC7F-A229-1145-B746-F357D6852359}\resmon.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\{1591EC7F-A229-1145-B746-F357D6852359}\resmon.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\{1591EC7F-A229-1145-B746-F357D6852359}\resmon.exe | N/A |
Loads dropped DLL
Reads user/profile data of web browsers
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\resmon = "\"C:\\Users\\Admin\\AppData\\Roaming\\{1591EC7F-A229-1145-B746-F357D6852359}\\resmon.exe\"" | C:\Users\Admin\AppData\Local\Temp\bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\resmon = "\"C:\\Users\\Admin\\AppData\\Roaming\\{1591EC7F-A229-1145-B746-F357D6852359}\\resmon.exe\"" | C:\Users\Admin\AppData\Local\Temp\bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\resmon = "\"C:\\Users\\Admin\\AppData\\Roaming\\{1591EC7F-A229-1145-B746-F357D6852359}\\resmon.exe\"" | C:\Users\Admin\AppData\Roaming\{1591EC7F-A229-1145-B746-F357D6852359}\resmon.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\resmon = "\"C:\\Users\\Admin\\AppData\\Roaming\\{1591EC7F-A229-1145-B746-F357D6852359}\\resmon.exe\"" | C:\Users\Admin\AppData\Roaming\{1591EC7F-A229-1145-B746-F357D6852359}\resmon.exe | N/A |
Checks whether UAC is enabled
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA | C:\Users\Admin\AppData\Roaming\{1591EC7F-A229-1145-B746-F357D6852359}\resmon.exe | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | ip-api.com | N/A | N/A |
Sets desktop wallpaper using registry
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp60A7.bmp" | C:\Users\Admin\AppData\Roaming\{1591EC7F-A229-1145-B746-F357D6852359}\resmon.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2784 set thread context of 2744 | N/A | C:\Users\Admin\AppData\Local\Temp\bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe | C:\Users\Admin\AppData\Local\Temp\bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe |
| PID 576 set thread context of 3056 | N/A | C:\Users\Admin\AppData\Roaming\{1591EC7F-A229-1145-B746-F357D6852359}\resmon.exe | C:\Users\Admin\AppData\Roaming\{1591EC7F-A229-1145-B746-F357D6852359}\resmon.exe |
Drops file in Program Files directory
| Description | Indicator | Process | Target |
| File created | C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# DECRYPT MY FILES #.url | C:\Users\Admin\AppData\Roaming\{1591EC7F-A229-1145-B746-F357D6852359}\resmon.exe | N/A |
| File created | C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# DECRYPT MY FILES #.vbs | C:\Users\Admin\AppData\Roaming\{1591EC7F-A229-1145-B746-F357D6852359}\resmon.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\PLANNERS.ONE | C:\Users\Admin\AppData\Roaming\{1591EC7F-A229-1145-B746-F357D6852359}\resmon.exe | N/A |
| File created | C:\Program Files (x86)\Microsoft Office\Office14\OneNote\# DECRYPT MY FILES #.txt | C:\Users\Admin\AppData\Roaming\{1591EC7F-A229-1145-B746-F357D6852359}\resmon.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\DESIGNER.ONE | C:\Users\Admin\AppData\Roaming\{1591EC7F-A229-1145-B746-F357D6852359}\resmon.exe | N/A |
| File created | C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# DECRYPT MY FILES #.txt | C:\Users\Admin\AppData\Roaming\{1591EC7F-A229-1145-B746-F357D6852359}\resmon.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\BUSINESS.ONE | C:\Users\Admin\AppData\Roaming\{1591EC7F-A229-1145-B746-F357D6852359}\resmon.exe | N/A |
| File created | C:\Program Files (x86)\Microsoft Office\Office14\OneNote\# DECRYPT MY FILES #.url | C:\Users\Admin\AppData\Roaming\{1591EC7F-A229-1145-B746-F357D6852359}\resmon.exe | N/A |
| File created | C:\Program Files (x86)\Microsoft Office\Office14\OneNote\# DECRYPT MY FILES #.html | C:\Users\Admin\AppData\Roaming\{1591EC7F-A229-1145-B746-F357D6852359}\resmon.exe | N/A |
| File created | C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# DECRYPT MY FILES #.html | C:\Users\Admin\AppData\Roaming\{1591EC7F-A229-1145-B746-F357D6852359}\resmon.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\Office14\OneNote\SendToOneNote-PipelineConfig.xml | C:\Users\Admin\AppData\Roaming\{1591EC7F-A229-1145-B746-F357D6852359}\resmon.exe | N/A |
| File created | C:\Program Files (x86)\Microsoft Office\Office14\OneNote\# DECRYPT MY FILES #.vbs | C:\Users\Admin\AppData\Roaming\{1591EC7F-A229-1145-B746-F357D6852359}\resmon.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\Office14\OneNote\SendToOneNote.ini | C:\Users\Admin\AppData\Roaming\{1591EC7F-A229-1145-B746-F357D6852359}\resmon.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\ACADEMIC.ONE | C:\Users\Admin\AppData\Roaming\{1591EC7F-A229-1145-B746-F357D6852359}\resmon.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\BLANK.ONE | C:\Users\Admin\AppData\Roaming\{1591EC7F-A229-1145-B746-F357D6852359}\resmon.exe | N/A |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\formulas | C:\Users\Admin\AppData\Local\Temp\bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Windows\formulas | C:\Users\Admin\AppData\Roaming\{1591EC7F-A229-1145-B746-F357D6852359}\resmon.exe | N/A |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Roaming\{1591EC7F-A229-1145-B746-F357D6852359}\resmon.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Roaming\{1591EC7F-A229-1145-B746-F357D6852359}\resmon.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\taskkill.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\PING.EXE | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Roaming\{1591EC7F-A229-1145-B746-F357D6852359}\resmon.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\DllHost.exe | N/A |
System Network Configuration Discovery: Internet Connection Discovery
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\cmd.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\PING.EXE | N/A |
| N/A | N/A | C:\Windows\system32\cmd.exe | N/A |
| N/A | N/A | C:\Windows\system32\PING.EXE | N/A |
NSIS installer
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Kills process with taskkill
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\system32\taskkill.exe | N/A |
Modifies Control Panel
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Control Panel\Desktop | C:\Users\Admin\AppData\Local\Temp\bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{1591EC7F-A229-1145-B746-F357D6852359}\\resmon.exe\"" | C:\Users\Admin\AppData\Local\Temp\bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Control Panel\Desktop | C:\Users\Admin\AppData\Roaming\{1591EC7F-A229-1145-B746-F357D6852359}\resmon.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{1591EC7F-A229-1145-B746-F357D6852359}\\resmon.exe\"" | C:\Users\Admin\AppData\Roaming\{1591EC7F-A229-1145-B746-F357D6852359}\resmon.exe | N/A |
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\PageSetup | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{30240061-B1B7-11EF-BFBC-7694D31B45CA} = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000035b06c32cee6a341a6be336e6d2c7a820000000002000000000010660000000100002000000046877bd224a963d5c3b24334c32afabc2aedd431829fdb097b49461c0d1ca794000000000e80000000020000200000009bed3f5406db4c1b8ed745da6adf21b498dc14a15b576711ea43946a635a186290000000064d48c646a58806d466417d1b3432c87f0c9d20b35149bd03b37b328f6840027a3c70565d92d14aa164a06aa7aa83e91d0428f10a5ba7e86d99f11d5c8c0b1d20fe0524cd383ea0b16353a957631b3dc9f28ce4163459ef2b10b4ed200840b2f034f9047783356ab29a9c5ebe2b6e9efbf2c51c89070711230adfeb1474e016b0a8dee7f0943d65d8a8ec555181e01b40000000518572198a0367e6fdab7d1d000a2d4bc8d54a1f5a478309641de39775ac2bdeef522b2ff7c630687fb57ffbdf5e08fde666c9058e72e4041aedb9893e8dc757 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IntelliForms | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "439420450" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\GPU | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Zoom | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000035b06c32cee6a341a6be336e6d2c7a8200000000020000000000106600000001000020000000b31adec4838375ffc7f13bb1b7342e185b9b452a68fbf1fe33f28aa864f0bb6a000000000e8000000002000020000000a83429a022695dc3b418134bcef120ad9a4542fc98fe5ba269278e37b3c2da8620000000e000e40675b7d29090c14167a3368aee1cb7389d2d7882be043a9532b00e1d784000000015f95150a1aa6862014e36df3eaaf5743c10fa3cbf4de0a3c6dd263d0f465eb7111c5f0b50ca39b6f545fc8c7f2ef06fa19ac04cbf739a5dfa54311ec5697507 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IETld\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\InternetRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90d867f3c345db01 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Runs ping.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\PING.EXE | N/A |
| N/A | N/A | C:\Windows\system32\PING.EXE | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Roaming\{1591EC7F-A229-1145-B746-F357D6852359}\resmon.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\system32\taskkill.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe"
C:\Users\Admin\AppData\Local\Temp\bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe"
C:\Users\Admin\AppData\Roaming\{1591EC7F-A229-1145-B746-F357D6852359}\resmon.exe
"C:\Users\Admin\AppData\Roaming\{1591EC7F-A229-1145-B746-F357D6852359}\resmon.exe"
C:\Windows\SysWOW64\cmd.exe
/d /c taskkill /t /f /im "bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe" > NUL
C:\Windows\SysWOW64\taskkill.exe
taskkill /t /f /im "bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe"
C:\Windows\SysWOW64\PING.EXE
ping -n 1 127.0.0.1
C:\Users\Admin\AppData\Roaming\{1591EC7F-A229-1145-B746-F357D6852359}\resmon.exe
"C:\Users\Admin\AppData\Roaming\{1591EC7F-A229-1145-B746-F357D6852359}\resmon.exe"
C:\Windows\system32\taskeng.exe
taskeng.exe {5BB2E5C7-6098-47D6-8EDC-752BFA51E504} S-1-5-21-4177215427-74451935-3209572229-1000:JSMURNPT\Admin:Interactive:[1]
C:\Users\Admin\AppData\Roaming\{1591EC7F-A229-1145-B746-F357D6852359}\resmon.exe
C:\Users\Admin\AppData\Roaming\{1591EC7F-A229-1145-B746-F357D6852359}\resmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html
C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txt
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1632 CREDAT:275457 /prefetch:2
C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbs"
C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}
C:\Windows\system32\cmd.exe
/d /c taskkill /t /f /im "resmon.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Roaming\{1591EC7F-A229-1145-B746-F357D6852359}\resmon.exe" > NUL
C:\Windows\system32\taskkill.exe
taskkill /t /f /im "resmon.exe"
C:\Windows\system32\PING.EXE
ping -n 1 127.0.0.1
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | ip-api.com | udp |
| US | 208.95.112.1:80 | ip-api.com | tcp |
| AM | 31.184.234.0:6892 | udp | |
| AM | 31.184.234.1:6892 | udp | |
| AM | 31.184.234.2:6892 | udp | |
| AM | 31.184.234.3:6892 | udp | |
| AM | 31.184.234.4:6892 | udp | |
| AM | 31.184.234.5:6892 | udp | |
| AM | 31.184.234.6:6892 | udp | |
| AM | 31.184.234.7:6892 | udp | |
| AM | 31.184.234.8:6892 | udp | |
| AM | 31.184.234.9:6892 | udp | |
| AM | 31.184.234.10:6892 | udp | |
| AM | 31.184.234.11:6892 | udp | |
| AM | 31.184.234.12:6892 | udp | |
| AM | 31.184.234.13:6892 | udp | |
| AM | 31.184.234.14:6892 | udp | |
| AM | 31.184.234.15:6892 | udp | |
| AM | 31.184.234.16:6892 | udp | |
| AM | 31.184.234.17:6892 | udp | |
| AM | 31.184.234.18:6892 | udp | |
| AM | 31.184.234.19:6892 | udp | |
| AM | 31.184.234.20:6892 | udp | |
| AM | 31.184.234.21:6892 | udp | |
| AM | 31.184.234.22:6892 | udp | |
| AM | 31.184.234.23:6892 | udp | |
| AM | 31.184.234.24:6892 | udp | |
| AM | 31.184.234.25:6892 | udp | |
| AM | 31.184.234.26:6892 | udp | |
| AM | 31.184.234.27:6892 | udp | |
| AM | 31.184.234.28:6892 | udp | |
| AM | 31.184.234.29:6892 | udp | |
| AM | 31.184.234.30:6892 | udp | |
| AM | 31.184.234.31:6892 | udp | |
| AM | 31.184.234.32:6892 | udp | |
| AM | 31.184.234.33:6892 | udp | |
| AM | 31.184.234.34:6892 | udp | |
| AM | 31.184.234.35:6892 | udp | |
| AM | 31.184.234.36:6892 | udp | |
| AM | 31.184.234.37:6892 | udp | |
| AM | 31.184.234.38:6892 | udp | |
| AM | 31.184.234.39:6892 | udp | |
| AM | 31.184.234.40:6892 | udp | |
| AM | 31.184.234.41:6892 | udp | |
| AM | 31.184.234.42:6892 | udp | |
| AM | 31.184.234.43:6892 | udp | |
| AM | 31.184.234.44:6892 | udp | |
| AM | 31.184.234.45:6892 | udp | |
| AM | 31.184.234.46:6892 | udp | |
| AM | 31.184.234.47:6892 | udp | |
| AM | 31.184.234.48:6892 | udp | |
| AM | 31.184.234.49:6892 | udp | |
| AM | 31.184.234.50:6892 | udp | |
| AM | 31.184.234.51:6892 | udp | |
| AM | 31.184.234.52:6892 | udp | |
| AM | 31.184.234.53:6892 | udp | |
| AM | 31.184.234.54:6892 | udp | |
| AM | 31.184.234.55:6892 | udp | |
| AM | 31.184.234.56:6892 | udp | |
| AM | 31.184.234.57:6892 | udp | |
| AM | 31.184.234.58:6892 | udp | |
| AM | 31.184.234.59:6892 | udp | |
| AM | 31.184.234.60:6892 | udp | |
| AM | 31.184.234.61:6892 | udp | |
| AM | 31.184.234.62:6892 | udp | |
| AM | 31.184.234.63:6892 | udp | |
| AM | 31.184.234.64:6892 | udp | |
| AM | 31.184.234.65:6892 | udp | |
| AM | 31.184.234.66:6892 | udp | |
| AM | 31.184.234.67:6892 | udp | |
| AM | 31.184.234.68:6892 | udp | |
| AM | 31.184.234.69:6892 | udp | |
| AM | 31.184.234.70:6892 | udp | |
| AM | 31.184.234.71:6892 | udp | |
| AM | 31.184.234.72:6892 | udp | |
| AM | 31.184.234.73:6892 | udp | |
| AM | 31.184.234.74:6892 | udp | |
| AM | 31.184.234.75:6892 | udp | |
| AM | 31.184.234.76:6892 | udp | |
| AM | 31.184.234.77:6892 | udp | |
| AM | 31.184.234.78:6892 | udp | |
| AM | 31.184.234.79:6892 | udp | |
| AM | 31.184.234.80:6892 | udp | |
| AM | 31.184.234.81:6892 | udp | |
| AM | 31.184.234.82:6892 | udp | |
| AM | 31.184.234.83:6892 | udp | |
| AM | 31.184.234.84:6892 | udp | |
| AM | 31.184.234.85:6892 | udp | |
| AM | 31.184.234.86:6892 | udp | |
| AM | 31.184.234.87:6892 | udp | |
| AM | 31.184.234.88:6892 | udp | |
| AM | 31.184.234.89:6892 | udp | |
| AM | 31.184.234.90:6892 | udp | |
| AM | 31.184.234.91:6892 | udp | |
| AM | 31.184.234.92:6892 | udp | |
| AM | 31.184.234.93:6892 | udp | |
| AM | 31.184.234.94:6892 | udp | |
| AM | 31.184.234.95:6892 | udp | |
| AM | 31.184.234.96:6892 | udp | |
| AM | 31.184.234.97:6892 | udp | |
| AM | 31.184.234.98:6892 | udp | |
| AM | 31.184.234.99:6892 | udp | |
| AM | 31.184.234.100:6892 | udp | |
| AM | 31.184.234.101:6892 | udp | |
| AM | 31.184.234.102:6892 | udp | |
| AM | 31.184.234.103:6892 | udp | |
| AM | 31.184.234.104:6892 | udp | |
| AM | 31.184.234.105:6892 | udp | |
| AM | 31.184.234.106:6892 | udp | |
| AM | 31.184.234.107:6892 | udp | |
| AM | 31.184.234.108:6892 | udp | |
| AM | 31.184.234.109:6892 | udp | |
| AM | 31.184.234.110:6892 | udp | |
| AM | 31.184.234.111:6892 | udp | |
| AM | 31.184.234.112:6892 | udp | |
| AM | 31.184.234.113:6892 | udp | |
| AM | 31.184.234.114:6892 | udp | |
| AM | 31.184.234.115:6892 | udp | |
| AM | 31.184.234.116:6892 | udp | |
| AM | 31.184.234.117:6892 | udp | |
| AM | 31.184.234.118:6892 | udp | |
| AM | 31.184.234.119:6892 | udp | |
| AM | 31.184.234.120:6892 | udp | |
| AM | 31.184.234.121:6892 | udp | |
| AM | 31.184.234.122:6892 | udp | |
| AM | 31.184.234.123:6892 | udp | |
| AM | 31.184.234.124:6892 | udp | |
| AM | 31.184.234.125:6892 | udp | |
| AM | 31.184.234.126:6892 | udp | |
| AM | 31.184.234.127:6892 | udp | |
| AM | 31.184.234.128:6892 | udp | |
| AM | 31.184.234.129:6892 | udp | |
| AM | 31.184.234.130:6892 | udp | |
| AM | 31.184.234.131:6892 | udp | |
| AM | 31.184.234.132:6892 | udp | |
| AM | 31.184.234.133:6892 | udp | |
| AM | 31.184.234.134:6892 | udp | |
| AM | 31.184.234.135:6892 | udp | |
| AM | 31.184.234.136:6892 | udp | |
| AM | 31.184.234.137:6892 | udp | |
| AM | 31.184.234.138:6892 | udp | |
| AM | 31.184.234.139:6892 | udp | |
| AM | 31.184.234.140:6892 | udp | |
| AM | 31.184.234.141:6892 | udp | |
| AM | 31.184.234.142:6892 | udp | |
| AM | 31.184.234.143:6892 | udp | |
| AM | 31.184.234.144:6892 | udp | |
| AM | 31.184.234.145:6892 | udp | |
| AM | 31.184.234.146:6892 | udp | |
| AM | 31.184.234.147:6892 | udp | |
| AM | 31.184.234.148:6892 | udp | |
| AM | 31.184.234.149:6892 | udp | |
| AM | 31.184.234.150:6892 | udp | |
| AM | 31.184.234.151:6892 | udp | |
| AM | 31.184.234.152:6892 | udp | |
| AM | 31.184.234.153:6892 | udp | |
| AM | 31.184.234.154:6892 | udp | |
| AM | 31.184.234.155:6892 | udp | |
| AM | 31.184.234.156:6892 | udp | |
| AM | 31.184.234.157:6892 | udp | |
| AM | 31.184.234.158:6892 | udp | |
| AM | 31.184.234.159:6892 | udp | |
| AM | 31.184.234.160:6892 | udp | |
| AM | 31.184.234.161:6892 | udp | |
| AM | 31.184.234.162:6892 | udp | |
| AM | 31.184.234.163:6892 | udp | |
| AM | 31.184.234.164:6892 | udp | |
| AM | 31.184.234.165:6892 | udp | |
| AM | 31.184.234.166:6892 | udp | |
| AM | 31.184.234.167:6892 | udp | |
| AM | 31.184.234.168:6892 | udp | |
| AM | 31.184.234.169:6892 | udp | |
| AM | 31.184.234.170:6892 | udp | |
| AM | 31.184.234.171:6892 | udp | |
| AM | 31.184.234.172:6892 | udp | |
| AM | 31.184.234.173:6892 | udp | |
| AM | 31.184.234.174:6892 | udp | |
| AM | 31.184.234.175:6892 | udp | |
| AM | 31.184.234.176:6892 | udp | |
| AM | 31.184.234.177:6892 | udp | |
| AM | 31.184.234.178:6892 | udp | |
| AM | 31.184.234.179:6892 | udp | |
| AM | 31.184.234.180:6892 | udp | |
| AM | 31.184.234.181:6892 | udp | |
| AM | 31.184.234.182:6892 | udp | |
| AM | 31.184.234.183:6892 | udp | |
| AM | 31.184.234.184:6892 | udp | |
| AM | 31.184.234.185:6892 | udp | |
| AM | 31.184.234.186:6892 | udp | |
| AM | 31.184.234.187:6892 | udp | |
| AM | 31.184.234.188:6892 | udp | |
| AM | 31.184.234.189:6892 | udp | |
| AM | 31.184.234.190:6892 | udp | |
| AM | 31.184.234.191:6892 | udp | |
| AM | 31.184.234.192:6892 | udp | |
| AM | 31.184.234.193:6892 | udp | |
| AM | 31.184.234.194:6892 | udp | |
| AM | 31.184.234.195:6892 | udp | |
| AM | 31.184.234.196:6892 | udp | |
| AM | 31.184.234.197:6892 | udp | |
| AM | 31.184.234.198:6892 | udp | |
| AM | 31.184.234.199:6892 | udp | |
| AM | 31.184.234.200:6892 | udp | |
| AM | 31.184.234.201:6892 | udp | |
| AM | 31.184.234.202:6892 | udp | |
| AM | 31.184.234.203:6892 | udp | |
| AM | 31.184.234.204:6892 | udp | |
| AM | 31.184.234.205:6892 | udp | |
| AM | 31.184.234.206:6892 | udp | |
| AM | 31.184.234.207:6892 | udp | |
| AM | 31.184.234.208:6892 | udp | |
| AM | 31.184.234.209:6892 | udp | |
| AM | 31.184.234.210:6892 | udp | |
| AM | 31.184.234.211:6892 | udp | |
| AM | 31.184.234.212:6892 | udp | |
| AM | 31.184.234.213:6892 | udp | |
| AM | 31.184.234.214:6892 | udp | |
| AM | 31.184.234.215:6892 | udp | |
| AM | 31.184.234.216:6892 | udp | |
| AM | 31.184.234.217:6892 | udp | |
| AM | 31.184.234.218:6892 | udp | |
| AM | 31.184.234.219:6892 | udp | |
| AM | 31.184.234.220:6892 | udp | |
| AM | 31.184.234.221:6892 | udp | |
| AM | 31.184.234.222:6892 | udp | |
| AM | 31.184.234.223:6892 | udp | |
| AM | 31.184.234.224:6892 | udp | |
| AM | 31.184.234.225:6892 | udp | |
| AM | 31.184.234.226:6892 | udp | |
| AM | 31.184.234.227:6892 | udp | |
| AM | 31.184.234.228:6892 | udp | |
| AM | 31.184.234.229:6892 | udp | |
| AM | 31.184.234.230:6892 | udp | |
| AM | 31.184.234.231:6892 | udp | |
| AM | 31.184.234.232:6892 | udp | |
| AM | 31.184.234.233:6892 | udp | |
| AM | 31.184.234.234:6892 | udp | |
| AM | 31.184.234.235:6892 | udp | |
| AM | 31.184.234.236:6892 | udp | |
| AM | 31.184.234.237:6892 | udp | |
| AM | 31.184.234.238:6892 | udp | |
| AM | 31.184.234.239:6892 | udp | |
| AM | 31.184.234.240:6892 | udp | |
| AM | 31.184.234.241:6892 | udp | |
| AM | 31.184.234.242:6892 | udp | |
| AM | 31.184.234.243:6892 | udp | |
| AM | 31.184.234.244:6892 | udp | |
| AM | 31.184.234.245:6892 | udp | |
| AM | 31.184.234.246:6892 | udp | |
| AM | 31.184.234.247:6892 | udp | |
| AM | 31.184.234.248:6892 | udp | |
| AM | 31.184.234.249:6892 | udp | |
| AM | 31.184.234.250:6892 | udp | |
| AM | 31.184.234.251:6892 | udp | |
| AM | 31.184.234.252:6892 | udp | |
| AM | 31.184.234.253:6892 | udp | |
| AM | 31.184.234.254:6892 | udp | |
| AM | 31.184.234.255:6892 | udp | |
| AM | 31.184.235.0:6892 | udp | |
| AM | 31.184.235.1:6892 | udp | |
| AM | 31.184.235.2:6892 | udp | |
| AM | 31.184.235.3:6892 | udp | |
| AM | 31.184.235.4:6892 | udp | |
| AM | 31.184.235.5:6892 | udp | |
| AM | 31.184.235.6:6892 | udp | |
| AM | 31.184.235.7:6892 | udp | |
| AM | 31.184.235.8:6892 | udp | |
| AM | 31.184.235.9:6892 | udp | |
| AM | 31.184.235.10:6892 | udp | |
| AM | 31.184.235.11:6892 | udp | |
| AM | 31.184.235.12:6892 | udp | |
| AM | 31.184.235.13:6892 | udp | |
| AM | 31.184.235.14:6892 | udp | |
| AM | 31.184.235.15:6892 | udp | |
| AM | 31.184.235.16:6892 | udp | |
| AM | 31.184.235.17:6892 | udp | |
| AM | 31.184.235.18:6892 | udp | |
| AM | 31.184.235.19:6892 | udp | |
| AM | 31.184.235.20:6892 | udp | |
| AM | 31.184.235.21:6892 | udp | |
| AM | 31.184.235.22:6892 | udp | |
| AM | 31.184.235.23:6892 | udp | |
| AM | 31.184.235.24:6892 | udp | |
| AM | 31.184.235.25:6892 | udp | |
| AM | 31.184.235.26:6892 | udp | |
| AM | 31.184.235.27:6892 | udp | |
| AM | 31.184.235.28:6892 | udp | |
| AM | 31.184.235.29:6892 | udp | |
| AM | 31.184.235.30:6892 | udp | |
| AM | 31.184.235.31:6892 | udp | |
| AM | 31.184.235.32:6892 | udp | |
| AM | 31.184.235.33:6892 | udp | |
| AM | 31.184.235.34:6892 | udp | |
| AM | 31.184.235.35:6892 | udp | |
| AM | 31.184.235.36:6892 | udp | |
| AM | 31.184.235.37:6892 | udp | |
| AM | 31.184.235.38:6892 | udp | |
| AM | 31.184.235.39:6892 | udp | |
| AM | 31.184.235.40:6892 | udp | |
| AM | 31.184.235.41:6892 | udp | |
| AM | 31.184.235.42:6892 | udp | |
| AM | 31.184.235.43:6892 | udp | |
| AM | 31.184.235.44:6892 | udp | |
| AM | 31.184.235.45:6892 | udp | |
| AM | 31.184.235.46:6892 | udp | |
| AM | 31.184.235.47:6892 | udp | |
| AM | 31.184.235.48:6892 | udp | |
| AM | 31.184.235.49:6892 | udp | |
| AM | 31.184.235.50:6892 | udp | |
| AM | 31.184.235.51:6892 | udp | |
| AM | 31.184.235.52:6892 | udp | |
| AM | 31.184.235.53:6892 | udp | |
| AM | 31.184.235.54:6892 | udp | |
| AM | 31.184.235.55:6892 | udp | |
| AM | 31.184.235.56:6892 | udp | |
| AM | 31.184.235.57:6892 | udp | |
| AM | 31.184.235.58:6892 | udp | |
| AM | 31.184.235.59:6892 | udp | |
| AM | 31.184.235.60:6892 | udp | |
| AM | 31.184.235.61:6892 | udp | |
| AM | 31.184.235.62:6892 | udp | |
| AM | 31.184.235.63:6892 | udp | |
| AM | 31.184.235.64:6892 | udp | |
| AM | 31.184.235.65:6892 | udp | |
| AM | 31.184.235.66:6892 | udp | |
| AM | 31.184.235.67:6892 | udp | |
| AM | 31.184.235.68:6892 | udp | |
| AM | 31.184.235.69:6892 | udp | |
| AM | 31.184.235.70:6892 | udp | |
| AM | 31.184.235.71:6892 | udp | |
| AM | 31.184.235.72:6892 | udp | |
| AM | 31.184.235.73:6892 | udp | |
| AM | 31.184.235.74:6892 | udp | |
| AM | 31.184.235.75:6892 | udp | |
| AM | 31.184.235.76:6892 | udp | |
| AM | 31.184.235.77:6892 | udp | |
| AM | 31.184.235.78:6892 | udp | |
| AM | 31.184.235.79:6892 | udp | |
| AM | 31.184.235.80:6892 | udp | |
| AM | 31.184.235.81:6892 | udp | |
| AM | 31.184.235.82:6892 | udp | |
| AM | 31.184.235.83:6892 | udp | |
| AM | 31.184.235.84:6892 | udp | |
| AM | 31.184.235.85:6892 | udp | |
| AM | 31.184.235.86:6892 | udp | |
| AM | 31.184.235.87:6892 | udp | |
| AM | 31.184.235.88:6892 | udp | |
| AM | 31.184.235.89:6892 | udp | |
| AM | 31.184.235.90:6892 | udp | |
| AM | 31.184.235.91:6892 | udp | |
| AM | 31.184.235.92:6892 | udp | |
| AM | 31.184.235.93:6892 | udp | |
| AM | 31.184.235.94:6892 | udp | |
| AM | 31.184.235.95:6892 | udp | |
| AM | 31.184.235.96:6892 | udp | |
| AM | 31.184.235.97:6892 | udp | |
| AM | 31.184.235.98:6892 | udp | |
| AM | 31.184.235.99:6892 | udp | |
| AM | 31.184.235.100:6892 | udp | |
| AM | 31.184.235.101:6892 | udp | |
| AM | 31.184.235.102:6892 | udp | |
| AM | 31.184.235.103:6892 | udp | |
| AM | 31.184.235.104:6892 | udp | |
| AM | 31.184.235.105:6892 | udp | |
| AM | 31.184.235.106:6892 | udp | |
| AM | 31.184.235.107:6892 | udp | |
| AM | 31.184.235.108:6892 | udp | |
| AM | 31.184.235.109:6892 | udp | |
| AM | 31.184.235.110:6892 | udp | |
| AM | 31.184.235.111:6892 | udp | |
| AM | 31.184.235.112:6892 | udp | |
| AM | 31.184.235.113:6892 | udp | |
| AM | 31.184.235.114:6892 | udp | |
| AM | 31.184.235.115:6892 | udp | |
| AM | 31.184.235.116:6892 | udp | |
| AM | 31.184.235.117:6892 | udp | |
| AM | 31.184.235.118:6892 | udp | |
| AM | 31.184.235.119:6892 | udp | |
| AM | 31.184.235.120:6892 | udp | |
| AM | 31.184.235.121:6892 | udp | |
| AM | 31.184.235.122:6892 | udp | |
| AM | 31.184.235.123:6892 | udp | |
| AM | 31.184.235.124:6892 | udp | |
| AM | 31.184.235.125:6892 | udp | |
| AM | 31.184.235.126:6892 | udp | |
| AM | 31.184.235.127:6892 | udp | |
| AM | 31.184.235.128:6892 | udp | |
| AM | 31.184.235.129:6892 | udp | |
| AM | 31.184.235.130:6892 | udp | |
| AM | 31.184.235.131:6892 | udp | |
| AM | 31.184.235.132:6892 | udp | |
| AM | 31.184.235.133:6892 | udp | |
| AM | 31.184.235.134:6892 | udp | |
| AM | 31.184.235.135:6892 | udp | |
| AM | 31.184.235.136:6892 | udp | |
| AM | 31.184.235.137:6892 | udp | |
| AM | 31.184.235.138:6892 | udp | |
| AM | 31.184.235.139:6892 | udp | |
| AM | 31.184.235.140:6892 | udp | |
| AM | 31.184.235.141:6892 | udp | |
| AM | 31.184.235.142:6892 | udp | |
| AM | 31.184.235.143:6892 | udp | |
| AM | 31.184.235.144:6892 | udp | |
| AM | 31.184.235.145:6892 | udp | |
| AM | 31.184.235.146:6892 | udp | |
| AM | 31.184.235.147:6892 | udp | |
| AM | 31.184.235.148:6892 | udp | |
| AM | 31.184.235.149:6892 | udp | |
| AM | 31.184.235.150:6892 | udp | |
| AM | 31.184.235.151:6892 | udp | |
| AM | 31.184.235.152:6892 | udp | |
| AM | 31.184.235.153:6892 | udp | |
| AM | 31.184.235.154:6892 | udp | |
| AM | 31.184.235.155:6892 | udp | |
| AM | 31.184.235.156:6892 | udp | |
| AM | 31.184.235.157:6892 | udp | |
| AM | 31.184.235.158:6892 | udp | |
| AM | 31.184.235.159:6892 | udp | |
| AM | 31.184.235.160:6892 | udp | |
| AM | 31.184.235.161:6892 | udp | |
| AM | 31.184.235.162:6892 | udp | |
| AM | 31.184.235.163:6892 | udp | |
| AM | 31.184.235.164:6892 | udp | |
| AM | 31.184.235.165:6892 | udp | |
| AM | 31.184.235.166:6892 | udp | |
| AM | 31.184.235.167:6892 | udp | |
| AM | 31.184.235.168:6892 | udp | |
| AM | 31.184.235.169:6892 | udp | |
| AM | 31.184.235.170:6892 | udp | |
| AM | 31.184.235.171:6892 | udp | |
| AM | 31.184.235.172:6892 | udp | |
| AM | 31.184.235.173:6892 | udp | |
| AM | 31.184.235.174:6892 | udp | |
| AM | 31.184.235.175:6892 | udp | |
| AM | 31.184.235.176:6892 | udp | |
| AM | 31.184.235.177:6892 | udp | |
| AM | 31.184.235.178:6892 | udp | |
| AM | 31.184.235.179:6892 | udp | |
| AM | 31.184.235.180:6892 | udp | |
| AM | 31.184.235.181:6892 | udp | |
| AM | 31.184.235.182:6892 | udp | |
| AM | 31.184.235.183:6892 | udp | |
| AM | 31.184.235.184:6892 | udp | |
| AM | 31.184.235.185:6892 | udp | |
| AM | 31.184.235.186:6892 | udp | |
| AM | 31.184.235.187:6892 | udp | |
| AM | 31.184.235.188:6892 | udp | |
| AM | 31.184.235.189:6892 | udp | |
| AM | 31.184.235.190:6892 | udp | |
| AM | 31.184.235.191:6892 | udp | |
| AM | 31.184.235.192:6892 | udp | |
| AM | 31.184.235.193:6892 | udp | |
| AM | 31.184.235.194:6892 | udp | |
| AM | 31.184.235.195:6892 | udp | |
| AM | 31.184.235.196:6892 | udp | |
| AM | 31.184.235.197:6892 | udp | |
| AM | 31.184.235.198:6892 | udp | |
| AM | 31.184.235.199:6892 | udp | |
| AM | 31.184.235.200:6892 | udp | |
| AM | 31.184.235.201:6892 | udp | |
| AM | 31.184.235.202:6892 | udp | |
| AM | 31.184.235.203:6892 | udp | |
| AM | 31.184.235.204:6892 | udp | |
| AM | 31.184.235.205:6892 | udp | |
| AM | 31.184.235.206:6892 | udp | |
| AM | 31.184.235.207:6892 | udp | |
| AM | 31.184.235.208:6892 | udp | |
| AM | 31.184.235.209:6892 | udp | |
| AM | 31.184.235.210:6892 | udp | |
| AM | 31.184.235.211:6892 | udp | |
| AM | 31.184.235.212:6892 | udp | |
| AM | 31.184.235.213:6892 | udp | |
| AM | 31.184.235.214:6892 | udp | |
| AM | 31.184.235.215:6892 | udp | |
| AM | 31.184.235.216:6892 | udp | |
| AM | 31.184.235.217:6892 | udp | |
| AM | 31.184.235.218:6892 | udp | |
| AM | 31.184.235.219:6892 | udp | |
| AM | 31.184.235.220:6892 | udp | |
| AM | 31.184.235.221:6892 | udp | |
| AM | 31.184.235.222:6892 | udp | |
| AM | 31.184.235.223:6892 | udp | |
| AM | 31.184.235.224:6892 | udp | |
| AM | 31.184.235.225:6892 | udp | |
| AM | 31.184.235.226:6892 | udp | |
| AM | 31.184.235.227:6892 | udp | |
| AM | 31.184.235.228:6892 | udp | |
| AM | 31.184.235.229:6892 | udp | |
| AM | 31.184.235.230:6892 | udp | |
| AM | 31.184.235.231:6892 | udp | |
| AM | 31.184.235.232:6892 | udp | |
| AM | 31.184.235.233:6892 | udp | |
| AM | 31.184.235.234:6892 | udp | |
| AM | 31.184.235.235:6892 | udp | |
| AM | 31.184.235.236:6892 | udp | |
| AM | 31.184.235.237:6892 | udp | |
| AM | 31.184.235.238:6892 | udp | |
| AM | 31.184.235.239:6892 | udp | |
| AM | 31.184.235.240:6892 | udp | |
| AM | 31.184.235.241:6892 | udp | |
| AM | 31.184.235.242:6892 | udp | |
| AM | 31.184.235.243:6892 | udp | |
| AM | 31.184.235.244:6892 | udp | |
| AM | 31.184.235.245:6892 | udp | |
| AM | 31.184.235.246:6892 | udp | |
| AM | 31.184.235.247:6892 | udp | |
| AM | 31.184.235.248:6892 | udp | |
| AM | 31.184.235.249:6892 | udp | |
| AM | 31.184.235.250:6892 | udp | |
| AM | 31.184.235.251:6892 | udp | |
| AM | 31.184.235.252:6892 | udp | |
| AM | 31.184.235.253:6892 | udp | |
| AM | 31.184.235.254:6892 | udp | |
| AM | 31.184.235.255:6892 | udp | |
| AM | 31.184.234.0:6892 | udp | |
| AM | 31.184.234.1:6892 | udp | |
| AM | 31.184.234.2:6892 | udp | |
| AM | 31.184.234.3:6892 | udp | |
| AM | 31.184.234.4:6892 | udp | |
| AM | 31.184.234.5:6892 | udp | |
| AM | 31.184.234.6:6892 | udp | |
| AM | 31.184.234.7:6892 | udp | |
| AM | 31.184.234.8:6892 | udp | |
| AM | 31.184.234.9:6892 | udp | |
| AM | 31.184.234.10:6892 | udp | |
| AM | 31.184.234.11:6892 | udp | |
| AM | 31.184.234.12:6892 | udp | |
| AM | 31.184.234.13:6892 | udp | |
| AM | 31.184.234.14:6892 | udp | |
| AM | 31.184.234.15:6892 | udp | |
| AM | 31.184.234.16:6892 | udp | |
| AM | 31.184.234.17:6892 | udp | |
| AM | 31.184.234.18:6892 | udp | |
| AM | 31.184.234.19:6892 | udp | |
| AM | 31.184.234.20:6892 | udp | |
| AM | 31.184.234.21:6892 | udp | |
| AM | 31.184.234.22:6892 | udp | |
| AM | 31.184.234.23:6892 | udp | |
| AM | 31.184.234.24:6892 | udp | |
| AM | 31.184.234.25:6892 | udp | |
| AM | 31.184.234.26:6892 | udp | |
| AM | 31.184.234.27:6892 | udp | |
| AM | 31.184.234.28:6892 | udp | |
| AM | 31.184.234.29:6892 | udp | |
| AM | 31.184.234.30:6892 | udp | |
| AM | 31.184.234.31:6892 | udp | |
| AM | 31.184.234.32:6892 | udp | |
| AM | 31.184.234.33:6892 | udp | |
| AM | 31.184.234.34:6892 | udp | |
| AM | 31.184.234.35:6892 | udp | |
| AM | 31.184.234.36:6892 | udp | |
| AM | 31.184.234.37:6892 | udp | |
| AM | 31.184.234.38:6892 | udp | |
| AM | 31.184.234.39:6892 | udp | |
| AM | 31.184.234.40:6892 | udp | |
| AM | 31.184.234.41:6892 | udp | |
| AM | 31.184.234.42:6892 | udp | |
| AM | 31.184.234.43:6892 | udp | |
| AM | 31.184.234.44:6892 | udp | |
| AM | 31.184.234.45:6892 | udp | |
| AM | 31.184.234.46:6892 | udp | |
| AM | 31.184.234.47:6892 | udp | |
| AM | 31.184.234.48:6892 | udp | |
| AM | 31.184.234.49:6892 | udp | |
| AM | 31.184.234.50:6892 | udp | |
| AM | 31.184.234.51:6892 | udp | |
| AM | 31.184.234.52:6892 | udp | |
| AM | 31.184.234.53:6892 | udp | |
| AM | 31.184.234.54:6892 | udp | |
| AM | 31.184.234.55:6892 | udp | |
| AM | 31.184.234.56:6892 | udp | |
| AM | 31.184.234.57:6892 | udp | |
| AM | 31.184.234.58:6892 | udp | |
| AM | 31.184.234.59:6892 | udp | |
| AM | 31.184.234.60:6892 | udp | |
| AM | 31.184.234.61:6892 | udp | |
| AM | 31.184.234.62:6892 | udp | |
| AM | 31.184.234.63:6892 | udp | |
| AM | 31.184.234.64:6892 | udp | |
| AM | 31.184.234.65:6892 | udp | |
| AM | 31.184.234.66:6892 | udp | |
| AM | 31.184.234.67:6892 | udp | |
| AM | 31.184.234.68:6892 | udp | |
| AM | 31.184.234.69:6892 | udp | |
| AM | 31.184.234.70:6892 | udp | |
| AM | 31.184.234.71:6892 | udp | |
| AM | 31.184.234.72:6892 | udp | |
| AM | 31.184.234.73:6892 | udp | |
| AM | 31.184.234.74:6892 | udp | |
| AM | 31.184.234.75:6892 | udp | |
| AM | 31.184.234.76:6892 | udp | |
| AM | 31.184.234.77:6892 | udp | |
| AM | 31.184.234.78:6892 | udp | |
| AM | 31.184.234.79:6892 | udp | |
| AM | 31.184.234.80:6892 | udp | |
| AM | 31.184.234.81:6892 | udp | |
| AM | 31.184.234.82:6892 | udp | |
| AM | 31.184.234.83:6892 | udp | |
| AM | 31.184.234.84:6892 | udp | |
| AM | 31.184.234.85:6892 | udp | |
| AM | 31.184.234.86:6892 | udp | |
| AM | 31.184.234.87:6892 | udp | |
| AM | 31.184.234.88:6892 | udp | |
| AM | 31.184.234.89:6892 | udp | |
| AM | 31.184.234.90:6892 | udp | |
| AM | 31.184.234.91:6892 | udp | |
| AM | 31.184.234.92:6892 | udp | |
| AM | 31.184.234.93:6892 | udp | |
| AM | 31.184.234.94:6892 | udp | |
| AM | 31.184.234.95:6892 | udp | |
| AM | 31.184.234.96:6892 | udp | |
| AM | 31.184.234.97:6892 | udp | |
| AM | 31.184.234.98:6892 | udp | |
| AM | 31.184.234.99:6892 | udp | |
| AM | 31.184.234.100:6892 | udp | |
| AM | 31.184.234.101:6892 | udp | |
| AM | 31.184.234.102:6892 | udp | |
| AM | 31.184.234.103:6892 | udp | |
| AM | 31.184.234.104:6892 | udp | |
| AM | 31.184.234.105:6892 | udp | |
| AM | 31.184.234.106:6892 | udp | |
| AM | 31.184.234.107:6892 | udp | |
| AM | 31.184.234.108:6892 | udp | |
| AM | 31.184.234.109:6892 | udp | |
| AM | 31.184.234.110:6892 | udp | |
| AM | 31.184.234.111:6892 | udp | |
| AM | 31.184.234.112:6892 | udp | |
| AM | 31.184.234.113:6892 | udp | |
| AM | 31.184.234.114:6892 | udp | |
| AM | 31.184.234.115:6892 | udp | |
| AM | 31.184.234.116:6892 | udp | |
| AM | 31.184.234.117:6892 | udp | |
| AM | 31.184.234.118:6892 | udp | |
| AM | 31.184.234.119:6892 | udp | |
| AM | 31.184.234.120:6892 | udp | |
| AM | 31.184.234.121:6892 | udp | |
| AM | 31.184.234.122:6892 | udp | |
| AM | 31.184.234.123:6892 | udp | |
| AM | 31.184.234.124:6892 | udp | |
| AM | 31.184.234.125:6892 | udp | |
| AM | 31.184.234.126:6892 | udp | |
| AM | 31.184.234.127:6892 | udp | |
| AM | 31.184.234.128:6892 | udp | |
| AM | 31.184.234.129:6892 | udp | |
| AM | 31.184.234.130:6892 | udp | |
| AM | 31.184.234.131:6892 | udp | |
| AM | 31.184.234.132:6892 | udp | |
| AM | 31.184.234.133:6892 | udp | |
| AM | 31.184.234.134:6892 | udp | |
| AM | 31.184.234.135:6892 | udp | |
| AM | 31.184.234.136:6892 | udp | |
| AM | 31.184.234.137:6892 | udp | |
| AM | 31.184.234.138:6892 | udp | |
| AM | 31.184.234.139:6892 | udp | |
| AM | 31.184.234.140:6892 | udp | |
| AM | 31.184.234.141:6892 | udp | |
| AM | 31.184.234.142:6892 | udp | |
| AM | 31.184.234.143:6892 | udp | |
| AM | 31.184.234.144:6892 | udp | |
| AM | 31.184.234.145:6892 | udp | |
| AM | 31.184.234.146:6892 | udp | |
| AM | 31.184.234.147:6892 | udp | |
| AM | 31.184.234.148:6892 | udp | |
| AM | 31.184.234.149:6892 | udp | |
| AM | 31.184.234.150:6892 | udp | |
| AM | 31.184.234.151:6892 | udp | |
| AM | 31.184.234.152:6892 | udp | |
| AM | 31.184.234.153:6892 | udp | |
| AM | 31.184.234.154:6892 | udp | |
| AM | 31.184.234.155:6892 | udp | |
| AM | 31.184.234.156:6892 | udp | |
| AM | 31.184.234.157:6892 | udp | |
| AM | 31.184.234.158:6892 | udp | |
| AM | 31.184.234.159:6892 | udp | |
| AM | 31.184.234.160:6892 | udp | |
| AM | 31.184.234.161:6892 | udp | |
| AM | 31.184.234.162:6892 | udp | |
| AM | 31.184.234.163:6892 | udp | |
| AM | 31.184.234.164:6892 | udp | |
| AM | 31.184.234.165:6892 | udp | |
| AM | 31.184.234.166:6892 | udp | |
| AM | 31.184.234.167:6892 | udp | |
| AM | 31.184.234.168:6892 | udp | |
| AM | 31.184.234.169:6892 | udp | |
| AM | 31.184.234.170:6892 | udp | |
| AM | 31.184.234.171:6892 | udp | |
| AM | 31.184.234.172:6892 | udp | |
| AM | 31.184.234.173:6892 | udp | |
| AM | 31.184.234.174:6892 | udp | |
| AM | 31.184.234.175:6892 | udp | |
| AM | 31.184.234.176:6892 | udp | |
| AM | 31.184.234.177:6892 | udp | |
| AM | 31.184.234.178:6892 | udp | |
| AM | 31.184.234.179:6892 | udp | |
| AM | 31.184.234.180:6892 | udp | |
| AM | 31.184.234.181:6892 | udp | |
| AM | 31.184.234.182:6892 | udp | |
| AM | 31.184.234.183:6892 | udp | |
| AM | 31.184.234.184:6892 | udp | |
| AM | 31.184.234.185:6892 | udp | |
| AM | 31.184.234.186:6892 | udp | |
| AM | 31.184.234.187:6892 | udp | |
| AM | 31.184.234.188:6892 | udp | |
| AM | 31.184.234.189:6892 | udp | |
| AM | 31.184.234.190:6892 | udp | |
| AM | 31.184.234.191:6892 | udp | |
| AM | 31.184.234.192:6892 | udp | |
| AM | 31.184.234.193:6892 | udp | |
| AM | 31.184.234.194:6892 | udp | |
| AM | 31.184.234.195:6892 | udp | |
| AM | 31.184.234.196:6892 | udp | |
| AM | 31.184.234.197:6892 | udp | |
| AM | 31.184.234.198:6892 | udp | |
| AM | 31.184.234.199:6892 | udp | |
| AM | 31.184.234.200:6892 | udp | |
| AM | 31.184.234.201:6892 | udp | |
| AM | 31.184.234.202:6892 | udp | |
| AM | 31.184.234.203:6892 | udp | |
| AM | 31.184.234.204:6892 | udp | |
| AM | 31.184.234.205:6892 | udp | |
| AM | 31.184.234.206:6892 | udp | |
| AM | 31.184.234.207:6892 | udp | |
| AM | 31.184.234.208:6892 | udp | |
| AM | 31.184.234.209:6892 | udp | |
| AM | 31.184.234.210:6892 | udp | |
| AM | 31.184.234.211:6892 | udp | |
| AM | 31.184.234.212:6892 | udp | |
| AM | 31.184.234.213:6892 | udp | |
| AM | 31.184.234.214:6892 | udp | |
| AM | 31.184.234.215:6892 | udp | |
| AM | 31.184.234.216:6892 | udp | |
| AM | 31.184.234.217:6892 | udp | |
| AM | 31.184.234.218:6892 | udp | |
| AM | 31.184.234.219:6892 | udp | |
| AM | 31.184.234.220:6892 | udp | |
| AM | 31.184.234.221:6892 | udp | |
| AM | 31.184.234.222:6892 | udp | |
| AM | 31.184.234.223:6892 | udp | |
| AM | 31.184.234.224:6892 | udp | |
| AM | 31.184.234.225:6892 | udp | |
| AM | 31.184.234.226:6892 | udp | |
| AM | 31.184.234.227:6892 | udp | |
| AM | 31.184.234.228:6892 | udp | |
| AM | 31.184.234.229:6892 | udp | |
| AM | 31.184.234.230:6892 | udp | |
| AM | 31.184.234.231:6892 | udp | |
| AM | 31.184.234.232:6892 | udp | |
| AM | 31.184.234.233:6892 | udp | |
| AM | 31.184.234.234:6892 | udp | |
| AM | 31.184.234.235:6892 | udp | |
| AM | 31.184.234.236:6892 | udp | |
| AM | 31.184.234.237:6892 | udp | |
| AM | 31.184.234.238:6892 | udp | |
| AM | 31.184.234.239:6892 | udp | |
| AM | 31.184.234.240:6892 | udp | |
| AM | 31.184.234.241:6892 | udp | |
| AM | 31.184.234.242:6892 | udp | |
| AM | 31.184.234.243:6892 | udp | |
| AM | 31.184.234.244:6892 | udp | |
| AM | 31.184.234.245:6892 | udp | |
| AM | 31.184.234.246:6892 | udp | |
| AM | 31.184.234.247:6892 | udp | |
| AM | 31.184.234.248:6892 | udp | |
| AM | 31.184.234.249:6892 | udp | |
| AM | 31.184.234.250:6892 | udp | |
| AM | 31.184.234.251:6892 | udp | |
| AM | 31.184.234.252:6892 | udp | |
| AM | 31.184.234.253:6892 | udp | |
| AM | 31.184.234.254:6892 | udp | |
| AM | 31.184.234.255:6892 | udp | |
| AM | 31.184.235.0:6892 | udp | |
| AM | 31.184.235.1:6892 | udp | |
| AM | 31.184.235.2:6892 | udp | |
| AM | 31.184.235.3:6892 | udp | |
| AM | 31.184.235.4:6892 | udp | |
| AM | 31.184.235.5:6892 | udp | |
| AM | 31.184.235.6:6892 | udp | |
| AM | 31.184.235.7:6892 | udp | |
| AM | 31.184.235.8:6892 | udp | |
| AM | 31.184.235.9:6892 | udp | |
| AM | 31.184.235.10:6892 | udp | |
| AM | 31.184.235.11:6892 | udp | |
| AM | 31.184.235.12:6892 | udp | |
| AM | 31.184.235.13:6892 | udp | |
| AM | 31.184.235.14:6892 | udp | |
| AM | 31.184.235.15:6892 | udp | |
| AM | 31.184.235.16:6892 | udp | |
| AM | 31.184.235.17:6892 | udp | |
| AM | 31.184.235.18:6892 | udp | |
| AM | 31.184.235.19:6892 | udp | |
| AM | 31.184.235.20:6892 | udp | |
| AM | 31.184.235.21:6892 | udp | |
| AM | 31.184.235.22:6892 | udp | |
| AM | 31.184.235.23:6892 | udp | |
| AM | 31.184.235.24:6892 | udp | |
| AM | 31.184.235.25:6892 | udp | |
| AM | 31.184.235.26:6892 | udp | |
| AM | 31.184.235.27:6892 | udp | |
| AM | 31.184.235.28:6892 | udp | |
| AM | 31.184.235.29:6892 | udp | |
| AM | 31.184.235.30:6892 | udp | |
| AM | 31.184.235.31:6892 | udp | |
| AM | 31.184.235.32:6892 | udp | |
| AM | 31.184.235.33:6892 | udp | |
| AM | 31.184.235.34:6892 | udp | |
| AM | 31.184.235.35:6892 | udp | |
| AM | 31.184.235.36:6892 | udp | |
| AM | 31.184.235.37:6892 | udp | |
| AM | 31.184.235.38:6892 | udp | |
| AM | 31.184.235.39:6892 | udp | |
| AM | 31.184.235.40:6892 | udp | |
| AM | 31.184.235.41:6892 | udp | |
| AM | 31.184.235.42:6892 | udp | |
| AM | 31.184.235.43:6892 | udp | |
| AM | 31.184.235.44:6892 | udp | |
| AM | 31.184.235.45:6892 | udp | |
| AM | 31.184.235.46:6892 | udp | |
| AM | 31.184.235.47:6892 | udp | |
| AM | 31.184.235.48:6892 | udp | |
| AM | 31.184.235.49:6892 | udp | |
| AM | 31.184.235.50:6892 | udp | |
| AM | 31.184.235.51:6892 | udp | |
| AM | 31.184.235.52:6892 | udp | |
| AM | 31.184.235.53:6892 | udp | |
| AM | 31.184.235.54:6892 | udp | |
| AM | 31.184.235.55:6892 | udp | |
| AM | 31.184.235.56:6892 | udp | |
| AM | 31.184.235.57:6892 | udp | |
| AM | 31.184.235.58:6892 | udp | |
| AM | 31.184.235.59:6892 | udp | |
| AM | 31.184.235.60:6892 | udp | |
| AM | 31.184.235.61:6892 | udp | |
| AM | 31.184.235.62:6892 | udp | |
| AM | 31.184.235.63:6892 | udp | |
| AM | 31.184.235.64:6892 | udp | |
| AM | 31.184.235.65:6892 | udp | |
| AM | 31.184.235.66:6892 | udp | |
| AM | 31.184.235.67:6892 | udp | |
| AM | 31.184.235.68:6892 | udp | |
| AM | 31.184.235.69:6892 | udp | |
| AM | 31.184.235.70:6892 | udp | |
| AM | 31.184.235.71:6892 | udp | |
| AM | 31.184.235.72:6892 | udp | |
| AM | 31.184.235.73:6892 | udp | |
| AM | 31.184.235.74:6892 | udp | |
| AM | 31.184.235.75:6892 | udp | |
| AM | 31.184.235.76:6892 | udp | |
| AM | 31.184.235.77:6892 | udp | |
| AM | 31.184.235.78:6892 | udp | |
| AM | 31.184.235.79:6892 | udp | |
| AM | 31.184.235.80:6892 | udp | |
| AM | 31.184.235.81:6892 | udp | |
| AM | 31.184.235.82:6892 | udp | |
| AM | 31.184.235.83:6892 | udp | |
| AM | 31.184.235.84:6892 | udp | |
| AM | 31.184.235.85:6892 | udp | |
| AM | 31.184.235.86:6892 | udp | |
| AM | 31.184.235.87:6892 | udp | |
| AM | 31.184.235.88:6892 | udp | |
| AM | 31.184.235.89:6892 | udp | |
| AM | 31.184.235.90:6892 | udp | |
| AM | 31.184.235.91:6892 | udp | |
| AM | 31.184.235.92:6892 | udp | |
| AM | 31.184.235.93:6892 | udp | |
| AM | 31.184.235.94:6892 | udp | |
| AM | 31.184.235.95:6892 | udp | |
| AM | 31.184.235.96:6892 | udp | |
| AM | 31.184.235.97:6892 | udp | |
| AM | 31.184.235.98:6892 | udp | |
| AM | 31.184.235.99:6892 | udp | |
| AM | 31.184.235.100:6892 | udp | |
| AM | 31.184.235.101:6892 | udp | |
| AM | 31.184.235.102:6892 | udp | |
| AM | 31.184.235.103:6892 | udp | |
| AM | 31.184.235.104:6892 | udp | |
| AM | 31.184.235.105:6892 | udp | |
| AM | 31.184.235.106:6892 | udp | |
| AM | 31.184.235.107:6892 | udp | |
| AM | 31.184.235.108:6892 | udp | |
| AM | 31.184.235.109:6892 | udp | |
| AM | 31.184.235.110:6892 | udp | |
| AM | 31.184.235.111:6892 | udp | |
| AM | 31.184.235.112:6892 | udp | |
| AM | 31.184.235.113:6892 | udp | |
| AM | 31.184.235.114:6892 | udp | |
| AM | 31.184.235.115:6892 | udp | |
| AM | 31.184.235.116:6892 | udp | |
| AM | 31.184.235.117:6892 | udp | |
| AM | 31.184.235.118:6892 | udp | |
| AM | 31.184.235.119:6892 | udp | |
| AM | 31.184.235.120:6892 | udp | |
| AM | 31.184.235.121:6892 | udp | |
| AM | 31.184.235.122:6892 | udp | |
| AM | 31.184.235.123:6892 | udp | |
| AM | 31.184.235.124:6892 | udp | |
| AM | 31.184.235.125:6892 | udp | |
| AM | 31.184.235.126:6892 | udp | |
| AM | 31.184.235.127:6892 | udp | |
| AM | 31.184.235.128:6892 | udp | |
| AM | 31.184.235.129:6892 | udp | |
| AM | 31.184.235.130:6892 | udp | |
| AM | 31.184.235.131:6892 | udp | |
| AM | 31.184.235.132:6892 | udp | |
| AM | 31.184.235.133:6892 | udp | |
| AM | 31.184.235.134:6892 | udp | |
| AM | 31.184.235.135:6892 | udp | |
| AM | 31.184.235.136:6892 | udp | |
| AM | 31.184.235.137:6892 | udp | |
| AM | 31.184.235.138:6892 | udp | |
| AM | 31.184.235.139:6892 | udp | |
| AM | 31.184.235.140:6892 | udp | |
| AM | 31.184.235.141:6892 | udp | |
| AM | 31.184.235.142:6892 | udp | |
| AM | 31.184.235.143:6892 | udp | |
| AM | 31.184.235.144:6892 | udp | |
| AM | 31.184.235.145:6892 | udp | |
| AM | 31.184.235.146:6892 | udp | |
| AM | 31.184.235.147:6892 | udp | |
| AM | 31.184.235.148:6892 | udp | |
| AM | 31.184.235.149:6892 | udp | |
| AM | 31.184.235.150:6892 | udp | |
| AM | 31.184.235.151:6892 | udp | |
| AM | 31.184.235.152:6892 | udp | |
| AM | 31.184.235.153:6892 | udp | |
| AM | 31.184.235.154:6892 | udp | |
| AM | 31.184.235.155:6892 | udp | |
| AM | 31.184.235.156:6892 | udp | |
| AM | 31.184.235.157:6892 | udp | |
| AM | 31.184.235.158:6892 | udp | |
| AM | 31.184.235.159:6892 | udp | |
| AM | 31.184.235.160:6892 | udp | |
| AM | 31.184.235.161:6892 | udp | |
| AM | 31.184.235.162:6892 | udp | |
| AM | 31.184.235.163:6892 | udp | |
| AM | 31.184.235.164:6892 | udp | |
| AM | 31.184.235.165:6892 | udp | |
| AM | 31.184.235.166:6892 | udp | |
| AM | 31.184.235.167:6892 | udp | |
| AM | 31.184.235.168:6892 | udp | |
| AM | 31.184.235.169:6892 | udp | |
| AM | 31.184.235.170:6892 | udp | |
| AM | 31.184.235.171:6892 | udp | |
| AM | 31.184.235.172:6892 | udp | |
| AM | 31.184.235.173:6892 | udp | |
| AM | 31.184.235.174:6892 | udp | |
| AM | 31.184.235.175:6892 | udp | |
| AM | 31.184.235.176:6892 | udp | |
| AM | 31.184.235.177:6892 | udp | |
| AM | 31.184.235.178:6892 | udp | |
| AM | 31.184.235.179:6892 | udp | |
| AM | 31.184.235.180:6892 | udp | |
| AM | 31.184.235.181:6892 | udp | |
| AM | 31.184.235.182:6892 | udp | |
| AM | 31.184.235.183:6892 | udp | |
| AM | 31.184.235.184:6892 | udp | |
| AM | 31.184.235.185:6892 | udp | |
| AM | 31.184.235.186:6892 | udp | |
| AM | 31.184.235.187:6892 | udp | |
| AM | 31.184.235.188:6892 | udp | |
| AM | 31.184.235.189:6892 | udp | |
| AM | 31.184.235.190:6892 | udp | |
| AM | 31.184.235.191:6892 | udp | |
| AM | 31.184.235.192:6892 | udp | |
| AM | 31.184.235.193:6892 | udp | |
| AM | 31.184.235.194:6892 | udp | |
| AM | 31.184.235.195:6892 | udp | |
| AM | 31.184.235.196:6892 | udp | |
| AM | 31.184.235.197:6892 | udp | |
| AM | 31.184.235.198:6892 | udp | |
| AM | 31.184.235.199:6892 | udp | |
| AM | 31.184.235.200:6892 | udp | |
| AM | 31.184.235.201:6892 | udp | |
| AM | 31.184.235.202:6892 | udp | |
| AM | 31.184.235.203:6892 | udp | |
| AM | 31.184.235.204:6892 | udp | |
| AM | 31.184.235.205:6892 | udp | |
| AM | 31.184.235.206:6892 | udp | |
| AM | 31.184.235.207:6892 | udp | |
| AM | 31.184.235.208:6892 | udp | |
| AM | 31.184.235.209:6892 | udp | |
| AM | 31.184.235.210:6892 | udp | |
| AM | 31.184.235.211:6892 | udp | |
| AM | 31.184.235.212:6892 | udp | |
| AM | 31.184.235.213:6892 | udp | |
| AM | 31.184.235.214:6892 | udp | |
| AM | 31.184.235.215:6892 | udp | |
| AM | 31.184.235.216:6892 | udp | |
| AM | 31.184.235.217:6892 | udp | |
| AM | 31.184.235.218:6892 | udp | |
| AM | 31.184.235.219:6892 | udp | |
| AM | 31.184.235.220:6892 | udp | |
| AM | 31.184.235.221:6892 | udp | |
| AM | 31.184.235.222:6892 | udp | |
| AM | 31.184.235.223:6892 | udp | |
| AM | 31.184.235.224:6892 | udp | |
| AM | 31.184.235.225:6892 | udp | |
| AM | 31.184.235.226:6892 | udp | |
| AM | 31.184.235.227:6892 | udp | |
| AM | 31.184.235.228:6892 | udp | |
| AM | 31.184.235.229:6892 | udp | |
| AM | 31.184.235.230:6892 | udp | |
| AM | 31.184.235.231:6892 | udp | |
| AM | 31.184.235.232:6892 | udp | |
| AM | 31.184.235.233:6892 | udp | |
| AM | 31.184.235.234:6892 | udp | |
| AM | 31.184.235.235:6892 | udp | |
| AM | 31.184.235.236:6892 | udp | |
| AM | 31.184.235.237:6892 | udp | |
| AM | 31.184.235.238:6892 | udp | |
| AM | 31.184.235.239:6892 | udp | |
| AM | 31.184.235.240:6892 | udp | |
| AM | 31.184.235.241:6892 | udp | |
| AM | 31.184.235.242:6892 | udp | |
| AM | 31.184.235.243:6892 | udp | |
| AM | 31.184.235.244:6892 | udp | |
| AM | 31.184.235.245:6892 | udp | |
| AM | 31.184.235.246:6892 | udp | |
| AM | 31.184.235.247:6892 | udp | |
| AM | 31.184.235.248:6892 | udp | |
| AM | 31.184.235.249:6892 | udp | |
| AM | 31.184.235.250:6892 | udp | |
| AM | 31.184.235.251:6892 | udp | |
| AM | 31.184.235.252:6892 | udp | |
| AM | 31.184.235.253:6892 | udp | |
| AM | 31.184.235.254:6892 | udp | |
| AM | 31.184.235.255:6892 | udp | |
| AM | 31.184.234.0:6892 | udp | |
| AM | 31.184.234.1:6892 | udp | |
| AM | 31.184.234.2:6892 | udp | |
| AM | 31.184.234.3:6892 | udp | |
| AM | 31.184.234.4:6892 | udp | |
| AM | 31.184.234.5:6892 | udp | |
| AM | 31.184.234.6:6892 | udp | |
| AM | 31.184.234.7:6892 | udp | |
| AM | 31.184.234.8:6892 | udp | |
| AM | 31.184.234.9:6892 | udp | |
| AM | 31.184.234.10:6892 | udp | |
| AM | 31.184.234.11:6892 | udp | |
| AM | 31.184.234.12:6892 | udp | |
| AM | 31.184.234.13:6892 | udp | |
| AM | 31.184.234.14:6892 | udp | |
| AM | 31.184.234.15:6892 | udp | |
| AM | 31.184.234.16:6892 | udp | |
| AM | 31.184.234.17:6892 | udp | |
| AM | 31.184.234.18:6892 | udp | |
| AM | 31.184.234.19:6892 | udp | |
| AM | 31.184.234.20:6892 | udp | |
| AM | 31.184.234.21:6892 | udp | |
| AM | 31.184.234.22:6892 | udp | |
| AM | 31.184.234.23:6892 | udp | |
| AM | 31.184.234.24:6892 | udp | |
| AM | 31.184.234.25:6892 | udp | |
| AM | 31.184.234.26:6892 | udp | |
| AM | 31.184.234.27:6892 | udp | |
| AM | 31.184.234.28:6892 | udp | |
| AM | 31.184.234.29:6892 | udp | |
| AM | 31.184.234.30:6892 | udp | |
| AM | 31.184.234.31:6892 | udp | |
| AM | 31.184.234.32:6892 | udp | |
| AM | 31.184.234.33:6892 | udp | |
| AM | 31.184.234.34:6892 | udp | |
| AM | 31.184.234.35:6892 | udp | |
| AM | 31.184.234.36:6892 | udp | |
| AM | 31.184.234.37:6892 | udp | |
| AM | 31.184.234.38:6892 | udp | |
| AM | 31.184.234.39:6892 | udp | |
| AM | 31.184.234.40:6892 | udp | |
| AM | 31.184.234.41:6892 | udp | |
| AM | 31.184.234.42:6892 | udp | |
| AM | 31.184.234.43:6892 | udp | |
| AM | 31.184.234.44:6892 | udp | |
| AM | 31.184.234.45:6892 | udp | |
| AM | 31.184.234.46:6892 | udp | |
| AM | 31.184.234.47:6892 | udp | |
| AM | 31.184.234.48:6892 | udp | |
| AM | 31.184.234.49:6892 | udp | |
| AM | 31.184.234.50:6892 | udp | |
| AM | 31.184.234.51:6892 | udp | |
| AM | 31.184.234.52:6892 | udp | |
| AM | 31.184.234.53:6892 | udp | |
| AM | 31.184.234.54:6892 | udp | |
| AM | 31.184.234.55:6892 | udp | |
| AM | 31.184.234.56:6892 | udp | |
| AM | 31.184.234.57:6892 | udp | |
| AM | 31.184.234.58:6892 | udp | |
| AM | 31.184.234.59:6892 | udp | |
| AM | 31.184.234.60:6892 | udp | |
| AM | 31.184.234.61:6892 | udp | |
| AM | 31.184.234.62:6892 | udp | |
| AM | 31.184.234.63:6892 | udp | |
| AM | 31.184.234.64:6892 | udp | |
| AM | 31.184.234.65:6892 | udp | |
| AM | 31.184.234.66:6892 | udp | |
| AM | 31.184.234.67:6892 | udp | |
| AM | 31.184.234.68:6892 | udp | |
| AM | 31.184.234.69:6892 | udp | |
| AM | 31.184.234.70:6892 | udp | |
| AM | 31.184.234.71:6892 | udp | |
| AM | 31.184.234.72:6892 | udp | |
| AM | 31.184.234.73:6892 | udp | |
| AM | 31.184.234.74:6892 | udp | |
| AM | 31.184.234.75:6892 | udp | |
| AM | 31.184.234.76:6892 | udp | |
| AM | 31.184.234.77:6892 | udp | |
| AM | 31.184.234.78:6892 | udp | |
| AM | 31.184.234.79:6892 | udp | |
| AM | 31.184.234.80:6892 | udp | |
| AM | 31.184.234.81:6892 | udp | |
| AM | 31.184.234.82:6892 | udp | |
| AM | 31.184.234.83:6892 | udp | |
| AM | 31.184.234.84:6892 | udp | |
| AM | 31.184.234.85:6892 | udp | |
| AM | 31.184.234.86:6892 | udp | |
| AM | 31.184.234.87:6892 | udp | |
| AM | 31.184.234.88:6892 | udp | |
| AM | 31.184.234.89:6892 | udp | |
| AM | 31.184.234.90:6892 | udp | |
| AM | 31.184.234.91:6892 | udp | |
| AM | 31.184.234.92:6892 | udp | |
| AM | 31.184.234.93:6892 | udp | |
| AM | 31.184.234.94:6892 | udp | |
| AM | 31.184.234.95:6892 | udp | |
| AM | 31.184.234.96:6892 | udp | |
| AM | 31.184.234.97:6892 | udp | |
| AM | 31.184.234.98:6892 | udp | |
| AM | 31.184.234.99:6892 | udp | |
| AM | 31.184.234.100:6892 | udp | |
| AM | 31.184.234.101:6892 | udp | |
| AM | 31.184.234.102:6892 | udp | |
| AM | 31.184.234.103:6892 | udp | |
| AM | 31.184.234.104:6892 | udp | |
| AM | 31.184.234.105:6892 | udp | |
| AM | 31.184.234.106:6892 | udp | |
| AM | 31.184.234.107:6892 | udp | |
| AM | 31.184.234.108:6892 | udp | |
| AM | 31.184.234.109:6892 | udp | |
| AM | 31.184.234.110:6892 | udp | |
| AM | 31.184.234.111:6892 | udp | |
| AM | 31.184.234.112:6892 | udp | |
| AM | 31.184.234.113:6892 | udp | |
| AM | 31.184.234.114:6892 | udp | |
| AM | 31.184.234.115:6892 | udp | |
| AM | 31.184.234.116:6892 | udp | |
| AM | 31.184.234.117:6892 | udp | |
| AM | 31.184.234.118:6892 | udp | |
| AM | 31.184.234.119:6892 | udp | |
| AM | 31.184.234.120:6892 | udp | |
| AM | 31.184.234.121:6892 | udp | |
| AM | 31.184.234.122:6892 | udp | |
| AM | 31.184.234.123:6892 | udp | |
| AM | 31.184.234.124:6892 | udp | |
| AM | 31.184.234.125:6892 | udp | |
| AM | 31.184.234.126:6892 | udp | |
| AM | 31.184.234.127:6892 | udp | |
| AM | 31.184.234.128:6892 | udp | |
| AM | 31.184.234.129:6892 | udp | |
| AM | 31.184.234.130:6892 | udp | |
| AM | 31.184.234.131:6892 | udp | |
| AM | 31.184.234.132:6892 | udp | |
| AM | 31.184.234.133:6892 | udp | |
| AM | 31.184.234.134:6892 | udp | |
| AM | 31.184.234.135:6892 | udp | |
| AM | 31.184.234.136:6892 | udp | |
| AM | 31.184.234.137:6892 | udp | |
| AM | 31.184.234.138:6892 | udp | |
| AM | 31.184.234.139:6892 | udp | |
| AM | 31.184.234.140:6892 | udp | |
| AM | 31.184.234.141:6892 | udp | |
| AM | 31.184.234.142:6892 | udp | |
| AM | 31.184.234.143:6892 | udp | |
| AM | 31.184.234.144:6892 | udp | |
| AM | 31.184.234.145:6892 | udp | |
| AM | 31.184.234.146:6892 | udp | |
| AM | 31.184.234.147:6892 | udp | |
| AM | 31.184.234.148:6892 | udp | |
| AM | 31.184.234.149:6892 | udp | |
| AM | 31.184.234.150:6892 | udp | |
| AM | 31.184.234.151:6892 | udp | |
| AM | 31.184.234.152:6892 | udp | |
| AM | 31.184.234.153:6892 | udp | |
| AM | 31.184.234.154:6892 | udp | |
| AM | 31.184.234.155:6892 | udp | |
| AM | 31.184.234.156:6892 | udp | |
| AM | 31.184.234.157:6892 | udp | |
| AM | 31.184.234.158:6892 | udp | |
| AM | 31.184.234.159:6892 | udp | |
| AM | 31.184.234.160:6892 | udp | |
| AM | 31.184.234.161:6892 | udp | |
| AM | 31.184.234.162:6892 | udp | |
| AM | 31.184.234.163:6892 | udp | |
| AM | 31.184.234.164:6892 | udp | |
| AM | 31.184.234.165:6892 | udp | |
| AM | 31.184.234.166:6892 | udp | |
| AM | 31.184.234.167:6892 | udp | |
| AM | 31.184.234.168:6892 | udp | |
| AM | 31.184.234.169:6892 | udp | |
| AM | 31.184.234.170:6892 | udp | |
| AM | 31.184.234.171:6892 | udp | |
| AM | 31.184.234.172:6892 | udp | |
| AM | 31.184.234.173:6892 | udp | |
| AM | 31.184.234.174:6892 | udp | |
| AM | 31.184.234.175:6892 | udp | |
| AM | 31.184.234.176:6892 | udp | |
| AM | 31.184.234.177:6892 | udp | |
| AM | 31.184.234.178:6892 | udp | |
| AM | 31.184.234.179:6892 | udp | |
| AM | 31.184.234.180:6892 | udp | |
| AM | 31.184.234.181:6892 | udp | |
| AM | 31.184.234.182:6892 | udp | |
| AM | 31.184.234.183:6892 | udp | |
| AM | 31.184.234.184:6892 | udp | |
| AM | 31.184.234.185:6892 | udp | |
| AM | 31.184.234.186:6892 | udp | |
| AM | 31.184.234.187:6892 | udp | |
| AM | 31.184.234.188:6892 | udp | |
| AM | 31.184.234.189:6892 | udp | |
| AM | 31.184.234.190:6892 | udp | |
| AM | 31.184.234.191:6892 | udp | |
| AM | 31.184.234.192:6892 | udp | |
| AM | 31.184.234.193:6892 | udp | |
| AM | 31.184.234.194:6892 | udp | |
| AM | 31.184.234.195:6892 | udp | |
| AM | 31.184.234.196:6892 | udp | |
| AM | 31.184.234.197:6892 | udp | |
| AM | 31.184.234.198:6892 | udp | |
| AM | 31.184.234.199:6892 | udp | |
| AM | 31.184.234.200:6892 | udp | |
| AM | 31.184.234.201:6892 | udp | |
| AM | 31.184.234.202:6892 | udp | |
| AM | 31.184.234.203:6892 | udp | |
| AM | 31.184.234.204:6892 | udp | |
| AM | 31.184.234.205:6892 | udp | |
| AM | 31.184.234.206:6892 | udp | |
| AM | 31.184.234.207:6892 | udp | |
| AM | 31.184.234.208:6892 | udp | |
| AM | 31.184.234.209:6892 | udp | |
| AM | 31.184.234.210:6892 | udp | |
| AM | 31.184.234.211:6892 | udp | |
| AM | 31.184.234.212:6892 | udp | |
| AM | 31.184.234.213:6892 | udp | |
| AM | 31.184.234.214:6892 | udp | |
| AM | 31.184.234.215:6892 | udp | |
| AM | 31.184.234.216:6892 | udp | |
| AM | 31.184.234.217:6892 | udp | |
| AM | 31.184.234.218:6892 | udp | |
| AM | 31.184.234.219:6892 | udp | |
| AM | 31.184.234.220:6892 | udp | |
| AM | 31.184.234.221:6892 | udp | |
| AM | 31.184.234.222:6892 | udp | |
| AM | 31.184.234.223:6892 | udp | |
| AM | 31.184.234.224:6892 | udp | |
| AM | 31.184.234.225:6892 | udp | |
| AM | 31.184.234.226:6892 | udp | |
| AM | 31.184.234.227:6892 | udp | |
| AM | 31.184.234.228:6892 | udp | |
| AM | 31.184.234.229:6892 | udp | |
| AM | 31.184.234.230:6892 | udp | |
| AM | 31.184.234.231:6892 | udp | |
| AM | 31.184.234.232:6892 | udp | |
| AM | 31.184.234.233:6892 | udp | |
| AM | 31.184.234.234:6892 | udp | |
| AM | 31.184.234.235:6892 | udp | |
| AM | 31.184.234.236:6892 | udp | |
| AM | 31.184.234.237:6892 | udp | |
| AM | 31.184.234.238:6892 | udp | |
| AM | 31.184.234.239:6892 | udp | |
| AM | 31.184.234.240:6892 | udp | |
| AM | 31.184.234.241:6892 | udp | |
| AM | 31.184.234.242:6892 | udp | |
| AM | 31.184.234.243:6892 | udp | |
| AM | 31.184.234.244:6892 | udp | |
| AM | 31.184.234.245:6892 | udp | |
| AM | 31.184.234.246:6892 | udp | |
| AM | 31.184.234.247:6892 | udp | |
| AM | 31.184.234.248:6892 | udp | |
| AM | 31.184.234.249:6892 | udp | |
| AM | 31.184.234.250:6892 | udp | |
| AM | 31.184.234.251:6892 | udp | |
| AM | 31.184.234.252:6892 | udp | |
| AM | 31.184.234.253:6892 | udp | |
| AM | 31.184.234.254:6892 | udp | |
| US | 8.8.8.8:53 | pmenboeqhyrpvomq.wz139z.top | udp |
| AM | 31.184.234.255:6892 | udp | |
| AM | 31.184.235.0:6892 | udp | |
| AM | 31.184.235.1:6892 | udp | |
| AM | 31.184.235.2:6892 | udp | |
| AM | 31.184.235.3:6892 | udp | |
| AM | 31.184.235.4:6892 | udp | |
| AM | 31.184.235.5:6892 | udp | |
| AM | 31.184.235.6:6892 | udp | |
| AM | 31.184.235.7:6892 | udp | |
| AM | 31.184.235.8:6892 | udp | |
| AM | 31.184.235.9:6892 | udp | |
| AM | 31.184.235.10:6892 | udp | |
| AM | 31.184.235.11:6892 | udp | |
| AM | 31.184.235.12:6892 | udp | |
| AM | 31.184.235.13:6892 | udp | |
| AM | 31.184.235.14:6892 | udp | |
| AM | 31.184.235.15:6892 | udp | |
| AM | 31.184.235.16:6892 | udp | |
| AM | 31.184.235.17:6892 | udp | |
| AM | 31.184.235.18:6892 | udp | |
| AM | 31.184.235.19:6892 | udp | |
| AM | 31.184.235.20:6892 | udp | |
| AM | 31.184.235.21:6892 | udp | |
| AM | 31.184.235.22:6892 | udp | |
| AM | 31.184.235.23:6892 | udp | |
| AM | 31.184.235.24:6892 | udp | |
| AM | 31.184.235.25:6892 | udp | |
| AM | 31.184.235.26:6892 | udp | |
| AM | 31.184.235.27:6892 | udp | |
| AM | 31.184.235.28:6892 | udp | |
| AM | 31.184.235.29:6892 | udp | |
| AM | 31.184.235.30:6892 | udp | |
| AM | 31.184.235.31:6892 | udp | |
| AM | 31.184.235.32:6892 | udp | |
| AM | 31.184.235.33:6892 | udp | |
| AM | 31.184.235.34:6892 | udp | |
| AM | 31.184.235.35:6892 | udp | |
| AM | 31.184.235.36:6892 | udp | |
| AM | 31.184.235.37:6892 | udp | |
| AM | 31.184.235.38:6892 | udp | |
| AM | 31.184.235.39:6892 | udp | |
| AM | 31.184.235.40:6892 | udp | |
| AM | 31.184.235.41:6892 | udp | |
| AM | 31.184.235.42:6892 | udp | |
| AM | 31.184.235.43:6892 | udp | |
| AM | 31.184.235.44:6892 | udp | |
| AM | 31.184.235.45:6892 | udp | |
| AM | 31.184.235.46:6892 | udp | |
| AM | 31.184.235.47:6892 | udp | |
| AM | 31.184.235.48:6892 | udp | |
| AM | 31.184.235.49:6892 | udp | |
| AM | 31.184.235.50:6892 | udp | |
| AM | 31.184.235.51:6892 | udp | |
| AM | 31.184.235.52:6892 | udp | |
| AM | 31.184.235.53:6892 | udp | |
| AM | 31.184.235.54:6892 | udp | |
| AM | 31.184.235.55:6892 | udp | |
| AM | 31.184.235.56:6892 | udp | |
| AM | 31.184.235.57:6892 | udp | |
| AM | 31.184.235.58:6892 | udp | |
| AM | 31.184.235.59:6892 | udp | |
| AM | 31.184.235.60:6892 | udp | |
| AM | 31.184.235.61:6892 | udp | |
| AM | 31.184.235.62:6892 | udp | |
| AM | 31.184.235.63:6892 | udp | |
| AM | 31.184.235.64:6892 | udp | |
| AM | 31.184.235.65:6892 | udp | |
| AM | 31.184.235.66:6892 | udp | |
| AM | 31.184.235.67:6892 | udp | |
| AM | 31.184.235.68:6892 | udp | |
| AM | 31.184.235.69:6892 | udp | |
| AM | 31.184.235.70:6892 | udp | |
| AM | 31.184.235.71:6892 | udp | |
| AM | 31.184.235.72:6892 | udp | |
| AM | 31.184.235.73:6892 | udp | |
| AM | 31.184.235.74:6892 | udp | |
| AM | 31.184.235.75:6892 | udp | |
| AM | 31.184.235.76:6892 | udp | |
| AM | 31.184.235.77:6892 | udp | |
| AM | 31.184.235.78:6892 | udp | |
| AM | 31.184.235.79:6892 | udp | |
| AM | 31.184.235.80:6892 | udp | |
| AM | 31.184.235.81:6892 | udp | |
| AM | 31.184.235.82:6892 | udp | |
| AM | 31.184.235.83:6892 | udp | |
| AM | 31.184.235.84:6892 | udp | |
| AM | 31.184.235.85:6892 | udp | |
| AM | 31.184.235.86:6892 | udp | |
| AM | 31.184.235.87:6892 | udp | |
| AM | 31.184.235.88:6892 | udp | |
| AM | 31.184.235.89:6892 | udp | |
| AM | 31.184.235.90:6892 | udp | |
| AM | 31.184.235.91:6892 | udp | |
| AM | 31.184.235.92:6892 | udp | |
| AM | 31.184.235.93:6892 | udp | |
| AM | 31.184.235.94:6892 | udp | |
| AM | 31.184.235.95:6892 | udp | |
| AM | 31.184.235.96:6892 | udp | |
| AM | 31.184.235.97:6892 | udp | |
| AM | 31.184.235.98:6892 | udp | |
| AM | 31.184.235.99:6892 | udp | |
| AM | 31.184.235.100:6892 | udp | |
| AM | 31.184.235.101:6892 | udp | |
| AM | 31.184.235.102:6892 | udp | |
| AM | 31.184.235.103:6892 | udp | |
| AM | 31.184.235.104:6892 | udp | |
| AM | 31.184.235.105:6892 | udp | |
| AM | 31.184.235.106:6892 | udp | |
| AM | 31.184.235.107:6892 | udp | |
| AM | 31.184.235.108:6892 | udp | |
| AM | 31.184.235.109:6892 | udp | |
| AM | 31.184.235.110:6892 | udp | |
| AM | 31.184.235.111:6892 | udp | |
| AM | 31.184.235.112:6892 | udp | |
| AM | 31.184.235.113:6892 | udp | |
| AM | 31.184.235.114:6892 | udp | |
| AM | 31.184.235.115:6892 | udp | |
| AM | 31.184.235.116:6892 | udp | |
| AM | 31.184.235.117:6892 | udp | |
| AM | 31.184.235.118:6892 | udp | |
| AM | 31.184.235.119:6892 | udp | |
| AM | 31.184.235.120:6892 | udp | |
| AM | 31.184.235.121:6892 | udp | |
| AM | 31.184.235.122:6892 | udp | |
| AM | 31.184.235.123:6892 | udp | |
| AM | 31.184.235.124:6892 | udp | |
| AM | 31.184.235.125:6892 | udp | |
| AM | 31.184.235.126:6892 | udp | |
| AM | 31.184.235.127:6892 | udp | |
| AM | 31.184.235.128:6892 | udp | |
| AM | 31.184.235.129:6892 | udp | |
| AM | 31.184.235.130:6892 | udp | |
| AM | 31.184.235.131:6892 | udp | |
| AM | 31.184.235.132:6892 | udp | |
| AM | 31.184.235.133:6892 | udp | |
| AM | 31.184.235.134:6892 | udp | |
| AM | 31.184.235.135:6892 | udp | |
| AM | 31.184.235.136:6892 | udp | |
| AM | 31.184.235.137:6892 | udp | |
| AM | 31.184.235.138:6892 | udp | |
| AM | 31.184.235.139:6892 | udp | |
| AM | 31.184.235.140:6892 | udp | |
| AM | 31.184.235.141:6892 | udp | |
| AM | 31.184.235.142:6892 | udp | |
| AM | 31.184.235.143:6892 | udp | |
| AM | 31.184.235.144:6892 | udp | |
| AM | 31.184.235.145:6892 | udp | |
| AM | 31.184.235.146:6892 | udp | |
| AM | 31.184.235.147:6892 | udp | |
| AM | 31.184.235.148:6892 | udp | |
| AM | 31.184.235.149:6892 | udp | |
| AM | 31.184.235.150:6892 | udp | |
| AM | 31.184.235.151:6892 | udp | |
| AM | 31.184.235.152:6892 | udp | |
| AM | 31.184.235.153:6892 | udp | |
| AM | 31.184.235.154:6892 | udp | |
| AM | 31.184.235.155:6892 | udp | |
| AM | 31.184.235.156:6892 | udp | |
| AM | 31.184.235.157:6892 | udp | |
| AM | 31.184.235.158:6892 | udp | |
| AM | 31.184.235.159:6892 | udp | |
| AM | 31.184.235.160:6892 | udp | |
| AM | 31.184.235.161:6892 | udp | |
| AM | 31.184.235.162:6892 | udp | |
| AM | 31.184.235.163:6892 | udp | |
| AM | 31.184.235.164:6892 | udp | |
| AM | 31.184.235.165:6892 | udp | |
| AM | 31.184.235.166:6892 | udp | |
| AM | 31.184.235.167:6892 | udp | |
| AM | 31.184.235.168:6892 | udp | |
| AM | 31.184.235.169:6892 | udp | |
| AM | 31.184.235.170:6892 | udp | |
| AM | 31.184.235.171:6892 | udp | |
| AM | 31.184.235.172:6892 | udp | |
| AM | 31.184.235.173:6892 | udp | |
| AM | 31.184.235.174:6892 | udp | |
| AM | 31.184.235.175:6892 | udp | |
| AM | 31.184.235.176:6892 | udp | |
| AM | 31.184.235.177:6892 | udp | |
| AM | 31.184.235.178:6892 | udp | |
| AM | 31.184.235.179:6892 | udp | |
| AM | 31.184.235.180:6892 | udp | |
| AM | 31.184.235.181:6892 | udp | |
| AM | 31.184.235.182:6892 | udp | |
| AM | 31.184.235.183:6892 | udp | |
| AM | 31.184.235.184:6892 | udp | |
| AM | 31.184.235.185:6892 | udp | |
| AM | 31.184.235.186:6892 | udp | |
| AM | 31.184.235.187:6892 | udp | |
| AM | 31.184.235.188:6892 | udp | |
| AM | 31.184.235.189:6892 | udp | |
| AM | 31.184.235.190:6892 | udp | |
| AM | 31.184.235.191:6892 | udp | |
| AM | 31.184.235.192:6892 | udp | |
| AM | 31.184.235.193:6892 | udp | |
| AM | 31.184.235.194:6892 | udp | |
| AM | 31.184.235.195:6892 | udp | |
| AM | 31.184.235.196:6892 | udp | |
| AM | 31.184.235.197:6892 | udp | |
| AM | 31.184.235.198:6892 | udp | |
| AM | 31.184.235.199:6892 | udp | |
| AM | 31.184.235.200:6892 | udp | |
| AM | 31.184.235.201:6892 | udp | |
| AM | 31.184.235.202:6892 | udp | |
| AM | 31.184.235.203:6892 | udp | |
| AM | 31.184.235.204:6892 | udp | |
| AM | 31.184.235.205:6892 | udp | |
| AM | 31.184.235.206:6892 | udp | |
| AM | 31.184.235.207:6892 | udp | |
| AM | 31.184.235.208:6892 | udp | |
| AM | 31.184.235.209:6892 | udp | |
| AM | 31.184.235.210:6892 | udp | |
| AM | 31.184.235.211:6892 | udp | |
| AM | 31.184.235.212:6892 | udp | |
| AM | 31.184.235.213:6892 | udp | |
| AM | 31.184.235.214:6892 | udp | |
| AM | 31.184.235.215:6892 | udp | |
| AM | 31.184.235.216:6892 | udp | |
| AM | 31.184.235.217:6892 | udp | |
| AM | 31.184.235.218:6892 | udp | |
| AM | 31.184.235.219:6892 | udp | |
| AM | 31.184.235.220:6892 | udp | |
| AM | 31.184.235.221:6892 | udp | |
| AM | 31.184.235.222:6892 | udp | |
| AM | 31.184.235.223:6892 | udp | |
| AM | 31.184.235.224:6892 | udp | |
| AM | 31.184.235.225:6892 | udp | |
| AM | 31.184.235.226:6892 | udp | |
| AM | 31.184.235.227:6892 | udp | |
| AM | 31.184.235.228:6892 | udp | |
| AM | 31.184.235.229:6892 | udp | |
| AM | 31.184.235.230:6892 | udp | |
| AM | 31.184.235.231:6892 | udp | |
| AM | 31.184.235.232:6892 | udp | |
| AM | 31.184.235.233:6892 | udp | |
| AM | 31.184.235.234:6892 | udp | |
| AM | 31.184.235.235:6892 | udp | |
| AM | 31.184.235.236:6892 | udp | |
| AM | 31.184.235.237:6892 | udp | |
| AM | 31.184.235.238:6892 | udp | |
| AM | 31.184.235.239:6892 | udp | |
| AM | 31.184.235.240:6892 | udp | |
| AM | 31.184.235.241:6892 | udp | |
| AM | 31.184.235.242:6892 | udp | |
| AM | 31.184.235.243:6892 | udp | |
| AM | 31.184.235.244:6892 | udp | |
| AM | 31.184.235.245:6892 | udp | |
| AM | 31.184.235.246:6892 | udp | |
| AM | 31.184.235.247:6892 | udp | |
| AM | 31.184.235.248:6892 | udp | |
| AM | 31.184.235.249:6892 | udp | |
| AM | 31.184.235.250:6892 | udp | |
| AM | 31.184.235.251:6892 | udp | |
| AM | 31.184.235.252:6892 | udp | |
| AM | 31.184.235.253:6892 | udp | |
| AM | 31.184.235.254:6892 | udp | |
| US | 8.8.8.8:53 | btc.blockr.io | udp |
| AM | 31.184.235.255:6892 | udp | |
| US | 8.8.8.8:53 | api.blockcypher.com | udp |
| US | 172.67.17.223:80 | api.blockcypher.com | tcp |
| US | 172.67.17.223:80 | api.blockcypher.com | tcp |
| US | 8.8.8.8:53 | chain.so | udp |
| US | 104.22.64.108:443 | chain.so | tcp |
| US | 104.22.64.108:443 | chain.so | tcp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| GB | 142.250.200.3:80 | c.pki.goog | tcp |
| GB | 142.250.200.3:80 | c.pki.goog | tcp |
| US | 8.8.8.8:53 | crl.microsoft.com | udp |
| GB | 2.18.190.80:80 | crl.microsoft.com | tcp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| GB | 95.100.245.144:80 | www.microsoft.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
Files
\Users\Admin\AppData\Local\Temp\nso6E2F.tmp\System.dll
| MD5 | 6f5257c0b8c0ef4d440f4f4fce85fb1b |
| SHA1 | b6ac111dfb0d1fc75ad09c56bde7830232395785 |
| SHA256 | b7ccb923387cc346731471b20fc3df1ead13ec8c2e3147353c71bb0bd59bc8b1 |
| SHA512 | a3cc27f1efb52fb8ecda54a7c36ada39cefeabb7b16f2112303ea463b0e1a4d745198d413eebb3551e012c84a20dcdf4359e511e51bc3f1a60b13f1e3bad1aa8 |
\Users\Admin\AppData\Local\Temp\SetCursor.dll
| MD5 | eca26c61607b5b8f511f73a2c820de3d |
| SHA1 | cfd03bc71cb462edb70a476c956ba8a9a9a44ea5 |
| SHA256 | ba57adfeaf6cbe5db7e19b428552900b083e3cbf19f0d1d30f5c35c9e01f51ea |
| SHA512 | b9a065b75e5f8d81de2c2bc3333ab775450c13b7ec16ed7f17c3963e969b35a4cd4a71533ba7058e2f3398136727a1cb90c1e76a3d489379299d9c89278567fc |
memory/2744-26-0x0000000000400000-0x000000000042B000-memory.dmp
memory/2744-32-0x0000000000400000-0x000000000042B000-memory.dmp
memory/2744-40-0x0000000000400000-0x000000000042B000-memory.dmp
memory/2744-38-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2744-36-0x0000000000400000-0x000000000042B000-memory.dmp
memory/2744-34-0x0000000000400000-0x000000000042B000-memory.dmp
memory/2744-30-0x0000000000400000-0x000000000042B000-memory.dmp
memory/2744-28-0x0000000000400000-0x000000000042B000-memory.dmp
memory/2744-42-0x0000000000400000-0x000000000042B000-memory.dmp
memory/2744-43-0x0000000000400000-0x000000000042B000-memory.dmp
memory/2744-44-0x0000000000400000-0x000000000042B000-memory.dmp
memory/2744-45-0x0000000000400000-0x000000000042B000-memory.dmp
\Users\Admin\AppData\Roaming\{1591EC7F-A229-1145-B746-F357D6852359}\resmon.exe
| MD5 | bf244a0d9ac81f0ca62e5b3ddfb7b72c |
| SHA1 | ecbdbcfab600d5cfc2a1ce67bd5a1819ae340a33 |
| SHA256 | 9abffaee18a87032e9db459d1309da167460acdd98dfc4c7fc4c3941f2cbbaf9 |
| SHA512 | d2f5d096b09446cb2c5ea99c33dad75b47e76cc5b0509c6d9d571d89b6f245ef86b3c63e4958d2766ef11f4483fb78af3cba49354912ed7c1f8a5497def44a53 |
memory/2744-58-0x0000000000400000-0x000000000042B000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\avalon-framework.NOTICE.TXT
| MD5 | 141edc03b0f0c08bf8847a4d20a2d140 |
| SHA1 | 8fb3d2fdebb7f5cf86e7d33b22b676f37a6a34eb |
| SHA256 | c19de564c3d24b412a55e8d39cc4aaf4b226ad1d87e41f1dd676e82e6ad2f56a |
| SHA512 | 15ddc9e4cc13121c3687494753ce2a3341bfd1c9263150c32620000ca2a1839529f9c497f75c41783e647e49229eb518b382b3ac229cc08c134395b06614d1cf |
C:\Users\Admin\AppData\Local\Temp\Piddle.azc
| MD5 | 3e45eef93b3cb1119e3510dc9b5719c8 |
| SHA1 | adf13f7d221ee3e0f6f443b01bcde4a10b54e33d |
| SHA256 | b68684a53123fa290b5ea29fbdc4eabb930a3f179a690554366d3ad63a3cdf8b |
| SHA512 | 7fe8d4fdd541333c8b6720e8d3902f59a181606d87bcb38c6ae79d3af3e8c92f227fc7f6078c897018921868ece16ba34b521904cfc75d7bdf83132a5f80b665 |
C:\Users\Admin\AppData\Local\Temp\alerts.xsd
| MD5 | 275c7bebd1f409bfaa98227f7787d3b3 |
| SHA1 | 73edaeb7a5de0b98b922414191d69ea6617edcac |
| SHA256 | 51e2e5877b9e355118cc27ad284db0bd6fce616a78e64e9d905cf836277376b7 |
| SHA512 | 3fcbfefa952b0f122fa6798f471805c13643a11fe060bcb8c22ec13ea7d0571717e0177073cdb3c4d43fc755cc476036b7bf0426f621515975c709a503d8433a |
C:\Users\Admin\AppData\Local\Temp\GIF 32 Dithered.irs
| MD5 | ad7857a8abf9bde686b7507079b9bc75 |
| SHA1 | c9ad654502127f32cc9658d9b17b9b84a45c3e4a |
| SHA256 | 622ae0e9a6c1012b7aef688cf4b9a57a3659066e23081f67b2565ddd9d55e170 |
| SHA512 | 5ebf99464292a5a94d610ba04cdfcd53b4fa39b05715948e14a876cd58a83f42759ea0ccb6aa72f75459fcd9199aa988ab5793847b9d7cb4118b059ba8bb7f6e |
C:\Users\Admin\AppData\Local\Temp\16_9-frame-image-inset.png
| MD5 | d0b27d901155b40f518d158f5e491028 |
| SHA1 | 93a71de9454d0e94edad1bf7c3c7659c2cf99c45 |
| SHA256 | fef5272cc87850a7e422d6bc5be7986fec6aad06f57746a728d58b7de6dde0f7 |
| SHA512 | 7b4a732ff48df05c895e07245b1370f1dc530af45f592aa60224bb9c17bf0a7066449cfb2c8f0c93d00ee61f34e8da3663f7f60585846d795cb329015f4b4b72 |
C:\Users\Admin\AppData\Local\Temp\blue 286 bl 2.ADO
| MD5 | a4c0299e39c677afd7a7517d2980bf15 |
| SHA1 | 8748961f6bda83bec226430bf60589d6b2344211 |
| SHA256 | 5b2da553b3587b710311b4b6318464456cbb2cdfd1c8bd7a831b3bb36aa8ca23 |
| SHA512 | 1e0491cbb298f18b192e96d23fd629739ea48de85ee1b7ed3a7e96a3a645d1ca8471580b6bb0545f10d0edc845612d002920071870bf69a7c90ed9705f8f52d1 |
C:\Users\Admin\AppData\Local\Temp\chunkfast.xsl
| MD5 | 4b3b2473db1fd9f3f04044bb47d000ca |
| SHA1 | a52a3fd19e5a1b72f9285ce4d0451650507a5dea |
| SHA256 | d116d6e0ef1c1b5cb1512e2de16fb266e86960f636e4a608147d214fd2055a76 |
| SHA512 | 2e110bc9822145b8347fe656b8021d985840a9a44c7659e9524059c94f3617c444900c248a263940f11b32ff82d3efcaa9a400e64d34303055ed9db63aaf3b80 |
C:\Users\Admin\AppData\Local\Temp\getOpenDocumentIDs.jsx
| MD5 | a6b21e84cfffda8936b29e7c9a99be33 |
| SHA1 | 52c8d102768228cf95165ce94482efe077250693 |
| SHA256 | 16aebcb843ceb74d45a814c633c1f2fc2577bc8ab485da16d20700efca8b80b7 |
| SHA512 | f049f65179fd715123f193f18c201ee23b05589dc16f9c08d4d04b4deabde2b01fb63cb905e09ed3bae6ce17ef290b26d19b66fb3a724399f450b0ba8d2ca4af |
C:\Users\Admin\AppData\Local\Temp\Cambridge_Bay
| MD5 | 89de3d027493b9dbe3298a06fef9a89d |
| SHA1 | 3d8ac130c5dab1becabb0a17cae55c9aa42e50cd |
| SHA256 | 4d1380365eaceb6082c783f733af0ec9fd99e947c1c08c84fa6ff1d370b551ea |
| SHA512 | d7699a070cc465d5d960bd3d712fe72f68b24bd6e6bca6e67b5a17fa9581bb0cb02d10bfca2c32949ef86c3156c08e8bacdb33f1bcf4b5b188f149fc52870829 |
C:\Users\Admin\AppData\Local\Temp\4to3Squareframe_VideoInset.png
| MD5 | 1e75354ac7277ac7d729e9d934b3fdf9 |
| SHA1 | 05ec2efcebd31cff1c77d9896c94c11a4722ae32 |
| SHA256 | b6c74c438f6cff931161a5ab8b0757ed185ad6c02033deac6503c9381414cac6 |
| SHA512 | e6db1edd746250f9c12c63785c4139bcfa29ec4de4cf10e9532588584f4532b6a990f3304306dc888ec6a24f04b94c7f42f615d580bb08e9db395c7244bd065c |
C:\Users\Admin\AppData\Local\Temp\405.htm
| MD5 | 1c7d2b2fddd34b82883053f74613a7f1 |
| SHA1 | 5ded4a3340c5baa2f7875a09234200662a5fb6c5 |
| SHA256 | f42aa8b08eac61b29a5cddc51819a28a692b69480948f7d003485c0dbddedd8b |
| SHA512 | 2d54662a2a3f852d88e27232a93e5807bfa84be55460f4d9c9d2082d22e7818a337d75edb3fcdbf2fd5e6e34721722df16ada243576ace9598701a51797f50db |
C:\Users\Admin\AppData\Local\Temp\Dawson
| MD5 | 0b8717be9826ff70ed75c74131f1a776 |
| SHA1 | 471eb762c3dafc031ac6a790c7e9201a4f644d60 |
| SHA256 | 0759787339284a189592ad2a6b8aea00b7c3cf37354ffea6bd9979348d14387b |
| SHA512 | 710ebe69e5fef8e57903b588ec453daf6507072f2b539e14c7eb284de96092b573cd2d9e4701ed4cf9773ad6bea77de5fa26cd402d74f54f0ce6733924e4f4f7 |
C:\Users\Admin\AppData\Local\Temp\color_mgmt.png
| MD5 | 4039f96ce68791185b4bd6c6836791ac |
| SHA1 | bce49bc0c17ba5c461e77f840b4f7c66f7203202 |
| SHA256 | b764c6ade27c74321310e38e47f72d79827ee2ce99d41f3f5b8e2711906f8a70 |
| SHA512 | 6f6feb92364ff863fa63750f0a0123934a0f7417aaf5a38485642b278b9ad2564520ca8ce4b62c6b794aa0f792dda95b0c99f9a793952ebd445f74d6714e1ec0 |
C:\Users\Admin\AppData\Local\Temp\Christmas
| MD5 | 02bc5aaee85e8b96af646d479bb3307c |
| SHA1 | 1bf41be125fe8058d5999555add1ea2a83505e72 |
| SHA256 | e8d8d94f0a94768716701faa977a4d0d6ef93603de925078822f5c7a89cc8fca |
| SHA512 | e01d82ac33729e7ee14516f5d9ff753559f73143c7aa8a25ed4cc65b59dc364b1a020bc28427f8ec43fec8ef139cf30b09e492d77f15d7b09ae83240cdf8bc14 |
C:\Users\Admin\AppData\Local\Temp\InulinWaistcloth.g
| MD5 | 49b34ea2cbae50de619d8128e6fa3b2c |
| SHA1 | 35e02fa92a71c32153f9907b72ec9a38833f6cec |
| SHA256 | e6e3a86896d639a24240ef4ebd68228567e28b7f8c382d2680d698d2e2ffe3e6 |
| SHA512 | 2468f066f6356a8eaa790a31407eabb68e420b047d9153562c28386f13f3768ba767dcbd5b47c5dc9e25c6e8c3c800c84ecf56704a9a58243923535009c92122 |
C:\Users\Admin\AppData\Local\Temp\SetCursor.dll
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
memory/3056-116-0x0000000000400000-0x000000000042B000-memory.dmp
memory/3056-117-0x0000000000400000-0x000000000042B000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\resmon.lnk
| MD5 | 6fccf03434ad9dfd871bf3a92b63411f |
| SHA1 | ac857c4d1b399377a6052d553e712c9b5037d34d |
| SHA256 | 8afc331f2931b8f5a46262f509b56dcba1a91ebf68553c5c6cdde8730712a119 |
| SHA512 | d47129bd7307f663952e450892453d8728efc4c7e97ea98b9304c773f49b5a8d0e4bec03c165912879d2f383271a602c788e714387abe17e988e6e59859713ce |
memory/3056-121-0x0000000000400000-0x000000000042B000-memory.dmp
memory/3056-122-0x0000000000400000-0x000000000042B000-memory.dmp
memory/3056-124-0x0000000000400000-0x000000000042B000-memory.dmp
memory/3056-125-0x0000000000400000-0x000000000042B000-memory.dmp
memory/3056-126-0x0000000000400000-0x000000000042B000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Templates\# DECRYPT MY FILES #.html
| MD5 | cbdb0d25b29793e35bb88b068c67fecd |
| SHA1 | 794019ec634a87e36343ab59547985860f3183e7 |
| SHA256 | 4807745b62acfb0b5794abaa625817fac5d42cf2f605b16b7930426fc18dba62 |
| SHA512 | 723573f68d3eb118088001f57100fa7c6d9be9f3e4ce8c5e150f60880612b72c7daaaef3cd4ca2110b468366c982ff07c515333393c8667791ed4ed218ae21b1 |
C:\Users\Admin\AppData\Roaming\Microsoft\Templates\# DECRYPT MY FILES #.vbs
| MD5 | 1c2a24505278e661eca32666d4311ce5 |
| SHA1 | d1deb57023bbe38a33f0894b6a9a7bbffbfdeeee |
| SHA256 | 3f0dc6126cf33e7aa725df926a1b7d434eaf62a69f42e1b8ae4c110fd3572628 |
| SHA512 | ce866f2c4b96c6c7c090f4bf1708bfebdfcd58ce65a23bdc124a13402ef4941377c7e286e6156a28bd229e422685454052382f1f532545bc2edf07be4861b36c |
C:\Users\Admin\AppData\Roaming\Microsoft\Templates\# DECRYPT MY FILES #.url
| MD5 | aad366f3e996ad390271e3c686fd685e |
| SHA1 | f61737c14497f3410f4f900d57e688c2bf0feabd |
| SHA256 | 3992d91fb1a84ca5645026326c6f140d2b0b0192ed48ee2f6cba56b4065dfabe |
| SHA512 | 3a24c85f2f2c4b643bbc99692d37e48844d77f08d5c044fb757625471db22c61bd61efa9c68a9babfaaa80703a1565714e124d5f63cdf9135f7c72227dc1208e |
C:\Users\Admin\AppData\Roaming\Microsoft\Templates\# DECRYPT MY FILES #.txt
| MD5 | fc48c8538bb6cdbf791a0bf7bfeeabdf |
| SHA1 | 501aca8e180252ecad7fdebdd8aea45e2b40ccc7 |
| SHA256 | 44c55d2632f9392955dc542bcd94899ea9c123f5d2d489ddec3e1b32c0b7d080 |
| SHA512 | c88155fce49841ee190df6f42efa022706d5d09a0eb2593c770aeece5f01a03fb1f4d96e25f8a7d812dc7bd24c784fd77975f8b475b07650fd9915e881aad837 |
memory/3056-537-0x0000000000400000-0x000000000042B000-memory.dmp
memory/3056-534-0x0000000000400000-0x000000000042B000-memory.dmp
memory/3056-531-0x0000000000400000-0x000000000042B000-memory.dmp
memory/3056-528-0x0000000000400000-0x000000000042B000-memory.dmp
memory/3056-552-0x0000000000400000-0x000000000042B000-memory.dmp
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 1d081644dda0a30933533b60f688a3fb |
| SHA1 | cc94705abf4494053255be5620d1319ed83abfcb |
| SHA256 | 4ed9ae6fdd68d149321266e80f2bfdc982933be41aef96ee2a41b99172c0f522 |
| SHA512 | 4f3e0fe6e8a6beb557fe448fc25cc09229c61096b8f37f22237bf1ce49111f3ed9640d31c6215d926c3cff45e67ee0ffc5d1d91d25e15fe4a08140e3f3bb610f |
C:\Users\Admin\AppData\Local\Temp\Cab62B9.tmp
| MD5 | 49aebf8cbd62d92ac215b2923fb1b9f5 |
| SHA1 | 1723be06719828dda65ad804298d0431f6aff976 |
| SHA256 | b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f |
| SHA512 | bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b |
C:\Users\Admin\AppData\Local\Temp\Tar62BB.tmp
| MD5 | 4ea6026cf93ec6338144661bf1202cd1 |
| SHA1 | a1dec9044f750ad887935a01430bf49322fbdcb7 |
| SHA256 | 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8 |
| SHA512 | 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | f02ef5eb428bfd13535e0e4b5442b49f |
| SHA1 | 9deb95b05e8fae58282fcace82b10eef8ab6faf7 |
| SHA256 | be367abdeaa8a17578210146528ca897a024480c588b6ce1ee0fb8e89f0696d0 |
| SHA512 | 31b93497f2932fb2da0d2c77e951dfdcea856e9a50424c35a2be6a8b27d3a1e5d78dba6defcd211ecd5b747990724ddf1419125ddaa6457079b2f09349ac8ea0 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
| MD5 | a266bb7dcc38a562631361bbf61dd11b |
| SHA1 | 3b1efd3a66ea28b16697394703a72ca340a05bd5 |
| SHA256 | df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e |
| SHA512 | 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
| MD5 | 45a64faa42b447b0ee9338b8d00ad4e6 |
| SHA1 | 7b143e0c33137792af69e06c39dd27a5904a76a0 |
| SHA256 | f5c8f9b8e866489a7c065d19a566b6467ec4ffe7d51ea9b1d930209e5f1c9588 |
| SHA512 | dbeab4c0f2522beffd91d8fdf6e5b655e34d7ba0443536631a008a5336b15491295348f70e74fa380a2f1fdd39feb577c77b2ff31b8915f45eeea85a78eb37de |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 04b97fd562fb992f2765ccfbd095c7f2 |
| SHA1 | ffdff21cae112053b164c9c94d83709611efc42d |
| SHA256 | a26098154e8dae9f5bfecdae607aa3282ce7f4b4b03e073671e6ca39e34fbf84 |
| SHA512 | e37fce113df9fd6d9366b2a72b91c03c7f7e13bbe7fd96df5fbf38b4ed0b12e7dc2885c97f4bb539b5030d6566fa3fe0b262bbc8526d1542fa6306561d446edf |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | dc49f5d6112ede71137069e5a6a2dcc7 |
| SHA1 | 7876af511debff21ce9ba3b7b3e70246dbc0f908 |
| SHA256 | 80058f39482a9aaf10a4f770fdef24181f316661c1dea7a22f596f04b4cd5c92 |
| SHA512 | d0b68da5bb86f391f4e0f5905778d8f285b91f552b6dfe20b40bf33357a60744455a9762b2b4531dd1279820ff0d6b3dcf78e363603637d239a77aa6318b1c86 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | a067640bcd4cbd1c0a46d8dc14c1a44f |
| SHA1 | 68b09a671bb05ec46eda51653966a0e00129132c |
| SHA256 | 0337212d50d8e623dd555dee33b49d5d8b3efc5928f49f77fca356b17fa9a284 |
| SHA512 | 6303b676f5bf3d393d78cbad1656a12992938391ebe2a9d19beaff216c620b2c361a66e8fe0c0ec6226ed13980f11aee95b14db6c4c3e94e13cf446f2f6448ed |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | c095babc0d314cee05e9233b0d7a558c |
| SHA1 | dd9be0acc85ba4b63bce7c4f7d69e4b2b466f270 |
| SHA256 | bf88688c567d02949c8b472879711629ffbae7ad1a1923e75578f694634fb117 |
| SHA512 | 806dbc790f22ea9444152a1f63f69649928b9884d269b008cdd43edcbc70495394a99a06cae05c003d1afb488b108da7cabea33c95cfa531602404ed1a7e5127 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 99cbc9f9af951792ca5b2e1ad00113a6 |
| SHA1 | 603ed0481436143a958f87efd3ff19cfd2f6d9b5 |
| SHA256 | 7eebd2683512ef8f1839e8112193e6a4bae42adb44b20f8203d4e2104401b110 |
| SHA512 | 8c431c34a9871838fcef773d335261f60377b211dc4f1d210bbfb6b366415504876cac90d610b28da9e77b78658c40e00a5a3a43b6556732fd2569dcf1ae4751 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
| MD5 | c51241fbe9a04243a871b0e631f5391c |
| SHA1 | a6192c48339587bb135f589f174bc5593937d49e |
| SHA256 | b8294dae7500e21bfe8e5b3a8ac0565cb01329e7f95bd0376cd475cd96576d13 |
| SHA512 | 6ddd7842fed84305648cd7e5d93775a9e3693d1c541ec133448907ad3c82e76c9a10fb0b6f4181d7722e62db87637914f2f2ab949a867bff698651331de06004 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
| MD5 | e4a68ac854ac5242460afd72481b2a44 |
| SHA1 | df3c24f9bfd666761b268073fe06d1cc8d4f82a4 |
| SHA256 | cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f |
| SHA512 | 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 3e9f227d6f16e3f729d37e7b6481b9e3 |
| SHA1 | 57a613aa572375826df641330dc4775d60785ec5 |
| SHA256 | 3ac87aff7c09f83378497a3b6862fc89043437d225693b0ce8cb147304b8d09d |
| SHA512 | b3d65b3093cb477b4c4433a9de0c22f20c70fcf42cb50dd765642588677f741eb60878f15a274aaf08c1cbd123fbc5cc10d979fc14eed35eb03409745b7cfc3c |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 66b1667505d862f6206145b378aa9402 |
| SHA1 | ac41d2994561ec5250b0563776812a851c1d8b35 |
| SHA256 | ff799997cd1b62a77f5a5e5b4f958291f692ef0c10b684fedce8af66f5ff2b64 |
| SHA512 | 5940fee625723ca144ff9192610d1de4fc568d3e4135343a27c41941d96d4d3ef2bf51ed5eece6d99acbb1b670d4ddfafbed32d332d8a894e160d51e5e13dbcc |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | b38b88b47ec9f6b1da78421020d7e338 |
| SHA1 | 4d8ca51100303abf5cc21de99d74c1fe6744c54b |
| SHA256 | 1bc24acd4ff287bfcd0ea107b4af8cae9e13367574f57de913772de50cbd0973 |
| SHA512 | 714da8243f3653852821527066d3d1348fd22d0c8f9ab98902a60133fe221764a0ff5074798fbe77f15ae6853f82def376f58645236448f192735128e4b25079 |
Analysis: behavioral2
Detonation Overview
Submitted
2024-12-03 20:41
Reported
2024-12-03 20:44
Platform
win10v2004-20241007-en
Max time kernel
150s
Max time network
151s
Command Line
Signatures
Cerber
Cerber family
Adds policy Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\\mfpmp.exe\"" | C:\Users\Admin\AppData\Local\Temp\bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\\mfpmp.exe\"" | C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mfpmp.exe | N/A |
Contacts a large (529) amount of remote hosts
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mfpmp.exe | N/A |
Drops startup file
| Description | Indicator | Process | Target |
| File created | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\mfpmp.lnk | C:\Users\Admin\AppData\Local\Temp\bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\mfpmp.lnk | C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mfpmp.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mfpmp.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mfpmp.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mfpmp.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mfpmp.exe | N/A |
Loads dropped DLL
Reads user/profile data of web browsers
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mfpmp = "\"C:\\Users\\Admin\\AppData\\Roaming\\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\\mfpmp.exe\"" | C:\Users\Admin\AppData\Local\Temp\bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\mfpmp = "\"C:\\Users\\Admin\\AppData\\Roaming\\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\\mfpmp.exe\"" | C:\Users\Admin\AppData\Local\Temp\bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mfpmp = "\"C:\\Users\\Admin\\AppData\\Roaming\\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\\mfpmp.exe\"" | C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mfpmp.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\mfpmp = "\"C:\\Users\\Admin\\AppData\\Roaming\\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\\mfpmp.exe\"" | C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mfpmp.exe | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | ip-api.com | N/A | N/A |
Sets desktop wallpaper using registry
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp4099.bmp" | C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mfpmp.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2000 set thread context of 4636 | N/A | C:\Users\Admin\AppData\Local\Temp\bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe | C:\Users\Admin\AppData\Local\Temp\bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe |
| PID 4664 set thread context of 740 | N/A | C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mfpmp.exe | C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mfpmp.exe |
| PID 1604 set thread context of 872 | N/A | C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mfpmp.exe | C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mfpmp.exe |
Drops file in Program Files directory
| Description | Indicator | Process | Target |
| File created | C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\# DECRYPT MY FILES #.url | C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mfpmp.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Office16\OneNote\# DECRYPT MY FILES #.html | C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mfpmp.exe | N/A |
| File opened for modification | C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\BUSINESS.ONE | C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mfpmp.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\# DECRYPT MY FILES #.html | C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mfpmp.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\# DECRYPT MY FILES #.txt | C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mfpmp.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Office16\OneNote\# DECRYPT MY FILES #.vbs | C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mfpmp.exe | N/A |
| File opened for modification | C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNote.ini | C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mfpmp.exe | N/A |
| File opened for modification | C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\PLANNERS.ONE | C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mfpmp.exe | N/A |
| File opened for modification | C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\BLANK.ONE | C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mfpmp.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Office16\OneNote\# DECRYPT MY FILES #.url | C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mfpmp.exe | N/A |
| File opened for modification | C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\DESIGNER.ONE | C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mfpmp.exe | N/A |
| File opened for modification | C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\ACADEMIC.ONE | C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mfpmp.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\# DECRYPT MY FILES #.vbs | C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mfpmp.exe | N/A |
| File opened for modification | C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNote-PipelineConfig.xml | C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mfpmp.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Office16\OneNote\# DECRYPT MY FILES #.txt | C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mfpmp.exe | N/A |
| File opened for modification | C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNote-manifest.ini | C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mfpmp.exe | N/A |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\formulas | C:\Users\Admin\AppData\Local\Temp\bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Windows\formulas | C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mfpmp.exe | N/A |
| File opened for modification | C:\Windows\formulas | C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mfpmp.exe | N/A |
Browser Information Discovery
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mfpmp.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mfpmp.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mfpmp.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\taskkill.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\PING.EXE | N/A |
System Network Configuration Discovery: Internet Connection Discovery
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\cmd.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\PING.EXE | N/A |
| N/A | N/A | C:\Windows\system32\cmd.exe | N/A |
| N/A | N/A | C:\Windows\system32\PING.EXE | N/A |
NSIS installer
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Kills process with taskkill
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
Modifies Control Panel
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop | C:\Users\Admin\AppData\Local\Temp\bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\\mfpmp.exe\"" | C:\Users\Admin\AppData\Local\Temp\bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop | C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mfpmp.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\\mfpmp.exe\"" | C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mfpmp.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings | C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mfpmp.exe | N/A |
Runs ping.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\PING.EXE | N/A |
| N/A | N/A | C:\Windows\system32\PING.EXE | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mfpmp.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mfpmp.exe | N/A |
| Token: 33 | N/A | C:\Windows\system32\AUDIODG.EXE | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\system32\AUDIODG.EXE | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\system32\taskkill.exe | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe"
C:\Users\Admin\AppData\Local\Temp\bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe"
C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mfpmp.exe
"C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mfpmp.exe"
C:\Windows\SysWOW64\cmd.exe
/d /c taskkill /t /f /im "bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe" > NUL
C:\Windows\SysWOW64\taskkill.exe
taskkill /t /f /im "bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe"
C:\Windows\SysWOW64\PING.EXE
ping -n 1 127.0.0.1
C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mfpmp.exe
"C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mfpmp.exe"
C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mfpmp.exe
C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mfpmp.exe
C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mfpmp.exe
C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mfpmp.exe
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd4ff446f8,0x7ffd4ff44708,0x7ffd4ff44718
C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txt
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,9050770182273065088,3265741817559045527,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,9050770182273065088,3265741817559045527,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,9050770182273065088,3265741817559045527,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9050770182273065088,3265741817559045527,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9050770182273065088,3265741817559045527,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://pmenboeqhyrpvomq.wz139z.top/D43B-1E28-8721-006D-FB53?auto
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x78,0x108,0x7ffd4ff446f8,0x7ffd4ff44708,0x7ffd4ff44718
C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbs"
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9050770182273065088,3265741817559045527,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9050770182273065088,3265741817559045527,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x524 0x51c
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9050770182273065088,3265741817559045527,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,9050770182273065088,3265741817559045527,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5592 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,9050770182273065088,3265741817559045527,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5592 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9050770182273065088,3265741817559045527,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9050770182273065088,3265741817559045527,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
C:\Windows\system32\cmd.exe
/d /c taskkill /t /f /im "mfpmp.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mfpmp.exe" > NUL
C:\Windows\system32\taskkill.exe
taskkill /t /f /im "mfpmp.exe"
C:\Windows\system32\PING.EXE
ping -n 1 127.0.0.1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9050770182273065088,3265741817559045527,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9050770182273065088,3265741817559045527,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9050770182273065088,3265741817559045527,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2248 /prefetch:1
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 154.239.44.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 88.210.23.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 228.249.119.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | ip-api.com | udp |
| US | 208.95.112.1:80 | ip-api.com | tcp |
| US | 8.8.8.8:53 | 1.112.95.208.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 50.23.12.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 139.190.18.2.in-addr.arpa | udp |
| AM | 31.184.234.0:6892 | udp | |
| AM | 31.184.234.1:6892 | udp | |
| AM | 31.184.234.2:6892 | udp | |
| AM | 31.184.234.3:6892 | udp | |
| AM | 31.184.234.4:6892 | udp | |
| AM | 31.184.234.5:6892 | udp | |
| AM | 31.184.234.6:6892 | udp | |
| AM | 31.184.234.7:6892 | udp | |
| AM | 31.184.234.8:6892 | udp | |
| AM | 31.184.234.9:6892 | udp | |
| AM | 31.184.234.10:6892 | udp | |
| AM | 31.184.234.11:6892 | udp | |
| AM | 31.184.234.12:6892 | udp | |
| AM | 31.184.234.13:6892 | udp | |
| AM | 31.184.234.14:6892 | udp | |
| AM | 31.184.234.15:6892 | udp | |
| AM | 31.184.234.16:6892 | udp | |
| AM | 31.184.234.17:6892 | udp | |
| AM | 31.184.234.18:6892 | udp | |
| AM | 31.184.234.19:6892 | udp | |
| AM | 31.184.234.20:6892 | udp | |
| AM | 31.184.234.21:6892 | udp | |
| AM | 31.184.234.22:6892 | udp | |
| AM | 31.184.234.23:6892 | udp | |
| AM | 31.184.234.24:6892 | udp | |
| AM | 31.184.234.25:6892 | udp | |
| AM | 31.184.234.26:6892 | udp | |
| AM | 31.184.234.27:6892 | udp | |
| AM | 31.184.234.28:6892 | udp | |
| AM | 31.184.234.29:6892 | udp | |
| AM | 31.184.234.30:6892 | udp | |
| AM | 31.184.234.31:6892 | udp | |
| AM | 31.184.234.32:6892 | udp | |
| AM | 31.184.234.33:6892 | udp | |
| AM | 31.184.234.34:6892 | udp | |
| AM | 31.184.234.35:6892 | udp | |
| AM | 31.184.234.36:6892 | udp | |
| AM | 31.184.234.37:6892 | udp | |
| AM | 31.184.234.38:6892 | udp | |
| AM | 31.184.234.39:6892 | udp | |
| AM | 31.184.234.40:6892 | udp | |
| AM | 31.184.234.41:6892 | udp | |
| AM | 31.184.234.42:6892 | udp | |
| AM | 31.184.234.43:6892 | udp | |
| AM | 31.184.234.44:6892 | udp | |
| AM | 31.184.234.45:6892 | udp | |
| AM | 31.184.234.46:6892 | udp | |
| AM | 31.184.234.47:6892 | udp | |
| AM | 31.184.234.48:6892 | udp | |
| AM | 31.184.234.49:6892 | udp | |
| AM | 31.184.234.50:6892 | udp | |
| AM | 31.184.234.51:6892 | udp | |
| AM | 31.184.234.52:6892 | udp | |
| AM | 31.184.234.53:6892 | udp | |
| AM | 31.184.234.54:6892 | udp | |
| AM | 31.184.234.55:6892 | udp | |
| AM | 31.184.234.56:6892 | udp | |
| AM | 31.184.234.57:6892 | udp | |
| AM | 31.184.234.58:6892 | udp | |
| AM | 31.184.234.59:6892 | udp | |
| AM | 31.184.234.60:6892 | udp | |
| AM | 31.184.234.61:6892 | udp | |
| AM | 31.184.234.62:6892 | udp | |
| AM | 31.184.234.63:6892 | udp | |
| AM | 31.184.234.64:6892 | udp | |
| AM | 31.184.234.65:6892 | udp | |
| AM | 31.184.234.66:6892 | udp | |
| AM | 31.184.234.67:6892 | udp | |
| AM | 31.184.234.68:6892 | udp | |
| AM | 31.184.234.69:6892 | udp | |
| AM | 31.184.234.70:6892 | udp | |
| AM | 31.184.234.71:6892 | udp | |
| AM | 31.184.234.72:6892 | udp | |
| AM | 31.184.234.73:6892 | udp | |
| AM | 31.184.234.74:6892 | udp | |
| AM | 31.184.234.75:6892 | udp | |
| AM | 31.184.234.76:6892 | udp | |
| AM | 31.184.234.77:6892 | udp | |
| AM | 31.184.234.78:6892 | udp | |
| AM | 31.184.234.79:6892 | udp | |
| AM | 31.184.234.80:6892 | udp | |
| AM | 31.184.234.81:6892 | udp | |
| AM | 31.184.234.82:6892 | udp | |
| AM | 31.184.234.83:6892 | udp | |
| AM | 31.184.234.84:6892 | udp | |
| AM | 31.184.234.85:6892 | udp | |
| AM | 31.184.234.86:6892 | udp | |
| AM | 31.184.234.87:6892 | udp | |
| AM | 31.184.234.88:6892 | udp | |
| AM | 31.184.234.89:6892 | udp | |
| AM | 31.184.234.90:6892 | udp | |
| AM | 31.184.234.91:6892 | udp | |
| AM | 31.184.234.92:6892 | udp | |
| AM | 31.184.234.93:6892 | udp | |
| AM | 31.184.234.94:6892 | udp | |
| AM | 31.184.234.95:6892 | udp | |
| AM | 31.184.234.96:6892 | udp | |
| AM | 31.184.234.97:6892 | udp | |
| AM | 31.184.234.98:6892 | udp | |
| AM | 31.184.234.99:6892 | udp | |
| AM | 31.184.234.100:6892 | udp | |
| AM | 31.184.234.101:6892 | udp | |
| AM | 31.184.234.102:6892 | udp | |
| AM | 31.184.234.103:6892 | udp | |
| AM | 31.184.234.104:6892 | udp | |
| AM | 31.184.234.105:6892 | udp | |
| AM | 31.184.234.106:6892 | udp | |
| AM | 31.184.234.107:6892 | udp | |
| AM | 31.184.234.108:6892 | udp | |
| AM | 31.184.234.109:6892 | udp | |
| AM | 31.184.234.110:6892 | udp | |
| AM | 31.184.234.111:6892 | udp | |
| AM | 31.184.234.112:6892 | udp | |
| AM | 31.184.234.113:6892 | udp | |
| AM | 31.184.234.114:6892 | udp | |
| AM | 31.184.234.115:6892 | udp | |
| AM | 31.184.234.116:6892 | udp | |
| AM | 31.184.234.117:6892 | udp | |
| AM | 31.184.234.118:6892 | udp | |
| AM | 31.184.234.119:6892 | udp | |
| AM | 31.184.234.120:6892 | udp | |
| AM | 31.184.234.121:6892 | udp | |
| AM | 31.184.234.122:6892 | udp | |
| AM | 31.184.234.123:6892 | udp | |
| AM | 31.184.234.124:6892 | udp | |
| AM | 31.184.234.125:6892 | udp | |
| AM | 31.184.234.126:6892 | udp | |
| AM | 31.184.234.127:6892 | udp | |
| AM | 31.184.234.128:6892 | udp | |
| AM | 31.184.234.129:6892 | udp | |
| AM | 31.184.234.130:6892 | udp | |
| AM | 31.184.234.131:6892 | udp | |
| AM | 31.184.234.132:6892 | udp | |
| AM | 31.184.234.133:6892 | udp | |
| AM | 31.184.234.134:6892 | udp | |
| AM | 31.184.234.135:6892 | udp | |
| AM | 31.184.234.136:6892 | udp | |
| AM | 31.184.234.137:6892 | udp | |
| AM | 31.184.234.138:6892 | udp | |
| AM | 31.184.234.139:6892 | udp | |
| AM | 31.184.234.140:6892 | udp | |
| AM | 31.184.234.141:6892 | udp | |
| AM | 31.184.234.142:6892 | udp | |
| AM | 31.184.234.143:6892 | udp | |
| AM | 31.184.234.144:6892 | udp | |
| AM | 31.184.234.145:6892 | udp | |
| AM | 31.184.234.146:6892 | udp | |
| AM | 31.184.234.147:6892 | udp | |
| AM | 31.184.234.148:6892 | udp | |
| AM | 31.184.234.149:6892 | udp | |
| AM | 31.184.234.150:6892 | udp | |
| AM | 31.184.234.151:6892 | udp | |
| AM | 31.184.234.152:6892 | udp | |
| AM | 31.184.234.153:6892 | udp | |
| AM | 31.184.234.154:6892 | udp | |
| AM | 31.184.234.155:6892 | udp | |
| AM | 31.184.234.156:6892 | udp | |
| AM | 31.184.234.157:6892 | udp | |
| AM | 31.184.234.158:6892 | udp | |
| AM | 31.184.234.159:6892 | udp | |
| AM | 31.184.234.160:6892 | udp | |
| AM | 31.184.234.161:6892 | udp | |
| AM | 31.184.234.162:6892 | udp | |
| AM | 31.184.234.163:6892 | udp | |
| AM | 31.184.234.164:6892 | udp | |
| AM | 31.184.234.165:6892 | udp | |
| AM | 31.184.234.166:6892 | udp | |
| AM | 31.184.234.167:6892 | udp | |
| AM | 31.184.234.168:6892 | udp | |
| AM | 31.184.234.169:6892 | udp | |
| AM | 31.184.234.170:6892 | udp | |
| AM | 31.184.234.171:6892 | udp | |
| AM | 31.184.234.172:6892 | udp | |
| AM | 31.184.234.173:6892 | udp | |
| AM | 31.184.234.174:6892 | udp | |
| AM | 31.184.234.175:6892 | udp | |
| AM | 31.184.234.176:6892 | udp | |
| AM | 31.184.234.177:6892 | udp | |
| AM | 31.184.234.178:6892 | udp | |
| AM | 31.184.234.179:6892 | udp | |
| AM | 31.184.234.180:6892 | udp | |
| AM | 31.184.234.181:6892 | udp | |
| AM | 31.184.234.182:6892 | udp | |
| AM | 31.184.234.183:6892 | udp | |
| AM | 31.184.234.184:6892 | udp | |
| AM | 31.184.234.185:6892 | udp | |
| AM | 31.184.234.186:6892 | udp | |
| AM | 31.184.234.187:6892 | udp | |
| AM | 31.184.234.188:6892 | udp | |
| AM | 31.184.234.189:6892 | udp | |
| AM | 31.184.234.190:6892 | udp | |
| AM | 31.184.234.191:6892 | udp | |
| AM | 31.184.234.192:6892 | udp | |
| AM | 31.184.234.193:6892 | udp | |
| AM | 31.184.234.194:6892 | udp | |
| AM | 31.184.234.195:6892 | udp | |
| AM | 31.184.234.196:6892 | udp | |
| AM | 31.184.234.197:6892 | udp | |
| AM | 31.184.234.198:6892 | udp | |
| AM | 31.184.234.199:6892 | udp | |
| AM | 31.184.234.200:6892 | udp | |
| AM | 31.184.234.201:6892 | udp | |
| AM | 31.184.234.202:6892 | udp | |
| AM | 31.184.234.203:6892 | udp | |
| AM | 31.184.234.204:6892 | udp | |
| AM | 31.184.234.205:6892 | udp | |
| AM | 31.184.234.206:6892 | udp | |
| AM | 31.184.234.207:6892 | udp | |
| AM | 31.184.234.208:6892 | udp | |
| AM | 31.184.234.209:6892 | udp | |
| AM | 31.184.234.210:6892 | udp | |
| AM | 31.184.234.211:6892 | udp | |
| AM | 31.184.234.212:6892 | udp | |
| AM | 31.184.234.213:6892 | udp | |
| AM | 31.184.234.214:6892 | udp | |
| AM | 31.184.234.215:6892 | udp | |
| AM | 31.184.234.216:6892 | udp | |
| AM | 31.184.234.217:6892 | udp | |
| AM | 31.184.234.218:6892 | udp | |
| AM | 31.184.234.219:6892 | udp | |
| AM | 31.184.234.220:6892 | udp | |
| AM | 31.184.234.221:6892 | udp | |
| AM | 31.184.234.222:6892 | udp | |
| AM | 31.184.234.223:6892 | udp | |
| AM | 31.184.234.224:6892 | udp | |
| AM | 31.184.234.225:6892 | udp | |
| AM | 31.184.234.226:6892 | udp | |
| AM | 31.184.234.227:6892 | udp | |
| AM | 31.184.234.228:6892 | udp | |
| AM | 31.184.234.229:6892 | udp | |
| AM | 31.184.234.230:6892 | udp | |
| AM | 31.184.234.231:6892 | udp | |
| AM | 31.184.234.232:6892 | udp | |
| AM | 31.184.234.233:6892 | udp | |
| AM | 31.184.234.234:6892 | udp | |
| AM | 31.184.234.235:6892 | udp | |
| AM | 31.184.234.236:6892 | udp | |
| AM | 31.184.234.237:6892 | udp | |
| AM | 31.184.234.238:6892 | udp | |
| AM | 31.184.234.239:6892 | udp | |
| AM | 31.184.234.240:6892 | udp | |
| AM | 31.184.234.241:6892 | udp | |
| AM | 31.184.234.242:6892 | udp | |
| AM | 31.184.234.243:6892 | udp | |
| AM | 31.184.234.244:6892 | udp | |
| AM | 31.184.234.245:6892 | udp | |
| AM | 31.184.234.246:6892 | udp | |
| AM | 31.184.234.247:6892 | udp | |
| AM | 31.184.234.248:6892 | udp | |
| AM | 31.184.234.249:6892 | udp | |
| AM | 31.184.234.250:6892 | udp | |
| AM | 31.184.234.251:6892 | udp | |
| AM | 31.184.234.252:6892 | udp | |
| AM | 31.184.234.253:6892 | udp | |
| AM | 31.184.234.254:6892 | udp | |
| US | 8.8.8.8:53 | 0.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 1.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 2.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 3.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 4.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 6.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 5.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 7.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 8.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 10.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 11.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 12.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 16.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 17.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 20.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 21.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 22.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 23.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 24.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 25.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 27.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 28.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 29.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 30.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 31.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 32.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 33.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 34.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 35.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 36.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 37.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 38.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 39.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 40.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 41.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 42.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 43.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 44.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 45.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 46.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 49.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 48.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 47.234.184.31.in-addr.arpa | udp |
| AM | 31.184.234.255:6892 | udp | |
| AM | 31.184.235.0:6892 | udp | |
| AM | 31.184.235.1:6892 | udp | |
| AM | 31.184.235.2:6892 | udp | |
| AM | 31.184.235.3:6892 | udp | |
| AM | 31.184.235.4:6892 | udp | |
| AM | 31.184.235.5:6892 | udp | |
| AM | 31.184.235.6:6892 | udp | |
| AM | 31.184.235.7:6892 | udp | |
| AM | 31.184.235.8:6892 | udp | |
| AM | 31.184.235.9:6892 | udp | |
| AM | 31.184.235.10:6892 | udp | |
| AM | 31.184.235.11:6892 | udp | |
| AM | 31.184.235.12:6892 | udp | |
| AM | 31.184.235.13:6892 | udp | |
| AM | 31.184.235.14:6892 | udp | |
| AM | 31.184.235.15:6892 | udp | |
| AM | 31.184.235.16:6892 | udp | |
| AM | 31.184.235.17:6892 | udp | |
| AM | 31.184.235.18:6892 | udp | |
| AM | 31.184.235.19:6892 | udp | |
| AM | 31.184.235.20:6892 | udp | |
| AM | 31.184.235.21:6892 | udp | |
| AM | 31.184.235.22:6892 | udp | |
| AM | 31.184.235.23:6892 | udp | |
| AM | 31.184.235.24:6892 | udp | |
| AM | 31.184.235.25:6892 | udp | |
| AM | 31.184.235.26:6892 | udp | |
| AM | 31.184.235.27:6892 | udp | |
| AM | 31.184.235.28:6892 | udp | |
| AM | 31.184.235.29:6892 | udp | |
| AM | 31.184.235.30:6892 | udp | |
| AM | 31.184.235.31:6892 | udp | |
| AM | 31.184.235.32:6892 | udp | |
| AM | 31.184.235.33:6892 | udp | |
| AM | 31.184.235.34:6892 | udp | |
| AM | 31.184.235.35:6892 | udp | |
| AM | 31.184.235.36:6892 | udp | |
| AM | 31.184.235.37:6892 | udp | |
| AM | 31.184.235.38:6892 | udp | |
| AM | 31.184.235.39:6892 | udp | |
| AM | 31.184.235.40:6892 | udp | |
| AM | 31.184.235.41:6892 | udp | |
| AM | 31.184.235.42:6892 | udp | |
| AM | 31.184.235.43:6892 | udp | |
| AM | 31.184.235.44:6892 | udp | |
| AM | 31.184.235.45:6892 | udp | |
| AM | 31.184.235.46:6892 | udp | |
| AM | 31.184.235.47:6892 | udp | |
| AM | 31.184.235.48:6892 | udp | |
| AM | 31.184.235.49:6892 | udp | |
| AM | 31.184.235.50:6892 | udp | |
| AM | 31.184.235.51:6892 | udp | |
| AM | 31.184.235.52:6892 | udp | |
| AM | 31.184.235.53:6892 | udp | |
| AM | 31.184.235.54:6892 | udp | |
| AM | 31.184.235.55:6892 | udp | |
| AM | 31.184.235.56:6892 | udp | |
| AM | 31.184.235.57:6892 | udp | |
| AM | 31.184.235.58:6892 | udp | |
| AM | 31.184.235.59:6892 | udp | |
| AM | 31.184.235.60:6892 | udp | |
| AM | 31.184.235.61:6892 | udp | |
| AM | 31.184.235.62:6892 | udp | |
| AM | 31.184.235.63:6892 | udp | |
| AM | 31.184.235.64:6892 | udp | |
| AM | 31.184.235.65:6892 | udp | |
| AM | 31.184.235.66:6892 | udp | |
| AM | 31.184.235.67:6892 | udp | |
| AM | 31.184.235.68:6892 | udp | |
| AM | 31.184.235.69:6892 | udp | |
| AM | 31.184.235.70:6892 | udp | |
| AM | 31.184.235.71:6892 | udp | |
| AM | 31.184.235.72:6892 | udp | |
| AM | 31.184.235.73:6892 | udp | |
| AM | 31.184.235.74:6892 | udp | |
| AM | 31.184.235.75:6892 | udp | |
| AM | 31.184.235.76:6892 | udp | |
| AM | 31.184.235.77:6892 | udp | |
| AM | 31.184.235.78:6892 | udp | |
| AM | 31.184.235.79:6892 | udp | |
| AM | 31.184.235.80:6892 | udp | |
| AM | 31.184.235.81:6892 | udp | |
| AM | 31.184.235.82:6892 | udp | |
| AM | 31.184.235.83:6892 | udp | |
| AM | 31.184.235.84:6892 | udp | |
| AM | 31.184.235.85:6892 | udp | |
| AM | 31.184.235.86:6892 | udp | |
| AM | 31.184.235.87:6892 | udp | |
| AM | 31.184.235.88:6892 | udp | |
| AM | 31.184.235.89:6892 | udp | |
| AM | 31.184.235.90:6892 | udp | |
| AM | 31.184.235.91:6892 | udp | |
| AM | 31.184.235.92:6892 | udp | |
| AM | 31.184.235.93:6892 | udp | |
| AM | 31.184.235.94:6892 | udp | |
| AM | 31.184.235.95:6892 | udp | |
| AM | 31.184.235.96:6892 | udp | |
| AM | 31.184.235.97:6892 | udp | |
| AM | 31.184.235.98:6892 | udp | |
| AM | 31.184.235.99:6892 | udp | |
| AM | 31.184.235.100:6892 | udp | |
| AM | 31.184.235.101:6892 | udp | |
| AM | 31.184.235.102:6892 | udp | |
| AM | 31.184.235.103:6892 | udp | |
| AM | 31.184.235.104:6892 | udp | |
| AM | 31.184.235.105:6892 | udp | |
| AM | 31.184.235.106:6892 | udp | |
| AM | 31.184.235.107:6892 | udp | |
| AM | 31.184.235.108:6892 | udp | |
| AM | 31.184.235.109:6892 | udp | |
| AM | 31.184.235.110:6892 | udp | |
| AM | 31.184.235.111:6892 | udp | |
| AM | 31.184.235.112:6892 | udp | |
| AM | 31.184.235.113:6892 | udp | |
| AM | 31.184.235.114:6892 | udp | |
| AM | 31.184.235.115:6892 | udp | |
| AM | 31.184.235.116:6892 | udp | |
| AM | 31.184.235.117:6892 | udp | |
| AM | 31.184.235.118:6892 | udp | |
| AM | 31.184.235.119:6892 | udp | |
| AM | 31.184.235.120:6892 | udp | |
| AM | 31.184.235.121:6892 | udp | |
| AM | 31.184.235.122:6892 | udp | |
| AM | 31.184.235.123:6892 | udp | |
| AM | 31.184.235.124:6892 | udp | |
| AM | 31.184.235.125:6892 | udp | |
| AM | 31.184.235.126:6892 | udp | |
| AM | 31.184.235.127:6892 | udp | |
| AM | 31.184.235.128:6892 | udp | |
| AM | 31.184.235.129:6892 | udp | |
| AM | 31.184.235.130:6892 | udp | |
| AM | 31.184.235.131:6892 | udp | |
| AM | 31.184.235.132:6892 | udp | |
| AM | 31.184.235.133:6892 | udp | |
| AM | 31.184.235.134:6892 | udp | |
| AM | 31.184.235.135:6892 | udp | |
| AM | 31.184.235.136:6892 | udp | |
| AM | 31.184.235.137:6892 | udp | |
| AM | 31.184.235.138:6892 | udp | |
| AM | 31.184.235.139:6892 | udp | |
| AM | 31.184.235.140:6892 | udp | |
| AM | 31.184.235.141:6892 | udp | |
| AM | 31.184.235.142:6892 | udp | |
| AM | 31.184.235.143:6892 | udp | |
| AM | 31.184.235.144:6892 | udp | |
| AM | 31.184.235.145:6892 | udp | |
| AM | 31.184.235.146:6892 | udp | |
| AM | 31.184.235.147:6892 | udp | |
| AM | 31.184.235.148:6892 | udp | |
| AM | 31.184.235.149:6892 | udp | |
| AM | 31.184.235.150:6892 | udp | |
| AM | 31.184.235.151:6892 | udp | |
| AM | 31.184.235.152:6892 | udp | |
| AM | 31.184.235.153:6892 | udp | |
| AM | 31.184.235.154:6892 | udp | |
| AM | 31.184.235.155:6892 | udp | |
| AM | 31.184.235.156:6892 | udp | |
| AM | 31.184.235.157:6892 | udp | |
| AM | 31.184.235.158:6892 | udp | |
| AM | 31.184.235.159:6892 | udp | |
| AM | 31.184.235.160:6892 | udp | |
| AM | 31.184.235.161:6892 | udp | |
| AM | 31.184.235.162:6892 | udp | |
| AM | 31.184.235.163:6892 | udp | |
| AM | 31.184.235.164:6892 | udp | |
| AM | 31.184.235.165:6892 | udp | |
| AM | 31.184.235.166:6892 | udp | |
| AM | 31.184.235.167:6892 | udp | |
| AM | 31.184.235.168:6892 | udp | |
| AM | 31.184.235.169:6892 | udp | |
| AM | 31.184.235.170:6892 | udp | |
| AM | 31.184.235.171:6892 | udp | |
| AM | 31.184.235.172:6892 | udp | |
| AM | 31.184.235.173:6892 | udp | |
| AM | 31.184.235.174:6892 | udp | |
| AM | 31.184.235.175:6892 | udp | |
| AM | 31.184.235.176:6892 | udp | |
| AM | 31.184.235.177:6892 | udp | |
| AM | 31.184.235.178:6892 | udp | |
| AM | 31.184.235.179:6892 | udp | |
| AM | 31.184.235.180:6892 | udp | |
| AM | 31.184.235.181:6892 | udp | |
| AM | 31.184.235.182:6892 | udp | |
| AM | 31.184.235.183:6892 | udp | |
| AM | 31.184.235.184:6892 | udp | |
| AM | 31.184.235.185:6892 | udp | |
| AM | 31.184.235.186:6892 | udp | |
| AM | 31.184.235.187:6892 | udp | |
| AM | 31.184.235.188:6892 | udp | |
| AM | 31.184.235.189:6892 | udp | |
| AM | 31.184.235.190:6892 | udp | |
| AM | 31.184.235.191:6892 | udp | |
| AM | 31.184.235.192:6892 | udp | |
| AM | 31.184.235.193:6892 | udp | |
| AM | 31.184.235.194:6892 | udp | |
| AM | 31.184.235.195:6892 | udp | |
| AM | 31.184.235.196:6892 | udp | |
| AM | 31.184.235.197:6892 | udp | |
| AM | 31.184.235.198:6892 | udp | |
| AM | 31.184.235.199:6892 | udp | |
| AM | 31.184.235.200:6892 | udp | |
| AM | 31.184.235.201:6892 | udp | |
| AM | 31.184.235.202:6892 | udp | |
| AM | 31.184.235.203:6892 | udp | |
| AM | 31.184.235.204:6892 | udp | |
| AM | 31.184.235.205:6892 | udp | |
| AM | 31.184.235.206:6892 | udp | |
| AM | 31.184.235.207:6892 | udp | |
| AM | 31.184.235.208:6892 | udp | |
| AM | 31.184.235.209:6892 | udp | |
| AM | 31.184.235.210:6892 | udp | |
| AM | 31.184.235.211:6892 | udp | |
| AM | 31.184.235.212:6892 | udp | |
| AM | 31.184.235.213:6892 | udp | |
| AM | 31.184.235.214:6892 | udp | |
| AM | 31.184.235.215:6892 | udp | |
| AM | 31.184.235.216:6892 | udp | |
| AM | 31.184.235.217:6892 | udp | |
| AM | 31.184.235.218:6892 | udp | |
| AM | 31.184.235.219:6892 | udp | |
| AM | 31.184.235.220:6892 | udp | |
| AM | 31.184.235.221:6892 | udp | |
| AM | 31.184.235.222:6892 | udp | |
| AM | 31.184.235.223:6892 | udp | |
| AM | 31.184.235.224:6892 | udp | |
| AM | 31.184.235.225:6892 | udp | |
| AM | 31.184.235.226:6892 | udp | |
| AM | 31.184.235.227:6892 | udp | |
| AM | 31.184.235.228:6892 | udp | |
| AM | 31.184.235.229:6892 | udp | |
| AM | 31.184.235.230:6892 | udp | |
| AM | 31.184.235.231:6892 | udp | |
| AM | 31.184.235.232:6892 | udp | |
| AM | 31.184.235.233:6892 | udp | |
| AM | 31.184.235.234:6892 | udp | |
| AM | 31.184.235.235:6892 | udp | |
| AM | 31.184.235.236:6892 | udp | |
| AM | 31.184.235.237:6892 | udp | |
| AM | 31.184.235.238:6892 | udp | |
| AM | 31.184.235.239:6892 | udp | |
| AM | 31.184.235.240:6892 | udp | |
| AM | 31.184.235.241:6892 | udp | |
| AM | 31.184.235.242:6892 | udp | |
| AM | 31.184.235.243:6892 | udp | |
| AM | 31.184.235.244:6892 | udp | |
| AM | 31.184.235.245:6892 | udp | |
| AM | 31.184.235.246:6892 | udp | |
| AM | 31.184.235.247:6892 | udp | |
| AM | 31.184.235.248:6892 | udp | |
| AM | 31.184.235.249:6892 | udp | |
| AM | 31.184.235.250:6892 | udp | |
| AM | 31.184.235.251:6892 | udp | |
| AM | 31.184.235.252:6892 | udp | |
| AM | 31.184.235.253:6892 | udp | |
| AM | 31.184.235.254:6892 | udp | |
| US | 8.8.8.8:53 | 50.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 51.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 52.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 53.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 54.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 56.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 55.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 57.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 58.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 59.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 60.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 61.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 62.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 63.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 64.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 65.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 66.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 67.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 68.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 69.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 70.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 71.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 72.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 73.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 74.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 76.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 75.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 77.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 78.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 79.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 80.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 82.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 83.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 84.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 85.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 86.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 87.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 88.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 89.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 90.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 91.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 92.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 93.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 94.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 96.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 97.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 98.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 99.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 101.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 100.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 102.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 103.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 104.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 105.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 106.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 107.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 108.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 109.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 110.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 111.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 113.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 112.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 114.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 115.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 116.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 117.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 118.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 119.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 120.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 122.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 121.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 123.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 124.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 125.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 126.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 127.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 129.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 130.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 131.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 132.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 134.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 135.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 136.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 137.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 138.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 139.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 140.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 141.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 142.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 143.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 144.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 145.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 146.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 147.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 148.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 149.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 150.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 151.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 152.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 153.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 154.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 155.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 157.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 156.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 158.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 159.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 160.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 161.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 163.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 164.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 165.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 166.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 167.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 168.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 169.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 170.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 171.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 173.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 174.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 176.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 177.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 178.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 175.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 179.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 180.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 181.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 182.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 183.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 184.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 185.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 186.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 187.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 188.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 189.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 190.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 191.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 192.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 193.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 194.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 195.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 196.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 197.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 199.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 200.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 201.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 202.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 203.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 204.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 205.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 207.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 209.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 208.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 211.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 210.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 212.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 213.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 214.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 215.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 216.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 217.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 218.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 219.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 220.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 221.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 222.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 223.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 224.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 225.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 226.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 227.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 228.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 229.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 230.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 231.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 232.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 233.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 234.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 235.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 236.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 237.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 238.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 239.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 242.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 243.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 244.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 245.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 246.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 247.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 248.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 250.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 249.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 251.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 252.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 253.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 254.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 255.234.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 1.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 2.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 3.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 4.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 6.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 5.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 7.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 8.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 10.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 11.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 12.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 16.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 17.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 19.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 20.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 21.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 22.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 23.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 24.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 25.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 27.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 28.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 29.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 30.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 31.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 32.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 33.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 34.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 36.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 37.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 35.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 38.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 39.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 40.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 41.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 42.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 43.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 44.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 45.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 46.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 47.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 48.235.184.31.in-addr.arpa | udp |
| AM | 31.184.235.255:6892 | udp | |
| US | 8.8.8.8:53 | 49.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 50.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 51.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 52.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 53.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 54.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 55.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 56.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 57.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 58.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 59.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 60.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 61.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 62.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 63.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 64.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 65.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 66.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 67.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 68.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 69.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 70.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 71.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 72.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 73.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 74.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 75.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 76.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 77.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 78.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 79.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 80.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 81.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 82.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 83.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 84.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 85.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 86.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 88.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 87.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 89.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 90.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 91.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 92.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 93.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 94.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 96.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 97.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 98.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 99.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 100.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 101.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 102.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 103.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 104.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 105.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 106.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 107.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 108.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 109.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 110.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 111.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 112.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 113.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 114.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 115.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 116.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 117.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 118.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 119.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 120.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 121.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 122.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 123.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 124.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 125.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 126.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 127.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 128.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 129.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 130.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 131.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 132.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 134.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 135.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 136.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 137.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 138.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 139.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 140.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 141.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 142.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 143.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 144.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 145.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 147.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 148.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 149.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 150.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 151.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 152.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 153.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 154.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 155.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 156.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 157.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 158.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 159.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 160.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 161.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 162.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 163.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 164.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 165.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 166.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 167.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 168.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 169.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 170.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 171.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 174.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 175.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 176.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 177.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 178.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 179.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 180.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 181.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 182.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 183.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 184.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 185.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 186.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 187.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 188.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 189.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 190.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 191.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 192.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 193.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 194.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 195.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 197.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 199.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 200.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 201.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 202.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 203.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 205.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 204.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 207.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 208.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 209.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 210.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 211.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 212.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 214.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 215.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 217.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 216.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 218.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 220.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 219.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 221.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 222.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 223.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 224.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 225.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 226.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 227.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 228.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 229.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 230.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 231.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 232.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 233.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 234.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 235.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 236.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 237.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 239.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 242.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 243.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 244.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 245.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 246.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 247.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 248.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 249.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 250.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 251.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 252.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 253.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 254.235.184.31.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 255.235.184.31.in-addr.arpa | udp |
| AM | 31.184.234.0:6892 | udp | |
| AM | 31.184.234.1:6892 | udp | |
| AM | 31.184.234.2:6892 | udp | |
| AM | 31.184.234.3:6892 | udp | |
| AM | 31.184.234.4:6892 | udp | |
| AM | 31.184.234.5:6892 | udp | |
| AM | 31.184.234.6:6892 | udp | |
| AM | 31.184.234.7:6892 | udp | |
| AM | 31.184.234.8:6892 | udp | |
| AM | 31.184.234.9:6892 | udp | |
| AM | 31.184.234.10:6892 | udp | |
| AM | 31.184.234.11:6892 | udp | |
| AM | 31.184.234.12:6892 | udp | |
| AM | 31.184.234.13:6892 | udp | |
| AM | 31.184.234.14:6892 | udp | |
| AM | 31.184.234.15:6892 | udp | |
| AM | 31.184.234.16:6892 | udp | |
| AM | 31.184.234.17:6892 | udp | |
| AM | 31.184.234.18:6892 | udp | |
| AM | 31.184.234.19:6892 | udp | |
| AM | 31.184.234.20:6892 | udp | |
| AM | 31.184.234.21:6892 | udp | |
| AM | 31.184.234.22:6892 | udp | |
| AM | 31.184.234.23:6892 | udp | |
| AM | 31.184.234.24:6892 | udp | |
| AM | 31.184.234.25:6892 | udp | |
| AM | 31.184.234.26:6892 | udp | |
| AM | 31.184.234.27:6892 | udp | |
| AM | 31.184.234.28:6892 | udp | |
| AM | 31.184.234.29:6892 | udp | |
| AM | 31.184.234.30:6892 | udp | |
| AM | 31.184.234.31:6892 | udp | |
| AM | 31.184.234.32:6892 | udp | |
| AM | 31.184.234.33:6892 | udp | |
| AM | 31.184.234.34:6892 | udp | |
| AM | 31.184.234.35:6892 | udp | |
| AM | 31.184.234.36:6892 | udp | |
| AM | 31.184.234.37:6892 | udp | |
| AM | 31.184.234.38:6892 | udp | |
| AM | 31.184.234.39:6892 | udp | |
| AM | 31.184.234.40:6892 | udp | |
| AM | 31.184.234.41:6892 | udp | |
| AM | 31.184.234.42:6892 | udp | |
| AM | 31.184.234.43:6892 | udp | |
| AM | 31.184.234.44:6892 | udp | |
| AM | 31.184.234.45:6892 | udp | |
| AM | 31.184.234.46:6892 | udp | |
| AM | 31.184.234.47:6892 | udp | |
| AM | 31.184.234.48:6892 | udp | |
| AM | 31.184.234.49:6892 | udp | |
| AM | 31.184.234.50:6892 | udp | |
| AM | 31.184.234.51:6892 | udp | |
| AM | 31.184.234.52:6892 | udp | |
| AM | 31.184.234.53:6892 | udp | |
| AM | 31.184.234.54:6892 | udp | |
| AM | 31.184.234.55:6892 | udp | |
| AM | 31.184.234.56:6892 | udp | |
| AM | 31.184.234.57:6892 | udp | |
| AM | 31.184.234.58:6892 | udp | |
| AM | 31.184.234.59:6892 | udp | |
| AM | 31.184.234.60:6892 | udp | |
| AM | 31.184.234.61:6892 | udp | |
| AM | 31.184.234.62:6892 | udp | |
| AM | 31.184.234.63:6892 | udp | |
| AM | 31.184.234.64:6892 | udp | |
| AM | 31.184.234.65:6892 | udp | |
| AM | 31.184.234.66:6892 | udp | |
| AM | 31.184.234.67:6892 | udp | |
| AM | 31.184.234.68:6892 | udp | |
| AM | 31.184.234.69:6892 | udp | |
| AM | 31.184.234.70:6892 | udp | |
| AM | 31.184.234.71:6892 | udp | |
| AM | 31.184.234.72:6892 | udp | |
| AM | 31.184.234.73:6892 | udp | |
| AM | 31.184.234.74:6892 | udp | |
| AM | 31.184.234.75:6892 | udp | |
| AM | 31.184.234.76:6892 | udp | |
| AM | 31.184.234.77:6892 | udp | |
| AM | 31.184.234.78:6892 | udp | |
| AM | 31.184.234.79:6892 | udp | |
| AM | 31.184.234.80:6892 | udp | |
| AM | 31.184.234.81:6892 | udp | |
| AM | 31.184.234.82:6892 | udp | |
| AM | 31.184.234.83:6892 | udp | |
| AM | 31.184.234.84:6892 | udp | |
| AM | 31.184.234.85:6892 | udp | |
| AM | 31.184.234.86:6892 | udp | |
| AM | 31.184.234.87:6892 | udp | |
| AM | 31.184.234.88:6892 | udp | |
| AM | 31.184.234.89:6892 | udp | |
| AM | 31.184.234.90:6892 | udp | |
| AM | 31.184.234.91:6892 | udp | |
| AM | 31.184.234.92:6892 | udp | |
| AM | 31.184.234.93:6892 | udp | |
| AM | 31.184.234.94:6892 | udp | |
| AM | 31.184.234.95:6892 | udp | |
| AM | 31.184.234.96:6892 | udp | |
| AM | 31.184.234.97:6892 | udp | |
| AM | 31.184.234.98:6892 | udp | |
| AM | 31.184.234.99:6892 | udp | |
| AM | 31.184.234.100:6892 | udp | |
| AM | 31.184.234.101:6892 | udp | |
| AM | 31.184.234.102:6892 | udp | |
| AM | 31.184.234.103:6892 | udp | |
| AM | 31.184.234.104:6892 | udp | |
| AM | 31.184.234.105:6892 | udp | |
| AM | 31.184.234.106:6892 | udp | |
| AM | 31.184.234.107:6892 | udp | |
| AM | 31.184.234.108:6892 | udp | |
| AM | 31.184.234.109:6892 | udp | |
| AM | 31.184.234.110:6892 | udp | |
| AM | 31.184.234.111:6892 | udp | |
| AM | 31.184.234.112:6892 | udp | |
| AM | 31.184.234.113:6892 | udp | |
| AM | 31.184.234.114:6892 | udp | |
| AM | 31.184.234.115:6892 | udp | |
| AM | 31.184.234.116:6892 | udp | |
| AM | 31.184.234.117:6892 | udp | |
| AM | 31.184.234.118:6892 | udp | |
| AM | 31.184.234.119:6892 | udp | |
| AM | 31.184.234.120:6892 | udp | |
| AM | 31.184.234.121:6892 | udp | |
| AM | 31.184.234.122:6892 | udp | |
| AM | 31.184.234.123:6892 | udp | |
| AM | 31.184.234.124:6892 | udp | |
| AM | 31.184.234.125:6892 | udp | |
| AM | 31.184.234.126:6892 | udp | |
| AM | 31.184.234.127:6892 | udp | |
| AM | 31.184.234.128:6892 | udp | |
| AM | 31.184.234.129:6892 | udp | |
| AM | 31.184.234.130:6892 | udp | |
| AM | 31.184.234.131:6892 | udp | |
| AM | 31.184.234.132:6892 | udp | |
| AM | 31.184.234.133:6892 | udp | |
| AM | 31.184.234.134:6892 | udp | |
| AM | 31.184.234.135:6892 | udp | |
| AM | 31.184.234.136:6892 | udp | |
| AM | 31.184.234.137:6892 | udp | |
| AM | 31.184.234.138:6892 | udp | |
| AM | 31.184.234.139:6892 | udp | |
| AM | 31.184.234.140:6892 | udp | |
| AM | 31.184.234.141:6892 | udp | |
| AM | 31.184.234.142:6892 | udp | |
| AM | 31.184.234.143:6892 | udp | |
| AM | 31.184.234.144:6892 | udp | |
| AM | 31.184.234.145:6892 | udp | |
| AM | 31.184.234.146:6892 | udp | |
| AM | 31.184.234.147:6892 | udp | |
| AM | 31.184.234.148:6892 | udp | |
| AM | 31.184.234.149:6892 | udp | |
| AM | 31.184.234.150:6892 | udp | |
| AM | 31.184.234.151:6892 | udp | |
| AM | 31.184.234.152:6892 | udp | |
| AM | 31.184.234.153:6892 | udp | |
| AM | 31.184.234.154:6892 | udp | |
| AM | 31.184.234.155:6892 | udp | |
| AM | 31.184.234.156:6892 | udp | |
| AM | 31.184.234.157:6892 | udp | |
| AM | 31.184.234.158:6892 | udp | |
| AM | 31.184.234.159:6892 | udp | |
| AM | 31.184.234.160:6892 | udp | |
| AM | 31.184.234.161:6892 | udp | |
| AM | 31.184.234.162:6892 | udp | |
| AM | 31.184.234.163:6892 | udp | |
| AM | 31.184.234.164:6892 | udp | |
| AM | 31.184.234.165:6892 | udp | |
| AM | 31.184.234.166:6892 | udp | |
| AM | 31.184.234.167:6892 | udp | |
| AM | 31.184.234.168:6892 | udp | |
| AM | 31.184.234.169:6892 | udp | |
| AM | 31.184.234.170:6892 | udp | |
| AM | 31.184.234.171:6892 | udp | |
| AM | 31.184.234.172:6892 | udp | |
| AM | 31.184.234.173:6892 | udp | |
| AM | 31.184.234.174:6892 | udp | |
| AM | 31.184.234.175:6892 | udp | |
| AM | 31.184.234.176:6892 | udp | |
| AM | 31.184.234.177:6892 | udp | |
| AM | 31.184.234.178:6892 | udp | |
| AM | 31.184.234.179:6892 | udp | |
| AM | 31.184.234.180:6892 | udp | |
| AM | 31.184.234.181:6892 | udp | |
| AM | 31.184.234.182:6892 | udp | |
| AM | 31.184.234.183:6892 | udp | |
| AM | 31.184.234.184:6892 | udp | |
| AM | 31.184.234.185:6892 | udp | |
| AM | 31.184.234.186:6892 | udp | |
| AM | 31.184.234.187:6892 | udp | |
| AM | 31.184.234.188:6892 | udp | |
| AM | 31.184.234.189:6892 | udp | |
| AM | 31.184.234.190:6892 | udp | |
| AM | 31.184.234.191:6892 | udp | |
| AM | 31.184.234.192:6892 | udp | |
| AM | 31.184.234.193:6892 | udp | |
| AM | 31.184.234.194:6892 | udp | |
| AM | 31.184.234.195:6892 | udp | |
| AM | 31.184.234.196:6892 | udp | |
| AM | 31.184.234.197:6892 | udp | |
| AM | 31.184.234.198:6892 | udp | |
| AM | 31.184.234.199:6892 | udp | |
| AM | 31.184.234.200:6892 | udp | |
| AM | 31.184.234.201:6892 | udp | |
| AM | 31.184.234.202:6892 | udp | |
| AM | 31.184.234.203:6892 | udp | |
| AM | 31.184.234.204:6892 | udp | |
| AM | 31.184.234.205:6892 | udp | |
| AM | 31.184.234.206:6892 | udp | |
| AM | 31.184.234.207:6892 | udp | |
| AM | 31.184.234.208:6892 | udp | |
| AM | 31.184.234.209:6892 | udp | |
| AM | 31.184.234.210:6892 | udp | |
| AM | 31.184.234.211:6892 | udp | |
| AM | 31.184.234.212:6892 | udp | |
| AM | 31.184.234.213:6892 | udp | |
| AM | 31.184.234.214:6892 | udp | |
| AM | 31.184.234.215:6892 | udp | |
| AM | 31.184.234.216:6892 | udp | |
| AM | 31.184.234.217:6892 | udp | |
| AM | 31.184.234.218:6892 | udp | |
| AM | 31.184.234.219:6892 | udp | |
| AM | 31.184.234.220:6892 | udp | |
| AM | 31.184.234.221:6892 | udp | |
| AM | 31.184.234.222:6892 | udp | |
| AM | 31.184.234.223:6892 | udp | |
| AM | 31.184.234.224:6892 | udp | |
| AM | 31.184.234.225:6892 | udp | |
| AM | 31.184.234.226:6892 | udp | |
| AM | 31.184.234.227:6892 | udp | |
| AM | 31.184.234.228:6892 | udp | |
| AM | 31.184.234.229:6892 | udp | |
| AM | 31.184.234.230:6892 | udp | |
| AM | 31.184.234.231:6892 | udp | |
| AM | 31.184.234.232:6892 | udp | |
| AM | 31.184.234.233:6892 | udp | |
| AM | 31.184.234.234:6892 | udp | |
| AM | 31.184.234.235:6892 | udp | |
| AM | 31.184.234.236:6892 | udp | |
| AM | 31.184.234.237:6892 | udp | |
| AM | 31.184.234.238:6892 | udp | |
| AM | 31.184.234.239:6892 | udp | |
| AM | 31.184.234.240:6892 | udp | |
| AM | 31.184.234.241:6892 | udp | |
| AM | 31.184.234.242:6892 | udp | |
| AM | 31.184.234.243:6892 | udp | |
| AM | 31.184.234.244:6892 | udp | |
| AM | 31.184.234.245:6892 | udp | |
| AM | 31.184.234.246:6892 | udp | |
| AM | 31.184.234.247:6892 | udp | |
| AM | 31.184.234.248:6892 | udp | |
| AM | 31.184.234.249:6892 | udp | |
| AM | 31.184.234.250:6892 | udp | |
| AM | 31.184.234.251:6892 | udp | |
| AM | 31.184.234.252:6892 | udp | |
| AM | 31.184.234.253:6892 | udp | |
| AM | 31.184.234.254:6892 | udp | |
| AM | 31.184.234.255:6892 | udp | |
| AM | 31.184.235.0:6892 | udp | |
| AM | 31.184.235.1:6892 | udp | |
| AM | 31.184.235.2:6892 | udp | |
| AM | 31.184.235.3:6892 | udp | |
| AM | 31.184.235.4:6892 | udp | |
| AM | 31.184.235.5:6892 | udp | |
| AM | 31.184.235.6:6892 | udp | |
| AM | 31.184.235.7:6892 | udp | |
| AM | 31.184.235.8:6892 | udp | |
| AM | 31.184.235.9:6892 | udp | |
| AM | 31.184.235.10:6892 | udp | |
| AM | 31.184.235.11:6892 | udp | |
| AM | 31.184.235.12:6892 | udp | |
| AM | 31.184.235.13:6892 | udp | |
| AM | 31.184.235.14:6892 | udp | |
| AM | 31.184.235.15:6892 | udp | |
| AM | 31.184.235.16:6892 | udp | |
| AM | 31.184.235.17:6892 | udp | |
| AM | 31.184.235.18:6892 | udp | |
| AM | 31.184.235.19:6892 | udp | |
| AM | 31.184.235.20:6892 | udp | |
| AM | 31.184.235.21:6892 | udp | |
| AM | 31.184.235.22:6892 | udp | |
| AM | 31.184.235.23:6892 | udp | |
| AM | 31.184.235.24:6892 | udp | |
| AM | 31.184.235.25:6892 | udp | |
| AM | 31.184.235.26:6892 | udp | |
| AM | 31.184.235.27:6892 | udp | |
| AM | 31.184.235.28:6892 | udp | |
| AM | 31.184.235.29:6892 | udp | |
| AM | 31.184.235.30:6892 | udp | |
| AM | 31.184.235.31:6892 | udp | |
| AM | 31.184.235.32:6892 | udp | |
| AM | 31.184.235.33:6892 | udp | |
| AM | 31.184.235.34:6892 | udp | |
| AM | 31.184.235.35:6892 | udp | |
| AM | 31.184.235.36:6892 | udp | |
| AM | 31.184.235.37:6892 | udp | |
| AM | 31.184.235.38:6892 | udp | |
| AM | 31.184.235.39:6892 | udp | |
| AM | 31.184.235.40:6892 | udp | |
| AM | 31.184.235.41:6892 | udp | |
| AM | 31.184.235.42:6892 | udp | |
| AM | 31.184.235.43:6892 | udp | |
| AM | 31.184.235.44:6892 | udp | |
| AM | 31.184.235.45:6892 | udp | |
| AM | 31.184.235.46:6892 | udp | |
| AM | 31.184.235.47:6892 | udp | |
| AM | 31.184.235.48:6892 | udp | |
| AM | 31.184.235.49:6892 | udp | |
| AM | 31.184.235.50:6892 | udp | |
| AM | 31.184.235.51:6892 | udp | |
| AM | 31.184.235.52:6892 | udp | |
| AM | 31.184.235.53:6892 | udp | |
| AM | 31.184.235.54:6892 | udp | |
| AM | 31.184.235.55:6892 | udp | |
| AM | 31.184.235.56:6892 | udp | |
| AM | 31.184.235.57:6892 | udp | |
| AM | 31.184.235.58:6892 | udp | |
| AM | 31.184.235.59:6892 | udp | |
| AM | 31.184.235.60:6892 | udp | |
| AM | 31.184.235.61:6892 | udp | |
| AM | 31.184.235.62:6892 | udp | |
| AM | 31.184.235.63:6892 | udp | |
| AM | 31.184.235.64:6892 | udp | |
| AM | 31.184.235.65:6892 | udp | |
| AM | 31.184.235.66:6892 | udp | |
| AM | 31.184.235.67:6892 | udp | |
| AM | 31.184.235.68:6892 | udp | |
| AM | 31.184.235.69:6892 | udp | |
| AM | 31.184.235.70:6892 | udp | |
| AM | 31.184.235.71:6892 | udp | |
| AM | 31.184.235.72:6892 | udp | |
| AM | 31.184.235.73:6892 | udp | |
| AM | 31.184.235.74:6892 | udp | |
| AM | 31.184.235.75:6892 | udp | |
| AM | 31.184.235.76:6892 | udp | |
| AM | 31.184.235.77:6892 | udp | |
| AM | 31.184.235.78:6892 | udp | |
| AM | 31.184.235.79:6892 | udp | |
| AM | 31.184.235.80:6892 | udp | |
| AM | 31.184.235.81:6892 | udp | |
| AM | 31.184.235.82:6892 | udp | |
| AM | 31.184.235.83:6892 | udp | |
| AM | 31.184.235.84:6892 | udp | |
| AM | 31.184.235.85:6892 | udp | |
| AM | 31.184.235.86:6892 | udp | |
| AM | 31.184.235.87:6892 | udp | |
| AM | 31.184.235.88:6892 | udp | |
| AM | 31.184.235.89:6892 | udp | |
| AM | 31.184.235.90:6892 | udp | |
| AM | 31.184.235.91:6892 | udp | |
| AM | 31.184.235.92:6892 | udp | |
| AM | 31.184.235.93:6892 | udp | |
| AM | 31.184.235.94:6892 | udp | |
| AM | 31.184.235.95:6892 | udp | |
| AM | 31.184.235.96:6892 | udp | |
| AM | 31.184.235.97:6892 | udp | |
| AM | 31.184.235.98:6892 | udp | |
| AM | 31.184.235.99:6892 | udp | |
| AM | 31.184.235.100:6892 | udp | |
| AM | 31.184.235.101:6892 | udp | |
| AM | 31.184.235.102:6892 | udp | |
| AM | 31.184.235.103:6892 | udp | |
| AM | 31.184.235.104:6892 | udp | |
| AM | 31.184.235.105:6892 | udp | |
| AM | 31.184.235.106:6892 | udp | |
| AM | 31.184.235.107:6892 | udp | |
| AM | 31.184.235.108:6892 | udp | |
| AM | 31.184.235.109:6892 | udp | |
| AM | 31.184.235.110:6892 | udp | |
| AM | 31.184.235.111:6892 | udp | |
| AM | 31.184.235.112:6892 | udp | |
| AM | 31.184.235.113:6892 | udp | |
| AM | 31.184.235.114:6892 | udp | |
| AM | 31.184.235.115:6892 | udp | |
| AM | 31.184.235.116:6892 | udp | |
| AM | 31.184.235.117:6892 | udp | |
| AM | 31.184.235.118:6892 | udp | |
| AM | 31.184.235.119:6892 | udp | |
| AM | 31.184.235.120:6892 | udp | |
| AM | 31.184.235.121:6892 | udp | |
| AM | 31.184.235.122:6892 | udp | |
| AM | 31.184.235.123:6892 | udp | |
| AM | 31.184.235.124:6892 | udp | |
| AM | 31.184.235.125:6892 | udp | |
| AM | 31.184.235.126:6892 | udp | |
| AM | 31.184.235.127:6892 | udp | |
| AM | 31.184.235.128:6892 | udp | |
| AM | 31.184.235.129:6892 | udp | |
| AM | 31.184.235.130:6892 | udp | |
| AM | 31.184.235.131:6892 | udp | |
| AM | 31.184.235.132:6892 | udp | |
| AM | 31.184.235.133:6892 | udp | |
| AM | 31.184.235.134:6892 | udp | |
| AM | 31.184.235.135:6892 | udp | |
| AM | 31.184.235.136:6892 | udp | |
| AM | 31.184.235.137:6892 | udp | |
| AM | 31.184.235.138:6892 | udp | |
| AM | 31.184.235.139:6892 | udp | |
| AM | 31.184.235.140:6892 | udp | |
| AM | 31.184.235.141:6892 | udp | |
| AM | 31.184.235.142:6892 | udp | |
| AM | 31.184.235.143:6892 | udp | |
| AM | 31.184.235.144:6892 | udp | |
| AM | 31.184.235.145:6892 | udp | |
| AM | 31.184.235.146:6892 | udp | |
| AM | 31.184.235.147:6892 | udp | |
| AM | 31.184.235.148:6892 | udp | |
| AM | 31.184.235.149:6892 | udp | |
| AM | 31.184.235.150:6892 | udp | |
| AM | 31.184.235.151:6892 | udp | |
| AM | 31.184.235.152:6892 | udp | |
| AM | 31.184.235.153:6892 | udp | |
| AM | 31.184.235.154:6892 | udp | |
| AM | 31.184.235.155:6892 | udp | |
| AM | 31.184.235.156:6892 | udp | |
| AM | 31.184.235.157:6892 | udp | |
| AM | 31.184.235.158:6892 | udp | |
| AM | 31.184.235.159:6892 | udp | |
| AM | 31.184.235.160:6892 | udp | |
| AM | 31.184.235.161:6892 | udp | |
| AM | 31.184.235.162:6892 | udp | |
| AM | 31.184.235.163:6892 | udp | |
| AM | 31.184.235.164:6892 | udp | |
| AM | 31.184.235.165:6892 | udp | |
| AM | 31.184.235.166:6892 | udp | |
| AM | 31.184.235.167:6892 | udp | |
| AM | 31.184.235.168:6892 | udp | |
| AM | 31.184.235.169:6892 | udp | |
| AM | 31.184.235.170:6892 | udp | |
| AM | 31.184.235.171:6892 | udp | |
| AM | 31.184.235.172:6892 | udp | |
| AM | 31.184.235.173:6892 | udp | |
| AM | 31.184.235.174:6892 | udp | |
| AM | 31.184.235.175:6892 | udp | |
| AM | 31.184.235.176:6892 | udp | |
| AM | 31.184.235.177:6892 | udp | |
| AM | 31.184.235.178:6892 | udp | |
| AM | 31.184.235.179:6892 | udp | |
| AM | 31.184.235.180:6892 | udp | |
| AM | 31.184.235.181:6892 | udp | |
| AM | 31.184.235.182:6892 | udp | |
| AM | 31.184.235.183:6892 | udp | |
| AM | 31.184.235.184:6892 | udp | |
| AM | 31.184.235.185:6892 | udp | |
| AM | 31.184.235.186:6892 | udp | |
| AM | 31.184.235.187:6892 | udp | |
| AM | 31.184.235.188:6892 | udp | |
| AM | 31.184.235.189:6892 | udp | |
| AM | 31.184.235.190:6892 | udp | |
| AM | 31.184.235.191:6892 | udp | |
| AM | 31.184.235.192:6892 | udp | |
| AM | 31.184.235.193:6892 | udp | |
| AM | 31.184.235.194:6892 | udp | |
| AM | 31.184.235.195:6892 | udp | |
| AM | 31.184.235.196:6892 | udp | |
| AM | 31.184.235.197:6892 | udp | |
| AM | 31.184.235.198:6892 | udp | |
| AM | 31.184.235.199:6892 | udp | |
| AM | 31.184.235.200:6892 | udp | |
| AM | 31.184.235.201:6892 | udp | |
| AM | 31.184.235.202:6892 | udp | |
| AM | 31.184.235.203:6892 | udp | |
| AM | 31.184.235.204:6892 | udp | |
| AM | 31.184.235.205:6892 | udp | |
| AM | 31.184.235.206:6892 | udp | |
| AM | 31.184.235.207:6892 | udp | |
| AM | 31.184.235.208:6892 | udp | |
| AM | 31.184.235.209:6892 | udp | |
| AM | 31.184.235.210:6892 | udp | |
| AM | 31.184.235.211:6892 | udp | |
| AM | 31.184.235.212:6892 | udp | |
| AM | 31.184.235.213:6892 | udp | |
| AM | 31.184.235.214:6892 | udp | |
| AM | 31.184.235.215:6892 | udp | |
| AM | 31.184.235.216:6892 | udp | |
| AM | 31.184.235.217:6892 | udp | |
| AM | 31.184.235.218:6892 | udp | |
| AM | 31.184.235.219:6892 | udp | |
| AM | 31.184.235.220:6892 | udp | |
| AM | 31.184.235.221:6892 | udp | |
| AM | 31.184.235.222:6892 | udp | |
| AM | 31.184.235.223:6892 | udp | |
| AM | 31.184.235.224:6892 | udp | |
| AM | 31.184.235.225:6892 | udp | |
| AM | 31.184.235.226:6892 | udp | |
| AM | 31.184.235.227:6892 | udp | |
| AM | 31.184.235.228:6892 | udp | |
| AM | 31.184.235.229:6892 | udp | |
| AM | 31.184.235.230:6892 | udp | |
| AM | 31.184.235.231:6892 | udp | |
| AM | 31.184.235.232:6892 | udp | |
| AM | 31.184.235.233:6892 | udp | |
| AM | 31.184.235.234:6892 | udp | |
| AM | 31.184.235.235:6892 | udp | |
| AM | 31.184.235.236:6892 | udp | |
| AM | 31.184.235.237:6892 | udp | |
| AM | 31.184.235.238:6892 | udp | |
| AM | 31.184.235.239:6892 | udp | |
| AM | 31.184.235.240:6892 | udp | |
| AM | 31.184.235.241:6892 | udp | |
| AM | 31.184.235.242:6892 | udp | |
| AM | 31.184.235.243:6892 | udp | |
| AM | 31.184.235.244:6892 | udp | |
| AM | 31.184.235.245:6892 | udp | |
| AM | 31.184.235.246:6892 | udp | |
| AM | 31.184.235.247:6892 | udp | |
| AM | 31.184.235.248:6892 | udp | |
| AM | 31.184.235.249:6892 | udp | |
| AM | 31.184.235.250:6892 | udp | |
| AM | 31.184.235.251:6892 | udp | |
| AM | 31.184.235.252:6892 | udp | |
| AM | 31.184.235.253:6892 | udp | |
| AM | 31.184.235.254:6892 | udp | |
| AM | 31.184.235.255:6892 | udp | |
| US | 8.8.8.8:53 | 105.209.201.84.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 23.236.111.52.in-addr.arpa | udp |
| AM | 31.184.234.0:6892 | udp | |
| AM | 31.184.234.1:6892 | udp | |
| AM | 31.184.234.2:6892 | udp | |
| AM | 31.184.234.3:6892 | udp | |
| AM | 31.184.234.4:6892 | udp | |
| AM | 31.184.234.5:6892 | udp | |
| AM | 31.184.234.6:6892 | udp | |
| AM | 31.184.234.7:6892 | udp | |
| AM | 31.184.234.8:6892 | udp | |
| AM | 31.184.234.9:6892 | udp | |
| AM | 31.184.234.10:6892 | udp | |
| AM | 31.184.234.11:6892 | udp | |
| AM | 31.184.234.12:6892 | udp | |
| AM | 31.184.234.13:6892 | udp | |
| AM | 31.184.234.14:6892 | udp | |
| AM | 31.184.234.15:6892 | udp | |
| AM | 31.184.234.16:6892 | udp | |
| AM | 31.184.234.17:6892 | udp | |
| AM | 31.184.234.18:6892 | udp | |
| AM | 31.184.234.19:6892 | udp | |
| AM | 31.184.234.20:6892 | udp | |
| AM | 31.184.234.21:6892 | udp | |
| AM | 31.184.234.22:6892 | udp | |
| AM | 31.184.234.23:6892 | udp | |
| AM | 31.184.234.24:6892 | udp | |
| AM | 31.184.234.25:6892 | udp | |
| AM | 31.184.234.26:6892 | udp | |
| AM | 31.184.234.27:6892 | udp | |
| AM | 31.184.234.28:6892 | udp | |
| AM | 31.184.234.29:6892 | udp | |
| AM | 31.184.234.30:6892 | udp | |
| AM | 31.184.234.31:6892 | udp | |
| AM | 31.184.234.32:6892 | udp | |
| AM | 31.184.234.33:6892 | udp | |
| AM | 31.184.234.34:6892 | udp | |
| AM | 31.184.234.35:6892 | udp | |
| AM | 31.184.234.36:6892 | udp | |
| AM | 31.184.234.37:6892 | udp | |
| AM | 31.184.234.38:6892 | udp | |
| AM | 31.184.234.39:6892 | udp | |
| AM | 31.184.234.40:6892 | udp | |
| AM | 31.184.234.41:6892 | udp | |
| AM | 31.184.234.42:6892 | udp | |
| AM | 31.184.234.43:6892 | udp | |
| AM | 31.184.234.44:6892 | udp | |
| AM | 31.184.234.45:6892 | udp | |
| AM | 31.184.234.46:6892 | udp | |
| AM | 31.184.234.47:6892 | udp | |
| AM | 31.184.234.48:6892 | udp | |
| AM | 31.184.234.49:6892 | udp | |
| AM | 31.184.234.50:6892 | udp | |
| AM | 31.184.234.51:6892 | udp | |
| AM | 31.184.234.52:6892 | udp | |
| AM | 31.184.234.53:6892 | udp | |
| AM | 31.184.234.54:6892 | udp | |
| AM | 31.184.234.55:6892 | udp | |
| AM | 31.184.234.56:6892 | udp | |
| AM | 31.184.234.57:6892 | udp | |
| AM | 31.184.234.58:6892 | udp | |
| AM | 31.184.234.59:6892 | udp | |
| AM | 31.184.234.60:6892 | udp | |
| AM | 31.184.234.61:6892 | udp | |
| AM | 31.184.234.62:6892 | udp | |
| AM | 31.184.234.63:6892 | udp | |
| AM | 31.184.234.64:6892 | udp | |
| AM | 31.184.234.65:6892 | udp | |
| AM | 31.184.234.66:6892 | udp | |
| AM | 31.184.234.67:6892 | udp | |
| AM | 31.184.234.68:6892 | udp | |
| AM | 31.184.234.69:6892 | udp | |
| AM | 31.184.234.70:6892 | udp | |
| AM | 31.184.234.71:6892 | udp | |
| AM | 31.184.234.72:6892 | udp | |
| AM | 31.184.234.73:6892 | udp | |
| AM | 31.184.234.74:6892 | udp | |
| AM | 31.184.234.75:6892 | udp | |
| AM | 31.184.234.76:6892 | udp | |
| AM | 31.184.234.77:6892 | udp | |
| AM | 31.184.234.78:6892 | udp | |
| AM | 31.184.234.79:6892 | udp | |
| AM | 31.184.234.80:6892 | udp | |
| AM | 31.184.234.81:6892 | udp | |
| AM | 31.184.234.82:6892 | udp | |
| AM | 31.184.234.83:6892 | udp | |
| AM | 31.184.234.84:6892 | udp | |
| AM | 31.184.234.85:6892 | udp | |
| AM | 31.184.234.86:6892 | udp | |
| AM | 31.184.234.87:6892 | udp | |
| AM | 31.184.234.88:6892 | udp | |
| AM | 31.184.234.89:6892 | udp | |
| AM | 31.184.234.90:6892 | udp | |
| AM | 31.184.234.91:6892 | udp | |
| AM | 31.184.234.92:6892 | udp | |
| AM | 31.184.234.93:6892 | udp | |
| AM | 31.184.234.94:6892 | udp | |
| AM | 31.184.234.95:6892 | udp | |
| AM | 31.184.234.96:6892 | udp | |
| AM | 31.184.234.97:6892 | udp | |
| AM | 31.184.234.98:6892 | udp | |
| AM | 31.184.234.99:6892 | udp | |
| AM | 31.184.234.100:6892 | udp | |
| AM | 31.184.234.101:6892 | udp | |
| AM | 31.184.234.102:6892 | udp | |
| AM | 31.184.234.103:6892 | udp | |
| AM | 31.184.234.104:6892 | udp | |
| AM | 31.184.234.105:6892 | udp | |
| AM | 31.184.234.106:6892 | udp | |
| AM | 31.184.234.107:6892 | udp | |
| AM | 31.184.234.108:6892 | udp | |
| AM | 31.184.234.109:6892 | udp | |
| AM | 31.184.234.110:6892 | udp | |
| AM | 31.184.234.111:6892 | udp | |
| AM | 31.184.234.112:6892 | udp | |
| AM | 31.184.234.113:6892 | udp | |
| AM | 31.184.234.114:6892 | udp | |
| AM | 31.184.234.115:6892 | udp | |
| AM | 31.184.234.116:6892 | udp | |
| AM | 31.184.234.117:6892 | udp | |
| AM | 31.184.234.118:6892 | udp | |
| AM | 31.184.234.119:6892 | udp | |
| AM | 31.184.234.120:6892 | udp | |
| AM | 31.184.234.121:6892 | udp | |
| AM | 31.184.234.122:6892 | udp | |
| AM | 31.184.234.123:6892 | udp | |
| AM | 31.184.234.124:6892 | udp | |
| AM | 31.184.234.125:6892 | udp | |
| AM | 31.184.234.126:6892 | udp | |
| AM | 31.184.234.127:6892 | udp | |
| AM | 31.184.234.128:6892 | udp | |
| AM | 31.184.234.129:6892 | udp | |
| AM | 31.184.234.130:6892 | udp | |
| AM | 31.184.234.131:6892 | udp | |
| AM | 31.184.234.132:6892 | udp | |
| AM | 31.184.234.133:6892 | udp | |
| AM | 31.184.234.134:6892 | udp | |
| AM | 31.184.234.135:6892 | udp | |
| AM | 31.184.234.136:6892 | udp | |
| AM | 31.184.234.137:6892 | udp | |
| AM | 31.184.234.138:6892 | udp | |
| AM | 31.184.234.139:6892 | udp | |
| AM | 31.184.234.140:6892 | udp | |
| AM | 31.184.234.141:6892 | udp | |
| AM | 31.184.234.142:6892 | udp | |
| AM | 31.184.234.143:6892 | udp | |
| AM | 31.184.234.144:6892 | udp | |
| AM | 31.184.234.145:6892 | udp | |
| AM | 31.184.234.146:6892 | udp | |
| AM | 31.184.234.147:6892 | udp | |
| AM | 31.184.234.148:6892 | udp | |
| AM | 31.184.234.149:6892 | udp | |
| AM | 31.184.234.150:6892 | udp | |
| AM | 31.184.234.151:6892 | udp | |
| AM | 31.184.234.152:6892 | udp | |
| AM | 31.184.234.153:6892 | udp | |
| AM | 31.184.234.154:6892 | udp | |
| AM | 31.184.234.155:6892 | udp | |
| AM | 31.184.234.156:6892 | udp | |
| AM | 31.184.234.157:6892 | udp | |
| AM | 31.184.234.158:6892 | udp | |
| AM | 31.184.234.159:6892 | udp | |
| AM | 31.184.234.160:6892 | udp | |
| AM | 31.184.234.161:6892 | udp | |
| AM | 31.184.234.162:6892 | udp | |
| AM | 31.184.234.163:6892 | udp | |
| AM | 31.184.234.164:6892 | udp | |
| AM | 31.184.234.165:6892 | udp | |
| AM | 31.184.234.166:6892 | udp | |
| AM | 31.184.234.167:6892 | udp | |
| AM | 31.184.234.168:6892 | udp | |
| AM | 31.184.234.169:6892 | udp | |
| AM | 31.184.234.170:6892 | udp | |
| AM | 31.184.234.171:6892 | udp | |
| AM | 31.184.234.172:6892 | udp | |
| AM | 31.184.234.173:6892 | udp | |
| AM | 31.184.234.174:6892 | udp | |
| AM | 31.184.234.175:6892 | udp | |
| AM | 31.184.234.176:6892 | udp | |
| AM | 31.184.234.177:6892 | udp | |
| AM | 31.184.234.178:6892 | udp | |
| AM | 31.184.234.179:6892 | udp | |
| AM | 31.184.234.180:6892 | udp | |
| AM | 31.184.234.181:6892 | udp | |
| AM | 31.184.234.182:6892 | udp | |
| AM | 31.184.234.183:6892 | udp | |
| AM | 31.184.234.184:6892 | udp | |
| AM | 31.184.234.185:6892 | udp | |
| AM | 31.184.234.186:6892 | udp | |
| AM | 31.184.234.187:6892 | udp | |
| AM | 31.184.234.188:6892 | udp | |
| AM | 31.184.234.189:6892 | udp | |
| AM | 31.184.234.190:6892 | udp | |
| AM | 31.184.234.191:6892 | udp | |
| AM | 31.184.234.192:6892 | udp | |
| AM | 31.184.234.193:6892 | udp | |
| AM | 31.184.234.194:6892 | udp | |
| AM | 31.184.234.195:6892 | udp | |
| AM | 31.184.234.196:6892 | udp | |
| AM | 31.184.234.197:6892 | udp | |
| AM | 31.184.234.198:6892 | udp | |
| AM | 31.184.234.199:6892 | udp | |
| AM | 31.184.234.200:6892 | udp | |
| AM | 31.184.234.201:6892 | udp | |
| AM | 31.184.234.202:6892 | udp | |
| AM | 31.184.234.203:6892 | udp | |
| AM | 31.184.234.204:6892 | udp | |
| AM | 31.184.234.205:6892 | udp | |
| AM | 31.184.234.206:6892 | udp | |
| AM | 31.184.234.207:6892 | udp | |
| AM | 31.184.234.208:6892 | udp | |
| AM | 31.184.234.209:6892 | udp | |
| AM | 31.184.234.210:6892 | udp | |
| AM | 31.184.234.211:6892 | udp | |
| AM | 31.184.234.212:6892 | udp | |
| AM | 31.184.234.213:6892 | udp | |
| AM | 31.184.234.214:6892 | udp | |
| AM | 31.184.234.215:6892 | udp | |
| AM | 31.184.234.216:6892 | udp | |
| AM | 31.184.234.217:6892 | udp | |
| AM | 31.184.234.218:6892 | udp | |
| AM | 31.184.234.219:6892 | udp | |
| AM | 31.184.234.220:6892 | udp | |
| AM | 31.184.234.221:6892 | udp | |
| AM | 31.184.234.222:6892 | udp | |
| AM | 31.184.234.223:6892 | udp | |
| AM | 31.184.234.224:6892 | udp | |
| AM | 31.184.234.225:6892 | udp | |
| AM | 31.184.234.226:6892 | udp | |
| AM | 31.184.234.227:6892 | udp | |
| AM | 31.184.234.228:6892 | udp | |
| AM | 31.184.234.229:6892 | udp | |
| AM | 31.184.234.230:6892 | udp | |
| AM | 31.184.234.231:6892 | udp | |
| AM | 31.184.234.232:6892 | udp | |
| AM | 31.184.234.233:6892 | udp | |
| AM | 31.184.234.234:6892 | udp | |
| AM | 31.184.234.235:6892 | udp | |
| AM | 31.184.234.236:6892 | udp | |
| AM | 31.184.234.237:6892 | udp | |
| AM | 31.184.234.238:6892 | udp | |
| AM | 31.184.234.239:6892 | udp | |
| AM | 31.184.234.240:6892 | udp | |
| AM | 31.184.234.241:6892 | udp | |
| AM | 31.184.234.242:6892 | udp | |
| AM | 31.184.234.243:6892 | udp | |
| AM | 31.184.234.244:6892 | udp | |
| AM | 31.184.234.245:6892 | udp | |
| AM | 31.184.234.246:6892 | udp | |
| AM | 31.184.234.247:6892 | udp | |
| AM | 31.184.234.248:6892 | udp | |
| AM | 31.184.234.249:6892 | udp | |
| AM | 31.184.234.250:6892 | udp | |
| AM | 31.184.234.251:6892 | udp | |
| AM | 31.184.234.252:6892 | udp | |
| AM | 31.184.234.253:6892 | udp | |
| AM | 31.184.234.254:6892 | udp | |
| US | 8.8.8.8:53 | 104.242.123.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | pmenboeqhyrpvomq.wz139z.top | udp |
| US | 8.8.8.8:53 | google.com | udp |
| US | 8.8.8.8:53 | google.com | udp |
| US | 8.8.8.8:53 | 68.32.126.40.in-addr.arpa | udp |
| AM | 31.184.234.255:6892 | udp | |
| AM | 31.184.235.0:6892 | udp | |
| AM | 31.184.235.1:6892 | udp | |
| AM | 31.184.235.2:6892 | udp | |
| AM | 31.184.235.3:6892 | udp | |
| AM | 31.184.235.4:6892 | udp | |
| AM | 31.184.235.5:6892 | udp | |
| AM | 31.184.235.6:6892 | udp | |
| AM | 31.184.235.7:6892 | udp | |
| AM | 31.184.235.8:6892 | udp | |
| AM | 31.184.235.9:6892 | udp | |
| AM | 31.184.235.10:6892 | udp | |
| AM | 31.184.235.11:6892 | udp | |
| AM | 31.184.235.12:6892 | udp | |
| AM | 31.184.235.13:6892 | udp | |
| AM | 31.184.235.14:6892 | udp | |
| AM | 31.184.235.15:6892 | udp | |
| AM | 31.184.235.16:6892 | udp | |
| AM | 31.184.235.17:6892 | udp | |
| AM | 31.184.235.18:6892 | udp | |
| AM | 31.184.235.19:6892 | udp | |
| AM | 31.184.235.20:6892 | udp | |
| AM | 31.184.235.21:6892 | udp | |
| AM | 31.184.235.22:6892 | udp | |
| AM | 31.184.235.23:6892 | udp | |
| AM | 31.184.235.24:6892 | udp | |
| AM | 31.184.235.25:6892 | udp | |
| AM | 31.184.235.26:6892 | udp | |
| AM | 31.184.235.27:6892 | udp | |
| AM | 31.184.235.28:6892 | udp | |
| AM | 31.184.235.29:6892 | udp | |
| AM | 31.184.235.30:6892 | udp | |
| AM | 31.184.235.31:6892 | udp | |
| AM | 31.184.235.32:6892 | udp | |
| AM | 31.184.235.33:6892 | udp | |
| AM | 31.184.235.34:6892 | udp | |
| AM | 31.184.235.35:6892 | udp | |
| AM | 31.184.235.36:6892 | udp | |
| AM | 31.184.235.37:6892 | udp | |
| AM | 31.184.235.38:6892 | udp | |
| AM | 31.184.235.39:6892 | udp | |
| AM | 31.184.235.40:6892 | udp | |
| AM | 31.184.235.41:6892 | udp | |
| AM | 31.184.235.42:6892 | udp | |
| AM | 31.184.235.43:6892 | udp | |
| AM | 31.184.235.44:6892 | udp | |
| AM | 31.184.235.45:6892 | udp | |
| AM | 31.184.235.46:6892 | udp | |
| AM | 31.184.235.47:6892 | udp | |
| AM | 31.184.235.48:6892 | udp | |
| AM | 31.184.235.49:6892 | udp | |
| AM | 31.184.235.50:6892 | udp | |
| AM | 31.184.235.51:6892 | udp | |
| AM | 31.184.235.52:6892 | udp | |
| AM | 31.184.235.53:6892 | udp | |
| AM | 31.184.235.54:6892 | udp | |
| AM | 31.184.235.55:6892 | udp | |
| AM | 31.184.235.56:6892 | udp | |
| AM | 31.184.235.57:6892 | udp | |
| AM | 31.184.235.58:6892 | udp | |
| AM | 31.184.235.59:6892 | udp | |
| AM | 31.184.235.60:6892 | udp | |
| AM | 31.184.235.61:6892 | udp | |
| AM | 31.184.235.62:6892 | udp | |
| AM | 31.184.235.63:6892 | udp | |
| AM | 31.184.235.64:6892 | udp | |
| AM | 31.184.235.65:6892 | udp | |
| AM | 31.184.235.66:6892 | udp | |
| AM | 31.184.235.67:6892 | udp | |
| AM | 31.184.235.68:6892 | udp | |
| AM | 31.184.235.69:6892 | udp | |
| AM | 31.184.235.70:6892 | udp | |
| AM | 31.184.235.71:6892 | udp | |
| AM | 31.184.235.72:6892 | udp | |
| AM | 31.184.235.73:6892 | udp | |
| AM | 31.184.235.74:6892 | udp | |
| AM | 31.184.235.75:6892 | udp | |
| AM | 31.184.235.76:6892 | udp | |
| AM | 31.184.235.77:6892 | udp | |
| AM | 31.184.235.78:6892 | udp | |
| AM | 31.184.235.79:6892 | udp | |
| AM | 31.184.235.80:6892 | udp | |
| AM | 31.184.235.81:6892 | udp | |
| AM | 31.184.235.82:6892 | udp | |
| AM | 31.184.235.83:6892 | udp | |
| AM | 31.184.235.84:6892 | udp | |
| AM | 31.184.235.85:6892 | udp | |
| AM | 31.184.235.86:6892 | udp | |
| AM | 31.184.235.87:6892 | udp | |
| AM | 31.184.235.88:6892 | udp | |
| AM | 31.184.235.89:6892 | udp | |
| AM | 31.184.235.90:6892 | udp | |
| AM | 31.184.235.91:6892 | udp | |
| AM | 31.184.235.92:6892 | udp | |
| AM | 31.184.235.93:6892 | udp | |
| AM | 31.184.235.94:6892 | udp | |
| AM | 31.184.235.95:6892 | udp | |
| AM | 31.184.235.96:6892 | udp | |
| AM | 31.184.235.97:6892 | udp | |
| AM | 31.184.235.98:6892 | udp | |
| AM | 31.184.235.99:6892 | udp | |
| AM | 31.184.235.100:6892 | udp | |
| AM | 31.184.235.101:6892 | udp | |
| AM | 31.184.235.102:6892 | udp | |
| AM | 31.184.235.103:6892 | udp | |
| AM | 31.184.235.104:6892 | udp | |
| AM | 31.184.235.105:6892 | udp | |
| AM | 31.184.235.106:6892 | udp | |
| AM | 31.184.235.107:6892 | udp | |
| AM | 31.184.235.108:6892 | udp | |
| AM | 31.184.235.109:6892 | udp | |
| AM | 31.184.235.110:6892 | udp | |
| AM | 31.184.235.111:6892 | udp | |
| AM | 31.184.235.112:6892 | udp | |
| AM | 31.184.235.113:6892 | udp | |
| AM | 31.184.235.114:6892 | udp | |
| AM | 31.184.235.115:6892 | udp | |
| AM | 31.184.235.116:6892 | udp | |
| AM | 31.184.235.117:6892 | udp | |
| AM | 31.184.235.118:6892 | udp | |
| AM | 31.184.235.119:6892 | udp | |
| AM | 31.184.235.120:6892 | udp | |
| AM | 31.184.235.121:6892 | udp | |
| AM | 31.184.235.122:6892 | udp | |
| AM | 31.184.235.123:6892 | udp | |
| AM | 31.184.235.124:6892 | udp | |
| AM | 31.184.235.125:6892 | udp | |
| AM | 31.184.235.126:6892 | udp | |
| AM | 31.184.235.127:6892 | udp | |
| AM | 31.184.235.128:6892 | udp | |
| AM | 31.184.235.129:6892 | udp | |
| AM | 31.184.235.130:6892 | udp | |
| AM | 31.184.235.131:6892 | udp | |
| AM | 31.184.235.132:6892 | udp | |
| AM | 31.184.235.133:6892 | udp | |
| AM | 31.184.235.134:6892 | udp | |
| AM | 31.184.235.135:6892 | udp | |
| AM | 31.184.235.136:6892 | udp | |
| AM | 31.184.235.137:6892 | udp | |
| AM | 31.184.235.138:6892 | udp | |
| AM | 31.184.235.139:6892 | udp | |
| AM | 31.184.235.140:6892 | udp | |
| AM | 31.184.235.141:6892 | udp | |
| AM | 31.184.235.142:6892 | udp | |
| AM | 31.184.235.143:6892 | udp | |
| AM | 31.184.235.144:6892 | udp | |
| AM | 31.184.235.145:6892 | udp | |
| AM | 31.184.235.146:6892 | udp | |
| AM | 31.184.235.147:6892 | udp | |
| AM | 31.184.235.148:6892 | udp | |
| AM | 31.184.235.149:6892 | udp | |
| AM | 31.184.235.150:6892 | udp | |
| AM | 31.184.235.151:6892 | udp | |
| AM | 31.184.235.152:6892 | udp | |
| AM | 31.184.235.153:6892 | udp | |
| AM | 31.184.235.154:6892 | udp | |
| AM | 31.184.235.155:6892 | udp | |
| AM | 31.184.235.156:6892 | udp | |
| AM | 31.184.235.157:6892 | udp | |
| AM | 31.184.235.158:6892 | udp | |
| AM | 31.184.235.159:6892 | udp | |
| AM | 31.184.235.160:6892 | udp | |
| AM | 31.184.235.161:6892 | udp | |
| AM | 31.184.235.162:6892 | udp | |
| AM | 31.184.235.163:6892 | udp | |
| AM | 31.184.235.164:6892 | udp | |
| AM | 31.184.235.165:6892 | udp | |
| AM | 31.184.235.166:6892 | udp | |
| AM | 31.184.235.167:6892 | udp | |
| AM | 31.184.235.168:6892 | udp | |
| AM | 31.184.235.169:6892 | udp | |
| AM | 31.184.235.170:6892 | udp | |
| AM | 31.184.235.171:6892 | udp | |
| AM | 31.184.235.172:6892 | udp | |
| AM | 31.184.235.173:6892 | udp | |
| AM | 31.184.235.174:6892 | udp | |
| AM | 31.184.235.175:6892 | udp | |
| AM | 31.184.235.176:6892 | udp | |
| AM | 31.184.235.177:6892 | udp | |
| AM | 31.184.235.178:6892 | udp | |
| AM | 31.184.235.179:6892 | udp | |
| AM | 31.184.235.180:6892 | udp | |
| AM | 31.184.235.181:6892 | udp | |
| AM | 31.184.235.182:6892 | udp | |
| AM | 31.184.235.183:6892 | udp | |
| AM | 31.184.235.184:6892 | udp | |
| AM | 31.184.235.185:6892 | udp | |
| AM | 31.184.235.186:6892 | udp | |
| AM | 31.184.235.187:6892 | udp | |
| AM | 31.184.235.188:6892 | udp | |
| AM | 31.184.235.189:6892 | udp | |
| AM | 31.184.235.190:6892 | udp | |
| AM | 31.184.235.191:6892 | udp | |
| AM | 31.184.235.192:6892 | udp | |
| AM | 31.184.235.193:6892 | udp | |
| AM | 31.184.235.194:6892 | udp | |
| AM | 31.184.235.195:6892 | udp | |
| AM | 31.184.235.196:6892 | udp | |
| AM | 31.184.235.197:6892 | udp | |
| AM | 31.184.235.198:6892 | udp | |
| AM | 31.184.235.199:6892 | udp | |
| AM | 31.184.235.200:6892 | udp | |
| AM | 31.184.235.201:6892 | udp | |
| AM | 31.184.235.202:6892 | udp | |
| AM | 31.184.235.203:6892 | udp | |
| AM | 31.184.235.204:6892 | udp | |
| AM | 31.184.235.205:6892 | udp | |
| AM | 31.184.235.206:6892 | udp | |
| AM | 31.184.235.207:6892 | udp | |
| AM | 31.184.235.208:6892 | udp | |
| AM | 31.184.235.209:6892 | udp | |
| AM | 31.184.235.210:6892 | udp | |
| AM | 31.184.235.211:6892 | udp | |
| AM | 31.184.235.212:6892 | udp | |
| AM | 31.184.235.213:6892 | udp | |
| AM | 31.184.235.214:6892 | udp | |
| AM | 31.184.235.215:6892 | udp | |
| AM | 31.184.235.216:6892 | udp | |
| AM | 31.184.235.217:6892 | udp | |
| AM | 31.184.235.218:6892 | udp | |
| AM | 31.184.235.219:6892 | udp | |
| AM | 31.184.235.220:6892 | udp | |
| AM | 31.184.235.221:6892 | udp | |
| AM | 31.184.235.222:6892 | udp | |
| AM | 31.184.235.223:6892 | udp | |
| AM | 31.184.235.224:6892 | udp | |
| AM | 31.184.235.225:6892 | udp | |
| AM | 31.184.235.226:6892 | udp | |
| AM | 31.184.235.227:6892 | udp | |
| AM | 31.184.235.228:6892 | udp | |
| AM | 31.184.235.229:6892 | udp | |
| AM | 31.184.235.230:6892 | udp | |
| AM | 31.184.235.231:6892 | udp | |
| AM | 31.184.235.232:6892 | udp | |
| AM | 31.184.235.233:6892 | udp | |
| AM | 31.184.235.234:6892 | udp | |
| AM | 31.184.235.235:6892 | udp | |
| AM | 31.184.235.236:6892 | udp | |
| AM | 31.184.235.237:6892 | udp | |
| AM | 31.184.235.238:6892 | udp | |
| AM | 31.184.235.239:6892 | udp | |
| AM | 31.184.235.240:6892 | udp | |
| AM | 31.184.235.241:6892 | udp | |
| AM | 31.184.235.242:6892 | udp | |
| AM | 31.184.235.243:6892 | udp | |
| AM | 31.184.235.244:6892 | udp | |
| AM | 31.184.235.245:6892 | udp | |
| AM | 31.184.235.246:6892 | udp | |
| AM | 31.184.235.247:6892 | udp | |
| AM | 31.184.235.248:6892 | udp | |
| AM | 31.184.235.249:6892 | udp | |
| AM | 31.184.235.250:6892 | udp | |
| AM | 31.184.235.251:6892 | udp | |
| AM | 31.184.235.252:6892 | udp | |
| AM | 31.184.235.253:6892 | udp | |
| AM | 31.184.235.254:6892 | udp | |
| N/A | 224.0.0.251:5353 | udp | |
| AM | 31.184.235.255:6892 | udp | |
| US | 8.8.8.8:53 | btc.blockr.io | udp |
| US | 8.8.8.8:53 | api.blockcypher.com | udp |
| US | 172.67.17.223:80 | api.blockcypher.com | tcp |
| US | 8.8.8.8:53 | 223.17.67.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | chain.so | udp |
| US | 104.22.65.108:443 | chain.so | tcp |
| US | 8.8.8.8:53 | 108.65.22.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | pmenboeqhyrpvomq.wz139z.top | udp |
| US | 8.8.8.8:53 | pmenboeqhyrpvomq.wz139z.top | udp |
Files
C:\Users\Admin\AppData\Local\Temp\nsrBCAA.tmp\System.dll
| MD5 | 6f5257c0b8c0ef4d440f4f4fce85fb1b |
| SHA1 | b6ac111dfb0d1fc75ad09c56bde7830232395785 |
| SHA256 | b7ccb923387cc346731471b20fc3df1ead13ec8c2e3147353c71bb0bd59bc8b1 |
| SHA512 | a3cc27f1efb52fb8ecda54a7c36ada39cefeabb7b16f2112303ea463b0e1a4d745198d413eebb3551e012c84a20dcdf4359e511e51bc3f1a60b13f1e3bad1aa8 |
C:\Users\Admin\AppData\Local\Temp\SetCursor.dll
| MD5 | eca26c61607b5b8f511f73a2c820de3d |
| SHA1 | cfd03bc71cb462edb70a476c956ba8a9a9a44ea5 |
| SHA256 | ba57adfeaf6cbe5db7e19b428552900b083e3cbf19f0d1d30f5c35c9e01f51ea |
| SHA512 | b9a065b75e5f8d81de2c2bc3333ab775450c13b7ec16ed7f17c3963e969b35a4cd4a71533ba7058e2f3398136727a1cb90c1e76a3d489379299d9c89278567fc |
memory/4636-28-0x0000000000400000-0x000000000042B000-memory.dmp
memory/4636-30-0x0000000000400000-0x000000000042B000-memory.dmp
memory/4636-31-0x0000000000400000-0x000000000042B000-memory.dmp
memory/4636-32-0x0000000000400000-0x000000000042B000-memory.dmp
memory/4636-33-0x0000000000400000-0x000000000042B000-memory.dmp
C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mfpmp.exe
| MD5 | bf244a0d9ac81f0ca62e5b3ddfb7b72c |
| SHA1 | ecbdbcfab600d5cfc2a1ce67bd5a1819ae340a33 |
| SHA256 | 9abffaee18a87032e9db459d1309da167460acdd98dfc4c7fc4c3941f2cbbaf9 |
| SHA512 | d2f5d096b09446cb2c5ea99c33dad75b47e76cc5b0509c6d9d571d89b6f245ef86b3c63e4958d2766ef11f4483fb78af3cba49354912ed7c1f8a5497def44a53 |
memory/4636-41-0x0000000000400000-0x000000000042B000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\InulinWaistcloth.g
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Temp\405.htm
| MD5 | 1c7d2b2fddd34b82883053f74613a7f1 |
| SHA1 | 5ded4a3340c5baa2f7875a09234200662a5fb6c5 |
| SHA256 | f42aa8b08eac61b29a5cddc51819a28a692b69480948f7d003485c0dbddedd8b |
| SHA512 | 2d54662a2a3f852d88e27232a93e5807bfa84be55460f4d9c9d2082d22e7818a337d75edb3fcdbf2fd5e6e34721722df16ada243576ace9598701a51797f50db |
C:\Users\Admin\AppData\Local\Temp\Dawson
| MD5 | 0b8717be9826ff70ed75c74131f1a776 |
| SHA1 | 471eb762c3dafc031ac6a790c7e9201a4f644d60 |
| SHA256 | 0759787339284a189592ad2a6b8aea00b7c3cf37354ffea6bd9979348d14387b |
| SHA512 | 710ebe69e5fef8e57903b588ec453daf6507072f2b539e14c7eb284de96092b573cd2d9e4701ed4cf9773ad6bea77de5fa26cd402d74f54f0ce6733924e4f4f7 |
C:\Users\Admin\AppData\Local\Temp\color_mgmt.png
| MD5 | 4039f96ce68791185b4bd6c6836791ac |
| SHA1 | bce49bc0c17ba5c461e77f840b4f7c66f7203202 |
| SHA256 | b764c6ade27c74321310e38e47f72d79827ee2ce99d41f3f5b8e2711906f8a70 |
| SHA512 | 6f6feb92364ff863fa63750f0a0123934a0f7417aaf5a38485642b278b9ad2564520ca8ce4b62c6b794aa0f792dda95b0c99f9a793952ebd445f74d6714e1ec0 |
C:\Users\Admin\AppData\Local\Temp\alerts.xsd
| MD5 | 275c7bebd1f409bfaa98227f7787d3b3 |
| SHA1 | 73edaeb7a5de0b98b922414191d69ea6617edcac |
| SHA256 | 51e2e5877b9e355118cc27ad284db0bd6fce616a78e64e9d905cf836277376b7 |
| SHA512 | 3fcbfefa952b0f122fa6798f471805c13643a11fe060bcb8c22ec13ea7d0571717e0177073cdb3c4d43fc755cc476036b7bf0426f621515975c709a503d8433a |
C:\Users\Admin\AppData\Local\Temp\Piddle.azc
| MD5 | 3e45eef93b3cb1119e3510dc9b5719c8 |
| SHA1 | adf13f7d221ee3e0f6f443b01bcde4a10b54e33d |
| SHA256 | b68684a53123fa290b5ea29fbdc4eabb930a3f179a690554366d3ad63a3cdf8b |
| SHA512 | 7fe8d4fdd541333c8b6720e8d3902f59a181606d87bcb38c6ae79d3af3e8c92f227fc7f6078c897018921868ece16ba34b521904cfc75d7bdf83132a5f80b665 |
C:\Users\Admin\AppData\Local\Temp\GIF 32 Dithered.irs
| MD5 | ad7857a8abf9bde686b7507079b9bc75 |
| SHA1 | c9ad654502127f32cc9658d9b17b9b84a45c3e4a |
| SHA256 | 622ae0e9a6c1012b7aef688cf4b9a57a3659066e23081f67b2565ddd9d55e170 |
| SHA512 | 5ebf99464292a5a94d610ba04cdfcd53b4fa39b05715948e14a876cd58a83f42759ea0ccb6aa72f75459fcd9199aa988ab5793847b9d7cb4118b059ba8bb7f6e |
C:\Users\Admin\AppData\Local\Temp\16_9-frame-image-inset.png
| MD5 | d0b27d901155b40f518d158f5e491028 |
| SHA1 | 93a71de9454d0e94edad1bf7c3c7659c2cf99c45 |
| SHA256 | fef5272cc87850a7e422d6bc5be7986fec6aad06f57746a728d58b7de6dde0f7 |
| SHA512 | 7b4a732ff48df05c895e07245b1370f1dc530af45f592aa60224bb9c17bf0a7066449cfb2c8f0c93d00ee61f34e8da3663f7f60585846d795cb329015f4b4b72 |
C:\Users\Admin\AppData\Local\Temp\avalon-framework.NOTICE.TXT
| MD5 | 141edc03b0f0c08bf8847a4d20a2d140 |
| SHA1 | 8fb3d2fdebb7f5cf86e7d33b22b676f37a6a34eb |
| SHA256 | c19de564c3d24b412a55e8d39cc4aaf4b226ad1d87e41f1dd676e82e6ad2f56a |
| SHA512 | 15ddc9e4cc13121c3687494753ce2a3341bfd1c9263150c32620000ca2a1839529f9c497f75c41783e647e49229eb518b382b3ac229cc08c134395b06614d1cf |
C:\Users\Admin\AppData\Local\Temp\blue 286 bl 2.ADO
| MD5 | a4c0299e39c677afd7a7517d2980bf15 |
| SHA1 | 8748961f6bda83bec226430bf60589d6b2344211 |
| SHA256 | 5b2da553b3587b710311b4b6318464456cbb2cdfd1c8bd7a831b3bb36aa8ca23 |
| SHA512 | 1e0491cbb298f18b192e96d23fd629739ea48de85ee1b7ed3a7e96a3a645d1ca8471580b6bb0545f10d0edc845612d002920071870bf69a7c90ed9705f8f52d1 |
C:\Users\Admin\AppData\Local\Temp\chunkfast.xsl
| MD5 | 4b3b2473db1fd9f3f04044bb47d000ca |
| SHA1 | a52a3fd19e5a1b72f9285ce4d0451650507a5dea |
| SHA256 | d116d6e0ef1c1b5cb1512e2de16fb266e86960f636e4a608147d214fd2055a76 |
| SHA512 | 2e110bc9822145b8347fe656b8021d985840a9a44c7659e9524059c94f3617c444900c248a263940f11b32ff82d3efcaa9a400e64d34303055ed9db63aaf3b80 |
C:\Users\Admin\AppData\Local\Temp\getOpenDocumentIDs.jsx
| MD5 | a6b21e84cfffda8936b29e7c9a99be33 |
| SHA1 | 52c8d102768228cf95165ce94482efe077250693 |
| SHA256 | 16aebcb843ceb74d45a814c633c1f2fc2577bc8ab485da16d20700efca8b80b7 |
| SHA512 | f049f65179fd715123f193f18c201ee23b05589dc16f9c08d4d04b4deabde2b01fb63cb905e09ed3bae6ce17ef290b26d19b66fb3a724399f450b0ba8d2ca4af |
C:\Users\Admin\AppData\Local\Temp\Cambridge_Bay
| MD5 | 89de3d027493b9dbe3298a06fef9a89d |
| SHA1 | 3d8ac130c5dab1becabb0a17cae55c9aa42e50cd |
| SHA256 | 4d1380365eaceb6082c783f733af0ec9fd99e947c1c08c84fa6ff1d370b551ea |
| SHA512 | d7699a070cc465d5d960bd3d712fe72f68b24bd6e6bca6e67b5a17fa9581bb0cb02d10bfca2c32949ef86c3156c08e8bacdb33f1bcf4b5b188f149fc52870829 |
C:\Users\Admin\AppData\Local\Temp\4to3Squareframe_VideoInset.png
| MD5 | 1e75354ac7277ac7d729e9d934b3fdf9 |
| SHA1 | 05ec2efcebd31cff1c77d9896c94c11a4722ae32 |
| SHA256 | b6c74c438f6cff931161a5ab8b0757ed185ad6c02033deac6503c9381414cac6 |
| SHA512 | e6db1edd746250f9c12c63785c4139bcfa29ec4de4cf10e9532588584f4532b6a990f3304306dc888ec6a24f04b94c7f42f615d580bb08e9db395c7244bd065c |
memory/740-91-0x0000000000400000-0x000000000042B000-memory.dmp
memory/740-90-0x0000000000400000-0x000000000042B000-memory.dmp
memory/740-93-0x0000000003780000-0x0000000003781000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\mfpmp.lnk
| MD5 | d643761bea8094c5df36a455c62dbf8e |
| SHA1 | efd0caa0a405ee3f5e85b44e9dc5a4e747a2ef0e |
| SHA256 | 61ebd46982a911e786b1a4707dd1661cc9998d3ea97cb0ae28d0e0da90429e52 |
| SHA512 | cfe641aba5aa5e7418673a8d488a28657efc0136cb06f256e786f94eadd67ac5f8495e8aedb51a2eb4c854f1eee88a94fa2b90969bb28e03a8b026fdb6e62d9d |
memory/740-95-0x0000000000400000-0x000000000042B000-memory.dmp
memory/740-96-0x0000000000400000-0x000000000042B000-memory.dmp
memory/740-97-0x0000000000400000-0x000000000042B000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\InulinWaistcloth.g
| MD5 | 49b34ea2cbae50de619d8128e6fa3b2c |
| SHA1 | 35e02fa92a71c32153f9907b72ec9a38833f6cec |
| SHA256 | e6e3a86896d639a24240ef4ebd68228567e28b7f8c382d2680d698d2e2ffe3e6 |
| SHA512 | 2468f066f6356a8eaa790a31407eabb68e420b047d9153562c28386f13f3768ba767dcbd5b47c5dc9e25c6e8c3c800c84ecf56704a9a58243923535009c92122 |
C:\Users\Admin\AppData\Local\Temp\Christmas
| MD5 | 02bc5aaee85e8b96af646d479bb3307c |
| SHA1 | 1bf41be125fe8058d5999555add1ea2a83505e72 |
| SHA256 | e8d8d94f0a94768716701faa977a4d0d6ef93603de925078822f5c7a89cc8fca |
| SHA512 | e01d82ac33729e7ee14516f5d9ff753559f73143c7aa8a25ed4cc65b59dc364b1a020bc28427f8ec43fec8ef139cf30b09e492d77f15d7b09ae83240cdf8bc14 |
C:\Users\Admin\AppData\Local\Temp\Piddle.azc
| MD5 | 3a0a6e99fd25fdcb0b600d3e655e520a |
| SHA1 | 97e9ec2b8432c3aec0c5d56650a43c8a922c8766 |
| SHA256 | b10f5c24e9c066aef23df3b7cf5311cbb3cc5bcbd414ff40aace396a41422625 |
| SHA512 | f9918ce003301c87a954ed26e4c3b6848e5968f165022409b4922a6c8998f885e979d691cb7f165de569e583c20837497aa35638514fe6847798d1a5c29d2935 |
memory/872-146-0x0000000000400000-0x000000000042B000-memory.dmp
memory/872-147-0x0000000000400000-0x000000000042B000-memory.dmp
memory/740-150-0x0000000000400000-0x000000000042B000-memory.dmp
memory/740-153-0x0000000000400000-0x000000000042B000-memory.dmp
memory/740-152-0x0000000000400000-0x000000000042B000-memory.dmp
C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\# DECRYPT MY FILES #.txt
| MD5 | 309346dc3ada17d2915b9fdfd35a0552 |
| SHA1 | 08148c2320740cdf35aa456d914b3f2f7aeb4ff1 |
| SHA256 | 60e0726cb7de677b236d7bdfe7bc95842e5d5bc6f9c1a8ffef882d39828639bc |
| SHA512 | e9a1a5e901178e6940b17cd64ecc7390e3fbd3bb8fe7b22b1aa82a8d81c8552d4d63387bebe5808ea80ce305c1c0c70a041496178e6f2b96bb6324c0608bf749 |
C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\# DECRYPT MY FILES #.html
| MD5 | 2f47de0c0bcc7a202b6e40337c96de6d |
| SHA1 | b54cfbc0b7270c620b00f4a074bb0b3e6925c351 |
| SHA256 | 63caabbf47c317b0afe5afe95aaae21cb4ed803369c3d7a4efcfba62fe151376 |
| SHA512 | e7ab4d92fd640153cf0b4decf0d77ad81d6d837dd4eb42e1643624ebfe613eefe432f6111adc31ef73399831026b64569948549ed0d54f47c1b06f72db601bf7 |
C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\# DECRYPT MY FILES #.vbs
| MD5 | 1c2a24505278e661eca32666d4311ce5 |
| SHA1 | d1deb57023bbe38a33f0894b6a9a7bbffbfdeeee |
| SHA256 | 3f0dc6126cf33e7aa725df926a1b7d434eaf62a69f42e1b8ae4c110fd3572628 |
| SHA512 | ce866f2c4b96c6c7c090f4bf1708bfebdfcd58ce65a23bdc124a13402ef4941377c7e286e6156a28bd229e422685454052382f1f532545bc2edf07be4861b36c |
C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\# DECRYPT MY FILES #.url
| MD5 | 88396120323975cefb9c7cf3b0c41a73 |
| SHA1 | 5db96a201919a96c5ec99000300e7a80e4909bec |
| SHA256 | 9dbcac4ac3f03d1037de5b228b9aac52431664f2903805245f8a708c91f3c3d3 |
| SHA512 | a334d6af27cdc38ff8fc92c329090947f2f20abd160b004c04c4c1ee14c344d2ad831f3ea70e053ba8ee14eb06c545ae0364c1701bd9a51307739be03b39d475 |
memory/740-399-0x0000000000400000-0x000000000042B000-memory.dmp
memory/740-956-0x0000000000400000-0x000000000042B000-memory.dmp
memory/740-962-0x0000000000400000-0x000000000042B000-memory.dmp
memory/740-988-0x0000000000400000-0x000000000042B000-memory.dmp
memory/740-997-0x0000000000400000-0x000000000042B000-memory.dmp
memory/740-994-0x0000000000400000-0x000000000042B000-memory.dmp
memory/740-993-0x0000000000400000-0x000000000042B000-memory.dmp
memory/740-992-0x0000000000400000-0x000000000042B000-memory.dmp
memory/740-991-0x0000000000400000-0x000000000042B000-memory.dmp
memory/740-985-0x0000000000400000-0x000000000042B000-memory.dmp
memory/740-980-0x0000000000400000-0x000000000042B000-memory.dmp
memory/740-978-0x0000000000400000-0x000000000042B000-memory.dmp
memory/740-976-0x0000000000400000-0x000000000042B000-memory.dmp
memory/740-974-0x0000000000400000-0x000000000042B000-memory.dmp
memory/740-972-0x0000000000400000-0x000000000042B000-memory.dmp
memory/740-966-0x0000000000400000-0x000000000042B000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 61cef8e38cd95bf003f5fdd1dc37dae1 |
| SHA1 | 11f2f79ecb349344c143eea9a0fed41891a3467f |
| SHA256 | ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e |
| SHA512 | 6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 0a9dc42e4013fc47438e96d24beb8eff |
| SHA1 | 806ab26d7eae031a58484188a7eb1adab06457fc |
| SHA256 | 58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151 |
| SHA512 | 868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | ce376b5c6b7075f79bf4f79779796446 |
| SHA1 | 521f79995173e561104ad572726c2d4ff9098593 |
| SHA256 | e0128d1e0c4d945df31c089450ae47da660cf5193f565aced53c565b90f65e31 |
| SHA512 | 8b03ae23ccb5b30ee6951e9961ab408ffcb0e87f74f66de4b8e3601f9e4d08acba92296ef22848d35b99ceb081017a2b6d0d0ed16322df18ee72cd97c64cc36f |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 6752a1d65b201c13b62ea44016eb221f |
| SHA1 | 58ecf154d01a62233ed7fb494ace3c3d4ffce08b |
| SHA256 | 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd |
| SHA512 | 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389 |
memory/740-1056-0x0000000000400000-0x000000000042B000-memory.dmp
memory/740-1057-0x0000000000400000-0x000000000042B000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | 5ef27d1c8213ee76c9fa02a3e86c1f43 |
| SHA1 | c6e952337eea95c561c67eb584b103dcc9ab552c |
| SHA256 | 878e4397af426074bed0d2671bf344476d37d7bff05a200c500e55fe65978224 |
| SHA512 | e850849e40c29717bcb3a674a0bd7ef4ee624a4623308124bce49c55b6c4d52154aa8617bde1daaded5609158346f476b54964c8d3d300e8cc156971c14f7a08 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 3914dd88b94755d201797faf9f53521a |
| SHA1 | b3880a0758f8cffa2fe8b9ad36b2570f8691eaf4 |
| SHA256 | b0130f543822b795f06f7b0f7d27b42c9e290c7c0c80468de0972606d55dc2a2 |
| SHA512 | 58525b6343a900bff7a0360e74d1ad91232661e952591592ac905762fc5ac3f2e89efefdbaca287563ad741c82f77a0746b61968b28fd42bfb0fb4249945f0a3 |
Analysis: behavioral3
Detonation Overview
Submitted
2024-12-03 20:41
Reported
2024-12-03 20:44
Platform
win7-20240903-en
Max time kernel
117s
Max time network
118s
Command Line
Signatures
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Windows\SysWOW64\rundll32.exe |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\rundll32.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1744 -s 224
Network
Files
Analysis: behavioral5
Detonation Overview
Submitted
2024-12-03 20:41
Reported
2024-12-03 20:44
Platform
win7-20240729-en
Max time kernel
133s
Max time network
130s
Command Line
Signatures
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009de17be73c59cb4d89c094baaa5e3aef000000000200000000001066000000010000200000009f28e57b5180a74169644f882d8640166e59755cb1a992f0f17da55caddabb90000000000e80000000020000200000006ba309b1a73cb48279dd3d683a768487a3dfa673be04213b4a8aad72b0998a5a20000000285f4e41ce81bbc3aa3228155c2a4f903c9d62722e24e37c1d7e1361e53535674000000011226ede41941d94b487428f80bb6d76dc3d14169eb1abae8dad5a036663d4c71c2b1a25ceff01deb07b45c0d48326fa67071c70f195fdf8a614497b95723a57 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0C2D2F11-B1B7-11EF-B40C-C6FE053A976A} = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 003aa4e0c345db01 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "439420388" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009de17be73c59cb4d89c094baaa5e3aef0000000002000000000010660000000100002000000038ada67269c807d56969b08d07308725ce86bcdb66ee7f9929bade92ece0b5f2000000000e8000000002000020000000e77c6f3d5ff4928b8541da459f4d657f7be2138a5b45e49102296d951e6dc1f590000000d007a2f3d792ae97d743396ae64476dade84ed7e40c1b3d9e7d1bc814fbd186a0c0b1c0d36ea6322ca2be2c7de410c31b613ef9c2ef696047b10f778059b4baf6d5bba545cbae18cc56a031155b7a1d11e59617d47df81a7d41fc8f43a15a98059d7df859301eb2d88cc71fbbd7cc6fc3ad39328e6d959b4ec09e028c43cc6ef76eee5764fa3040a7e534c5b67f4b6d6400000009b90cef699cedafa421ea8bc577f3b6db34e5fb755e4473f940a3bd7db5f6748d395f1956d7917fcb4beb074e2ed8365592e6eaa0805c386304c2e22f0430964 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2772 wrote to memory of 2192 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2772 wrote to memory of 2192 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2772 wrote to memory of 2192 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2772 wrote to memory of 2192 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
Processes
C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\405.htm
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2772 CREDAT:275457 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\Cab1085.tmp
| MD5 | 49aebf8cbd62d92ac215b2923fb1b9f5 |
| SHA1 | 1723be06719828dda65ad804298d0431f6aff976 |
| SHA256 | b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f |
| SHA512 | bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b |
C:\Users\Admin\AppData\Local\Temp\Tar10F8.tmp
| MD5 | 4ea6026cf93ec6338144661bf1202cd1 |
| SHA1 | a1dec9044f750ad887935a01430bf49322fbdcb7 |
| SHA256 | 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8 |
| SHA512 | 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | a39c283486987474bace182415cc50df |
| SHA1 | b79cd55db66060ca934b5ae9945d0604ad888361 |
| SHA256 | 485106ecaad8a5458e7d54b7228bf26b71361a2e0511bd77799ed139cdabeab8 |
| SHA512 | 6f288fa143a4fd7f5dff328a7425c32731146539172749ed265fbe4d41b3f4cdf9f276ebe28d1099da5d76e71137b049f68b04b32783084e73636592df6b9368 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 8956b7a483d82d84429f0dc72900384e |
| SHA1 | a39f273f57e25811a43f1ea1cb34ce9872d9218b |
| SHA256 | 8b70955fc5ae26655015f6754c6c5e01d013f67de251e4cabaa6bbe06057754e |
| SHA512 | cdc12f3313ab6e349de4d2f0e2e78921c6723c319138ab2b5c1101d3a11104df58e505342111d12702ae65ea59ede389a8dad4df55a6415a1a9f00d130d51ced |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | bc85e10e7118aa8f5666d6be074fe65d |
| SHA1 | 7235a8fb46f54e58009b6278dc077b5282686a60 |
| SHA256 | d6f6367ea0552100be853450a1f972c5866976b003b07a993a02dd76be94d6e8 |
| SHA512 | 3423b8868474cc22f738faebd147f4893ca7867a5271dcea1182c9fe9ab226199da1d1cbd03091398482706a7691c9f141dc8ad6dda60fa4019a101fc5a4e4bd |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 5fcfdee44f056a85041a69181034f455 |
| SHA1 | 2d44d230b969761ef9b3eb4dc5dcad95ef2ed419 |
| SHA256 | 0f429df83e371172c3bc400fd05908295557b0b6911638b5c9736fbea3dca65e |
| SHA512 | a295dd4884e5247e6b49ec0e9f70b0ce6e46c5f18c7b08e1ba241de6a73e3234c7f9d3eb00b0c052f99aac198e2586681d744808eb96dac61de3909cb24cae15 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | c1ff60ef64fce9024de35a329a99c231 |
| SHA1 | c4c27e758f932caa908904f28b5e0834e9b26c5a |
| SHA256 | e14ed128129a894aa5388af3e0d577e7dc45da60b275192053997d91a6f55a3c |
| SHA512 | e76ef45ecff99af1301aee8abee02fe72e90aca6c7c4d62f9fc7112db25ba9bac5ad2fdedc5c52d5c2f0c0fc893b505ab5246c8b93cff82a5fbe6bf613443eee |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 0bbb7bc5e34f8db1da08f65b8684a664 |
| SHA1 | 67617d15f1b744186303bfc9f32a0bfc86e66ee3 |
| SHA256 | 562eb2a64f0f7ad6dff3cea1e72f900e943920bbd3cbfdba6a5d516d5e264d15 |
| SHA512 | 1df091cfe3a18736b45aa219239e1e8ef82a78a1a6c54890d48591737355c5d72394958783ecc0b278752333b1a9d7f9901a054875d61b0c9884b235845eb350 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | d02b982a78e49d679b815b58a958d1ef |
| SHA1 | c9bedcd60965dd4aa8e192b72c19b0d8b5bd3c66 |
| SHA256 | 0d2bf5ca529226341ae8b595d0ce1a4b9b9da8f0297003727ea150a23f1f1132 |
| SHA512 | ffecd0991c647c83cecfa7c455d49b14dea3a2a26420b8124d5f491ddf8881998d35dcdb3ae3c54f241634fbcbe7809ea8620ee426fe94fa6f8377ddaf5e1d93 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 091dc957d768b104abbab17696268998 |
| SHA1 | a55d63dfc46125e0b745b8adc74ec846540be494 |
| SHA256 | 40155390242fad7deaddb4ecfd74a1f42ea76d7acb98157eb96b98bcb1337cb1 |
| SHA512 | 0cf18909e93512dd7e8b4edc435f8be139142ed28cd3b6a04d2408ef1a562830c1cda9e45ff1abdd928051fbbf49899cc1f9faa0e71b36a71f115d3c382d1218 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | e2841a86036b3919d1284f4b5969c8f1 |
| SHA1 | b19d48e24a57a1c96f0075ec3f38d680713db386 |
| SHA256 | 520b577e6ab1abfcbf36dda89a2401cb20e0c88db80fb6937c90df814ed06890 |
| SHA512 | 8207cfa4371b20d2fd017ca9ec9aa1e45c674f7ed57f7624b06a2d2eff12e39e86043be1cac62bdbcb6ed5fd1294e19e9dda1ae2c4b74d06486bc9946f7514bc |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | c94a51fa8b0bfeefe70d43216c9017b4 |
| SHA1 | adbbb6d8c4db023a410aa32111681135c26a70b4 |
| SHA256 | fb0fab2bd5752ccb23de4bc14aad332b19890c3a56213f9c2ef17a0438f62b05 |
| SHA512 | 48c57d61eb971d93a5e44157bb06a3976fddbec77eea348bbd260b3931a1e99dee18cdab43518be7c55d1297e9ec3d0d3147edd0388b965a110d31aaaf5c1701 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 5c02d60c0abbf6cb5695cd43aab3772d |
| SHA1 | bf7c18d199def96605ec1463036cb850f52ac2eb |
| SHA256 | cdfcc953c20d6b35cbbb934b8c9ed69777e3c677ad8980929a22099dbe187e2e |
| SHA512 | 3d768cb247ec47d78242501da3886d953b7a5585c9392ba3a1e1ee616247f2758e3f15eeab22720ee74c14e66746c2d531d8f9422b6ad971d01a84c2b966a816 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 6caf2779f2392cf759b163a1d91b093e |
| SHA1 | 71d1c0bb6617a25986775fbe503dd50dd8a586d1 |
| SHA256 | 06caf6edcc5494eaec72bd3dcc2f690b219aafe34c17a2375628e263b51d7ffe |
| SHA512 | 4a74c92c36f374d45305c012cd5d38d538aa77936b9a95c28831e17ea8964bd5574d24d505c2a8a3fde15d7f869a955521705ead46003469325eefdf792e3ffb |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | ed23896df539179b76d34d3e023f4b22 |
| SHA1 | 1cbda0fc92e3aafc881f413c19a2e67d998a61e3 |
| SHA256 | b7733010971088bc3070bc0c29e0791bc285ae0aa0bdf5dbfef9d254335db067 |
| SHA512 | 245aa0678efdbe88f455d121f4c87554db0c25c50d7bf8b384923d4dbb611fe452276edc5299b92912b7a42f5c8640bd78f62d9890461f16ccb9bc669863b5f8 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 5f824473410370ce57646e33b96553bb |
| SHA1 | 6270d1ec395dfd4fac2110ea0f1122a42afe5dab |
| SHA256 | 096e68bc5314045f26643f61b8bd22adf9a6c192ce93c99c88511aa7ab0bd846 |
| SHA512 | 3169dfa579f119e930fa588c1f95315696e696200d50e103f5114256167d6312d95538c31a8ba0555be1936415fe52d18f4ea7d9dc3a347cfa3de20c142bb4e5 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | ae6c26406e97f9126c55194a6e792256 |
| SHA1 | 59e664b8a30e2cd870e74bd6679b857e6357ec64 |
| SHA256 | d07b2bb468d30afd526b964553078509bb315c5fc3a1b479a8dce767d83269a7 |
| SHA512 | 521d926d7df75b5d0cb3539e4b42bf303135c951fa4307408ddb068380a6e5aa74ea0154aaf82b8408747007128e64658ffe3c9da6d50b59ab9a13073c5d5d4f |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | f2d6697edcc1d67c1a1b359ffa19e239 |
| SHA1 | 402a9f591f189d2a02276fb3233f345c876ad963 |
| SHA256 | fa28fc175d991549402747aaa99edffced795b5cc51bb5ebea36a14c406d1c55 |
| SHA512 | 10b02994159c10268baf979c2d17fe1e37494689a2fa5cc7bd31574e54da45435d17272c6fdbd0d92ed41821698d618fe4c8683ea36369c01bf329df001c7dda |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 087b4ef2775fc14b90f521f541322d1b |
| SHA1 | 15e2600e79ad321cd23e24f1e41bec42baebd634 |
| SHA256 | 0cbfab3160b86fefde848cbeaf087364769b7bbc5d0f5f03f1f68b4d8e3e5a04 |
| SHA512 | e66eafe934962a4ef875869a1156551b114fa5462394d21b6ec661a21e4b37a27e3b9e6a044dcb21df763e112db5616dc32f1124586c3741c7ebbdec9085c979 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 75e64a43ad93b7ccca1f5bfe1a5032f5 |
| SHA1 | 3d74f8f7d81d3734b21367de3bf431ca89014c94 |
| SHA256 | 446883ae8df10607525962bdb53390732107d45f2ac2b1ca072eea6cc00f4e3c |
| SHA512 | 4b94133998e50bb4154a5d71ffbcd096d0766bd15670654225e60d7ec4d245c93eae407e196bcd33a8ce3b87944ea392139b74a8679be4ab142d94b7a59b42a3 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 89e4c766eb8ca4b352487631bd2fa7ad |
| SHA1 | 7234286c0271699ef69bc2f32854dcfcabe65e05 |
| SHA256 | bf86a5bd20fef0f0122d1f16ccf591ad641372edfce5916adb8ce5c62c7ca781 |
| SHA512 | 6167d62a64a24f1defa9c2162a358ef0c641bacb3aeac846a147944b9139fd8b99011eb86da77cc2debfc873bc932494af8502252ce2d354cf5aee764432276f |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 1721c8803f281b6ab0785bc059c32c49 |
| SHA1 | f453f351d010cb15411847bd9e974c066a2b2c4b |
| SHA256 | c112b0c43e659aeb7844e704b093b6c76d17dc9832d1f012734d971228e38546 |
| SHA512 | d6353045d96b7d63483605df51b186262c08c6cc05c8281aaed16ca23ac3c7d39de6a5ce58dcd495a48bb237a42ad4dd467f8e7384d439db981784c2d2f3b1c2 |
Analysis: behavioral7
Detonation Overview
Submitted
2024-12-03 20:41
Reported
2024-12-03 20:44
Platform
win7-20240903-en
Max time kernel
122s
Max time network
123s
Command Line
Signatures
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\rundll32.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 3052 wrote to memory of 2436 | N/A | C:\Windows\system32\rundll32.exe | C:\Windows\SysWOW64\rundll32.exe |
| PID 3052 wrote to memory of 2436 | N/A | C:\Windows\system32\rundll32.exe | C:\Windows\SysWOW64\rundll32.exe |
| PID 3052 wrote to memory of 2436 | N/A | C:\Windows\system32\rundll32.exe | C:\Windows\SysWOW64\rundll32.exe |
| PID 3052 wrote to memory of 2436 | N/A | C:\Windows\system32\rundll32.exe | C:\Windows\SysWOW64\rundll32.exe |
| PID 3052 wrote to memory of 2436 | N/A | C:\Windows\system32\rundll32.exe | C:\Windows\SysWOW64\rundll32.exe |
| PID 3052 wrote to memory of 2436 | N/A | C:\Windows\system32\rundll32.exe | C:\Windows\SysWOW64\rundll32.exe |
| PID 3052 wrote to memory of 2436 | N/A | C:\Windows\system32\rundll32.exe | C:\Windows\SysWOW64\rundll32.exe |
Processes
C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SetCursor.dll,#1
C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SetCursor.dll,#1
Network
Files
Analysis: behavioral10
Detonation Overview
Submitted
2024-12-03 20:41
Reported
2024-12-03 20:44
Platform
win10v2004-20241007-en
Max time kernel
96s
Max time network
140s
Command Line
Signatures
Command and Scripting Interpreter: JavaScript
Processes
C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\getOpenDocumentIDs.js
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 228.249.119.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 83.210.23.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 154.239.44.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.86.106.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 200.163.202.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 105.209.201.84.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 22.236.111.52.in-addr.arpa | udp |