WannaCry Ransomware | Grouped Behavior
Try VMRay Analyzer
| Host | Resolved to | Country | City | Protocol |
|---|---|---|---|---|
| www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com | 144.217.74.156 | CA | Beauharnois | HTTP |
| 146.130.110.7 | US | Houston | TCP | |
| 192.168.0.1 | TCP | |||
| 192.168.0.2 | TCP | |||
| 192.168.0.3 | TCP | |||
| 192.168.0.4 | TCP | |||
| 192.168.0.5 | TCP | |||
| 192.168.0.6 | TCP | |||
| 192.168.0.7 | TCP | |||
| 7ZA1P8WI | 192.168.0.8 | TCP | ||
| 204.119.118.82 | US | Mountain View | TCP | |
| 192.168.0.9 | TCP | |||
| 192.168.0.10 | TCP | |||
| 192.168.0.11 | TCP | |||
| 192.168.0.12 | TCP | |||
| 192.168.0.13 | TCP | |||
| 192.168.0.14 | TCP | |||
| 192.168.0.15 | TCP | |||
| 192.168.0.16 | TCP | |||
| 40.19.113.192 | US | TCP | ||
| 192.168.0.17 | TCP | |||
| 192.168.0.18 | TCP | |||
| 192.168.0.19 | TCP | |||
| 105.51.66.128 | KE | TCP | ||
| 192.168.0.20 | TCP | |||
| 192.168.0.21 | TCP | |||
| 192.168.0.22 | TCP | |||
| 192.168.0.23 | TCP | |||
| 192.168.0.24 | TCP | |||
| 192.168.0.25 | TCP | |||
| 192.168.0.26 | TCP | |||
| 2.191.28.127 | IR | TCP | ||
| 192.168.0.27 | TCP | |||
| 192.168.0.28 | TCP | |||
| 199.62.59.123 | US | Morristown | TCP | |
| 192.168.0.29 | TCP | |||
| 192.168.0.30 | TCP | |||
| 192.168.0.31 | TCP | |||
| 192.168.0.32 | TCP | |||
| 192.168.0.33 | TCP | |||
| 192.168.0.34 | TCP | |||
| 44.42.12.128 | US | San Diego | TCP | |
| 192.168.0.35 | TCP | |||
| 192.168.0.36 | TCP | |||
| 71.153.41.191 | US | TCP | ||
| 192.168.0.37 | TCP | |||
| 192.168.0.38 | TCP | |||
| abts-tn-dynamic-062.206.174.122.airtelbroadband.in | 122.174.206.62 | IN | Cochin | TCP |
| 192.168.0.39 | TCP | |||
| 192.168.0.40 | TCP | |||
| 192.168.0.41 | TCP | |||
| 192.168.0.42 | TCP | |||
| 192.168.0.43 | TCP | |||
| 192.168.0.44 | TCP | |||
| 198.135.192.252 | CA | London | TCP | |
| 192.168.0.45 | TCP | |||
| 116.176.179.62 | CN | Chaoyang | TCP | |
| 192.168.0.46 | TCP | |||
| 192.168.0.47 | TCP | |||
| 131.119.87.192 | US | TCP | ||
| 192.168.0.48 | TCP | |||
| 192.168.0.49 | TCP | |||
| 192.168.0.50 | TCP | |||
| 192.168.0.51 | TCP | |||
| 192.168.0.52 | TCP | |||
| 192.168.0.53 | TCP | |||
| 113.2.101.59 | CN | Harbin | TCP | |
| 192.168.0.54 | TCP | |||
| 57.229.251.173 | BE | TCP | ||
| 192.168.0.55 | TCP | |||
| 192.168.0.56 | TCP | |||
| 140.37.202.244 | US | TCP | ||
| 192.168.0.57 | TCP | |||
| 192.168.0.58 | TCP | |||
| ec2-54-229-131-27.eu-west-1.compute.amazonaws.com | 54.229.131.27 | IE | Dublin | TCP |
| 192.168.0.59 | TCP | |||
| 192.168.0.60 | TCP | |||
| 192.168.0.61 | TCP | |||
| 192.168.0.62 | TCP | |||
| 192.168.0.63 | TCP | |||
| 190-120-214-195.accesshaiti.net | 190.120.214.195 | HT | TCP | |
| 192.168.0.64 | TCP | |||
| 192.168.0.65 | TCP | |||
| 128.238.53.91 | US | Brooklyn | TCP | |
| 192.168.0.66 | TCP | |||
| 118.199.10.12 | CN | Beijing | TCP | |
| 192.168.0.67 | TCP | |||
| 192.168.0.68 | TCP | |||
| client-186-9-249-194.imovil.entelpcs.cl | 186.9.249.194 | CL | Santiago | TCP |
| 192.168.0.69 | TCP | |||
| 192.168.0.70 | TCP | |||
| 192.168.0.71 | TCP | |||
| 4.64.202.39 | US | TCP | ||
| 192.168.0.72 | TCP | |||
| 192.168.0.73 | TCP | |||
| 106.105.96.163.adsl.dynamic.seed.net.tw | 106.105.96.163 | TW | Taipei | TCP |
| 192.168.0.74 | TCP | |||
| 192.168.0.75 | TCP | |||
| 145.10.159.164 | NL | Utrecht | TCP | |
| 192.168.0.76 | TCP | |||
| 192.168.0.77 | TCP | |||
| 62.97.21.155 | IT | Milan | TCP | |
| 192.168.0.78 | TCP | |||
| 192.168.0.79 | TCP | |||
| 192.168.0.80 | TCP | |||
| modemcable088.107-81-70.mc.videotron.ca | 70.81.107.88 | CA | Montral | TCP |
| 192.168.0.81 | TCP | |||
| 192.168.0.82 | TCP | |||
| 141.176.177.124 | NL | Rotterdam | TCP | |
| 192.168.0.83 | TCP | |||
| 53.14.167.30 | DE | TCP | ||
| 192.168.0.84 | TCP | |||
| 192.168.0.85 | TCP | |||
| 192.168.0.86 | TCP | |||
| 192.168.0.87 | TCP | |||
| 160.137.128.203 | US | TCP | ||
| 192.168.0.88 | TCP | |||
| 192.168.0.89 | TCP | |||
| 47.102.157.48 | CN | Hangzhou | TCP | |
| 192.168.0.90 | TCP | |||
| 192.168.0.91 | TCP | |||
| 215.134.212.196 | US | TCP | ||
| 103.33.142.60 | CN | Qingdao | TCP | |
| 192.168.0.92 | TCP | |||
| 192.168.0.93 | TCP | |||
| 107-215-250-20.lightspeed.sntcca.sbcglobal.net | 107.215.250.20 | US | San Jose | TCP |
| 192.168.0.94 | TCP | |||
| 192.168.0.95 | TCP | |||
| 50.124.26.85 | US | Hartford | TCP | |
| 192.168.0.96 | TCP | |||
| 192.168.0.97 | TCP | |||
| 206.216.244.158 | US | TCP | ||
| 192.168.0.98 | TCP | |||
| 192.168.0.99 | TCP | |||
| 65.155.65.85 | US | TCP | ||
| 192.168.0.100 | TCP | |||
| 192.168.0.101 | TCP | |||
| nothing.attdns.com | 135.67.192.70 | US | TCP | |
| 192.168.0.102 | TCP | |||
| 34.55.249.26 | US | TCP | ||
| 192.168.0.103 | TCP | |||
| 192.168.0.104 | TCP | |||
| cm-114-109-12-194.revip13.asianet.co.th | 114.109.12.194 | TH | Bangkok | TCP |
| 85.198.18.72 | IR | TCP | ||
| 192.168.0.105 | TCP | |||
| 192.168.0.106 | TCP | |||
| 192.168.0.107 | TCP | |||
| 7.11.219.156 | US | TCP | ||
| 59x158x214x129.ap59.ftth.ucom.ne.jp | 59.158.214.129 | JP | Tokyo | TCP |
| 192.168.0.108 | TCP | |||
| 192.168.0.109 | TCP | |||
| 162.86.231.64 | CH | TCP | ||
| 218.78.188.0 | CN | Shanghai | TCP | |
| 192.168.0.110 | TCP | |||
| 67.203.80.79.rev.sfr.net | 79.80.203.67 | FR | Versailles | TCP |
| 192.168.0.111 | TCP | |||
| 192.168.0.112 | TCP | |||
| 192.168.0.113 | TCP | |||
| n003-000-000-000.static.ge.com | 3.138.72.155 | US | TCP | |
| 192.168.0.114 | TCP | |||
| 192.168.0.115 | TCP | |||
| 192.168.0.116 | TCP | |||
| 192.168.0.117 | TCP | |||
| 192.168.0.118 | TCP | |||
| lgb-static-216.70.133.34.mpowercom.net | 216.70.133.34 | US | TCP | |
| 192.168.0.119 | TCP | |||
| 1.14.218.68 | CN | Beijing | TCP | |
| 167.200.162.155 | US | Atlanta | TCP | |
| 192.168.0.120 | TCP | |||
| 179-90-112-232.user.vivozap.com.br | 179.90.112.232 | BR | TCP | |
| 69.46.75.131 | US | San Jose | TCP | |
| 192.168.0.121 | TCP | |||
| 47.170.65.192 | US | TCP | ||
| 217.183.240.212 | GB | TCP | ||
| 192.168.0.122 | TCP | |||
| dsl-201-100-226-146-sta.prod-empresarial.com.mx | 201.100.226.146 | MX | TCP | |
| 75-148-1-240-WashingtonDC.hfc.comcastbusiness.net | 75.148.1.240 | US | Baltimore | TCP |
| 209.58.70.37 | US | Wanaque | TCP | |
| dslb-084-058-127-241.084.058.pools.vodafone-ip.de | 84.58.127.241 | DE | Bad Kreuznach | TCP |
| 28.230.234.162 | US | TCP | ||
| 192-227-166-46-host.colocrossing.com | 192.227.166.46 | US | Buffalo | TCP |
| 192.168.0.123 | TCP | |||
| 149-169-200-246.nat.asu.edu | 149.169.200.246 | US | Tempe | TCP |
| 192.168.0.124 | TCP | |||
| 192.168.0.125 | TCP | |||
| 178.236.120.238.comenersol.com | 178.236.120.238 | ES | Aspe | TCP |
| 192.168.0.126 | TCP | |||
| 192.168.0.127 | TCP | |||
| 192.168.0.128 | TCP | |||
| 151.233.43.215 | IR | TCP | ||
| 57.235.150.91 | BE | TCP | ||
| 146.30.81.140 | US | San Ramon | TCP | |
| 215.125.23.8 | US | TCP | ||
| 71-83-251-196.dhcp.knwc.wa.charter.com | 71.83.251.196 | US | Sutherlin | TCP |
| 223.172.126.107 | KR | Seoul | TCP | |
| 60.51.17.86 | MY | Ipoh | TCP | |
| 210.46.247.168 | CN | Suihua | TCP | |
| 192.168.0.129 | TCP | |||
| 192.168.0.130 | TCP | |||
| 192.168.0.131 | TCP | |||
| 192.168.0.132 | TCP | |||
| 192.168.0.133 | TCP | |||
| 192.168.0.134 | TCP | |||
| 192.168.0.135 | TCP | |||
| 192.168.0.136 | TCP | |||
| c-50-179-36-23.hsd1.il.comcast.net | 50.179.36.23 | US | Warrenville | TCP |
| 192.168.0.137 | TCP | |||
| 162.122.201.85 | VE | Caracas | TCP | |
| 209.213.120.6 | 209.213.120.6 | US | Atlanta | TCP |
| 70.102.154.142 | US | Kirkland | TCP | |
| 133.66.205.80 | JP | TCP | ||
| 159.60.126.127 | NL | Den Haag | TCP | |
| 222.72.227.91 | CN | Shanghai | TCP | |
| 134.157.165.105 | FR | Paris | TCP | |
| 192.168.0.138 | TCP | |||
| 157.254.51.122 | US | Burbank | TCP | |
| 192.168.0.139 | TCP | |||
| 192.168.0.140 | TCP | |||
| 192.168.0.141 | TCP | |||
| 192.168.0.142 | TCP | |||
| 192.168.0.143 | TCP | |||
| 192.168.0.144 | TCP | |||
| 163.251.154.153 | US | Virginia Beach | TCP | |
| 192.168.0.145 | TCP | |||
| 192.168.0.146 | TCP | |||
| 44.21.37.226 | US | San Diego | TCP | |
| 71-209-9-53.bois.qwest.net | 71.209.9.53 | US | Boise | TCP |
| static-176-159-242-90.ftth.abo.bbox.fr | 176.159.242.90 | FR | TCP | |
| 117.116.167.78 | CN | Beijing | TCP | |
| 132.132.113.205 | US | Fort Huachuca | TCP | |
| 191-25-68-57.user.vivozap.com.br | 191.25.68.57 | BR | Rio De Janeiro | TCP |
| dialup-4.172.171.148.Dial1.NewYork1.Level3.net | 4.172.171.148 | US | TCP | |
| 192.168.0.147 | TCP | |||
| 66.180.32.141 | US | Plano | TCP | |
| 192.168.0.148 | TCP | |||
| 192.168.0.149 | TCP | |||
| 192.168.0.150 | TCP | |||
| 192.168.0.151 | TCP | |||
| 207.228.159.127 | BM | Hamilton | TCP | |
| 192.168.0.152 | TCP | |||
| 192.168.0.153 | TCP | |||
| 192.168.0.154 | TCP | |||
| 192.168.0.155 | TCP | |||
| 17.214.248.5 | US | Sunnyvale | TCP | |
| 192.168.0.156 | TCP | |||
| 192.168.0.157 | TCP | |||
| 129.243.50.250 | US | Denver | TCP | |
| 215.6.76.252 | US | TCP | ||
| softbank220007148019.bbtec.net | 220.7.148.19 | JP | TCP | |
| 8.193.244.20 | US | TCP | ||
| 179-91-243-195.user.vivozap.com.br | 179.91.243.195 | BR | TCP | |
| 192.168.0.158 | TCP | |||
| 28.155.208.69 | US | TCP | ||
| 138.107.63.208 | JP | TCP | ||
| 197.246.85.132 | EG | TCP | ||
| 192.168.0.159 | TCP | |||
| 192.168.0.160 | TCP | |||
| 192.168.0.161 | TCP | |||
| 192.168.0.162 | TCP | |||
| 192.168.0.163 | TCP | |||
| 202-132-45-94.adsl.ttn.net | 202.132.45.94 | TW | Taipei | TCP |
| 192.168.0.164 | TCP | |||
| 192.168.0.165 | TCP | |||
| xd93094d9.dyn.telefonica.de | 217.48.148.217 | DE | TCP | |
| 192.168.0.166 | TCP | |||
| 192.168.0.167 | TCP | |||
| 192.168.0.168 | TCP | |||
| 155.79.2.36 | US | Fort Huachuca | TCP | |
| 215.164.163.38 | US | TCP | ||
| 142.180.85.13 | CA | TCP | ||
| 110.221.174.22 | CN | Beijing | TCP | |
| 65.57.3.3 | US | TCP | ||
| 192.168.0.169 | TCP | |||
| 154.168.94.161 | TCP | |||
| 38.189.128.195 | US | TCP | ||
| 7.23.170.253 | US | TCP | ||
| 192.168.0.170 | TCP | |||
| 192.168.0.171 | TCP | |||
| 99-102-22-14.lightspeed.brhmal.sbcglobal.net | 99.102.22.14 | US | Birmingham | TCP |
| 192.168.0.172 | TCP | |||
| 192.168.0.173 | TCP | |||
| dsl-197-245-138-127.voxdsl.co.za | 197.245.138.127 | ZA | Welkom | TCP |
| 192.168.0.174 | TCP | |||
| 192.168.0.175 | TCP | |||
| 97-90-159-3.static.mtpk.ca.charter.com | 97.90.159.3 | US | Long Beach | TCP |
| 192.168.0.176 | TCP | |||
| 192.168.0.177 | TCP | |||
| 62-181-179-47.static.ip.netia.com.pl | 62.181.179.47 | PL | TCP | |
| 49.161.16.37 | KR | Seoul | TCP | |
| 89.40.170.8 | RO | TCP | ||
| ec2-52-1-189-42.compute-1.amazonaws.com | 52.1.189.42 | US | Ashburn | TCP |
| 46.210.86.182 | IL | Haifa | TCP | |
| 203.31.250.98 | AU | Perth | TCP | |
| 192.168.0.178 | TCP | |||
| cpe-66-108-122-49.nyc.res.rr.com | 66.108.122.49 | US | Howard Beach | TCP |
| 192.168.0.179 | TCP | |||
| 60.184.115.43 | CN | Lishui | TCP | |
| 192.168.0.180 | TCP | |||
| 192.168.0.181 | TCP | |||
| 192.168.0.182 | TCP | |||
| softbank219014112192.bbtec.net | 219.14.112.192 | JP | TCP | |
| 192.168.0.183 | TCP | |||
| 192.168.0.184 | TCP | |||
| 19.53.214.216 | US | Dearborn | TCP | |
| 192.168.0.185 | TCP | |||
| 155.203.121.135 | US | Elgin | TCP | |
| 192.168.0.186 | TCP | |||
| 192.168.0.187 | TCP | |||
| 192.168.0.188 | TCP | |||
| 139.157.1.116 | FI | TCP | ||
| 207-250-113-79.static.twtelecom.net | 207.250.113.79 | US | Fairborn | TCP |
| 249.247-56-198.rdns.scalabledns.com | 198.56.247.249 | US | Los Angeles | TCP |
| 128.51.237.134 | US | TCP | ||
| 180.170.209.48 | CN | Shanghai | TCP | |
| 120.134.112.234 | CN | Beijing | TCP | |
| 192.168.0.189 | TCP | |||
| 27.147.138.253 | BD | TCP | ||
| 192.168.0.190 | TCP | |||
| 192.168.0.191 | TCP | |||
| 65.107.234.73.ptr.us.xo.net | 65.107.234.73 | US | Nolensville | TCP |
| 220.174.98.197 | CN | TCP | ||
| 192.168.0.192 | TCP | |||
| 67.138.199.213 | US | TCP | ||
| 192.168.0.193 | TCP | |||
| 192.168.0.194 | TCP | |||
| 192.168.0.195 | TCP | |||
| host86-189-31-14.range86-189.btcentralplus.com | 86.189.31.14 | GB | TCP | |
| 192.168.0.196 | TCP | |||
| 169.167.150.201 | US | Reston | TCP | |
| 192.168.0.197 | TCP | |||
| 123.181.32.231 | CN | Hebei | TCP | |
| dra38-8-78-244-7-140.fbx.proxad.net | 78.244.7.140 | FR | Grenoble | TCP |
| c-73-144-56-21.hsd1.mi.comcast.net | 73.144.56.21 | US | Detroit | TCP |
| 192.168.0.198 | TCP | |||
| 11.142.5.131 | US | TCP | ||
| 26.21.104.186 | US | TCP | ||
| 34.12.235.192 | US | TCP | ||
| 80.237.118.154 | RU | Alexandrov | TCP | |
| 1r6pFh | 192.168.0.199 | TCP | ||
| 192.168.0.200 | TCP | |||
| 158.34.190.5 | US | Irving | TCP | |
| 147.212.9.244 | TCP | |||
| 192.168.0.201 | TCP | |||
| 192.168.0.202 | TCP | |||
| 192.168.0.203 | TCP | |||
| 199.207.5.140 | US | Montvale | TCP | |
| 192.168.0.204 | TCP | |||
| 192.168.0.205 | TCP | |||
| 148.133.182.215 | US | Savannah | TCP | |
| 192.168.0.206 | TCP | |||
| 192.168.0.207 | TCP | |||
| 36-224-94-83.dynamic-ip.hinet.net | 36.224.94.83 | TW | Taipei | TCP |
| 192.168.0.208 | TCP | |||
| 192.168.0.209 | TCP | |||
| CPE-60-224-164-87.vic.bigpond.net.au | 60.224.164.87 | AU | Claremont | TCP |
| 133.243.14.247 | JP | Yokosuka | TCP | |
| AGrenoble-652-1-390-66.w82-122.abo.wanadoo.fr | 82.122.65.66 | FR | Huez | TCP |
| 32.146.57.106 | US | TCP | ||
| 133.234.73.101 | JP | TCP | ||
| 113.18.12.186 | CN | Fuzhou | TCP | |
| 69.152.31.75 | US | TCP | ||
| host173-72-static.110-62-b.business.telecomitalia.it | 62.110.72.173 | IT | TCP | |
| 49.114.43.176 | CN | rmqi | TCP | |
| 192.168.0.210 | TCP | |||
| 67.145.58.6 | US | TCP | ||
| 192.168.0.211 | TCP | |||
| 71-87-25-137.static.eucl.wi.charter.com | 71.87.25.137 | US | TCP | |
| 192.168.0.212 | TCP | |||
| 192.168.0.213 | TCP | |||
| 7.193.81.172 | US | TCP | ||
| 192.168.0.214 | TCP | |||
| 192.168.0.215 | TCP | |||
| 53.101.103.243 | DE | TCP | ||
| 192.168.0.216 | TCP | |||
| 9.125.170.99 | US | Durham | TCP | |
| static.vnpt.vn | 14.180.66.240 | VN | Hanoi | TCP |
| 198.135.222.232 | US | Longview | TCP | |
| 192.168.0.217 | TCP | |||
| dialup-4.197.110.175.Dial1.Detroit1.Level3.net | 4.197.110.175 | US | TCP | |
| 198.107.218.177.isp.timbrasil.com.br | 177.218.107.198 | BR | TCP | |
| 149.194.188.85 | GB | Sunbury | TCP | |
| 192.168.0.218 | TCP | |||
| 35.86.109.210 | US | Ann Arbor | TCP | |
| 192.168.0.219 | TCP | |||
| 209.110.55.155 | US | TCP | ||
| 192.168.0.220 | TCP | |||
| 102.82.183.107 | TCP | |||
| 192.168.0.221 | TCP | |||
| 192.168.0.222 | TCP | |||
| 192.168.0.223 | TCP | |||
| 192.168.0.224 | TCP | |||
| 163.212.71.209 | JP | Yokohama | TCP | |
| 192.168.0.225 | TCP | |||
| KD106134165252.au-net.ne.jp | 106.134.165.252 | JP | TCP | |
| host-92-18-112-23.as13285.net | 92.18.112.23 | GB | Kettering | TCP |
| 192.168.0.226 | TCP | |||
| 192.168.0.227 | TCP | |||
| 135.124.54.45.rdns.hostvirtual.com | 45.54.124.135 | US | West Hollywood | TCP |
| 150.210.64.35 | US | New York | TCP | |
| i59F75E88.versanet.de | 89.247.94.136 | DE | Berlin | TCP |
| 39.34.151.167 | PK | Lahore | TCP | |
| 152.127.127.139 | US | TCP | ||
| 146.183.1.217 | US | Portland | TCP | |
| 10.229.216.146 | TCP | |||
| ec2-52-45-77-9.compute-1.amazonaws.com | 52.45.77.9 | US | Ashburn | TCP |
| ec2-54-246-188-157.eu-west-1.compute.amazonaws.com | 54.246.188.157 | IE | Dublin | TCP |
| 192.168.0.228 | TCP | |||
| 4.69.248.174 | US | TCP | ||
| 192.168.0.229 | TCP | |||
| 147.112.76.174 | NO | TCP | ||
| 192.168.0.230 | TCP | |||
| 192.168.0.231 | TCP | |||
| 192.168.0.232 | TCP | |||
| cpe-67-249-249-118.twcny.res.rr.com | 67.249.249.118 | US | Oswego | TCP |
| 192.168.0.233 | TCP | |||
| 189-13-36-36.user.veloxzone.com.br | 189.13.36.36 | BR | Belo Horizonte | TCP |
| 192.168.0.234 | TCP | |||
| 192.168.0.235 | TCP | |||
| 149.197.159.135 | FI | TCP | ||
| 196.103.153.56 | KE | TCP | ||
| 169.18.46.180 | US | New York | TCP | |
| 201.sub-97-41-41.myvzw.com | 97.41.41.201 | US | TCP | |
| 192.168.0.236 | TCP | |||
| 192.168.0.237 | TCP | |||
| 95.163.86.240 | RU | TCP | ||
| 59.30.189.174 | KR | Suwon | TCP | |
| 34.76.174.241 | US | TCP | ||
| 53.219.82.223 | DE | TCP | ||
| 144.sub-72-120-72.myvzw.com | 72.120.72.144 | US | TCP | |
| 192.168.0.238 | TCP | |||
| 37-33-156-107.bb.dnainternet.fi | 37.33.156.107 | FI | TCP | |
| 192.168.0.239 | TCP | |||
| 181.72.185.59 | CL | Santiago | TCP | |
| 192.168.0.240 | TCP | |||
| 192.168.0.241 | TCP | |||
| 91-174-83.132.subs.proxad.net | 91.174.83.132 | FR | TCP | |
| 192.168.0.242 | TCP | |||
| 66.221.157.69 | US | Dallas | TCP | |
| h213.174.133.40.static.ip.windstream.net | 40.133.174.213 | US | Chagrin Falls | TCP |
| 123.233.212.32 | CN | Jinan | TCP | |
| 192.168.0.243 | TCP | |||
| 205.105.60.51 | US | Virginia Beach | TCP | |
| 11.2.7.201 | US | TCP | ||
| 85.166.69.108 | NO | TCP | ||
| 104-188-62-22.lightspeed.irvnca.sbcglobal.net | 104.188.62.22 | US | TCP | |
| softbank218120207251.bbtec.net | 218.120.207.251 | JP | TCP | |
| static-173-210-6-237.ngn.onecommunications.net | 173.210.6.237 | US | Lee | TCP |
| 150.205.155.40 | CH | Fallanden | TCP | |
| 37.79.148.51 | RU | Tyumen | TCP | |
| 123-195-39-120.dynamic.kbronet.com.tw | 123.195.39.120 | TW | Taipei | TCP |
| 192.168.0.244 | TCP | |||
| 192.168.0.245 | TCP | |||
| 28.113.229.43 | US | TCP | ||
| 192.168.0.246 | TCP | |||
| 14.29.105.130 | CN | Guangzhou | TCP | |
| 192.168.0.247 | TCP | |||
| 192.168.0.248 | TCP | |||
| 9.163.82.54 | US | Durham | TCP | |
| 192.168.0.249 | TCP | |||
| 35.124.167.202 | US | Ann Arbor | TCP | |
| 192.168.0.250 | TCP | |||
| 192.168.0.251 | TCP | |||
| 192.168.0.252 | TCP | |||
| kxfLhBWMxzi | 192.168.0.253 | TCP | ||
| 87-92-52-42.bb.dnainternet.fi | 87.92.52.42 | FI | Helsinki | TCP |
| 90.82.34.165 | FR | TCP | ||
| 192.168.0.254 | TCP | |||
| 65.198.67.36 | US | TCP | ||
| 120.86.220.46 | CN | Guangzhou | TCP | |
| 90.252.213.91 | GB | Birmingham | TCP | |
| 240.168.154.77.rev.sfr.net | 77.154.168.240 | FR | TCP | |
| LFbn-1-9830-214.w86-202.abo.wanadoo.fr | 86.202.19.214 | FR | TCP | |
| 146.61.111.218 | US | Dallas | TCP | |
| 83.150.68.164 | FI | Helsinki | TCP | |
| ec2-54-176-76-60.us-west-1.compute.amazonaws.com | 54.176.76.60 | US | San Jose | TCP |
| 179.138.167.242 | BR | So Gonalo | TCP | |
| 47.157.119.29 | US | TCP | ||
| 78-56-187-105.static.zebra.lt | 78.56.187.105 | LT | Vilnius | TCP |
| 171.15.124.57 | CN | Zhengzhou | TCP | |
| 47.241.203.84 | CA | Ottawa | TCP | |
| 9.51.188.202 | US | Durham | TCP | |
| 102.174.105.123 | TCP | |||
| p159105-ipngn200302toyamahon.toyama.ocn.ne.jp | 153.198.23.105 | JP | Takaoka | TCP |
| cancer110-126-87.ucsd.edu | 137.110.126.87 | US | La Jolla | TCP |
| 88-97-175-196.dsl.in-addr.zen.co.uk | 88.97.175.196 | GB | TCP | |
| 152.76.232.8 | AU | TCP | ||
| 21.90.86.148 | US | TCP | ||
| 69.4.183.132 | US | South Jordan | TCP | |
| 102.74.194.173 | TCP | |||
| ec2-52-42-17-214.us-west-2.compute.amazonaws.com | 52.42.17.214 | US | Boardman | TCP |
| CPE788df7e97961-CM788df7e97960.cpe.net.cable.rogers.com | 173.34.132.132 | CA | North York | TCP |
| 190.209.28.8 | CL | Santiago | TCP | |
| 195.90.188.63 | RU | Moscow | TCP | |
| 18.55.60.108 | US | Cambridge | TCP | |
| cliente91.rede177.osirnet.com.br | 168.205.177.91 | BR | Rio Grande | TCP |
| 7.198.54.146 | US | TCP | ||
| 4.21.129.0 | US | TCP | ||
| 205.214.147.116 | US | Fremont | TCP | |
| 28.93.223.76 | US | TCP | ||
| 99.79.236.116 | US | TCP | ||
| 191.32.127.45.dynamic.adsl.gvt.net.br | 191.32.127.45 | BR | Porto Alegre | TCP |
| 67.242.244.178 | US | TCP | ||
| 89-105-95-226.lunet.it | 89.105.95.226 | IT | TCP | |
| 82.198.49.157.dyn.user.ono.com | 82.198.49.157 | ES | Zaragoza | TCP |
| 158.69.79.235 | CA | Montral | TCP | |
| 22.70.106.126 | US | TCP | ||
| 173-112-71-231.pools.spcsdns.net | 173.112.71.231 | US | TCP | |
| 96.49.18.66 | CA | Richmond | TCP | |
| 51.117.87.242 | GB | TCP | ||
| 144.237.90.2 | US | TCP | ||
| 155.216.78.186 | US | Fort Huachuca | TCP | |
| ip1f12c974.dynamic.kabel-deutschland.de | 31.18.201.116 | DE | Ankershagen | TCP |
| 91-172-240-207.subs.proxad.net | 91.172.240.207 | FR | TCP | |
| 186-148-3-73.static.mundo.movistar.cl | 186.148.3.73 | CL | Santiago | TCP |
| 160.70.207.132 | DE | TCP | ||
| softbank221061122051.bbtec.net | 221.61.122.51 | JP | TCP | |
| p9005-ipngn801akita.akita.ocn.ne.jp | 153.216.168.5 | JP | Akita | TCP |
| 161.119.163.91 | US | Salt Lake City | TCP | |
| 105.165.28.143 | KE | TCP | ||
| 197.75.126.184 | ZA | Pretoria | TCP | |
| 82.92.57.4 | NL | TCP | ||
| 63.231.181.251 | US | TCP | ||
| 39.29.248.161 | KR | TCP | ||
| 78.174.118.4.dynamic.ttnet.com.tr | 78.174.118.4 | TR | Istanbul | TCP |
| 104.244.90.235 | US | Newark | TCP | |
| www.petersenpontiac.apdlr.com | 209.115.148.30 | CA | Calgary | TCP |
| 36.61.9.250 | CN | Hefei | TCP | |
| 214.237.81.209 | US | TCP | ||
| ec2-54-147-84-163.compute-1.amazonaws.com | 54.147.84.163 | US | Ashburn | TCP |
| 108-114-223-177.pools.spcsdns.net | 108.114.223.177 | US | TCP | |
| 40.181.125.196 | US | TCP | ||
| adsl-108-140-223-53.gsp.bellsouth.net | 108.140.223.53 | US | TCP | |
| dsl-189-232-105-39-dyn.prod-infinitum.com.mx | 189.232.105.39 | MX | Mexico | TCP |
| 167.4.111.101 | US | Carrollton | TCP | |
| 54.37.50.213 | US | Woodbridge | TCP | |
| 153.25.222.20 | US | Montgomery | TCP | |
| 213.69.78.108 | DE | TCP | ||
| 166.16.57.14 | US | Santa Clara | TCP | |
| 62-47-156-5.adsl.highway.telekom.at | 62.47.156.5 | AT | TCP | |
| 132.253.125.80 | US | Needham Heights | TCP | |
| 20.201.236.237 | US | Falls Church | TCP | |
| 191.174.126.225 | BR | TCP | ||
| dsl-189-166-80-130-dyn.prod-infinitum.com.mx | 189.166.80.130 | MX | Quertaro | TCP |
| 188.231.54.188 | KW | TCP | ||
| mo110-163-111-55.fix.mopera.net | 110.163.111.55 | JP | Tokyo | TCP |
| 34.243.238.59 | US | TCP | ||
| 202.sub-75-218-41.myvzw.com | 75.218.41.202 | US | TCP | |
| dynamicip-176-215-125-85.pppoe.krsk.ertelecom.ru | 176.215.125.85 | RU | Krasnoyarsk | TCP |
| 152-83-103-145.static.glaslokaal.nl | 145.103.83.152 | NL | Utrecht | TCP |
| mia.miami-design.info | 216.172.190.47 | US | Houston | TCP |
| 202.98.143.225 | CN | Chengdu | TCP | |
| 189-209-103-42.static.axtel.net | 189.209.103.42 | MX | Guadalajara | TCP |
| 61.72.89.217 | KR | Seongbuk-gu | TCP | |
| CPE-1-121-164-2.qwl9.woo.bigpond.net.au | 1.121.164.2 | AU | Brisbane | TCP |
| 250.62.184.183.adsl-pool.sx.cn | 183.184.62.250 | CN | Taiyuan | TCP |
| 32.128.218.93 | US | TCP | ||
| 156.245.235.79 | ZA | Johannesburg | TCP | |
| 133.44.178.25 | JP | TCP | ||
| 175.219.10.124 | KR | TCP | ||
| 105.62.186.83 | KE | TCP | ||
| 175.181.60.172 | TW | Taipei | TCP | |
| 184-88-14-176.res.bhn.net | 184.88.14.176 | US | Clermont | TCP |
| 175.241.37.98 | KR | TCP | ||
| 120.82.180.241 | CN | Guangzhou | TCP | |
| 168.168.216.161 | US | Louisville | TCP | |
| 121-80-12-58f1.shg1.eonet.ne.jp | 121.80.12.58 | JP | Kusatsu | TCP |
| 51.197.7.108 | GB | TCP | ||
| bzq-79-180-96-207.red.bezeqint.net | 79.180.96.207 | IL | TCP | |
| 192.94.124.41 | US | TCP | ||
| 11.138.240.213 | US | TCP | ||
| 16.75.74.104 | US | Palo Alto | TCP | |
| 38.224.245.47 | US | TCP | ||
| 9.100.112.251 | US | Durham | TCP | |
| 75-48-73-116.lightspeed.snrsca.sbcglobal.net | 75.48.73.116 | US | Santa Rosa | TCP |
| softbank218136226171.bbtec.net | 218.136.226.171 | JP | TCP | |
| a5.55.3fa9.ip4.static.sl-reverse.com | 169.63.85.165 | US | TCP | |
| cl27-59-137-95.cl.metrocom.ru | 95.137.59.27 | RU | Vyborg | TCP |
| dialup-4.159.83.222.Dial1.Chicago1.Level3.net | 4.159.83.222 | US | TCP | |
| 6.116.223.55 | US | Fort Huachuca | TCP | |
| 0.199.90.60 | TCP | |||
| 223.163.66.118 | CN | Beijing | TCP | |
| 196.12.98.30 | BM | Hamilton | TCP | |
| 39.133.230.137 | CN | TCP | ||
| modemcable180.4-70-69.static.videotron.ca | 69.70.4.180 | CA | Montral | TCP |
| 137.151.202.201 | US | Norwalk | TCP | |
| dynamic-ip-190156110201.cable.net.co | 190.156.110.201 | CO | TCP | |
| p36116-em01otemachi.tokyo.ocn.ne.jp | 180.40.130.116 | JP | Sakaishi | TCP |
| 195.85.89.164 | DK | TCP | ||
| 100.139.172.39 | US | TCP | ||
| 88-149-103-250.du.xdsl.is | 88.149.103.250 | IS | Akureyri | TCP |
| 152.215.158.245 | US | Ashburn | TCP | |
| ravex.generali.at | 194.48.84.124 | AT | Neusiedl Am See | TCP |
| 40.24.107.82 | US | TCP | ||
| abts-kk-dynamic-144.42.172.122.airtelbroadband.in | 122.172.42.144 | IN | Bangalore | TCP |
| 156.26.242.241 | US | Wichita | TCP | |
| london1483w-lp130-03-76-64-230-35.dsl.bell.ca | 76.64.230.35 | CA | London | TCP |
| 69.152.248.195 | US | TCP | ||
| 216.182.204.63 | US | Chesterfield | TCP | |
| 185.167.58.45 | MD | TCP | ||
| 96-65-199-164-static.hfc.comcastbusiness.net | 96.65.199.164 | US | TCP | |
| 123.242.250.0 | IN | TCP | ||
| cpc85734-newc19-2-0-cust48.16-2.cable.virginm.net | 82.42.94.49 | GB | North Shields | TCP |
| 180.65.61.245 | KR | TCP | ||
| public-gprs507961.centertel.pl | 31.61.103.122 | PL | TCP | |
| dsl-187-225-89-163-dyn.prod-infinitum.com.mx | 187.225.89.163 | MX | Mexico | TCP |
| DNS-192-221-138-185.Chicago1.Level3.net | 192.221.138.185 | US | Chicago | TCP |
| 174.75.220.63 | US | TCP | ||
| 40.197.93.72 | US | TCP | ||
| softbank219170165048.bbtec.net | 219.170.165.48 | JP | TCP | |
| 20.9.235.148 | US | Falls Church | TCP | |
| 44.45.24.119 | US | San Diego | TCP | |
| 211.138.11.137 | CN | Hebei | TCP | |
| 15.76.250.105 | US | Palo Alto | TCP | |
| 152.45.157.245 | US | Durham | TCP | |
| 41.117.205.224 | ZA | Cape Town | TCP | |
| 31.224.184.72 | DE | TCP | ||
| 5.51.185.60.broad.qz.zj.dynamic.163data.com.cn | 60.185.51.5 | CN | Quzhou | TCP |
| 14.67.178.212 | KR | TCP | ||
| 111-242-99-44.dynamic-ip.hinet.net | 111.242.99.44 | TW | TCP | |
| 132.20.126.147 | US | Montgomery | TCP | |
| utk-251-86.utk.ru | 62.168.251.86 | RU | Yekaterinburg | TCP |
| 38.36.201.20 | US | TCP | ||
| 49.112.125.253 | CN | rmqi | TCP | |
| 103.50.142.76 | CN | TCP | ||
| 53.127.139.237 | DE | TCP | ||
| 45.153.127.154 | TCP | |||
| KD106172231063.ppp-bb.dion.ne.jp | 106.172.231.63 | JP | Horibata-cho | TCP |
| 67-134-194-96.dia.static.qwest.net | 67.134.194.96 | US | Lakewood | TCP |
| 28.95.176.24 | US | TCP | ||
| 134.115.62.97 | AU | TCP | ||
| 56.214.104.57 | US | Raleigh | TCP | |
| 159.242.86.220 | US | Indianapolis | TCP | |
| 36.67.142.100 | ID | TCP | ||
| 49.86.75.229 | CN | Nanjing | TCP | |
| 12.80.53.223 | US | TCP | ||
| 222.130.56.146 | CN | Beijing | TCP | |
| 4.109.215.200 | US | TCP | ||
| 9.238.81.219 | US | Durham | TCP | |
| 67.12.93.58 | US | TCP | ||
| 208.22.224.37 | US | TCP | ||
| 193.221.95.160 | TCP | |||
| janis220254114189.janis.or.jp | 220.254.114.189 | JP | TCP | |
| 182.218.95.140 | KR | Seoul | TCP | |
| 14.2.245.51 | AU | TCP | ||
| 16.215.153.57 | US | Palo Alto | TCP | |
| 199.85.197.72 | CA | Toronto | TCP | |
| 146.69.128.154 | US | Denver | TCP | |
| w099.z066089134.pdx-or.dsl.cnc.net | 66.89.134.99 | US | TCP | |
| 29.115.63.130 | US | TCP | ||
| 1.246.23.152 | KR | Cheongju | TCP | |
| 106.242.93.68 | KR | Seoul | TCP | |
| 9.17.241.239 | US | Durham | TCP | |
| 0.248.99.228 | TCP | |||
| 157.109.20.53 | JP | TCP | ||
| 48.93.92.175 | US | Newark | TCP | |
| 109.225.161.19 | IR | Tabriz | TCP | |
| 162.79.152.161 | US | Fort Collins | TCP | |
| 140.11.155.75 | US | TCP | ||
| adsl-72-155-199-119.mem.bellsouth.net | 72.155.199.119 | US | TCP | |
| 185.204.224.139 | TCP | |||
| 49.44.136.201 | IN | TCP | ||
| 117.58.95.60 | CN | Beijing | TCP | |
| 18.239.126.55 | US | Cambridge | TCP | |
| 80.231.232.34 | EU | TCP | ||
| 166.181.192.178.dynamic.wline.res.cust.swisscom.ch | 178.192.181.166 | CH | TCP | |
| 12.238.151.37 | US | TCP | ||
| KD036008064018.ppp-bb.dion.ne.jp | 36.8.64.18 | JP | Yamagata | TCP |
| 203.191.44.140 | ID | Jakarta | TCP | |
| 161.76.201.197 | GB | London | TCP | |
| 132.228.54.148 | US | Bethpage | TCP | |
| ec2-52-24-52-113.us-west-2.compute.amazonaws.com | 52.24.52.113 | US | Boardman | TCP |
| 143.31.219.87 | US | Cincinnati | TCP | |
| 117.188.85.189.dyn.oletelecom.com.br | 189.85.188.117 | BR | So Jos | TCP |
| 83.144.29.149 | FR | TCP | ||
| cxj173.cxjjhj.com | 43.251.105.173 | HK | TCP | |
| 27.7.75.194 | IN | Bangalore | TCP | |
| 46.155.44.125 | TR | TCP | ||
| 211.239.19.113 | KR | TCP | ||
| 209-23-194-135-ip-static.hfc.comcastbusiness.net | 209.23.194.135 | US | Park City | TCP |
| 199.125.222.152 | US | TCP | ||
| 157.18.19.22 | CN | Guangzhou | TCP | |
| 164.174.225.210 | US | Fort Huachuca | TCP | |
| 49.172.218.254 | KR | Seongnam | TCP | |
| zz101-224-145.nhtv.nl | 145.101.224.145 | NL | Utrecht | TCP |
| a95-92-227-241.cpe.netcabo.pt | 95.92.227.241 | PT | Rio De Mouro | TCP |
| softbank219207172110.bbtec.net | 219.207.172.110 | JP | TCP | |
| 55.56.124.36 | US | Fort Huachuca | TCP | |
| a184-84-10-144.deploy.static.akamaitechnologies.com | 184.84.10.144 | US | Cambridge | TCP |
| 182.4.87.183 | ID | TCP | ||
| 47.153.38.31 | US | TCP | ||
| softbank219038196235.bbtec.net | 219.38.196.235 | JP | TCP | |
| ool-45712fd5.dyn.optonline.net | 69.113.47.213 | US | Norwalk | TCP |
| mc167-24.medctr.luhs.org | 147.126.167.24 | US | Chicago | TCP |
| s92.20.158.220.fls.vectant.ne.jp | 220.158.20.92 | JP | Osaka | TCP |
| 13.232.208.142 | US | Norwalk | TCP | |
| 22.177.110.250 | US | TCP | ||
| 53.247.195.248 | DE | TCP | ||
| 147.147.34.179.isp.timbrasil.com.br | 179.34.147.147 | BR | So Paulo | TCP |
| 43.12.94.193 | JP | Tokyo | TCP | |
| 47-32-211-239.dhcp.ftwo.tx.charter.com | 47.32.211.239 | US | Fort Worth | TCP |
| 146.125.228.142 | US | Orange Park | TCP | |
| h0.113.96.50.static.ip.windstream.net | 50.96.113.0 | US | Walton | TCP |
| 201-167-171-208-cable.cybercable.net.mx | 201.167.171.208 | MX | TCP | |
| dun2262122.lnk.telstra.net | 144.139.226.156 | AU | Glen Waverley | TCP |
| dsl-178-208-103-59.pool.bitel.net | 178.208.103.59 | DE | Gtersloh | TCP |
| 30.166.153.178 | US | TCP | ||
| 212.157.46.1 | FR | TCP | ||
| 52.212.98.84.rev.sfr.net | 84.98.212.52 | FR | Montussan | TCP |
| e0109-106-189-116-99.uqwimax.jp | 106.189.116.99 | JP | TCP | |
| 6.53.8.221 | US | Fort Huachuca | TCP | |
| 132.78.186.140 | IL | TCP | ||
| 111.75.0.77 | CN | Nanchang | TCP | |
| 119.57.12.23 | CN | Beijing | TCP | |
| 44.64.95.18 | US | San Diego | TCP | |
| wsip-70-166-203-162.ph.ph.cox.net | 70.166.203.162 | US | Tempe | TCP |
| cpe-94-253-219-2.st2.cable.xnet.hr | 94.253.219.2 | HR | Zagreb | TCP |
| w0109-114-22-184-189.uqwimax.jp | 114.22.184.189 | JP | TCP | |
| 18.189.148.102 | US | Cambridge | TCP | |
| ai126250156229.11.tss.access-internet.ne.jp | 126.250.156.229 | JP | Setagaya | TCP |
| 129.56.102.171 | NG | TCP | ||
| 133.213.95.181 | JP | TCP | ||
| pool-71-162-156-15.phlapa.fios.verizon.net | 71.162.156.15 | US | Huntingdon Valley | TCP |
| 183.1.146.146 | CN | Guangzhou | TCP | |
| 141.90.23.170 | DE | Wiesbaden | TCP | |
| 212.154.195.188 | KZ | TCP | ||
| ip68-9-68-251.ri.ri.cox.net | 68.9.68.251 | US | Meriden | TCP |
| c-4f66b59c-74736162.cust.telenor.se | 79.102.181.156 | SE | Stockholm | TCP |
| 65.170.91.222.broad.xa.sn.dynamic.163data.com.cn | 222.91.170.65 | CN | Xian | TCP |
| softbank221052234162.bbtec.net | 221.52.234.162 | JP | TCP | |
| 223.4.218.64 | CN | Hangzhou | TCP | |
| abts-north-dynamic-055.229.64.182.airtelbroadband.in | 182.64.229.55 | IN | Delhi | TCP |
| 69.166.135.168 | US | Saint Louis | TCP | |
| 159.101.147.84 | GB | TCP | ||
| 162.110.59.114 | US | Pittsburgh | TCP | |
| 135.11.41.164 | US | Basking Ridge | TCP | |
| dialup-4.130.83.246.Dial1.Dallas1.Level3.net | 4.130.83.246 | US | Azle | TCP |
| 159.120.26.32 | US | TCP | ||
| pei-190-151-ccxxxiii-ccliv.une.net.co | 190.151.233.254 | CO | Cartago | TCP |
| host193-40-static.41-88-b.business.telecomitalia.it | 88.41.40.193 | IT | TCP | |
| ppp-58-11-244-91.revip2.asianet.co.th | 58.11.244.91 | TH | Bangkok | TCP |
| 218.80.9.46.customer.cdi.no | 46.9.80.218 | NO | Sandvika | TCP |
| h-69-3-223-35.chcg.il.dynamic.megapath.net | 69.3.223.35 | US | Minneapolis | TCP |
| 40.195.35.32 | US | TCP | ||
| adsl-13-141-192-81.adsl2.iam.net.ma | 81.192.141.13 | MA | Tanger | TCP |
| r179-28-206-77.dialup.mobile.ancel.net.uy | 179.28.206.77 | UY | Montevideo | TCP |
| 214.67.49.237 | US | TCP | ||
| 191.144.105.147 | CO | TCP | ||
| 56.196.21.96 | US | Raleigh | TCP | |
| 42-148-166-240.rev.home.ne.jp | 42.148.166.240 | JP | Saitama | TCP |
| 58.2.0.147 | IN | TCP | ||
| 29.44.224.230 | US | TCP | ||
| host86-164-89-183.range86-164.btcentralplus.com | 86.164.89.183 | GB | Dalkeith | TCP |
| 217.174.16.109.rev.sfr.net | 109.16.174.217 | FR | La Madeleine | TCP |
| 167.77.22.80 | US | Pittsburgh | TCP | |
| p903140-mobac01.tokyo.ocn.ne.jp | 221.189.237.139 | JP | Yokkaichi | TCP |
| 186.168.189.176 | CO | Bogot | TCP | |
| 27-105-81-116.STATIC.so-net.net.tw | 27.105.81.116 | TW | Taipei | TCP |
| ip-195-207-176-172.dsl.scarlet.be | 195.207.176.172 | BE | TCP | |
| 103.75.95.7 | CN | Chaoyang | TCP | |
| 19.124.151.99 | US | Dearborn | TCP | |
| cpe-67-243-46-142.hvc.res.rr.com | 67.243.46.142 | US | Port Jervis | TCP |
| 123.235.194.179 | CN | Jinan | TCP | |
| kate.niees.group.cam.ac.uk | 128.232.232.29 | GB | Cambridge | TCP |
| 45.131.168.133 | TCP | |||
| 181.244.97.228 | CO | TCP | ||
| 216.87.155.235 | US | Reston | TCP | |
| 115.118.151.30.static-ttsl-hyderabad.vsnl.net.in | 115.118.151.30 | IN | Ahmedabad | TCP |
| 157.160.51.238 | US | Smithsburg | TCP | |
| 62.166.135.98 | NL | TCP | ||
| 179-82-143-148.user.vivozap.com.br | 179.82.143.148 | BR | TCP | |
| 143.38.238.226 | US | Cincinnati | TCP | |
| 018.042.092.145.hva.nl | 145.92.42.18 | NL | Amsterdam | TCP |
| 112.155.252.8 | KR | Seoul | TCP | |
| 101.206.105.0 | CN | Chengdu | TCP | |
| 191.63.142.219.broad.bj.bj.dynamic.163data.com.cn | 219.142.63.191 | CN | Beijing | TCP |
| 44.195.123.32 | US | San Diego | TCP | |
| 202.212.94.26 | JP | Kawaguchi | TCP | |
| 115-124-160-43.ppp.bbiq.jp | 115.124.160.43 | JP | Fukuoka | TCP |
| 189-69-239-64.dial-up.telesp.net.br | 189.69.239.64 | BR | Taboo Da Serra | TCP |
| host081-063.cablenet.net.ar | 206.221.81.63 | AR | San Vicente | TCP |
| 193.88.48.16 | DK | TCP | ||
| 150.106.41.114 | NO | TCP | ||
| 50-87-148-193.unifiedlayer.com | 50.87.148.193 | US | Provo | TCP |
| 5.93.68.170 | IT | TCP | ||
| 131.166.59.100 | LU | TCP | ||
| 124.93.72.254 | CN | Dalian | TCP | |
| 186.20.153.59 | CL | Santiago | TCP | |
| 39.174.110.94 | CN | Shanghai | TCP | |
| 145.176.EARLY-REGISTRATION.of.SURFnet.invalid | 145.176.121.108 | NL | Utrecht | TCP |
| 113.25.134.6 | CN | Taiyuan | TCP | |
| 223.154.235.10 | CN | Changsha | TCP | |
| nor87-h01-176-148-162-3.dsl.sta.abo.bbox.fr | 176.148.162.3 | FR | Limoges | TCP |
| S0106940c6de850a1.cc.shawcable.net | 70.66.244.192 | CA | Courtenay | TCP |
| adsl-074-237-153-072.sip.bna.bellsouth.net | 74.237.153.72 | US | Clarksville | TCP |
| 189-72-3-100.smace700.dsl.brasiltelecom.net.br | 189.72.3.100 | BR | Trs De Maio | TCP |
| 163.182.128.219.broad.st.gd.dynamic.163data.com.cn | 219.128.182.163 | CN | Guangzhou | TCP |
| softbank220047094210.bbtec.net | 220.47.94.210 | JP | TCP | |
| AClermont-Ferrand-652-1-471-84.w86-216.abo.wanadoo.fr | 86.216.190.84 | FR | Clermont-ferrand | TCP |
| 196.108.171.185 | KE | TCP | ||
| 172.66.19.203 | US | San Francisco | TCP | |
| hn.kd.ny.adsl | 42.235.120.55 | CN | Zhengzhou | TCP |
| dslb-188-109-164-176.188.109.pools.vodafone-ip.de | 188.109.164.176 | DE | Essen | TCP |
| 117.245.62.233 | IN | Imphal | TCP | |
| 47.147.239.167 | US | TCP | ||
| 124.230.211.28 | CN | Changsha | TCP | |
| 164.159.120.42 | US | Denver | TCP | |
| 0.229.215.58 | TCP | |||
| 44.90.240.27 | US | San Diego | TCP | |
| 207.144.181.94 | US | Columbia | TCP | |
| 27.4.152.34 | IN | TCP | ||
| 18.168.80.33 | US | Cambridge | TCP | |
| 199.197.133.175 | US | Painted Post | TCP | |
| 40.9.195.244 | US | TCP | ||
| 220.123.179.53 | KR | Daejeon | TCP | |
| 130.162.160.126 | US | New Kensington | TCP | |
| 133.101.200.159 | JP | Kyoto | TCP | |
| 19.sub-72-105-177.myvzw.com | 72.105.177.19 | US | TCP | |
| 68.68.57.67 | US | Patchogue | TCP | |
| 221.17.22.171 | JP | TCP | ||
| 195.163.168.93 | SE | TCP | ||
| 24.13.192.33 | US | Vernon Hills | TCP | |
| 99.186.188.89 | US | TCP | ||
| 169.73.239.98 | US | New York | TCP | |
| 29.247.170.87 | US | TCP | ||
| static-ip.anet.net.th | 203.148.215.155 | TH | Bangkok | TCP |
| 54.96.237.168 | US | Woodbridge | TCP | |
| 173.114.236.103 | US | TCP | ||
| 34.23.204.1 | US | TCP | ||
| p57BCD756.dip0.t-ipconnect.de | 87.188.215.86 | DE | TCP | |
| 207.187.194.34 | US | Schaumburg | TCP | |
| 132.141.135.244 | US | Fort Huachuca | TCP | |
| factor-unify.devilsettings.net | 144.48.16.168 | NL | Lelystad | TCP |
| 102.3.34.197 | TCP | |||
| a23-65-197-227.deploy.static.akamaitechnologies.com | 23.65.197.227 | NL | Amsterdam | TCP |
| 208.32.96.58 | US | TCP | ||
| c-71-224-152-224.hsd1.pa.comcast.net | 71.224.152.224 | US | Collegeville | TCP |
| 154.62.247.13 | US | TCP | ||
| 141192197087.edelkey.net | 141.192.197.87 | FI | Helsinki | TCP |
| 205.157.75.96 | US | Boca Raton | TCP | |
| 57.124.101.159 | FR | TCP | ||
| 91.250.130.24 | RO | TCP | ||
| bzq-79-182-90-100.red.bezeqint.net | 79.182.90.100 | IL | Netanya | TCP |
| 150.216.32.128 | US | Greenville | TCP | |
| 111.133.89.34 | CN | Beijing | TCP | |
| 171.14.208.185 | CN | Zhengzhou | TCP | |
| 12.44.133.44 | US | TCP | ||
| 121.163.244.176 | KR | Namyangju | TCP | |
| 32.217.119.168 | US | Old Lyme | TCP | |
| 143.215.77.23 | US | Atlanta | TCP | |
| 93-139-128-238.adsl.net.t-com.hr | 93.139.128.238 | HR | Zagreb | TCP |
| 56.17.178.250 | US | Raleigh | TCP | |
| 146.red-83-59-205.dynamicip.rima-tde.net | 83.59.205.146 | ES | Villafranca Del Cid | TCP |
| 27.215.209.16 | CN | Jinan | TCP | |
| 221.220.248.30 | CN | Beijing | TCP | |
| 110.70.49.197 | KR | Seoul | TCP | |
| dsl-189-173-77-13-dyn.prod-infinitum.com.mx | 189.173.77.13 | MX | Hermosillo | TCP |
| 152.68.248.218 | US | Redwood City | TCP | |
| 54.56.59.57 | US | Woodbridge | TCP | |
| 159.25.65.2 | DE | TCP | ||
| 189.207.132.188 | MX | Mexico | TCP | |
| 110.49.81.54 | TH | TCP | ||
| cable-181-134-244-24.une.net.co | 181.134.244.24 | CO | Santiago De Cali | TCP |
| 18.249.127.110 | US | Cambridge | TCP | |
| d91-129-58-202.cust.tele2.at | 91.129.58.202 | AT | TCP | |
| 15.48.136.193 | US | Palo Alto | TCP | |
| 252.60.63.188.dynamic.wline.res.cust.swisscom.ch | 188.63.60.252 | CH | TCP | |
| ip-cust-sv14136.telefonica-ca.net | 168.243.205.136 | SV | TCP | |
| 17-200-82-173-dedicated.multacom.com | 173.82.200.17 | US | Canyon Country | TCP |
| 210.154.96.43 | JP | Fujisawa | TCP | |
| 106.44.192.61 | CN | Changsha | TCP | |
| a88-113-96-176.elisa-laajakaista.fi | 88.113.96.176 | FI | Hmeenlinna | TCP |
| 55.181.150.216 | US | Fort Huachuca | TCP | |
| 184.191.214.139.adsl-pool.jlccptt.net.cn | 139.214.191.184 | CN | Changchun | TCP |
| 179-198-1-127.user3g.veloxzone.com.br | 179.198.1.127 | BR | Vitria | TCP |
| ool-4356156d.dyn.optonline.net | 67.86.21.109 | US | Huntington Station | TCP |
| ip-200-52-230-114-static.netra.net | 200.52.230.114 | MX | Juarez | TCP |
| 36.174.159.151 | CN | TCP | ||
| 8.1.40.179 | US | TCP | ||
| softbank220001110051.bbtec.net | 220.1.110.51 | JP | TCP | |
| a23-0-211-242.deploy.static.akamaitechnologies.com | 23.0.211.242 | US | Cambridge | TCP |
| 134.164.104.39 | US | Clinton | TCP | |
| 33.222.137.43 | US | TCP | ||
| 213.144.179.139 | IT | TCP | ||
| 213.136.253.162 | PL | Sedziszow | TCP | |
| 92.121.135.83 | NL | TCP | ||
| a23-1-10-234.deploy.static.akamaitechnologies.com | 23.1.10.234 | US | Cambridge | TCP |
| 199.234.205.143 | US | Englewood | TCP | |
| wsip-68-15-25-182.sd.sd.cox.net | 68.15.25.182 | US | San Diego | TCP |
| vc-kzn-41-9-237-246.umts.vodacom.co.za | 41.9.237.246 | ZA | TCP | |
| port-92-192-152-202.dynamic.qsc.de | 92.192.152.202 | DE | TCP | |
| 32.94.105.136 | US | TCP | ||
| 36.76.61.190 | ID | Simpang | TCP | |
| 197.205.99.5 | DZ | Constantine | TCP | |
| 53.240.190.126 | DE | TCP | ||
| AStLambert-681-1-44-67.w90-86.abo.wanadoo.fr | 90.86.162.67 | FR | TCP | |
| 28.160.96.126 | US | TCP | ||
| 128.185.233.36 | IN | Gurgaon | TCP | |
| c-73-175-141-176.hsd1.pa.comcast.net | 73.175.141.176 | US | Williamsport | TCP |
| 108.139.253.50 | US | TCP | ||
| 92.222.128.181 | FR | Paris | TCP | |
| 208.200.105.191 | US | TCP | ||
| 193.195.88.192 | GB | TCP | ||
| 187.253.226.58.cable.dyn.cableonline.com.mx | 187.253.226.58 | MX | Cosoleacaque | TCP |
| 38.72.131.185 | US | Seattle | TCP | |
| 97.45.117.63.unassigned.omegacomminc.com | 63.117.45.97 | US | Southington | TCP |
| p773161-ipbf942aobadori.miyagi.ocn.ne.jp | 122.18.13.161 | JP | Tokyo | TCP |
| 112.161.163.78 | KR | Namyangju | TCP | |
| 10.209.127.179 | TCP | |||
| m5CE30E1F072A.npls2.fl.comcast.net | 184.117.202.161 | US | TCP | |
| 11.215.51.35 | US | TCP | ||
| 52.140.225.227 | US | Redmond | TCP | |
| 118.88.93.114 | CN | Changchun | TCP | |
| 42.94.129.42 | CN | Lanzhou | TCP | |
| 196201.CHA.ncyu.edu.tw | 140.130.196.201 | TW | TCP | |
| 181.252.109.55 | CO | TCP | ||
| 142.44.54.217 | CA | Victoria | TCP | |
| pl25437.ag0708.nttpc.ne.jp | 128.28.66.93 | JP | Tokyo | TCP |
| 56.152.175.51 | US | Raleigh | TCP | |
| 173-149-228-240.pools.spcsdns.net | 173.149.228.240 | US | Houston | TCP |
| host149-11-static.75-81-b.business.telecomitalia.it | 81.75.11.149 | IT | TCP | |
| 204.186.137.206 | US | Schnecksville | TCP | |
| cpe-88-216-6-148.res.lt | 88.216.6.148 | LT | TCP | |
| 126.254.69.84 | JP | Tokyo | TCP | |
| 74.49.254.6 | CA | TCP | ||
| 39.209.39.72 | ID | TCP | ||
| 21.39.109.38 | US | TCP | ||
| 156.21.136.37 | US | Lexington | TCP | |
| ip1f102832.dynamic.kabel-deutschland.de | 31.16.40.50 | DE | Bddenstedt | TCP |
| 41.219.72.107 | NA | TCP | ||
| ip565669e3.adsl-surfen.hetnet.nl | 86.86.105.227 | NL | Amsterdam | TCP |
| 156.187.122.25 | EG | TCP | ||
| 150.176.230.130 | US | Tallahassee | TCP | |
| 214.201.80.238 | US | TCP | ||
| 189.61.29.157 | BR | Braslia | TCP | |
| localhost | 127.0.0.1 | TCP | ||
| 1c.5e.8c0d.ip4.static.sl-reverse.com | 13.140.94.28 | US | TCP | |
| 139.53.38.209 | ZA | Vanderbijlpark | TCP | |
| adsl-184-39-229-248.clt.bellsouth.net | 184.39.229.248 | US | Charlotte | TCP |
| 155.43.147.254 | US | Hartford | TCP | |
| 123.43.127.177 | KR | Seoul | TCP | |
| 165.137.228.166.in-addr.arpa | 166.228.137.165 | US | TCP | |
| 26.156.184.8 | US | TCP | ||
| c-76-127-49-174.hsd1.nm.comcast.net | 76.127.49.174 | US | Santa Fe | TCP |
| 53.15.212.161 | DE | TCP | ||
| 81.169.192.142 | DE | Wernau | TCP | |
| 0.40.102.95 | TCP | |||
| 209.231.171.81 | US | Redwood City | TCP | |
| 56.112.55.146 | US | Raleigh | TCP | |
| 173.84-234-243.customer.lyse.net | 84.234.243.173 | NO | TCP | |
| 113.221.132.42 | CN | Changsha | TCP | |
| 157.49.80.108 | IN | TCP | ||
| 28.213.98.130 | US | TCP | ||
| 51.115.250.161 | GB | TCP | ||
| cpe-104-173-211-3.socal.res.rr.com | 104.173.211.3 | US | Los Angeles | TCP |
| 74.253.197.55 | US | Atlanta | TCP | |
| 163.151.93.76 | US | White Plains | TCP | |
| 150.151.26.72 | AU | TCP | ||
| adsl-74-248-4-232.mob.bellsouth.net | 74.248.4.232 | US | TCP | |
| 87-239-40-252.ip.gronet.pl | 87.239.40.252 | PL | Sosnowiec | TCP |
| 180.209.118.11 | CN | Nanjing | TCP | |
| 143.16.186.129 | US | Cincinnati | TCP | |
| 103.94.123.175 | TCP | |||
| 130.35.65.29 | US | Redwood City | TCP | |
| 94.204.217.25 | AE | Dubai | TCP | |
| 184-226-147-124.pools.spcsdns.net | 184.226.147.124 | US | TCP | |
| 93.48.92.154 | IT | Cariati | TCP | |
| 140.207.147.105 | CN | Shanghai | TCP | |
| 207.175.240.5 | US | TCP | ||
| 42.50.233.2 | CN | Beijing | TCP | |
| 193.184.37.98 | FI | TCP | ||
| 91.189.2.57 | PL | Zgierz | TCP | |
| 69-11-50-4.msjw.hsdb.sasknet.sk.ca | 69.11.50.4 | CA | Moose Jaw | TCP |
| 80.245.12.50 | ES | Bilbao | TCP | |
| dup-200-64-174-111.prodigy.net.mx | 200.64.174.111 | MX | TCP | |
| 12.68.212.139 | US | Mesquite | TCP | |
| 61.177.209.15 | CN | Nanjing | TCP | |
| pD9E03168.dip0.t-ipconnect.de | 217.224.49.104 | DE | Wettenberg | TCP |
| 183.234.28.237 | CN | TCP | ||
| 211.105.197.74 | KR | TCP | ||
| 48.68.5.251 | US | Newark | TCP | |
| 208.45.241.92 | US | TCP | ||
| 87.225.40.174 | RU | Khabarovsk | TCP | |
| 155.90.134.245 | US | Ogden | TCP | |
| 16.148.102.89 | US | Palo Alto | TCP | |
| 34.88.109.114 | US | TCP | ||
| vpn110.h-ab.de | 193.175.21.110 | DE | Bremen | TCP |
| x5d83cc87.dyn.telefonica.de | 93.131.204.135 | DE | Herten | TCP |
| 218.71.136.48 | CN | Ningbo | TCP | |
| 0.158.247.65 | TCP | |||
| 162.119.113.137 | US | Walnut Creek | TCP | |
| 100.29.54.189 | US | TCP | ||
| 94.137.65.4 | RU | Lobnya | TCP | |
| 129.122.96.14 | RE | Sainte-clotilde | TCP | |
| 129.44.36.203 | US | TCP | ||
| 40.108.237.218 | US | TCP | ||
| 167.88.56.120 | US | Wilmington | TCP | |
| 29.230.15.181 | US | TCP | ||
| 135-180-32-53.dsl.dynamic.sonic.net | 135.180.32.53 | US | Santa Rosa | TCP |
| 18.115.48.199 | US | Cambridge | TCP | |
| 190.90.78.114 | CO | Popayn | TCP | |
| 90.46.124.13 | FR | Kremlin-bictre | TCP | |
| 182.7.133.217 | ID | TCP | ||
| 25.79-160-253.customer.lyse.net | 79.160.253.25 | NO | Haugesund | TCP |
| 94.186.190.82 | DE | Korntal-mnchingen | TCP | |
| 104.12.175.167 | US | TCP | ||
| 50-119-115-42.acedatacenter.com | 50.119.115.42 | US | Orem | TCP |
| porgyon-73.dynamic.rpi.edu | 128.113.193.162 | US | Troy | TCP |
| 50-201-70-5-static.hfc.comcastbusiness.net | 50.201.70.5 | US | TCP | |
| 53.222.16.165 | DE | TCP | ||
| 152.10.29.177 | US | Boone | TCP | |
| 216.173.141.126.gatespeed.com | 216.173.141.126 | US | Santa Cruz | TCP |
| 116.7.55.124 | CN | Guangzhou | TCP | |
| 133.128.74.156 | JP | TCP | ||
| 45.85.22.129 | TCP | |||
| 203.42.106.36 | AU | TCP | ||
| 61.179.252.142 | CN | Jinan | TCP | |
| 107.66.227.226 | US | TCP | ||
| 192.185.123.60 | US | Houston | TCP | |
| 91.219.172.102 | FI | TCP | ||
| 47-39-27-243.dhcp.unas.mo.charter.com | 47.39.27.243 | US | TCP | |
| 130.136.234.130 | IT | Bologna | TCP | |
| 15.200.102.163 | US | Palo Alto | TCP | |
| 156.224.24.217 | ZA | Johannesburg | TCP | |
| 198.24.181.45 | US | Tempe | TCP | |
| 213.253.65.53 | SI | TCP | ||
| vc-gp-n-105-241-135-96.umts.vodacom.co.za | 105.241.135.96 | ZA | TCP | |
| eduroam-151-149.fsv.cvut.cz | 147.32.151.149 | CZ | Prague | TCP |
| host-92-29-51-137.as13285.net | 92.29.51.137 | GB | Pinner | TCP |
| 171.147.178.195 | US | Concord | TCP | |
| 166.17.14.89 | US | Denver | TCP | |
| 11.13.234.144 | US | TCP | ||
| 152.60.204.251 | US | Durham | TCP | |
| 217.146.83.205 | GB | Birmingham | TCP | |
| 67.69.41.59 | CA | TCP | ||
| 203.176.228.228 | HK | Kowloon | TCP | |
| 35.10.199.192 | US | East Lansing | TCP | |
| 8ta-246-8-31.telkomadsl.co.za | 41.246.8.31 | ZA | TCP | |
| 58.124.129.33 | KR | TCP | ||
| 29.249.104.17 | US | TCP | ||
| 12.84.36.172 | US | TCP | ||
| 200.32.168.74 | CL | Santiago | TCP | |
| 26.133.198.228 | US | TCP | ||
| 18.134.247.188 | US | Cambridge | TCP | |
| c-73-131-148-3.hsd1.sc.comcast.net | 73.131.148.3 | US | Ladys Island | TCP |
| 180.231.17.19 | KR | Incheon | TCP | |
| 223.12.135.245 | CN | Xian | TCP | |
| 163.193.10.71 | US | Chicago | TCP | |
| 110.196.194.245 | CN | Beijing | TCP | |
| 194.150.179.94 | RU | TCP | ||
| 186-94-133-191.genericrev.cantv.net | 186.94.133.191 | VE | San Cristbal | TCP |
| 161.100.42.103 | US | Houston | TCP | |
| 48.130.237.55 | US | Newark | TCP | |
| 46.183.28.246 | SE | TCP | ||
| 44.248.149.124 | US | San Diego | TCP | |
| unused.stjosham.on.ca | 142.238.171.195 | CA | Hamilton | TCP |
| 148.131.48.119 | US | TCP | ||
| p3219-ipadfx21fukuokachu.fukuoka.ocn.ne.jp | 211.11.40.219 | JP | TCP | |
| 57.202.123.4 | BE | TCP | ||
| 173-24-84-142.client.mchsi.com | 173.24.84.142 | US | Lawson | TCP |
| ip-188-230-17-181.airbites.net.ua | 188.230.17.181 | UA | Ivanofrankovsk | TCP |
| 100.209.165.177.isp.timbrasil.com.br | 177.165.209.100 | BR | TCP | |
| 18.207.9.83 | US | Cambridge | TCP | |
| 53.26.0.134 | DE | TCP | ||
| 19.184.19.60 | US | Dearborn | TCP | |
| 101.200.139.176 | CN | Hangzhou | TCP | |
| 26.243.67.4 | US | TCP | ||
| 212.248.253.186.isp.timbrasil.com.br | 186.253.248.212 | BR | So Paulo | TCP |
| moss-bluff-ftth-4310.camtel.net | 207.235.115.120 | US | Plano | TCP |
| 25.210.216.216 | GB | TCP | ||
| 177-196-56-153.user.vivozap.com.br | 177.196.56.153 | BR | Taboo Da Serra | TCP |
| 113.118.181.233 | CN | Shenzhen | TCP | |
| 171.233.120.43 | VN | Ho Chi Minh City | TCP | |
| LFbn-1-6723-32.w90-120.abo.wanadoo.fr | 90.120.158.32 | FR | TCP | |
| cpe-65-31-18-32.insight.res.rr.com | 65.31.18.32 | US | Reynoldsburg | TCP |
| 26.116.236.33 | US | TCP | ||
| 63.sub-69-82-24.myvzw.com | 69.82.24.63 | US | TCP | |
| h146.167.97.216.static.ip.windstream.net | 216.97.167.146 | US | Sanford | TCP |
| ec2-34-199-121-221.compute-1.amazonaws.com | 34.199.121.221 | US | Ashburn | TCP |
| 81.184.236.139.dyn.user.ono.com | 81.184.236.139 | ES | Barcelona | TCP |
| 19.44.89.71 | US | Dearborn | TCP | |
| 185.114.124.182 | DE | TCP | ||
| c-73-97-132-82.hsd1.wa.comcast.net | 73.97.132.82 | US | Seattle | TCP |
| 187.58.63.12 | BR | Goinia | TCP | |
| 8.8.19.60 | US | TCP | ||
| 158.107.41.156 | US | Bayport | TCP | |
| c-71-232-55-156.hsd1.ma.comcast.net | 71.232.55.156 | US | Boston | TCP |
| 124.107.180.138.pldt.net | 124.107.180.138 | PH | TCP | |
| 29.143.93.187 | US | TCP | ||
| 123.51.129.58 | TW | Taipei | TCP | |
| 0.27.15.105 | TCP | |||
| c-73-95-65-149.hsd1.co.comcast.net | 73.95.65.149 | US | Longmont | TCP |
| 203.170-209-149.hydro.com | 149.209.170.203 | NO | TCP | |
| 41.sub-72-108-142.myvzw.com | 72.108.142.41 | US | TCP | |
| dsl-187-207-170-131-dyn.prod-infinitum.com.mx | 187.207.170.131 | MX | Mexico | TCP |
| 12.173.14.150 | US | San Diego | TCP | |
| 196.18.203.153 | SC | Victoria | TCP | |
| 99-119-12-56.lightspeed.sntcca.sbcglobal.net | 99.119.12.56 | US | Fremont | TCP |
| 209.179.155.90 | US | TCP | ||
| 45.4.82.166 | TCP | |||
| 178.158.124.101 | UA | Luhansk | TCP | |
| 150.85.138.207 | JP | TCP | ||
| 160.242.131.219 | UG | Kampala | TCP | |
| 154.65.57.100 | KE | TCP | ||
| monn-02-032.dialup.netins.net | 216.51.136.96 | US | Denison | TCP |
| 211.142.169.196 | CN | Henan | TCP | |
| c-68-43-184-187.hsd1.mi.comcast.net | 68.43.184.187 | US | Warren | TCP |
| 198.118.161.143 | US | Huntsville | TCP | |
| 86.246.63.86.rev.sfr.net | 86.63.246.86 | FR | Sainte-marie-aux-mines | TCP |
| 59.160.61.35.static-illhyd.vsnl.net.in | 59.160.61.35 | IN | Hyderabad | TCP |
| 206.235.194.231 | US | TCP | ||
| cblmdm24-53-157-47.buckeyecom.net | 24.53.157.47 | US | TCP | |
| softbank126064103155.bbtec.net | 126.64.103.155 | JP | Kakuda | TCP |
| 153.35.250.38 | CN | Nanjing | TCP | |
| 160.243.125.140 | JP | TCP | ||
| 129.110.207.54 | US | Richardson | TCP | |
| 177.137.10.5.net11.com.br | 177.137.10.5 | BR | Guapor | TCP |
| 168.172.35.10 | ZA | Pretoria | TCP | |
| 5.24.109.223 | TR | Istanbul | TCP | |
| 211.117.216.179 | KR | Ulsan | TCP | |
| LFbn-1-18244-242.w90-100.abo.wanadoo.fr | 90.100.44.242 | FR | TCP | |
| c-69-250-57-85.hsd1.md.comcast.net | 69.250.57.85 | US | Ellicott City | TCP |
| 111.39.206.88 | CN | TCP | ||
| 214.225.171.243 | US | TCP | ||
| 191.134.88.245 | BR | TCP | ||
| i114-189-20-23.s41.a042.ap.plala.or.jp | 114.189.20.23 | JP | Nagoya | TCP |
| 222.38.152.90 | CN | Beijing | TCP | |
| 159.226.188.82 | CN | Beijing | TCP | |
| 220.124.190.196 | KR | TCP | ||
| agvn99.neoplus.adsl.tpnet.pl | 31.63.167.99 | PL | TCP | |
| l37-193-199-128.novotelecom.ru | 37.193.199.128 | RU | Novosibirsk | TCP |
| 193.116.124.86 | GB | TCP | ||
| 157.238.171.164 | US | Fort Lauderdale | TCP | |
| 191.179.28.23 | BR | Sapucaia | TCP | |
| 119.194.199.153 | KR | Seongnam | TCP | |
| KD036012249097.au-net.ne.jp | 36.12.249.97 | JP | Sumida | TCP |
| 4.35.226.31 | US | Clearwater | TCP | |
| 183.142.190.16 | CN | Huzhou | TCP | |
| 04-023.200.popsite.net | 66.19.111.23 | US | Schaumburg | TCP |
| 22.125.174.199 | US | TCP | ||
| 61.241.192.65 | CN | Fuzhou | TCP | |
| 68-245-249-125.pools.spcsdns.net | 68.245.249.125 | US | TCP | |
| 43.75.218.117 | JP | Tokyo | TCP | |
| 206.213.25.159 | US | Phoenix | TCP | |
| i220-109-1-40.s41.a001.ap.plala.or.jp | 220.109.1.40 | JP | Kawagoe | TCP |
| 129.176.96.12 | US | Rochester | TCP | |
| 146.214.142.84 | US | Hazelwood | TCP | |
| pc24115.justice.tas.gov.au | 147.109.24.115 | AU | Sandy Bay | TCP |
| 77-59-71-111.dclient.hispeed.ch | 77.59.71.111 | CH | TCP | |
| 178.112.82.32.wireless.dyn.drei.com | 178.112.82.32 | AT | TCP | |
| vc-gp-s-41-29-40-40.umts.vodacom.co.za | 41.29.40.40 | ZA | Johannesburg | TCP |
| 15.147.33.148 | US | Palo Alto | TCP | |
| 169.2.208.175 | US | Rancho Cordova | TCP | |
| 133.141.81.122 | JP | TCP | ||
| 112.62.228.13 | CN | TCP | ||
| 180.191.132.31 | PH | Carmona | TCP | |
| 59.178.50.150 | IN | Delhi | TCP | |
| 135.209.4.254 | US | TCP | ||
| 216.6.240.127 | US | Syracuse | TCP | |
| 86.156.43.85 | GB | Crewe | TCP | |
| 12.169.43.169 | US | Costa Mesa | TCP | |
| 33.185.1.204 | US | TCP | ||
| 135.140.93.85 | US | TCP | ||
| 81.51.128.211 | FR | Noiron-sous-gevrey | TCP | |
| 164.45.253.5 | US | TCP | ||
| ucmail05.sendcloud.org | 107.155.57.45 | US | Los Angeles | TCP |
| host86-131-134-64.range86-131.btcentralplus.com | 86.131.134.64 | GB | Ceres | TCP |
| static-64-223-203-132.port.east.myfairpoint.net | 64.223.203.132 | US | TCP | |
| 137.182.171.164 | US | Cincinnati | TCP | |
| 119.117.10.23 | CN | Shenyang | TCP | |
| 128.32.169.251 | US | Berkeley | TCP | |
| 118.18.43.167 | JP | Hamamatsu | TCP | |
| 25.188.220.248 | GB | TCP | ||
| kun68-1-78-217-48-179.fbx.proxad.net | 78.217.48.179 | FR | Baltzenheim | TCP |
| 111.188.83.45 | JP | TCP | ||
| 135.57.154.103 | US | TCP | ||
| 223.73.149.134 | CN | Jiangmen | TCP | |
| 175.183.237.30 | TW | Taipei | TCP | |
| 69.36.254.16 | US | Belmont | TCP | |
| dsl-187-228-31-65-dyn.prod-infinitum.com.mx | 187.228.31.65 | MX | Mexico | TCP |
| 214.226.130.19 | US | TCP | ||
| 140.40.174.78 | US | TCP | ||
| 161.198.47.10 | US | Wichita | TCP | |
| 130.171.83.110 | US | Palo Alto | TCP | |
| 63.12.13.226 | US | TCP | ||
| 191.229.69.142 | BR | So Vicente | TCP | |
| 103.41.244.222 | BD | Dhaka | TCP | |
| dsl-201-128-206-14.prod-infinitum.com.mx | 201.128.206.14 | MX | Celaya | TCP |
| ip68-229-56-135.lv.lv.cox.net | 68.229.56.135 | US | Las Vegas | TCP |
| 49.215.143.45 | TW | Taipei | TCP | |
| 62.44.91.39 | GB | TCP | ||
| 44.107.155.235 | US | San Diego | TCP | |
| 144.128.192.145 | US | TCP | ||
| ppp-135-225.28-151.wind.it | 151.28.225.135 | IT | Rome | TCP |
| 131.84.225.53 | US | TCP | ||
| softbank221109088232.bbtec.net | 221.109.88.232 | JP | Tokyo | TCP |
| 195.113.91.82 | CZ | Prague | TCP | |
| 149.254.211.52 | GB | TCP | ||
| adsl-178-39-98-246.adslplus.ch | 178.39.98.246 | CH | Zurich | TCP |
| host-156.202.81.107-static.tedata.net | 156.202.107.81 | EG | TCP | |
| host-90-234-191-207.mobileonline.telia.com | 90.234.191.207 | SE | TCP | |
| 192.196.123.187 | FR | TCP | ||
| 150.55.187.178 | JP | TCP | ||
| 39.99.91.68 | CN | Hangzhou | TCP | |
| 42.208.125.148 | CN | Beijing | TCP | |
| 115.65.26.225 | JP | Tokyo | TCP | |
| 198.191.229.232 | US | Richardson | TCP | |
| a88-112-118-4.elisa-laajakaista.fi | 88.112.118.4 | FI | Jyvskyl | TCP |
| p227064-ipngn200206takakise.saga.ocn.ne.jp | 180.4.49.64 | JP | Fukuroi | TCP |
| 183.71.60.10 | CN | Chongqing | TCP | |
| 64.40.39.169 | US | Seattle | TCP | |
| 11.221.91.131 | US | TCP | ||
| 8.27.36.172 | US | Chicago | TCP | |
| 101.172.69.240 | AU | Box Hill | TCP | |
| 114.54.94.172 | CN | Beijing | TCP | |
| 158.210.94.136 | JP | TCP | ||
| 120.94.140.138 | CN | Chongqing | TCP | |
| 187-77-200-167.user3g.veloxzone.com.br | 187.77.200.167 | BR | Mau | TCP |
| 84.52.35.225 | EE | Tallinn | TCP | |
| 28.87.27.157 | US | TCP | ||
| 187.63.89.206 | BR | Brotas | TCP | |
| 163.54.232.192 | JP | Aomori | TCP | |
| 63.159.249.199 | US | TCP | ||
| 18.188.161.146 | US | Cambridge | TCP | |
| 212-88-21-124.adsl.highway.telekom.at | 212.88.21.124 | AT | Siebenhirten | TCP |
| 149.251.53.45 | FR | TCP | ||
| 140.18.154.22 | US | TCP | ||
| 131.167.121.206 | US | Columbus | TCP | |
| 0.0.72.87 | TCP | |||
| 55.1.243.7 | US | Fort Huachuca | TCP | |
| 46.43.133.20 | GB | TCP | ||
| 172.35.8.218 | US | TCP | ||
| 53.18.116.180 | DE | TCP | ||
| 162.186.50.129 | US | TCP | ||
| ec2-54-219-243-46.us-west-1.compute.amazonaws.com | 54.219.243.46 | US | San Jose | TCP |
| 148.123.116.101 | NO | TCP | ||
| 134.165.31.42 | US | Montgomery | TCP | |
| 159.201.190.107 | US | Woodland Hills | TCP | |
| 4.114.76.98 | US | TCP | ||
| 63.45.199.74 | US | TCP | ||
| 119247029151.ctinets.com | 119.247.29.151 | HK | Central District | TCP |
| 14.sub-166-156-254.myvzw.com | 166.156.254.14 | US | TCP | |
| 205.118.252.12 | US | South Jordan | TCP | |
| 31.177.133.239 | TR | TCP | ||
| 148.138.130.119 | SE | Gothenburg | TCP | |
| 184-156-115-208.dyn.centurytel.net | 184.156.115.208 | US | TCP | |
| 95.218.164.7 | SA | Riyadh | TCP | |
| 156.29.110.145 | US | San Diego | TCP | |
| 22.211.71.44 | US | TCP | ||
| 133.33.104.211 | JP | TCP | ||
| em1-112-213-38.pool.e-mobile.ne.jp | 1.112.213.38 | JP | TCP | |
| 180.231.130.163 | KR | Seoul | TCP | |
| 69.139.214.177 | US | TCP | ||
| 47.209.78.169 | US | Lake Charles | TCP | |
| ma-145-5-125-16.mobile-devices.eur.nl | 145.5.125.16 | NL | Rotterdam | TCP |
| 216.4.5.101 | US | TCP | ||
| 94.51.103.114 | RU | TCP | ||
| 5.123.11.108 | IR | TCP | ||
| 146.251.4.86 | SA | TCP | ||
| 16.232.66.253 | US | Palo Alto | TCP | |
| 203.149.184.242 | SG | Singapore | TCP | |
| 0.0.169.124 | TCP | |||
| 100.197.40.67 | US | TCP | ||
| ABordeaux-658-1-68-109.w83-200.abo.wanadoo.fr | 83.200.159.109 | FR | TCP | |
| 40.44.111.76 | US | TCP | ||
| p57B2C8D2.dip0.t-ipconnect.de | 87.178.200.210 | DE | TCP | |
| 37.19.232.29 | UA | TCP | ||
| 131.108.156.10 | BR | Cruz Machado | TCP | |
| host-197.53.191.185.tedata.net | 197.53.191.185 | EG | Cairo | TCP |
| 168.106.87.139 | HK | TCP | ||
| 173-132-55-78.pools.spcsdns.net | 173.132.55.78 | US | TCP | |
| 156.237.29.232 | US | TCP | ||
| 46.68.200.176 | GB | TCP | ||
| london1611w-lp130-03-64-231-140-197.dsl.bell.ca | 64.231.140.197 | CA | London | TCP |
| 72.29.133.98 | US | El Segundo | TCP | |
| 26.182.46.167 | US | TCP | ||
| 45.108.12.127 | EG | Cairo | TCP | |
| 33.62.21.80 | US | TCP | ||
| 134.151.233.72 | GB | Aston | TCP | |
| 1.3.233.253 | CN | Guangzhou | TCP | |
| ec2-52-200-33-90.compute-1.amazonaws.com | 52.200.33.90 | US | Ashburn | TCP |
| 52.120.171.234 | US | Redmond | TCP | |
| 195.237.80.207 | FI | TCP | ||
| 136.142.51.199 | US | Pittsburgh | TCP | |
| 26.198.127.13 | US | TCP | ||
| 44.207.58.154 | US | San Diego | TCP | |
| 178.99.254.47 | GB | Dukinfield | TCP | |
| 155.33.199.53 | US | Boston | TCP | |
| 25.111.12.24 | GB | TCP | ||
| softbank218137248158.bbtec.net | 218.137.248.158 | JP | TCP | |
| p54B3DA3A.dip0.t-ipconnect.de | 84.179.218.58 | DE | TCP | |
| dsl-187-205-58-55-dyn.prod-infinitum.com.mx | 187.205.58.55 | MX | Ocotln | TCP |
| 0.0.100.246 | TCP | |||
| 130.144.76.115 | NL | Eindhoven | TCP | |
| 48.103.121.55 | US | Newark | TCP | |
| 0.0.150.220 | TCP | |||
| 13.51.246.246 | US | Norwalk | TCP | |
| 202.209.78.35 | JP | Kawasaki | TCP | |
| 109.39.90.212 | NL | TCP | ||
| 105.35.103.31 | EG | TCP | ||
| 61.83.14.231 | KR | TCP | ||
| vp214070.kln.uac75.hknet.com | 203.169.214.70 | HK | Kwai Chung | TCP |
| 10.193.142.227 | TCP | |||
| 190.98.53.245 | SR | Paramaribo | TCP | |
| 114.240.179.209 | CN | Beijing | TCP | |
| 198.213.59.254 | US | Tyler | TCP | |
| 163.173.125.123 | FR | Paris | TCP | |
| 103.44.100.74 | ID | TCP | ||
| host-156.211.78.235-static.tedata.net | 156.211.235.78 | EG | Zagazig | TCP |
| 104.149.250.179 | US | Walnut | TCP | |
| 28.139.193.51 | US | TCP | ||
| ip-37-28-170-90.nwgsm.ru | 37.28.170.90 | RU | TCP | |
| 28.54.248.169 | US | TCP | ||
| softbank220061202151.bbtec.net | 220.61.202.151 | JP | TCP | |
| 69.sub-166-211-161.myvzw.com | 166.211.161.69 | US | TCP | |
| 179-41-167-29.speedy.com.ar | 179.41.167.29 | AR | San Justo | TCP |
| 203.63.220.100 | AU | TCP | ||
| p19116-ipngn4601marunouchi.tokyo.ocn.ne.jp | 153.160.90.116 | JP | Tokyo | TCP |
| host-95-202-29-150.mobileonline.telia.com | 95.202.29.150 | SE | Sjbo | TCP |
| 21Cust2041.an4.lax32.da.uu.net | 63.5.127.249 | US | TCP | |
| 53.123.202.168 | DE | TCP | ||
| 89.45.103.150 | RO | Constanta | TCP | |
| 168.106.113.13 | HK | TCP | ||
| 130.142.250.91 | NL | Eindhoven | TCP | |
| 125.189.97.132 | KR | TCP | ||
| 0.0.117.56 | TCP | |||
| 43.96.178.151 | JP | Tokyo | TCP | |
| 45.156.60.251 | TCP | |||
| 212.136.250.47 | NL | TCP | ||
| 174.12.201.165 | US | TCP | ||
| 0.0.152.55 | TCP | |||
| ec2-52-206-49-176.compute-1.amazonaws.com | 52.206.49.176 | US | Ashburn | TCP |
| 47.126.74.13 | CN | Hangzhou | TCP | |
| 146.28.129.250 | US | San Ramon | TCP | |
| 188.146.220.20 | PL | Polska | TCP | |
| 203.233.94.17 | KR | TCP | ||
| adsl-68-127-34-11.dsl.irvnca.pacbell.net | 68.127.34.11 | US | TCP | |
| 220.82.119.110 | KR | TCP | ||
| vok7.vok.east.ru | 195.170.49.86 | RU | Moscow | TCP |
| fixed-187-190-92-5.totalplay.net | 187.190.92.5 | MX | Mexico | TCP |
| 40.243.183.213 | US | TCP | ||
| 213.239.178.124 | NL | TCP | ||
| 29.222.194.9 | US | TCP | ||
| 164.242.89.13 | US | TCP | ||
| 139.79.198.3 | CH | TCP | ||
| s51474cf5.adsl.online.nl | 81.71.76.245 | NL | Dordrecht | TCP |
| 22.251.118.239 | US | TCP | ||
| 122.101.146.8 | KR | Seoul | TCP | |
| 23.128.118.145 | TCP | |||
| 151.131.167.169 | US | Rockford | TCP | |
| 47.209.103.210 | US | Lake Charles | TCP | |
| 136.233.165.185 | US | Palo Alto | TCP | |
| 207.2.174.240 | US | Chesterfield | TCP | |
| 0.0.178.185 | TCP | |||
| 194.87.73.209 | RU | Moscow | TCP | |
| 143.86.103.223 | US | Fort Huachuca | TCP | |
| 196.31.76.49 | ZA | TCP | ||
| 215.218.18.4 | US | TCP | ||
| 171.241.69.166 | VN | Hanoi | TCP | |
| 20.172.182.33 | US | Falls Church | TCP | |
| 60-59-234-251.rev.home.ne.jp | 60.59.234.251 | JP | TCP | |
| 0.0.71.111 | TCP | |||
| 76-251-167-115.lightspeed.austtx.sbcglobal.net | 76.251.167.115 | US | TCP | |
| 0.0.61.174 | TCP | |||
| A05D91BD.state.nj.us | 160.93.145.189 | US | Trenton | TCP |
| 8.151.64.41 | US | TCP | ||
| host-81.10.32.78.tedata.net | 81.10.32.78 | EG | Cairo | TCP |
| 83.113.101.240 | FR | Bormes-les-mimosas | TCP | |
| 35.156.52.219 | DE | Frankfurt | TCP | |
| 168.132.163.149 | AU | TCP | ||
| 68.76.175.155 | US | TCP | ||
| 63.9.38.141 | US | TCP | ||
| 211.211.7.147 | KR | Yongin | TCP | |
| dhcp-emea-uk-csvpn-occnv2-gw2-141-147-196-108.vpn.oracle.com | 141.147.196.108 | SE | Kista | TCP |
| 94-35-93-138.client-mvno.tiscali.it | 94.35.93.138 | IT | TCP | |
| 213.121.250.16 | GB | TCP | ||
| 135.17.103.7 | US | Daly City | TCP | |
| 175.61.30.233 | CN | Beijing | TCP | |
| 56.130.64.7 | US | Raleigh | TCP | |
| 121.37.47.171 | CN | Shenzhen | TCP | |
| 11.215.175.208 | US | TCP | ||
| 50.239.79.125 | US | TCP | ||
| 159.254.52.124 | GB | Aylesbury | TCP | |
| ANice-654-1-106-158.w86-203.abo.wanadoo.fr | 86.203.41.158 | FR | Saint-raphal | TCP |
| softbank218137177200.bbtec.net | 218.137.177.200 | JP | TCP | |
| 25.6.41.169 | GB | TCP | ||
| 180.50.120.195 | JP | TCP | ||
| 185.33.86.51 | DE | TCP | ||
| 0.0.202.157 | TCP | |||
| 201.203.101.205 | CR | Alajuela | TCP | |
| 22.189.220.178 | US | TCP | ||
| 72.64.232.175 | US | Pinellas Park | TCP | |
| 196.254.35.16 | ZA | TCP | ||
| 25.151.52.231 | GB | TCP | ||
| 0.0.233.160 | TCP | |||
| 161.211.213.121 | US | Saint Paul | TCP | |
| 34.68.176.161 | US | TCP | ||
| 147.50.236.235 | TH | TCP | ||
| 201.150.26.157 | BR | TCP | ||
| 0.0.214.158 | TCP | |||
| 137.85.53.228 | US | Cheyenne | TCP | |
| 169.177.177.163 | US | Reston | TCP | |
| 113.213.12.191 | CN | Changchun | TCP | |
| 34.186.149.219 | US | TCP | ||
| 120.58.69.235 | IN | TCP | ||
| 150.182.204.74 | US | Chattanooga | TCP | |
| 145.166.early-registration.of.surfnet.invalid | 145.166.244.126 | NL | Utrecht | TCP |
| 15.71.167.164 | US | Palo Alto | TCP | |
| 219.227.42.100 | CN | Shenzhen | TCP | |
| 136.93.72.238 | US | Dearborn | TCP | |
| 56.221.108.131 | US | Raleigh | TCP | |
| 51.194.247.4 | GB | TCP | ||
| dhcp-64-101-245-156.cisco.com | 64.101.245.156 | US | Wylie | TCP |
| ppp-2-84-161-167.home.otenet.gr | 2.84.161.167 | GR | Athens | TCP |
| 214.98.63.34 | US | TCP | ||
| c-73-131-82-156.hsd1.sc.comcast.net | 73.131.82.156 | US | North Charleston | TCP |
| 201-4-45-170.user.veloxzone.com.br | 201.4.45.170 | BR | Belo Horizonte | TCP |
| dslb-092-078-139-009.092.078.pools.vodafone-ip.de | 92.78.139.9 | DE | Berlin | TCP |
| 1.18.18.114 | KR | Seoul | TCP | |
| x-128-101-201-129.reshalls.umn.edu | 128.101.201.129 | US | Minneapolis | TCP |
| 54.117.115.24 | US | Woodbridge | TCP | |
| 18.210.226.205 | US | Cambridge | TCP | |
| 134.43.118.66 | US | White Plains | TCP | |
| 0.0.109.230 | TCP | |||
| 213.122.51.91 | GB | TCP | ||
| 184-79-27-115.txr.clearwire-wmx.net | 184.79.27.115 | US | Belton | TCP |
| 129.42.89.30 | US | Durham | TCP | |
| 36.188.160.57 | CN | TCP | ||
| 213-47-189-74.cable.dynamic.surfer.at | 213.47.189.74 | AT | Vienna | TCP |
| d-65-175-229-0.cpe.metrocast.net | 65.175.229.0 | US | Rochester | TCP |
| 139.191.118.239 | EU | TCP | ||
| 0.0.182.221 | TCP | |||
| 43.79.238.8 | JP | Tokyo | TCP | |
| 0.0.71.204 | TCP | |||
| 0.0.237.226 | TCP | |||
| 10.106.168.84 | TCP | |||
| 29.146.180.47 | US | TCP | ||
| 218.194.144.179 | CN | Chongqing | TCP | |
| 47.14.54.179 | CA | Ottawa | TCP | |
| 222.129.176.143 | CN | Beijing | TCP | |
| 148.159.197.194 | US | Philadelphia | TCP | |
| 20.36.29.36 | US | Falls Church | TCP | |
| 190.209.176.136 | CL | Santiago | TCP | |
| ppp-82-84-122-175.dialup.tiscali.it | 82.84.122.175 | IT | TCP | |
| 60-60-173-166.rev.home.ne.jp | 60.60.173.166 | JP | TCP | |
| c-50-189-66-102.hsd1.ct.comcast.net | 50.189.66.102 | US | Middlebury | TCP |
| 170.103.111.105 | US | Defiance | TCP | |
| 201.56.48.93 | BR | TCP | ||
| rrcs-71-41-231-105.sw.biz.rr.com | 71.41.231.105 | US | San Antonio | TCP |
| 142.96.221.40 | CA | TCP | ||
| 111-244-69-221.dynamic-ip.hinet.net | 111.244.69.221 | TW | TCP | |
| 220.67.173.117 | KR | TCP | ||
| 187.171.33.196 | MX | Crdoba | TCP | |
| 202.155.69.42 | ID | Kebon Baru | TCP | |
| 85.39.241.106 | IT | TCP | ||
| 150.116.41.114 | TW | Taipei | TCP | |
| 199.193.31.252 | US | Redwood City | TCP | |
| 94.227.244.188 | BE | Torhout | TCP | |
| 0.0.105.212 | TCP | |||
| 137.232.1.212 | US | TCP | ||
| element-r.miragenat.com | 170.150.120.177 | CL | TCP | |
| 223.68.88.121 | CN | Zhenjiang | TCP | |
| 102.137.113.165 | TCP | |||
| 57.98.221.33 | FR | TCP | ||
| 0.0.193.131 | TCP | |||
| 129.87.152.98 | US | Houston | TCP | |
| 59.200.38.163 | CN | Beijing | TCP | |
| 170.23.166.107 | US | Madison | TCP | |
| 0.0.68.135 | TCP | |||
| 149.29.29.221 | US | TCP | ||
| 0.0.94.246 | TCP | |||
| 146.49.156.38 | US | TCP | ||
| 152.210.50.200 | US | Ashburn | TCP | |
| 205.8.126.10 | US | TCP | ||
| 166.125.145.75 | KR | TCP | ||
| 79.105.54.183 | RU | Tynda | TCP | |
| dsl-187-192-215-188-dyn.prod-infinitum.com.mx | 187.192.215.188 | MX | Celaya | TCP |
| 44.98.114.147 | US | San Diego | TCP | |
| 202.175.93.170 | MO | TCP | ||
| 157.242.237.83 | US | Los Angeles | TCP | |
| 54.4.48.235 | US | Woodbridge | TCP | |
| 51.219.5.198 | GB | TCP | ||
| 99.108.135.118 | US | TCP | ||
| 173.72.58.77 | US | Woodbury | TCP | |
| 19.238.10.12 | US | Dearborn | TCP | |
| 16.79.104.158 | US | Palo Alto | TCP | |
| 111.25.2.10 | CN | TCP | ||
| 94.231.204.54.serverel.net | 94.231.204.54 | RU | TCP | |
| ec2-52-18-124-136.eu-west-1.compute.amazonaws.com | 52.18.124.136 | IE | Dublin | TCP |
| 0.0.147.134 | TCP | |||
| 122.99.92.5 | AU | Queanbeyan | TCP | |
| 48.101.199.37 | US | Newark | TCP | |
| 186.102.42.136 | CO | Bogot | TCP | |
| 199.100.106.186 | US | TCP | ||
| 167.197.97.229 | US | Atlanta | TCP | |
| 0.0.202.69 | TCP | |||
| 174.149.168.161 | US | Pueblo | TCP | |
| 12.122.103.246 | US | TCP | ||
| 197.232.156.37 | KE | TCP | ||
| 199.114.51.38 | US | Fort Huachuca | TCP | |
| 205.138.19.84 | US | Chesterfield | TCP | |
| host117-133-dynamic.27-79-r.retail.telecomitalia.it | 79.27.133.117 | IT | Massa | TCP |
| 191.24.34.207 | BR | TCP | ||
| 0.0.161.23 | TCP | |||
| 204.26.35.173 | US | Riverside | TCP | |
| 0.0.163.158 | TCP | |||
| 0.0.123.62 | TCP | |||
| 148.19.92.171 | US | TCP | ||
| 27.118.49.225 | IN | TCP | ||
| 202.245.247.95 | JP | TCP | ||
| 33.178.235.15 | US | TCP | ||
| 52.85-85-64.dynamic.clientes.euskaltel.es | 85.85.64.52 | ES | Erma | TCP |
| 124.2.225.1 | KR | TCP | ||
| 171.137.69.225 | US | Concord | TCP | |
| bba149651.alshamil.net.ae | 217.165.169.45 | AE | Dubai | TCP |
| provedorm4net.95.154.8.177-BGP.provedorm4net.com.br | 177.8.154.95 | BR | Fernando Pedroza | TCP |
| 39.27.199.119 | KR | TCP | ||
| x4dbe5a89.dyn.telefonica.de | 77.190.90.137 | DE | TCP | |
| 38.100.49.52 | US | TCP | ||
| 158.113.125.220 | US | New York | TCP | |
| static-71-176-118-107.syrcny.fios.verizon.net | 71.176.118.107 | US | Syracuse | TCP |
| 0.0.164.19 | TCP | |||
| 202.60.234.057.static.cyberec.com | 202.60.234.57 | HK | TCP | |
| CPEbc4dfbc93983-CMbc4dfbc93980.cpe.net.cable.rogers.com | 99.235.41.103 | CA | Etobicoke | TCP |
| 150.33.233.64 | JP | TCP | ||
| 89-119-144-17-static.albacom.net | 89.119.144.17 | IT | TCP | |
| 11.198.57.71 | US | TCP | ||
| 175.237.219.12 | KR | TCP | ||
| 139.178.98.193 | NL | Utrecht | TCP | |
| 122.55.114.105.static.pldt.net | 122.55.114.105 | PH | TCP | |
| 212.246.184.87 | FI | TCP | ||
| 0.0.142.105 | TCP | |||
| 1.221.206.188 | KR | Seoul | TCP | |
| 24-196-244-248.dhcp.reno.nv.charter.com | 24.196.244.248 | US | Gardnerville | TCP |
| 74.214.76.13 | US | Laie | TCP | |
| 160.159.135.15 | TN | TCP | ||
| 219.99.249.248 | JP | Anjo | TCP | |
| 0.0.189.144 | TCP | |||
| 125.89.42.213 | CN | Guangzhou | TCP | |
| 148.208.71.44 | MX | Mexico | TCP | |
| 154.227.49.50 | UG | TCP | ||
| 0.0.41.132 | TCP | |||
| host109-148-227-204.range109-148.btcentralplus.com | 109.148.227.204 | GB | Farnham | TCP |
| 0.0.111.8 | TCP | |||
| 158.216.89.115 | CH | TCP | ||
| 206.191.83.59 | CA | Stouffville | TCP | |
| 117.229.239.170 | IN | Chandigarh | TCP | |
| c-4f662ddb-74736162.cust.telenor.se | 79.102.45.219 | SE | Stockholm | TCP |
| 162.68.121.78.rev.sfr.net | 78.121.68.162 | FR | Saint Etienne | TCP |
| 210.136.30.93.rev.sfr.net | 93.30.136.210 | FR | TCP | |
| 78-25-164-219.colomna.net | 78.25.164.219 | RU | Kolomna | TCP |
| 167.223.8.163 | US | Walnut Creek | TCP | |
| lns-bzn-44-82-249-243-205.adsl.proxad.net | 82.249.243.205 | FR | TCP | |
| 100.146.169.108 | US | TCP | ||
| 204.52.21.4 | US | TCP | ||
| p549C7E6F.dip0.t-ipconnect.de | 84.156.126.111 | DE | Meppen | TCP |
| 208.sub-97-235-78.myvzw.com | 97.235.78.208 | US | TCP | |
| 72-15-63-166.beanfield.net | 72.15.63.166 | CA | Toronto | TCP |
| 147.41.52.183 | AU | Hobart | TCP | |
| 44.134.129.230 | US | San Diego | TCP | |
| 102.208.122.196 | TCP | |||
| 22.242.75.198 | US | TCP | ||
| 0.0.11.107 | TCP | |||
| 9.217.254.1 | US | Durham | TCP | |
| 0.0.120.56 | TCP | |||
| 110.196.175.201 | CN | Beijing | TCP | |
| 78-62-232-149.static.zebra.lt | 78.62.232.149 | LT | TCP | |
| 110.196.97.120 | CN | Beijing | TCP | |
| 150.57.120.190 | JP | TCP | ||
| 140.206.207.174 | CN | Shanghai | TCP | |
| 168.84.16.24 | US | San Diego | TCP | |
| 10.113.114.238 | TCP | |||
| 43.254.238.240 | CN | Beijing | TCP | |
| 113.138.221.153 | CN | Xian | TCP | |
| 110.10.69.207 | KR | Seoul | TCP | |
| 50-87-229-185.unifiedlayer.com | 50.87.229.185 | US | Provo | TCP |
| 0.0.85.243 | TCP | |||
| softbank060084046226.bbtec.net | 60.84.46.226 | JP | TCP | |
| 0.0.160.241 | TCP | |||
| 0.0.103.165 | TCP | |||
| 0.0.82.236 | TCP | |||
| cpe-107-11-146-10.columbus.res.rr.com | 107.11.146.10 | US | Columbus | TCP |
| 205.209.4.84.rev.sfr.net | 84.4.209.205 | FR | Poitiers | TCP |
| 43.203.87.188 | JP | Tokyo | TCP | |
| 0.151.32.207 | TCP | |||
| 41.106.176.149 | DZ | TCP | ||
| ll-static-213-183-183-059.ewe-ip-backbone.de | 213.183.183.59 | DE | TCP | |
| 17.85.25.144 | US | Cupertino | TCP | |
| 188.135.254.193 | IT | Pistoia | TCP | |
| 139.123.93.134 | FI | TCP | ||
| 105.15.134.141 | ZA | Cape Town | TCP | |
| 187.23.254.238 | BR | Itapetininga | TCP | |
| 210-66-138-106.adsl.dynamic.seed.net.tw | 210.66.138.106 | TW | Taipei | TCP |
| 11.254.193.86 | US | TCP | ||
| 154.22.0.156 | US | TCP | ||
| 55.11.166.117 | US | Fort Huachuca | TCP | |
| 47.136.188.122 | US | Moreno Valley | TCP | |
| 214.110.128.79 | US | TCP | ||
| 53.234.224.12 | DE | TCP | ||
| 0.0.121.101 | TCP | |||
| 70.44.56.166.res-cmts.sett.ptd.net | 70.44.56.166 | US | Vernon | TCP |
| 20.132.15.87 | US | Falls Church | TCP | |
| 221.1.141.84 | CN | Dezhou | TCP | |
| 206.236.40.236 | US | TCP | ||
| 140.97.73.248 | GB | London | TCP | |
| 0.0.79.159 | TCP | |||
| 46.100.147.65 | IR | TCP | ||
| 122.15.231.77 | IN | TCP | ||
| 178.238.197.48 | IR | TCP | ||
| 155.62.92.106 | US | San Jose | TCP | |
| 11.153.108.2 | US | TCP | ||
| 0.0.221.101 | TCP | |||
| 37.196.118.117 | SE | Bro | TCP | |
| 137.167.75.137 | US | Plano | TCP | |
| 0.0.22.23 | TCP | |||
| 198.117.164.34 | US | Slidell | TCP | |
| 0.0.227.209 | TCP | |||
| 50.225.189.18 | US | TCP | ||
| 0.0.188.245 | TCP | |||
| 43.218.96.28 | JP | Tokyo | TCP | |
| 12.144.42.15 | US | TCP | ||
| 84.51.141.234 | GB | Northampton | TCP | |
| 49.118.207.187 | CN | rmqi | TCP | |
| 140.51.222.81 | US | TCP | ||
| 18.8.235.118 | US | Cambridge | TCP | |
| 69.95.35.211 | US | TCP | ||
| 160.161.137.11 | MA | TCP | ||
| 41.192.201.146 | ZA | Durban | TCP | |
| 193.66.245.211 | FI | TCP | ||
| 76.40.48.205 | US | TCP | ||
| 75-27-0-207.lightspeed.iplsin.sbcglobal.net | 75.27.0.207 | US | TCP | |
| 40.90.93.249 | US | TCP | ||
| 0.0.25.92 | TCP | |||
| 101.59.1.60 | IN | Mundargi | TCP | |
| 145.235.11.118 | SE | Linkping | TCP | |
| 106.76.140.158 | IN | TCP | ||
| 111.4.211.51 | CN | TCP | ||
| 137.35.57.78 | US | Saint Louis | TCP | |
| 0.0.98.209 | TCP | |||
| 18.42.203.130 | US | Cambridge | TCP | |
| 45.215.82.242 | ZM | TCP | ||
| 55.231.40.138 | US | Fort Huachuca | TCP | |
| 189.7.197.204 | BR | Passo Fundo | TCP | |
| 8.198.188.66 | US | TCP | ||
| 0.0.253.43 | TCP | |||
| roc30-1-78-217-26-88.fbx.proxad.net | 78.217.26.88 | FR | Rochefort-du-gard | TCP |
| 11.70.130.74 | US | TCP | ||
| 157.121.17.107 | US | Middletown | TCP | |
| 67-197-129-213.ln.dsl.dyn.comporium.net | 67.197.129.213 | US | Fort Mill | TCP |
| 0.0.177.71 | TCP | |||
| 97.95.22.212 | US | Saginaw | TCP | |
| 82.159.186.115.static.user.ono.com | 82.159.186.115 | ES | Cieza | TCP |
| 0.0.2.107 | TCP | |||
| 60.200.7.165 | CN | Nanchang | TCP | |
| 207.51.81.196 | US | Chesterfield | TCP | |
| 0.0.81.102 | TCP | |||
| 0.0.243.99 | TCP | |||
| pdf86b968.hyognt01.ap.so-net.ne.jp | 223.134.185.104 | JP | Tokyo | TCP |
| 49.178.254.5-pppoe-dynamic.uvttk.ru | 5.254.178.49 | RU | Liski | TCP |
| 7.192.140.48 | US | TCP | ||
| 25.168.58.10 | GB | TCP | ||
| host188.186-153-34.telecom.net.ar | 186.153.34.188 | AR | Buenos Aires | TCP |
| 110.223.42.69.static.awknet.com | 69.42.223.110 | US | Los Angeles | TCP |
| 9.46.39.27 | US | Durham | TCP | |
| 152.135.34.232 | US | Santa Clara | TCP | |
| 40.red-80-58-170.staticip.rima-tde.net | 80.58.170.40 | ES | TCP | |
| 16.101.133.110 | US | Palo Alto | TCP | |
| 165.245.237.79 | US | New York | TCP | |
| 76.184.14.148 | US | Arlington | TCP | |
| 42.155.113.47 | MY | Petaling Jaya | TCP | |
| 163.33.249.171 | US | Santa Clara | TCP | |
| 0.0.221.204 | TCP | |||
| 145.191.early-registration.of.surfnet.invalid | 145.191.98.176 | NL | Utrecht | TCP |
| CPE788df74e05a1-CM788df74e05a0.cpe.net.cable.rogers.com | 99.252.171.108 | CA | Oshawa | TCP |
| 150.226.219.117 | US | Columbus | TCP | |
| 221.49.251.51 | JP | TCP | ||
| 52.155.211.214 | US | Redmond | TCP | |
| 0.0.47.126 | TCP | |||
| 215.213.25.119 | US | TCP | ||
| 171.15.60.253 | CN | Zhengzhou | TCP | |
| 14.11.253.61 | JP | TCP | ||
| 42.120.192.26 | CN | Hangzhou | TCP | |
| 152.96.250.251 | CH | Rapperswil | TCP | |
| 0.0.138.82 | TCP | |||
| 177.158.224.242 | BR | Bayeux | TCP | |
| 193.133.240.59 | GB | TCP | ||
| 200.209.90.144 | BR | TCP | ||
| 119.116.97.10 | CN | Shenyang | TCP | |
| 12.133.205.97 | US | TCP | ||
| 0.0.162.120 | TCP | |||
| 15.126.26.189 | US | Palo Alto | TCP | |
| 142.45.70.184 | CA | Toronto | TCP | |
| 0.0.60.71 | TCP | |||
| 45.31.187.31 | US | TCP | ||
| 0.0.42.138 | TCP | |||
| 76.250.138.222 | US | TCP | ||
| 0.0.161.49 | TCP | |||
| rrcs-24-97-80-6.nys.biz.rr.com | 24.97.80.6 | US | Oxford | TCP |
| 2.43.252.199 | IT | Milan | TCP | |
| 104-60-28-161.lightspeed.lsvlky.sbcglobal.net | 104.60.28.161 | US | Crestwood | TCP |
| 33.135.43.115 | US | TCP | ||
| 92.115.175.0 | MD | Chisinau | TCP | |
| 0.0.239.203 | TCP | |||
| 85.188.201.1 | GB | TCP | ||
| 142.206.155.249 | CA | Ottawa | TCP | |
| 59.127.188.54 | TW | TCP | ||
| 10.203.77.189 | TCP | |||
| 21.145.173.223 | US | TCP | ||
| 34.242.211.30 | US | TCP | ||
| p3449247-ipngn19801marunouchi.tokyo.ocn.ne.jp | 153.228.242.247 | JP | Tokyo | TCP |
| 200.114.130.167 | AR | Zarate | TCP | |
| 0.0.105.127 | TCP | |||
| 171.21.202.102 | NL | Amstelveen | TCP | |
| 183.71.79.217 | CN | Chongqing | TCP | |
| 108-203-44-112.lightspeed.jcvlfl.sbcglobal.net | 108.203.44.112 | US | Baxley | TCP |
| 199.192.10.5.in-addr.arpa | 5.10.192.199 | NL | Amsterdam | TCP |
| 0.0.12.138 | TCP | |||
| 37.sub-174-238-107.myvzw.com | 174.238.107.37 | US | TCP | |
| 77.117.169.244.wireless.dyn.drei.com | 77.117.169.244 | AT | TCP | |
| 124.174.106.14 | CN | Guangzhou | TCP | |
| 149.113.152.205 | US | TCP | ||
| p5B200680.dip0.t-ipconnect.de | 91.32.6.128 | DE | Penig | TCP |
| 86.58.222.122 | DK | Frederiksberg | TCP | |
| 0.0.114.225 | TCP | |||
| 192.109.101.79 | DE | TCP | ||
| 71.147.160.120 | US | TCP | ||
| lvps80-237-164-160.dedicated.hosteurope.de | 80.237.164.160 | DE | Hst | TCP |
| 143.226.39.253 | US | Rock Island | TCP | |
| 0.0.120.113 | TCP | |||
| 13.129.177.32 | US | Norwalk | TCP | |
| 47.52.196.56 | US | San Mateo | TCP | |
| 0.0.234.181 | TCP | |||
| 116.45.187.10 | KR | Seoul | TCP | |
| 148.194.109.206 | US | Little Rock | TCP | |
| 0.0.208.203 | TCP | |||
| 0.0.42.185 | TCP | |||
| 160.200.129.24 | JP | TCP | ||
| 204.99.237.203 | US | TCP | ||
| 195.98.141.70 | SK | TCP | ||
| 171.83.180.36 | CN | Wuhan | TCP | |
| 103.43.248.196 | IN | TCP | ||
| 218.63.9.93.rev.sfr.net | 93.9.63.218 | FR | La Ciotat | TCP |
| 0.0.49.132 | TCP | |||
| 183.75.219.41 | JP | Tokyo | TCP | |
| 129.12.243.149 | GB | Canterbury | TCP | |
| 16.52.13.205 | US | Palo Alto | TCP | |
| ip5b40056e.dynamic.kabel-deutschland.de | 91.64.5.110 | DE | Berlin | TCP |
| 35.250.197.226 | US | TCP | ||
| athei53-e-192.home.otenet.gr | 62.103.139.192 | GR | Athens | TCP |
| 160.72.175.8.lightower.net | 160.72.175.8 | US | Boxborough | TCP |
| adsl-68-253-159-82.dsl.emhril.ameritech.net | 68.253.159.82 | US | Louisville | TCP |
| 0.0.242.35 | TCP | |||
| 53.189.11.219 | DE | TCP | ||
| ec2-52-62-76-136.ap-southeast-2.compute.amazonaws.com | 52.62.76.136 | AU | Sydney | TCP |
| 0.0.213.142 | TCP | |||
| 15.197.245.122 | US | Palo Alto | TCP | |
| ip-85-160-145-236.eurotel.cz | 85.160.145.236 | CZ | TCP | |
| 221.142.91.79.rev.sfr.net | 79.91.142.221 | FR | Igny | TCP |
| 51.10.59.137 | GB | TCP | ||
| 123-51-21-145.static.dsl.net.au | 123.51.21.145 | AU | Young | TCP |
| 11.35.166.199 | US | TCP | ||
| 29.52.75.167 | US | Claremont | TCP | |
| 0.0.173.233 | TCP | |||
| 0.0.251.194 | TCP | |||
| 67.29.207.116 | US | TCP | ||
| 131.84.19.139 | US | Fredericksburg | TCP | |
| 107-211-52-13.lightspeed.tukrga.sbcglobal.net | 107.211.52.13 | US | Tucker | TCP |
| 87.136.147.191 | DE | TCP | ||
| 0.0.241.27 | TCP | |||
| 167.204.247.89 | US | Chicago | TCP | |
| 195.203.143.231 | DE | TCP | ||
| 0.0.95.236 | TCP | |||
| 63.95.160.187 | US | TCP | ||
| 19.164.170.212 | US | Dearborn | TCP | |
| 0.0.195.195 | TCP | |||
| 0.0.214.208 | TCP | |||
| 139.199.117.0 | CN | Beijing | TCP | |
| 219.146.32.189 | CN | Jinan | TCP | |
| 101.32.156.69 | CN | Beijing | TCP | |
| 105.210.79.150 | ZA | Durban | TCP | |
| 142.123.67.194 | CA | TCP | ||
| 204.220.123.110 | US | Buffalo | TCP | |
| 88.235.71.46.dynamic.ttnet.com.tr | 88.235.71.46 | TR | Istanbul | TCP |
| stt15947.broadband.vi | 204.11.159.47 | VI | TCP | |
| 0.0.101.250 | TCP | |||
| 189-213-60-114.static.axtel.net | 189.213.60.114 | MX | Mexico | TCP |
| 27.222.27.183 | CN | Jinan | TCP | |
| 28.246.23.108 | US | TCP | ||
| 41-174-201-123.static.youbroadband.in | 123.201.174.41 | IN | TCP | |
| cpe-76-88-143-232.hawaii.res.rr.com | 76.88.143.232 | US | Aiea | TCP |
| 136.226.82.2 | US | Bartlesville | TCP | |
| 14.150.132.181 | CN | Guangzhou | TCP | |
| 0.0.79.33 | TCP | |||
| 155.71.110.177 | AU | TCP | ||
| 191-210-52-56.user.vivozap.com.br | 191.210.52.56 | BR | Catu | TCP |
| cable.nib-tv.kr | 101.250.181.17 | KR | Incheon | TCP |
| 0.0.209.160 | TCP | |||
| dynamic-186-28-180-212.dynamic.etb.net.co | 186.28.180.212 | CO | Bogot | TCP |
| 131.174.186.88 | NL | Nijmegen | TCP | |
| 149.49.121.2 | IL | Tel Aviv | TCP | |
| 102.247.245.95 | TCP | |||
| 68.183.38.51 | US | San Clemente | TCP | |
| 140.107.59.47 | US | Seattle | TCP | |
| ACCE20E9.ipt.aol.com | 172.206.32.233 | GB | TCP | |
| 0.0.76.133 | TCP | |||
| 0.0.72.91 | TCP | |||
| 42.115.190.17 | VN | Hanoi | TCP | |
| 196.98.146.213 | KE | TCP | ||
| mctnnbsa45w-156-34-241-26.dhcp-dynamic.fibreop.nb.bellaliant.net | 156.34.241.26 | CA | Bouctouche | TCP |
| 0.0.231.5 | TCP | |||
| 143.249.137.128 | US | Fort Huachuca | TCP | |
| 196.199.150.165 | US | San Diego | TCP | |
| 0.0.96.106 | TCP | |||
| 1.100.198.55 | KR | TCP | ||
| 139.174.249.142 | DE | Clausthal | TCP | |
| 64.240.233.24 | US | Chesterfield | TCP | |
| 0.0.162.65 | TCP | |||
| 0.0.66.38 | TCP | |||
| 0.0.138.226 | TCP | |||
| ZE253130.ppp.dion.ne.jp | 220.217.253.130 | JP | TCP | |
| 99.240.31.201 | CA | Moncton | TCP | |
| 167.160.57.122 | GB | London | TCP | |
| 223.252.158.224 | CN | Zhengzhou | TCP | |
| 8.241.84.241 | US | TCP | ||
| 0.0.227.141 | TCP | |||
| c-67-162-21-5.hsd1.il.comcast.net | 67.162.21.5 | US | Lockport | TCP |
| unpredictable.getusadomains.com | 104.203.74.25 | US | Los Angeles | TCP |
| 30.80.32.201 | US | TCP | ||
| AToulouse-651-1-144-24.w109-222.abo.wanadoo.fr | 109.222.223.24 | FR | TCP | |
| 216-210-173-92.atgi.net | 216.210.173.92 | US | Reno | TCP |
| 87.228.32.183 | RU | Mytishchi | TCP | |
| 160.177.53.227 | MA | Casablanca | TCP | |
| 0.0.29.14 | TCP | |||
| cpe-65-184-159-237.ec.res.rr.com | 65.184.159.237 | US | Swansboro | TCP |
| 56.44.63.127 | US | Raleigh | TCP | |
| 30.47.210.226 | US | TCP | ||
| m044E5AEAD8CA.phil5.pa.comcast.net | 96.134.70.246 | US | TCP | |
| abts-tn-dynamic-223.90.178.122.airtelbroadband.in | 122.178.90.223 | IN | Coimbatore | TCP |
| 51.19.4.171 | GB | TCP | ||
| 146.94.148.235 | US | Wilkes Barre | TCP | |
| 0.0.47.89 | TCP | |||
| static-host119-73-16-245.link.net.pk | 119.73.16.245 | PK | Karachi | TCP |
| 155.55.232.109 | NO | TCP | ||
| 156.24.161.106 | US | West Greenwich | TCP | |
| 164.213.136.90 | US | TCP | ||
| 78.164.130.78.dynamic.ttnet.com.tr | 78.164.130.78 | TR | Ahmetalan Ky | TCP |
| 0.0.29.154 | TCP | |||
| 0.0.220.188 | TCP | |||
| 211.85.246.235 | CN | Changsha | TCP | |
| 56.236.112.69 | US | Raleigh | TCP | |
| 254.138.223.114.broad.wx.js.dynamic.163data.com.cn | 114.223.138.254 | CN | Wuxi | TCP |
| 0.0.133.41 | TCP | |||
| dsl-201-152-122-183-dyn.prod-infinitum.com.mx | 201.152.122.183 | MX | San Luis Potos | TCP |
| APoitiers-654-1-108-39.w92-146.abo.wanadoo.fr | 92.146.155.39 | FR | TCP | |
| 0.0.9.243 | TCP | |||
| 8ta-145-159-217.telkomadsl.co.za | 41.145.159.217 | ZA | Pretoria | TCP |
| static-176-183-13-90.ncc.abo.bbox.fr | 176.183.13.90 | FR | Montigny-ls-metz | TCP |
| 0.0.123.248 | TCP | |||
| 0.0.62.165 | TCP | |||
| 145.243.125.241 | DE | TCP | ||
| 0.0.24.32 | TCP | |||
| 0.0.158.130 | TCP | |||
| h99.213.22.98.dynamic.ip.windstream.net | 98.22.213.99 | US | Newark | TCP |
| 190.140.238.141 | PA | TCP | ||
| rrcs-74-142-174-240.central.biz.rr.com | 74.142.174.240 | US | TCP | |
| ns1432.ztomy.com | 166.66.207.24 | US | Lancaster | TCP |
| 215.230.114.24 | US | TCP | ||
| 39.92.244.167 | CN | Jinan | TCP | |
| 15.193.165.4 | US | Palo Alto | TCP | |
| 26.70.34.66 | US | TCP | ||
| 142.34.42.67 | CA | Victoria | TCP | |
| 128.170.240.72 | US | New York | TCP | |
| 213.159.224.192.iptelecom.net.ua | 213.159.224.192 | UA | Kiev | TCP |
| 2.194.169.59 | IT | Rome | TCP | |
| 0.0.125.42 | TCP | |||
| 139.128.228.190 | IT | Corbetta | TCP | |
| 134.123.243.36 | US | Washington | TCP | |
| 36.130.191.14 | CN | TCP | ||
| pa49-186-128-138.pa.vic.optusnet.com.au | 49.186.128.138 | AU | Melbourne | TCP |
| 177-177-30-176.user.veloxzone.com.br | 177.177.30.176 | BR | TCP | |
| 0.0.233.1 | TCP | |||
| 147.152.59.33 | GB | TCP | ||
| host62-185-static.124-81-b.business.telecomitalia.it | 81.124.185.62 | IT | TCP | |
| 139.43.139.15 | US | TCP | ||
| 157.34.191.91 | IN | TCP | ||
| 207.sub-97-232-40.myvzw.com | 97.232.40.207 | US | TCP | |
| c-210571d5.027-122-6c756c1.cust.bredbandsbolaget.se | 213.113.5.33 | SE | Lule | TCP |
| 0.0.93.141 | TCP | |||
| 42.23.78.50 | KR | TCP | ||
| 161.185.253.166 | US | Brooklyn | TCP | |
| 0.0.224.45 | TCP | |||
| 0.0.125.245 | TCP | |||
| 0.0.123.9 | TCP | |||
| 137.249.1.183 | US | Denver | TCP | |
| 65.132.194.138 | US | TCP | ||
| 0.0.28.104 | TCP | |||
| 39.139.144.115 | CN | TCP | ||
| 17.123.28.244 | US | Cupertino | TCP | |
| 59.244.85.249 | CN | Beijing | TCP | |
| 134.140.254.156 | US | Boston | TCP | |
| 0.0.203.58 | TCP | |||
| 0.0.182.49 | TCP | |||
| 0.0.236.55 | TCP | |||
| 185.253.142.218 | TCP | |||
| 154.134.22.156 | TCP | |||
| 145.61.154.173 | NL | Utrecht | TCP | |
| 0.0.110.183 | TCP | |||
| 95.red-213-99-78.dynamicip.rima-tde.net | 213.99.78.95 | ES | TCP | |
| 0.0.59.106 | TCP | |||
| 86.58.143.1 | DK | TCP | ||
| 16.119.219.98 | US | Palo Alto | TCP | |
| KD125052189087.ppp-bb.dion.ne.jp | 125.52.189.87 | JP | Tokyo | TCP |
| pc-53-82-156-186.cm.vtr.net | 186.156.82.53 | CL | Santiago | TCP |
| 208.1.171.242 | US | Pascagoula | TCP | |
| 116.188.206.95 | CN | Chaoyang | TCP | |
| 159.38.156.37 | SE | TCP | ||
| softbank060128034235.bbtec.net | 60.128.34.235 | JP | Nagoya | TCP |
| 65.129.125.117 | US | Boise | TCP | |
| 163.8.7.215 | AU | TCP | ||
| 170.231.81.41 | PE | TCP | ||
| 113.73.111.239 | CN | Zhongshan | TCP | |
| 58.148.65.243 | KR | Seoul | TCP | |
| 8ta-247-250-135.telkomadsl.co.za | 41.247.250.135 | ZA | Kempton Park | TCP |
| 122x221x238x251.ap122.ftth.ucom.ne.jp | 122.221.238.251 | JP | Chiba | TCP |
| 146.26.107.213 | US | San Ramon | TCP | |
| 0.0.232.183 | TCP | |||
| 136.84.167.26 | US | Dearborn | TCP | |
| 19.238.131.11 | US | Dearborn | TCP | |
| 211.184.141.172 | KR | TCP | ||
| 110.179.5.155 | CN | Xian | TCP | |
| 0.0.131.10 | TCP | |||
| 0.0.9.0 | TCP | |||
| 91.229.244.118 | RU | TCP | ||
| 0.0.21.59 | TCP | |||
| 0.0.229.52 | TCP | |||
| 56.227.49.19 | US | Raleigh | TCP | |
| abts-kk-dynamic-147.41.179.122.airtelbroadband.in | 122.179.41.147 | IN | Angol | TCP |
| 0.0.104.191 | TCP | |||
| JUE-ext-Foto.fb9.fh-aachen.de | 149.201.5.82 | DE | Aachen | TCP |
| 129.139.216.102 | US | Fort Huachuca | TCP | |
| 0.0.76.55 | TCP | |||
| 0.0.82.227 | TCP | |||
| 0.0.158.30 | TCP | |||
| 58.148.132.85 | KR | TCP | ||
| 177.195.154.111 | BR | Embu | TCP | |
| 51.152.46.176 | GB | TCP | ||
| 0.0.27.52 | TCP | |||
| 2-49-28-181.fibertel.com.ar | 181.28.49.2 | AR | Buenos Aires | TCP |
| 0.0.19.177 | TCP | |||
| 175.26.174.77 | CN | Renqiu | TCP | |
| 72.59.79.218.broad.xw.sh.dynamic.163data.com.cn | 218.79.59.72 | CN | Shanghai | TCP |
| bb121-6-41-182.singnet.com.sg | 121.6.41.182 | SG | Singapore | TCP |
| 202-160-119-135.colo.onesquared.net | 202.160.119.135 | NZ | TCP | |
| fm-dyn-118-137-82-219.fast.net.id | 118.137.82.219 | ID | Jakarta | TCP |
| 48.156.92.60 | US | Newark | TCP | |
| 2.172.153.94 | DE | TCP | ||
| ip-163-102.sn1.clouditalia.com | 62.94.163.102 | IT | TCP | |
| ppp-67-118-247-109.dialup.pltn13.pacbell.net | 67.118.247.109 | US | TCP | |
| 173.44.189.116 | US | Henderson | TCP | |
| 182-155-104-182.veetime.com | 182.155.104.182 | TW | Taichung | TCP |
| 81.121.84.84 | IT | TCP | ||
| 56.109.32.117 | US | Raleigh | TCP | |
| 92.196.166.222 | DE | TCP | ||
| 0.0.90.159 | TCP | |||
| 100.174.228.36 | US | TCP | ||
| 110.127.237.120 | CN | Beijing | TCP | |
| 198.245.68.216 | CA | TCP | ||
| 96.59.204.214 | US | Riverview | TCP | |
| 0.0.131.249 | TCP | |||
| 208.63.89.76 | US | Waycross | TCP | |
| 165.32.237.22 | US | Concord | TCP | |
| 27.144.124.59 | CN | Beijing | TCP | |
| 167.190.221.134 | US | Des Moines | TCP | |
| 0.0.178.84 | TCP | |||
| 0.0.11.82 | TCP | |||
| 182.150.156.201 | CN | Chengdu | TCP | |
| 0.0.84.98 | TCP | |||
| 184.18.105.47 | US | TCP | ||
| 121.159.85.179 | KR | Daejeon | TCP | |
| 0.0.197.192 | TCP | |||
| 34.122.219.164 | US | TCP | ||
| 114.211.82.230 | CN | Beijing | TCP | |
| 0.0.173.22 | TCP | |||
| host16.181-9-96.telecom.net.ar | 181.9.96.16 | AR | TCP | |
| 35.51.67.243 | US | Ann Arbor | TCP | |
| 5.72.217.165 | IR | Tehran | TCP | |
| mtrlpq2314w-lp130-06-70-55-77-161.dsl.bell.ca | 70.55.77.161 | CA | Montral | TCP |
| 0.0.232.72 | TCP | |||
| 0.0.189.91 | TCP | |||
| 0.0.143.234 | TCP | |||
| 141.28.18.67 | DE | Furtwangen | TCP | |
| dynamic-ip-1868624542.cable.net.co | 186.86.245.42 | CO | TCP | |
| 41.184.122.234 | NG | TCP | ||
| 168.249.215.245 | KR | TCP | ||
| modemcable164.2-162-184.mc.videotron.ca | 184.162.2.164 | CA | Jonquire | TCP |
| 102.142.99.175 | TCP | |||
| 37.215.242.15 | BY | TCP | ||
| 0.0.142.182 | TCP | |||
| 141.208.141.250 | FI | TCP | ||
| 0.0.190.92 | TCP | |||
| 55.230.50.93 | US | Fort Huachuca | TCP | |
| 86.81.208.238 | NL | TCP | ||
| 219.89.71.78 | NZ | TCP | ||
| 197-86-125-100.cpt.mweb.co.za | 197.86.125.100 | ZA | TCP | |
| 210-135-170-181.fibertel.com.ar | 181.170.135.210 | AR | Rosario | TCP |
| 4.153.63.79 | US | TCP | ||
| 91.60.67.165 | DE | Hockenheim | TCP | |
| 0.0.83.206 | TCP | |||
| 43.116.83.219 | JP | Tokyo | TCP | |
| 0.0.250.217 | TCP | |||
| 96.189.229.32 | US | TCP | ||
| mhric-64-75-127-146.mhric.org | 64.75.127.146 | US | Liberty | TCP |
| 170.114.246.71 | US | Latham | TCP | |
| 40.167.181.207 | US | TCP | ||
| 0.0.58.210 | TCP | |||
| 82-171-178-81.ip.telfort.nl | 82.171.178.81 | NL | Apeldoorn | TCP |
| 0.0.146.128 | TCP | |||
| 0.0.21.20 | TCP | |||
| 110.183.118.88 | CN | Xian | TCP | |
| 81.28.42.84 | IR | TCP | ||
| 208.203.194.28 | US | TCP | ||
| 135.254.217.105 | US | Naperville | TCP | |
| 30.16.163.42 | US | TCP | ||
| 0.0.24.198 | TCP | |||
| 88-104-234-174.dynamic.dsl.as9105.com | 88.104.234.174 | GB | Woodbridge | TCP |
| 0.0.78.163 | TCP | |||
| host68-65-static.20-80-b.business.telecomitalia.it | 80.20.65.68 | IT | TCP | |
| 210.198.38.84 | JP | TCP | ||
| 0.0.74.160 | TCP | |||
| 0.0.86.199 | TCP | |||
| 0.0.177.31 | TCP | |||
| 37.42.118.204 | SA | TCP | ||
| x4e30750c.dyn.telefonica.de | 78.48.117.12 | DE | Essen | TCP |
| host86-178-194-131.range86-178.btcentralplus.com | 86.178.194.131 | GB | Sheffield | TCP |
| 176.6.82.113 | DE | TCP | ||
| 33.37.55.116.broad.km.yn.dynamic.163data.com.cn | 116.55.37.33 | CN | Kunming | TCP |
| ns1327.ztomy.com | 159.75.105.137 | US | Westwood | TCP |
| 162-195-227-96.lightspeed.wchtks.sbcglobal.net | 162.195.227.96 | US | Fort Scott | TCP |
| 89-97-121-181.ip17.fastwebnet.it | 89.97.121.181 | IT | Rome | TCP |
| 0.0.119.124 | TCP | |||
| 81-67-115-9.rev.numericable.fr | 81.67.115.9 | FR | Le Pecq | TCP |
| 0.0.80.90 | TCP | |||
| 172.21.111.128 | TCP | |||
| 219.225.168.50 | CN | Beijing | TCP | |
| 74-60-225-233.cin.clearwire-wmx.net | 74.60.225.233 | US | Cincinnati | TCP |
| 47.244.142.91 | CA | Ottawa | TCP | |
| 61.237.107.57 | CN | Beijing | TCP | |
| 174.132.230.8 | US | Houston | TCP | |
| 208.79.16.91 | US | Herndon | TCP | |
| 130.33.209.215 | US | Skillman | TCP | |
| 116.95.199.121 | CN | Baotou | TCP | |
| 0.0.123.144 | TCP | |||
| 0.0.237.68 | TCP | |||
| 0.0.125.82 | TCP | |||
| dialup-4.142.33.231.Dial1.Chicago1.Level3.net | 4.142.33.231 | US | TCP | |
| 0.0.68.117 | TCP | |||
| 210.168.1.233 | JP | TCP | ||
| 219.16.4.57 | JP | TCP | ||
| 179.129.237.123 | BR | Niteri | TCP | |
| 146.112.247.36 | EU | TCP | ||
| 0.0.201.184 | TCP | |||
| 138.134.227.95 | IL | Haifa | TCP | |
| 0.0.50.97 | TCP | |||
| 194.40.197.45 | CH | TCP | ||
| smtp.digimetrica.com | 95.110.163.246 | IT | Arezzo | TCP |
| host129.chesmatv.com | 65.213.13.129 | US | TCP | |
| 32.31.81.74 | US | TCP | ||
| 220.126.184.124 | KR | Incheon | TCP | |
| pr-osk-2-158.dsn.jp | 202.216.59.158 | JP | TCP | |
| 0.0.84.224 | TCP | |||
| 206.40.4.211 | US | Sacramento | TCP | |
| 0.0.202.251 | TCP | |||
| 39.123.164.171 | KR | Daejeon | TCP | |
| 201.6.248.177 | BR | So Paulo | TCP | |
| ool-ad024781.dyn.optonline.net | 173.2.71.129 | US | Newark | TCP |
| 0.0.115.163 | TCP | |||
| 0.0.200.14 | TCP | |||
| 0.0.141.184 | TCP | |||
| 17.254.115.235 | US | Cupertino | TCP | |
| 0.0.228.138 | TCP | |||
| 7.191.224.163 | US | TCP | ||
| adsl-074-165-227-101.sip.msy.bellsouth.net | 74.165.227.101 | US | TCP | |
| 132.111.153.41 | US | Fort Huachuca | TCP | |
| dialup216-212-40-250.birch.net | 216.212.40.250 | US | TCP | |
| cpc105782-ruth9-2-0-cust125.14-1.cable.virginm.net | 80.2.105.126 | GB | London | TCP |
| 7.248.156.149 | US | TCP | ||
| static-71-240-120-43.pitt.east.verizon.net | 71.240.120.43 | US | Hermitage | TCP |
| 211.37.164.212 | KR | TCP | ||
| 116.154.238.35 | CN | Chaoyang | TCP | |
| c-50-182-138-192.hsd1.nj.comcast.net | 50.182.138.192 | US | Swedesboro | TCP |
| 8.140.3.179 | US | TCP | ||
| 140.17.155.199 | US | TCP | ||
| 0.0.174.236 | TCP | |||
| 2.57.140.18 | TCP | |||
| 175.66.54.39 | CN | Beijing | TCP | |
| 222.47.152.249 | CN | Beijing | TCP | |
| 0.0.231.177 | TCP | |||
| 0.0.50.150 | TCP | |||
| 131.107.93.54 | US | Redmond | TCP | |
| d207-216-171-15.bchsia.telus.net | 207.216.171.15 | CA | TCP | |
| 13.38.157.234 | US | Norwalk | TCP | |
| 0.0.178.187 | TCP | |||
| 146.227.85.50 | GB | TCP | ||
| 0.0.87.68 | TCP | |||
| 30.240.193.156 | US | TCP | ||
| 0.0.188.31 | TCP | |||
| 214.97.167.179 | US | TCP | ||
| 26.25.196.139 | US | TCP | ||
| 201.38.201.125 | BR | TCP | ||
| 0.0.253.62 | TCP | |||
| 183.95.187.86 | CN | Wuhan | TCP | |
| 52.114.11.54 | US | Redmond | TCP | |
| balticom-142-92-31.balticom.lv | 212.142.92.31 | LV | Riga | TCP |
| 41.130.75.213 | EG | Cairo | TCP | |
| 0.0.108.82 | TCP | |||
| LFbn-1-2638-56.w86-245.abo.wanadoo.fr | 86.245.108.56 | FR | Saint-cloud | TCP |
| 0.0.90.3 | TCP | |||
| 0.0.216.14 | TCP | |||
| 0.0.160.99 | TCP | |||
| 0.0.84.229 | TCP | |||
| 26.68.163.15 | US | TCP | ||
| 28.22.76.172 | US | TCP | ||
| 61.137.90.159 | CN | Changsha | TCP | |
| 209.135.29.62 | US | Keller | TCP | |
| 87-53-186-17-dynamic.dk.customer.tdc.net | 87.53.186.17 | DK | Haslev | TCP |
| 223.110.168.200 | CN | TCP | ||
| 0.0.30.227 | TCP | |||
| 6.244.218.28 | US | Fort Huachuca | TCP | |
| 134.2.131.213 | DE | Tbingen | TCP | |
| 30.254.26.19 | US | TCP | ||
| 76.19.43.161 | US | Saugus | TCP | |
| 3.75.98.47 | US | Fairfield | TCP | |
| 117.139.66.235 | CN | Dazhou | TCP | |
| 207.157.50.177 | US | Huntsville | TCP | |
| 23.35.172.75 | US | Cambridge | TCP | |
| 42.253.136.81 | CN | Shenyang | TCP | |
| 23.233.17.211 | CA | Bowmanville | TCP | |
| softbank220021103110.bbtec.net | 220.21.103.110 | JP | TCP | |
| 68.117.15.63 | US | Eau Claire | TCP | |
| 187.196.9.31 | MX | TCP | ||
| 0.0.13.100 | TCP | |||
| 0.0.165.162 | TCP | |||
| 0.0.14.132 | TCP | |||
| 82.114.32.50 | CY | TCP | ||
| 0.0.51.199 | TCP | |||
| ip124.50-31-122.static.steadfastdns.net | 50.31.122.124 | US | Portland | TCP |
| 223.84.16.165 | CN | TCP | ||
| 183.122.254.174 | KR | TCP | ||
| 49.142.228.227 | KR | Seoul | TCP | |
| 0.0.39.239 | TCP | |||
| 125.49.121.254 | JP | TCP | ||
| 0.0.81.156 | TCP | |||
| 182.238.142.118 | CN | Tianjin | TCP | |
| 0.0.224.241 | TCP | |||
| 100.251.32.59 | US | TCP | ||
| 158.121.198.39 | US | Boston | TCP | |
| 195.205.83.170 | PL | TCP | ||
| 0.0.223.21 | TCP | |||
| 0.0.86.36 | TCP | |||
| 0.0.207.211 | TCP | |||
| 0.0.160.235 | TCP | |||
| 0.0.73.221 | TCP | |||
| 56.41.74.42 | US | Raleigh | TCP | |
| 0.0.50.52 | TCP | |||
| host-90-188-190-167.pppoe.omsknet.ru | 90.188.190.167 | RU | Omsk | TCP |
| 168.187.179.66 | KW | Kuwait | TCP | |
| 196.106.128.160 | KE | TCP | ||
| 109-92-156-228.dynamic.isp.telekom.rs | 109.92.156.228 | RS | Nis | TCP |
| 111.43.72.13 | CN | TCP | ||
| 57.172.47.21 | BE | TCP | ||
| 158.9.24.190 | US | Fort Huachuca | TCP | |
| 0.0.242.219 | TCP | |||
| 210.227.28.116 | JP | TCP | ||
| 36.211.126.168 | CN | Beijing | TCP | |
| 191.187.242.85 | BR | Maring | TCP | |
| 0.0.247.248 | TCP | |||
| nad5.biologie.uni-ulm.de | 134.60.62.64 | DE | Memmingen | TCP |
| dialup-4.226.59.133.Dial1.Dallas1.Level3.net | 4.226.59.133 | US | TCP | |
| c-24-23-51-153.hsd1.ca.comcast.net | 24.23.51.153 | US | Shingle Springs | TCP |
| 173-124-161-80.pools.spcsdns.net | 173.124.161.80 | US | TCP | |
| 44.27.222.233 | US | San Diego | TCP | |
| 75.57.64.226 | US | TCP | ||
| host-82-222-72-24.reverse.superonline.net | 82.222.72.24 | TR | Istanbul | TCP |
| 59.215.144.56 | CN | Beijing | TCP | |
| 85.188.218.86 | GB | TCP | ||
| c-73-171-192-195.hsd1.fl.comcast.net | 73.171.192.195 | US | Middleburg | TCP |
| 191.41.83.91 | BR | TCP | ||
| 0.0.8.152 | TCP | |||
| 0.0.218.204 | TCP | |||
| 0.0.75.89 | TCP | |||
| 87.134.124.238 | DE | TCP | ||
| 0.0.166.33 | TCP | |||
| 98.32.105.176 | US | TCP | ||
| 120.12.103.138 | CN | Hebei | TCP | |
| 96.101.200.248 | US | TCP | ||
| 8.123.145.10 | US | TCP | ||
| 0.0.91.146 | TCP | |||
| 77.62.200.14 | NL | TCP | ||
| 0.0.92.70 | TCP | |||
| 197.224.33.106 | MU | Port Louis | TCP | |
| 0.0.85.113 | TCP | |||
| 45.41.179.152 | US | Lewes | TCP | |
| 89.160.165.169 | IS | Reykjavk | TCP | |
| 216.106.159.81 | US | Ann Arbor | TCP | |
| 0.0.125.180 | TCP | |||
| 0.0.95.52 | TCP | |||
| 0.0.179.222 | TCP | |||
| 0.0.87.229 | TCP | |||
| 0.0.81.61 | TCP | |||
| 84.232.140.52 | RO | Brasov | TCP | |
| 132.216.201.201 | CA | Montral | TCP | |
| we.love.servers.at.ioflood.com | 104.161.10.52 | US | Phoenix | TCP |
| 0.0.130.87 | TCP | |||
| 31.218.55.138 | AE | Abu Dhabi | TCP | |
| cpe-76-84-18-184.neb.res.rr.com | 76.84.18.184 | US | Lincoln | TCP |
| 202.234.233.65 | JP | TCP | ||
| 0.0.60.212 | TCP | |||
| 119.129.239.52 | CN | Guangzhou | TCP | |
| 202.154.73.202 | AU | TCP | ||
| 128.102.192.43 | US | Huntsville | TCP | |
| 56.44.141.127 | US | Raleigh | TCP | |
| 0.0.254.150 | TCP | |||
| 18.221.189.201 | US | Cambridge | TCP | |
| 51.141.36.230 | GB | Cardiff | TCP | |
| 216.111.189.25 | US | TCP | ||
| 193.9.70.0 | SE | TCP | ||
| 66-193-254-236.static.tenantsolutions.com | 66.193.254.236 | US | TCP | |
| 133.7.76.144 | JP | TCP | ||
| 150.189.90.177 | VE | Caracas | TCP | |
| 147.115.237.81 | US | Denver | TCP | |
| 21.208.135.171 | US | TCP | ||
| 2.223.19.163 | GB | Romford | TCP | |
| 39.249.197.218 | ID | TCP | ||
| 0.0.57.3 | TCP | |||
| 0.0.133.202 | TCP | |||
| 0.0.58.157 | TCP | |||
| 0.0.89.138 | TCP | |||
| 154.226.85.63 | UG | TCP | ||
| 0.0.33.10 | TCP | |||
| 5.185.2.171 | PL | TCP | ||
| 0.0.109.52 | TCP | |||
| 154.4.96.73 | US | New York | TCP | |
| 24.156.33.92 | US | Bullhead City | TCP | |
| 91.145.240.114 | UA | TCP | ||
| 13.49.80.241 | US | Norwalk | TCP | |
| 164.239.84.150 | US | TCP | ||
| 0.0.38.15 | TCP | |||
| 171.198.187.185 | US | Concord | TCP | |
| 222.110.18.206 | KR | TCP | ||
| 218.79.250.48 | CN | Shanghai | TCP | |
| 0.0.144.166 | TCP | |||
| 0.0.25.19 | TCP | |||
| 0.0.177.239 | TCP | |||
| 0.0.123.21 | TCP | |||
| 0.0.206.248 | TCP | |||
| 0.0.250.239 | TCP | |||
| 193.179.106.21 | CZ | Karvina | TCP | |
| host-92-24-47-131.ppp.as43234.net | 92.24.47.131 | GB | Hounslow | TCP |
| 154.124.52.103 | SN | TCP | ||
| 75-174-20-44.boid.qwest.net | 75.174.20.44 | US | Boise | TCP |
| 209.155.24.166 | US | TCP | ||
| 196.175.183.162 | GH | TCP | ||
| 1.230.191.107 | KR | TCP | ||
| 138.104.58.23 | GB | TCP | ||
| 101.161.75.133 | AU | Glenhaven | TCP | |
| 93.105.94.215 | PL | TCP | ||
| 120.120.159.122 | TW | Taipei | TCP | |
| 0.0.139.200 | TCP | |||
| 0.0.173.146 | TCP | |||
| lan-78-157-85-191.vln.skynet.lt | 78.157.85.191 | LT | Vilnius | TCP |
| 43.84.112.121 | JP | Tokyo | TCP | |
| 218.61.72.32 | CN | Shenyang | TCP | |
| 144.253.38.92 | US | Milpitas | TCP | |
| d194030.dhcp.ee.es.osaka-u.ac.jp | 133.1.194.30 | JP | Suita | TCP |
| cpe-184-152-89-108.hvc.res.rr.com | 184.152.89.108 | US | Pleasant Valley | TCP |
| 212.76.118.140 | IL | TCP | ||
| 188.232.241.176 | RU | Omsk | TCP | |
| 20.143.209.58 | US | Falls Church | TCP | |
| 0.0.125.242 | TCP | |||
| 80.90.31.108 | LV | TCP | ||
| 114.14.128.235 | ID | Jakarta | TCP | |
| 0.0.49.124 | TCP | |||
| 0.0.39.79 | TCP | |||
| 20.10.48.246 | US | Falls Church | TCP | |
| 0.0.3.242 | TCP | |||
| 0.0.15.79 | TCP | |||
| 102.177.141.212 | TCP | |||
| 0.0.246.106 | TCP | |||
| softbank220058011123.bbtec.net | 220.58.11.123 | JP | TCP | |
| 170.228.99.158 | US | Auburn Hills | TCP | |
| 210.43.212.88 | CN | Changsha | TCP | |
| 133.220.100.224 | JP | TCP | ||
| 0.0.206.180 | TCP | |||
| 0.0.171.238 | TCP | |||
| 142.168.151.34 | CA | TCP | ||
| softbank060153030081.bbtec.net | 60.153.30.81 | JP | TCP | |
| 179.233.114.178 | BR | Petrpolis | TCP | |
| 0.0.65.144 | TCP | |||
| 0.0.122.97 | TCP | |||
| 0.0.57.62 | TCP | |||
| 0.0.229.165 | TCP | |||
| 0.0.200.64 | TCP | |||
| 146.39.7.242 | US | San Ramon | TCP | |
| 56.139.208.151 | US | Raleigh | TCP | |
| 28.156.49.219 | US | TCP | ||
| 0.0.55.6 | TCP | |||
| 102.97.235.83 | TCP | |||
| 23.53.184.93 | NL | Amsterdam | TCP | |
| 111.80.185.231 | TW | Taipei | TCP | |
| 219.44.63.161 | JP | TCP | ||
| 0.0.153.80 | TCP | |||
| 154.232.115.80 | TCP | |||
| 191-25-220-59.user.vivozap.com.br | 191.25.220.59 | BR | TCP | |
| 133.175.67.208 | JP | TCP | ||
| 124.112.211.52 | CN | Hefei | TCP | |
| 223.82.168.250 | CN | TCP | ||
| adsl-66-136-102-36.dsl.hrlntx.swbell.net | 66.136.102.36 | US | TCP | |
| 164.227.101.216 | US | TCP | ||
| 0.0.46.191 | TCP | |||
| 81.7.10.93 | DE | TCP | ||
| 7.251.233.254 | US | TCP | ||
| 131.188.40.189 | DE | Erlangen | TCP | |
| 144.104.142.38 | US | Fort Huachuca | TCP | |
| 55.33.129.245 | US | Fort Huachuca | TCP | |
| 87.74.145.46 | GB | Maidenhead | TCP | |
| 149.153.220.27 | IE | Carlow | TCP | |
| 183.136.173.73 | CN | Hangzhou | TCP | |
| 186.201.155.63 | BR | So Bernardo Do Campo | TCP | |
| 52.191.157.203 | US | TCP | ||
| 0.0.130.101 | TCP | |||
| 0.0.230.132 | TCP | |||
| 0.0.240.251 | TCP | |||
| 0.0.53.100 | TCP | |||
| 22.20.130.141 | US | TCP | ||
| 0.0.57.159 | TCP | |||
| 141.130.27.180 | DE | Esslingen | TCP | |
| 0.0.96.142 | TCP | |||
| 47.186.58.191 | US | TCP | ||
| 118.54.193.98 | KR | TCP | ||
| 181.78.4.174 | AR | Buenos Aires | TCP | |
| 61-24-53-210.rev.home.ne.jp | 61.24.53.210 | JP | Tokyo | TCP |
| 1.sub-98-105-216.myvzw.com | 98.105.216.1 | US | TCP | |
| 0.0.185.182 | TCP | |||
| 0.0.115.74 | TCP | |||
| 94.31.251.106 | RU | Yekaterinburg | TCP | |
| 172.157.75.187 | US | TCP | ||
| 196.187.186.140 | TN | TCP | ||
| 0.0.123.40 | TCP | |||
| 0.0.119.131 | TCP | |||
| 0.0.58.86 | TCP | |||
| 0.0.232.143 | TCP | |||
| 0.0.203.83 | TCP | |||
| 213.215.66.15 | SK | Senica | TCP | |
| 0.0.33.101 | TCP | |||
| 164.237.13.97 | US | TCP | ||
| 30.123.162.10 | US | TCP | ||
| . | 120.204.228.47 | CN | Shanghai | TCP |
| 0.0.125.121 | TCP | |||
| 138.222.183.182 | DE | Mannheim | TCP | |
| 54.4.2.182 | US | Woodbridge | TCP | |
| 8.17.236.25 | US | TCP | ||
| host86-183-37-54.range86-183.btcentralplus.com | 86.183.37.54 | GB | Arbroath | TCP |
| 203.243.115.160 | KR | TCP | ||
| 140.107.149.48 | US | Seattle | TCP | |
| 192.66.165.125 | DK | TCP | ||
| a80-127-137-19.adsl.xs4all.nl | 80.127.137.19 | NL | TCP | |
| ec2-54-207-34-85.sa-east-1.compute.amazonaws.com | 54.207.34.85 | BR | So Paulo | TCP |
| 170.251.137.74 | AU | Perth | TCP | |
| c-71-237-80-88.hsd1.co.comcast.net | 71.237.80.88 | US | Arvada | TCP |
| 0.0.75.223 | TCP | |||
| 0.173.166.124.adsl-pool.sx.cn | 124.166.173.0 | CN | TCP | |
| 17.245.112.125 | US | San Jose | TCP | |
| dca-priv-14.inet.qwest.net | 65.126.20.77 | US | TCP | |
| 207.19.241.182 | US | TCP | ||
| 116.181.228.173 | CN | Chaoyang | TCP | |
| 169.101.48.193 | US | New York | TCP | |
| mail.head-first.co.uk | 82.109.231.9 | GB | TCP | |
| 117.52.72.16 | KR | Seoul | TCP | |
| 0.0.209.3 | TCP | |||
| 0.0.1.105 | TCP | |||
| 0.0.243.184 | TCP | |||
| 0.0.165.147 | TCP | |||
| 0.0.154.135 | TCP | |||
| 15.100.66.120 | US | Palo Alto | TCP | |
| 0.0.104.84 | TCP | |||
| 223.91.26.129 | CN | Nanyang | TCP | |
| 0.0.16.112 | TCP | |||
| 6.211.102.190 | US | Fort Huachuca | TCP | |
| 103.103.154.192 | TCP | |||
| 158.245.189.156 | US | Quantico | TCP | |
| m121-203-62-229.smartone.com | 121.203.62.229 | HK | TCP | |
| 223.77.119.80.rev.sfr.net | 80.119.77.223 | FR | Saint-andr | TCP |
| 0.0.35.245 | TCP | |||
| 0.0.47.148 | TCP | |||
| 171.165.214.86 | US | Concord | TCP | |
| 200.211.56.58 | BR | TCP | ||
| 96.67.135.205 | US | TCP | ||
| 0.0.160.201 | TCP | |||
| 0.0.35.116 | TCP | |||
| 0.0.213.122 | TCP | |||
| 0.0.254.4 | TCP | |||
| 0.0.208.107 | TCP | |||
| bzq-79-178-250-251.red.bezeqint.net | 79.178.250.251 | IL | Tel Aviv | TCP |
| 0.0.45.134 | TCP | |||
| 57.104.217.31 | FR | TCP | ||
| 97.48.254.107 | US | TCP | ||
| 142.208.39.115 | CA | Hull | TCP | |
| 0.0.27.132 | TCP | |||
| 215.183.73.125 | US | TCP | ||
| 184.128.13.61 | US | TCP | ||
| adsl-66-137-115-12.dsl.hstntx.swbell.net | 66.137.115.12 | US | TCP | |
| 189.61.22.251 | BR | Braslia | TCP | |
| 42.2.145.42 | HK | Central District | TCP | |
| 157.83.56.77 | GB | London | TCP | |
| dyna78-84.acadiau.ca | 131.162.78.84 | CA | Wolfville | TCP |
| 31.86.187.151 | GB | Rotherham | TCP | |
| 19.213.60.53 | US | Dearborn | TCP | |
| 42.100.190.15 | CN | Harbin | TCP | |
| 0.0.83.224 | TCP | |||
| 100.193.226.126 | US | TCP | ||
| 51.16.22.40 | GB | TCP | ||
| 214.65.96.187.isp.timbrasil.com.br | 187.96.65.214 | BR | TCP | |
| 154.242.62.90 | DZ | TCP | ||
| 160.61.211.219 | CH | TCP | ||
| 147.82.216.9 | US | Wilmington | TCP | |
| host-156.202.208.242-static.tedata.net | 156.202.242.208 | EG | Luxor | TCP |
| 135.red-95-125-88.dynamicip.rima-tde.net | 95.125.88.135 | ES | TCP | |
| 0.0.209.67 | TCP | |||
| 0.0.175.125 | TCP | |||
| 0.0.140.212 | TCP | |||
| 0.0.29.164 | TCP | |||
| 123.234.224.120 | CN | Jinan | TCP | |
| 0.0.177.218 | TCP | |||
| ip-57.net-89-3-74.rev.numericable.fr | 89.3.74.57 | FR | Bouliac | TCP |
| 0.0.123.201 | TCP | |||
| 0.0.169.45 | TCP | |||
| 162.8.123.27 | US | Stamford | TCP | |
| bigip-upktestpri-llu.oracle.com | 129.80.164.124 | US | Redwood City | TCP |
| 119.249.65.186 | CN | Hebei | TCP | |
| 41.197.161.77 | RW | TCP | ||
| 121.77.52.41 | CN | Shanghai | TCP | |
| 0.0.151.190 | TCP | |||
| 0.0.79.180 | TCP | |||
| host5-250-dynamic.27-79-r.retail.telecomitalia.it | 79.27.250.5 | IT | Lizzanello | TCP |
| 36.44.160.113 | CN | Xian | TCP | |
| 193.244.210.244 | BE | TCP | ||
| 0.0.52.193 | TCP | |||
| 0.0.222.189 | TCP | |||
| 5.120.124.237 | IR | TCP | ||
| 0.0.114.144 | TCP | |||
| 108.43.127.152 | US | TCP | ||
| 0.0.22.32 | TCP | |||
| 0.0.99.150 | TCP | |||
| 0.0.8.41 | TCP | |||
| 145.11.162.73 | NL | Nijmegen | TCP | |
| 57.213.74.8 | BE | TCP | ||
| 183.132.96.52 | CN | Ningbo | TCP | |
| 0.0.103.243 | TCP | |||
| 209.22.29.32 | US | TCP | ||
| 47.147.182.81 | US | TCP | ||
| 134.112.150.169 | US | Alameda | TCP | |
| 200-161-247-165.dsl.telesp.net.br | 200.161.247.165 | BR | Caapava | TCP |
| 19.65.93.141 | US | Dearborn | TCP | |
| 5.194.193.135 | AE | TCP | ||
| 0.0.105.87 | TCP | |||
| 44.90.142.122 | US | San Diego | TCP | |
| 115.97.65.100 | IN | Mumbai | TCP | |
| 123.238.144.224 | IN | Mumbai | TCP | |
| 0.0.198.186 | TCP | |||
| 131.125.115.132 | US | Union | TCP | |
| KD106168140095.ppp-bb.dion.ne.jp | 106.168.140.95 | JP | Yokosuka | TCP |
| 108.61.0.40.choopa.net | 108.61.0.40 | US | Matawan | TCP |
| 2.28.51.237 | GB | Havant | TCP | |
| 200-98-56-130.clouduol.com.br | 200.98.56.130 | BR | TCP | |
| 139.65.92.131 | US | San Ramon | TCP | |
| 19.15.113.24 | US | Dearborn | TCP | |
| a85-138-126-109.cpe.netcabo.pt | 85.138.126.109 | PT | Barreiro | TCP |
| 0.0.167.164 | TCP | |||
| 0.0.61.244 | TCP | |||
| 0.0.35.43 | TCP | |||
| 0.0.162.202 | TCP | |||
| 18.70.197.240 | US | Cambridge | TCP | |
| 0.0.242.210 | TCP | |||
| 202.99.152.88 | CN | Hebei | TCP | |
| 0.0.193.44 | TCP | |||
| 0.0.248.76 | TCP | |||
| ip72-221-88-209.ri.ri.cox.net | 72.221.88.209 | US | Portsmouth | TCP |
| 49.27.59.125 | KR | TCP | ||
| 28.168.232.72 | US | TCP | ||
| 165.178.91.130 | CA | Toronto | TCP | |
| 193.52.93.112 | FR | Rennes | TCP | |
| 0.0.212.113 | TCP | |||
| 91.185.17.16 | KZ | TCP | ||
| 191.118.87.139 | CL | Santiago | TCP | |
| 0.0.114.248 | TCP | |||
| 0.0.36.168 | TCP | |||
| 150.94.51.232 | JP | TCP | ||
| 0.0.19.211 | TCP | |||
| 145.17.127.44 | GB | TCP | ||
| 0.0.178.161 | TCP | |||
| 0.0.175.183 | TCP | |||
| 0.0.29.66 | TCP | |||
| 15.17.88.51 | US | Palo Alto | TCP | |
| 0.0.150.53 | TCP | |||
| 223.73.82.169 | CN | Yunfu | TCP | |
| 15.45.219.98 | US | Palo Alto | TCP | |
| 200.175.252.21.static.gvt.net.br | 200.175.252.21 | BR | Cuiab | TCP |
| 0.0.112.81 | TCP | |||
| 216.222.52.242 | US | Rochester | TCP | |
| 188.red-88-10-196.dynamicip.rima-tde.net | 88.10.196.188 | ES | Vitoria | TCP |
| 147.178.73.232 | US | Southborough | TCP | |
| 188.80.innet.cz | 77.48.80.188 | CZ | Chrastava | TCP |
| p1102023-ipngn200506kobeminato.hyogo.ocn.ne.jp | 180.38.150.23 | JP | Suzuka | TCP |
| 0.0.38.170 | TCP | |||
| 116.30.117.46 | CN | Shenzhen | TCP | |
| 207.68.177.10 | US | Redmond | TCP | |
| 67-2-64-205.slkc.qwest.net | 67.2.64.205 | US | Salt Lake City | TCP |
| 0.0.31.184 | TCP | |||
| 41.109.95.66 | DZ | Tizi Ouzou | TCP | |
| SURFnet-NL.IPv4.PTR.145.114.x.INVALID | 145.114.56.238 | NL | Utrecht | TCP |
| 154.208.83.105 | SC | TCP | ||
| host86-182-198-29.range86-182.btcentralplus.com | 86.182.198.29 | GB | High Peak | TCP |
| 193.129.83.130 | GB | TCP | ||
| 35.149.206.133 | US | Ann Arbor | TCP | |
| 23.180.197.3 | TCP | |||
| host115-209-static.23-80-b.business.telecomitalia.it | 80.23.209.115 | IT | TCP | |
| 0.0.169.14 | TCP | |||
| 0.0.239.0 | TCP | |||
| 0.0.217.37 | TCP | |||
| 0.0.152.29 | TCP | |||
| 48.101.198.37 | US | Newark | TCP | |
| 0.0.173.226 | TCP | |||
| adsl-184-38-94-107.msy.bellsouth.net | 184.38.94.107 | US | New Orleans | TCP |
| 0.0.234.75 | TCP | |||
| 0.0.198.164 | TCP | |||
| 0.0.160.243 | TCP | |||
| 154.152.176.13 | TCP | |||
| p75084-adsau16honb10-acca.tokyo.ocn.ne.jp | 60.33.135.84 | JP | Tokyo | TCP |
| 212.45.198.55 | CH | TCP | ||
| 153.35.23.207 | CN | Nanjing | TCP | |
| 0.0.118.37 | TCP | |||
| 118.205.195.200 | CN | Beijing | TCP | |
| 116.151.189.37 | CN | Chaoyang | TCP | |
| 0.0.88.181 | TCP | |||
| 0.0.9.57 | TCP | |||
| 193.112.69.91 | GB | TCP | ||
| 0.0.20.196 | TCP | |||
| 28.94.168.33 | US | TCP | ||
| 54.250.227.214 | JP | Tokyo | TCP | |
| 0.0.219.116 | TCP | |||
| 0.0.124.47 | TCP | |||
| 0.0.232.110 | TCP | |||
| 159.214.98.70 | US | Philadelphia | TCP | |
| 0.0.236.2 | TCP | |||
| 203.153.212.110 | ID | Medan | TCP | |
| 10.21.123.144 | TCP | |||
| host-154.187.125.213-static.tedata.net | 154.187.213.125 | TCP | ||
| 0.0.16.131 | TCP | |||
| 191.25.147.23 | BR | Rio De Janeiro | TCP | |
| 87.0.248.165 | IT | Verona | TCP | |
| 172.63.46.54 | US | TCP | ||
| 64.89.23.243 | TCP | |||
| 114.197.59.82 | CN | Daqing | TCP | |
| 0.0.92.14 | TCP | |||
| 56.30.254.32 | US | Raleigh | TCP | |
| 203.74.153.181 | TW | Taichung | TCP | |
| 84.186.58.24 | DE | TCP | ||
| 0.0.239.238 | TCP | |||
| 134.49.51.166 | US | Moscow | TCP | |
| 115.133.183.53 | MY | Klang | TCP | |
| 28.211.143.72 | US | TCP | ||
| 0.0.10.107 | TCP | |||
| 13.195.85.16 | US | Norwalk | TCP | |
| 119.226.97.232 | IN | TCP | ||
| 22.96.245.222 | US | TCP | ||
| 13.117.73.55 | US | TCP | ||
| 30.44.54.222 | US | TCP | ||
| 0.0.21.232 | TCP | |||
| 72.157.104.252 | US | Atlanta | TCP | |
| 0.0.70.154 | TCP | |||
| 0.0.248.28 | TCP | |||
| 0.0.54.80 | TCP | |||
| 0.0.212.112 | TCP | |||
| 0.0.248.68 | TCP | |||
| 0.0.111.158 | TCP | |||
| 177.77.85.161 | BR | TCP | ||
| 125.162.120.199 | ID | TCP | ||
| 204.78.94.91 | US | Pensacola | TCP | |
| 30.77.238.171 | US | TCP | ||
| 0.0.74.27 | TCP | |||
| 57.71.96.49 | NC | TCP | ||
| ip-213-127-0-156.ip.prioritytelecom.net | 213.127.0.156 | NL | Amsterdam | TCP |
| 0.0.217.162 | TCP | |||
| 7.28.75.73 | US | TCP | ||
| 80.109.222.25 | AT | Klagenfurt | TCP | |
| 0.0.177.82 | TCP | |||
| 0.0.154.85 | TCP | |||
| 150.215.50.61 | US | Seattle | TCP | |
| ec2-13-211-233-73.ap-southeast-2.compute.amazonaws.com | 13.211.233.73 | US | Norwalk | TCP |
| 0.0.79.176 | TCP | |||
| 162.178.69.147 | US | TCP | ||
| 182.242.43.17 | CN | Kunming | TCP | |
| 188.120.106.201 | RS | Beograd | TCP | |
| 0.0.61.199 | TCP | |||
| 167.218.20.173 | US | Beaver Dam | TCP | |
| 175.104.198.53 | JP | Miyako | TCP | |
| 0.0.250.56 | TCP | |||
| 0.0.99.17 | TCP | |||
| 40.57.208.78 | US | TCP | ||
| 196.95.157.2 | MA | TCP | ||
| 0.0.228.155 | TCP | |||
| 42.7.17.160 | CN | Shenyang | TCP | |
| 5.124.94.137 | IR | TCP | ||
| 121.132.213.103 | KR | TCP | ||
| 16.153.178.191 | US | Palo Alto | TCP | |
| 0.0.237.186 | TCP | |||
| 51.228.81.181 | GB | TCP | ||
| 0.0.65.138 | TCP | |||
| 0.0.240.72 | TCP | |||
| 114.34.5.138 | TW | Taipei | TCP | |
| 197.47.81.232 | EG | Cairo | TCP | |
| 90.208.90.146 | GB | Blackpool | TCP | |
| 64.125.76.241.IPYX-078143-ZYO.above.net | 64.125.76.241 | US | TCP | |
| 0.0.112.116 | TCP | |||
| 229.120.113.78.rev.sfr.net | 78.113.120.229 | FR | Thoard | TCP |
| 112.222.165.181 | KR | Namyangju | TCP | |
| 24.185.79.200.xturbo.com.br | 200.79.185.24 | BR | Araras | TCP |
| 152.114.19.52 | GB | TCP | ||
| 20.236.12.40 | US | Falls Church | TCP | |
| 0.0.73.56 | TCP | |||
| 0.0.16.135 | TCP | |||
| 0.0.25.184 | TCP | |||
| 0.0.96.172 | TCP | |||
| 0.0.157.184 | TCP | |||
| 0.0.107.39 | TCP | |||
| 184-225-93-10.pools.spcsdns.net | 184.225.93.10 | US | TCP | |
| 173.103.59.75 | US | TCP | ||
| 33.200.7.125 | US | TCP | ||
| 0.0.245.94 | TCP | |||
| 204.254.42.188 | US | TCP | ||
| 147.54.124.36 | DE | Munich | TCP | |
| 0.0.248.58 | TCP | |||
| 48.200.239.250 | US | Newark | TCP | |
| 187.46.124.0 | BR | TCP | ||
| KD118156098127.au-net.ne.jp | 118.156.98.127 | JP | Tokyo | TCP |
| 4.23.154.88 | US | TCP | ||
| 0.0.221.233 | TCP | |||
| 0.0.70.143 | TCP | |||
| softbank219002171145.bbtec.net | 219.2.171.145 | JP | TCP | |
| 49.75.10.243 | CN | Nanjing | TCP | |
| 0.0.155.204 | TCP | |||
| 0.0.218.102 | TCP | |||
| 168.185.220.126 | US | Palo Alto | TCP | |
| 0.0.67.4 | TCP | |||
| 39.196.186.196 | ID | TCP | ||
| 0.0.143.223 | TCP | |||
| 107.73.74.40 | US | TCP | ||
| 53.141.171.15 | DE | TCP | ||
| 86.203.224.47 | FR | Nice | TCP | |
| 0.0.90.11 | TCP | |||
| 93-82-35-171.adsl.highway.telekom.at | 93.82.35.171 | AT | Eggelsberg | TCP |
| 138.100.76.199 | ES | Madrid | TCP | |
| 0.0.5.152 | TCP | |||
| 0.0.227.42 | TCP | |||
| 0.0.14.243 | TCP | |||
| 213.107.123.187 | GB | TCP | ||
| 73.54.192.198 | US | Kennesaw | TCP | |
| 113.113.43.176 | CN | Guangzhou | TCP | |
| 148.103.128.138 | DO | Santo Domingo | TCP | |
| 204.212.166.28 | US | Rancho Cucamonga | TCP | |
| 0.0.114.236 | TCP | |||
| 154.213.86.80 | SC | TCP | ||
| 141.88.4.50 | DE | TCP | ||
| 102.146.2.237 | TCP | |||
| 95.198.167.150 | SE | TCP | ||
| 0.0.158.146 | TCP | |||
| 110.89.135.137 | CN | Fuzhou | TCP | |
| 215.125.79.147 | US | TCP | ||
| host92-25-static.82-213-b.business.telecomitalia.it | 213.82.25.92 | IT | Erba | TCP |
| 185.113.38.23 | KZ | Aqtau | TCP | |
| 35.182.233.46 | US | Seattle | TCP | |
| 0.0.228.52 | TCP | |||
| 0.0.148.222 | TCP | |||
| 210.212.112.83 | IN | Rohtak | TCP | |
| 43.189.251.182 | JP | Tokyo | TCP | |
| 199.222.55.15 | US | Ashburn | TCP | |
| 0.0.205.63 | TCP | |||
| 0.0.92.172 | TCP | |||
| 0.0.197.237 | TCP | |||
| 0.0.73.174 | TCP | |||
| 0.0.104.249 | TCP | |||
| 56.81.59.154 | US | Raleigh | TCP | |
| 68-243-94-79.pools.spcsdns.net | 68.243.94.79 | US | TCP | |
| tho79-1-78-245-170-37.fbx.proxad.net | 78.245.170.37 | FR | Thouars | TCP |
| 0.0.107.117 | TCP | |||
| 166.89.226.44 | US | Tucson | TCP | |
| 22.88.108.23 | US | TCP | ||
| 0.0.208.59 | TCP | |||
| 0.0.30.177 | TCP | |||
| 141.6.43.19 | DE | TCP | ||
| 15.80.157.156 | US | Palo Alto | TCP | |
| 0.0.129.177 | TCP | |||
| 0.0.192.82 | TCP | |||
| 32.62.166.250 | US | TCP | ||
| 126.82.141.229 | JP | Fukuoka | TCP | |
| 0.0.136.190 | TCP | |||
| 154.209.42.142 | SC | TCP | ||
| 169.135.164.96 | US | Denver | TCP | |
| 195.247.61.196 | DE | TCP | ||
| 0.0.70.64 | TCP | |||
| 150.220.217.23 | US | Rochester | TCP | |
| 0.0.213.253 | TCP | |||
| 0.0.175.119 | TCP | |||
| 0.0.167.213 | TCP | |||
| 0.0.198.18 | TCP | |||
| 122.97.203.153 | CN | Nanjing | TCP | |
| 84.228.103.38 | IL | TCP | ||
| 0.0.65.171 | TCP | |||
| 134.150.184.13 | CA | Markham | TCP | |
| 10.233.46.168 | TCP | |||
| 51.25.13.93 | GB | TCP | ||
| 90.157.151.40 | SI | TCP | ||
| 83.35.37.115 | ES | San Juan | TCP | |
| 0.0.117.233 | TCP | |||
| 86.86.197.178.dynamic.wline.res.cust.swisscom.ch | 178.197.86.86 | CH | TCP | |
| 56.113.160.45 | US | Raleigh | TCP | |
| 69.57.87.90 | US | Crosby | TCP | |
| 11.26.25.49 | US | TCP | ||
| 0.0.247.245 | TCP | |||
| 31.120.111.23 | GB | Wolverhampton | TCP | |
| 152.95.99.126 | DK | TCP | ||
| 123.111.152.81 | KR | TCP | ||
| 96.178.144.145 | US | TCP | ||
| 176-227-143-51.ip.skylogicnet.com | 176.227.143.51 | GB | TCP | |
| 0.0.36.160 | TCP | |||
| 0.0.94.147 | TCP | |||
| 0.0.82.210 | TCP | |||
| 0.0.87.109 | TCP | |||
| 0.0.201.130 | TCP | |||
| 0.0.254.212 | TCP | |||
| host96.181-87-120.telecom.net.ar | 181.87.120.96 | AR | TCP | |
| 147.205.242.37 | US | Oneonta | TCP | |
| 73.99.248.64 | US | TCP | ||
| 175.91.249.2 | CN | Beijing | TCP | |
| 169.176.150.57 | US | Reston | TCP | |
| 66.5.45.41 | US | Nashville | TCP | |
| 0.0.17.38 | TCP | |||
| 185.43.196.142 | RU | TCP | ||
| 0.0.86.117 | TCP | |||
| 0.0.238.61 | TCP | |||
| 134.253.143.87 | US | Albuquerque | TCP | |
| 105.173.165.16 | AO | TCP | ||
| 0.0.109.85 | TCP | |||
| softbank219168200188.bbtec.net | 219.168.200.188 | JP | TCP | |
| 0.0.152.17 | TCP | |||
| 0.0.188.247 | TCP | |||
| 219.101.240.86 | JP | Nagoya | TCP | |
| 86.215.183.32 | FR | Pontrieux | TCP | |
| 0.0.243.147 | TCP | |||
| 95.sub-97-237-254.myvzw.com | 97.237.254.95 | US | TCP | |
| 183.70.50.199 | CN | Chongqing | TCP | |
| 0.0.7.134 | TCP | |||
| 0.0.43.43 | TCP | |||
| zaqd37cab02.zaq.ne.jp | 211.124.171.2 | JP | Kobe | TCP |
| 0.0.242.198 | TCP | |||
| 44.198.233.76 | US | San Diego | TCP | |
| 216.39.211.31 | US | Baytown | TCP | |
| 0.0.204.4 | TCP | |||
| 87.116.4.131 | DK | Vanlse | TCP | |
| 61.210.220.254 | JP | TCP | ||
| 0.0.122.133 | TCP | |||
| 0.0.112.130 | TCP | |||
| 96.155.22.2 | US | TCP | ||
| 199.0.60.229 | US | Charlottesville | TCP | |
| 152.227.36.13 | US | TCP | ||
| 63.90.1.170 | US | TCP | ||
| 51.232.175.102 | GB | TCP | ||
| 0.0.254.173 | TCP | |||
| 200.207.109.251 | BR | So Bernardo Do Campo | TCP | |
| 57.25.142.109 | BE | TCP | ||
| 214.54.170.215 | US | TCP | ||
| 72.211.232.149 | US | Aliso Viejo | TCP | |
| 0.0.74.110 | TCP | |||
| 20.183.160.53 | US | Falls Church | TCP | |
| 5.79.131.59 | RU | Chelyabinsk | TCP | |
| 55.61.106.239 | US | Fort Huachuca | TCP | |
| 205.189.157.127 | CA | Mississauga | TCP | |
| 0.0.202.49 | TCP | |||
| 0.0.29.20 | TCP | |||
| 0.0.247.35 | TCP | |||
| 0.0.174.193 | TCP | |||
| 0.0.0.156 | TCP | |||
| 0.0.191.25 | TCP | |||
| 9.197.195.149 | US | Durham | TCP | |
| 216.149.101.226.ptr.us.xo.net | 216.149.101.226 | US | TCP | |
| 131.9.108.222 | US | Montgomery | TCP | |
| 106.30.198.54 | CN | Changsha | TCP | |
| host81-136-59-43.range81-136.btcentralplus.com | 81.136.59.43 | GB | Glasgow | TCP |
| 0.0.65.112 | TCP | |||
| 5.101.25.246 | RU | Rybinsk | TCP | |
| 54.33.130.114 | US | Woodbridge | TCP | |
| 0.0.162.231 | TCP | |||
| 0.0.33.163 | TCP | |||
| 152.116.232.236 | US | Detroit | TCP | |
| ip-95-220-4-210.bb.netbynet.ru | 95.220.4.210 | RU | Moscow | TCP |
| 0.0.62.83 | TCP | |||
| 160.250.65.43 | TCP | |||
| 0.0.115.18 | TCP | |||
| 18-72-232.connect.netcom.no | 178.232.72.18 | NO | TCP | |
| 176.0.159.187 | DE | TCP | ||
| 0.0.168.116 | TCP | |||
| 40.60.186.19 | US | TCP | ||
| 131.240.11.110 | US | TCP | ||
| 64.31.156.202 | US | TCP | ||
| 204.143.17.62 | US | Englewood | TCP | |
| 0.0.133.91 | TCP | |||
| 148.154.100.121 | US | Saint Louis | TCP | |
| 0.0.98.157 | TCP | |||
| 0.0.243.72 | TCP | |||
| 173.238.89.60 | CA | Ridgeway | TCP | |
| 0.0.225.142 | TCP | |||
| 0.0.96.236 | TCP | |||
| 171.146.32.206 | US | Concord | TCP | |
| 161.6.181.223 | US | Bowling Green | TCP | |
| 0.0.160.229 | TCP | |||
| 202-177-17-152.kddi.net.hk | 202.177.17.152 | HK | Central District | TCP |
| 146.218.142.44 | US | Silverdale | TCP | |
| 139.22.141.31 | DE | TCP | ||
| 38.244.234.131 | US | TCP | ||
| 0.0.104.197 | TCP | |||
| label-occase.fr | 217.160.2.91 | DE | TCP | |
| 51.249.231.228 | GB | TCP | ||
| 181.176.208.35 | PE | Lima | TCP | |
| 124.75.132.118 | CN | Shanghai | TCP | |
| 10.15.192.204 | TCP | |||
| 194.75.96.141 | GB | TCP | ||
| 0.0.223.22 | TCP | |||
| 16.101.63.47 | US | Palo Alto | TCP | |
| 0.0.109.228 | TCP | |||
| 0.0.22.166 | TCP | |||
| 0.0.62.23 | TCP | |||
| 0.0.197.169 | TCP | |||
| 0.0.83.171 | TCP | |||
| 0.0.28.102 | TCP | |||
| 0.0.1.50 | TCP | |||
| 36.1.120.218 | CN | TCP | ||
| eth3926.nsw.adsl.internode.on.net | 150.101.126.85 | AU | Sydney | TCP |
| 19.1.158.171 | US | Dearborn | TCP | |
| static-25-224-25-46.ipcom.comunitel.net | 46.25.224.25 | ES | TCP | |
| 23.187.139.85 | TCP | |||
| 200.218.33.192 | BR | TCP | ||
| 188.57.92.93 | TR | Izmir | TCP | |
| 0.0.72.181 | TCP | |||
| q-248.n-81.18.251.qore.nl | 81.18.251.248 | NL | Utrecht | TCP |
| 0.0.197.170 | TCP | |||
| 0.0.28.55 | TCP | |||
| 0.0.113.112 | TCP | |||
| softbank126066223220.bbtec.net | 126.66.223.220 | JP | Narita | TCP |
| 0.0.94.248 | TCP | |||
| 0.0.132.9 | TCP | |||
| 0.58.143.180 | TCP | |||
| 154.86.9.84 | US | TCP | ||
| 0.0.123.206 | TCP | |||
| 153.107.16.130 | AU | TCP | ||
| 1.157.62.67 | AU | TCP | ||
| 0.0.210.119 | TCP | |||
| 0.0.126.35 | TCP | |||
| 2.181.212.184 | IR | TCP | ||
| 0.0.161.119 | TCP | |||
| 13.64.133.139 | US | San Jose | TCP | |
| 40.59.49.180 | US | TCP | ||
| 21.197.148.53 | US | TCP | ||
| 178.77.223.7 | CZ | Strasice | TCP | |
| 37.251.112.228 | NL | TCP | ||
| 0.0.121.0 | TCP | |||
| 155.206.242.133 | US | Silver Spring | TCP | |
| 118.21.208.128 | JP | TCP | ||
| 10.104.191.42 | TCP | |||
| 204.27.4.112 | US | Buffalo | TCP | |
| 0.0.141.136 | TCP | |||
| 176.254.251.160 | GB | Milton Keynes | TCP | |
| 177.207.98.110.dynamic.adsl.gvt.net.br | 177.207.98.110 | BR | Fortaleza | TCP |
| pool-96-242-104-152.nwrknj.east.verizon.net | 96.242.104.152 | US | TCP | |
| c-50-178-72-1.hsd1.il.comcast.net | 50.178.72.1 | US | Saint Charles | TCP |
| 0.0.27.210 | TCP | |||
| 195.228.112.184 | HU | TCP | ||
| 58.111.37.251 | AU | TCP | ||
| 24.179.109.39 | US | Westport | TCP | |
| 13.65.196.51 | US | San Antonio | TCP | |
| 74.191.171.88 | US | TCP | ||
| 0.0.154.4 | TCP | |||
| 0.0.16.208 | TCP | |||
| 0.0.143.5 | TCP | |||
| 0.0.0.195 | TCP | |||
| 0.0.47.117 | TCP | |||
| 0.0.197.19 | TCP | |||
| 0.0.167.61 | TCP | |||
| 0.0.49.232 | TCP | |||
| 194.220.159.31 | ES | A Corua | TCP | |
| 94-33-27-217.static.clienti.tiscali.it | 94.33.27.217 | IT | TCP | |
| 36.127.141.147 | CN | Hangzhou | TCP | |
| 114.218.229.27 | CN | Suzhou | TCP | |
| 214.40.91.195 | US | TCP | ||
| 0.0.208.225 | TCP | |||
| 101.7.164.173 | CN | Xian | TCP | |
| 58.52.176.208 | CN | Wuhan | TCP | |
| 0.0.67.48 | TCP | |||
| 0.0.212.96 | TCP | |||
| 136.183.66.221 | US | Buffalo | TCP | |
| 0.0.104.250 | TCP | |||
| 202.91.9.64 | ID | Yogyakarta | TCP | |
| 0.0.159.134 | TCP | |||
| 0.0.147.174 | TCP | |||
| 65.10.196.241 | US | TCP | ||
| NWTcd-01p11-10.ppp11.odn.ad.jp | 219.67.38.10 | JP | Kitakyushu | TCP |
| 40.112.117.52 | NL | Amsterdam | TCP | |
| 0.0.230.42 | TCP | |||
| 19.175.43.236 | US | Dearborn | TCP | |
| 0.0.139.145 | TCP | |||
| 0.0.75.95 | TCP | |||
| 193.252.150.123 | FR | TCP | ||
| 85.209.41.47 | SA | TCP | ||
| 0.0.214.123 | TCP | |||
| 206.219.170.46 | US | Little River | TCP | |
| 39.78.23.218 | CN | Jinan | TCP | |
| 0.0.180.163 | TCP | |||
| 0.0.155.250 | TCP | |||
| 172.9.45.133 | US | Saint Louis | TCP | |
| 125.150.194.107 | KR | TCP | ||
| customer-MOR-63-123.megared.net.mx | 177.243.63.123 | MX | Morelia | TCP |
| 0.0.45.80 | TCP | |||
| 178.160.16.210 | HR | TCP | ||
| 29.187.195.113 | US | TCP | ||
| 31.54.216.68 | GB | Shillingstone | TCP | |
| 73.122.18.79 | US | TCP | ||
| 0.0.144.108 | TCP | |||
| 88.226.202.199 | TR | TCP | ||
| 205.167.184.117 | US | TCP | ||
| 166.85.219.174 | ZA | Marshalltown | TCP | |
| 174.198.10.91 | US | Crystal Lake | TCP | |
| 115.169.76.214 | CN | Beijing | TCP | |
| 0.0.63.81 | TCP | |||
| 29.233.5.58 | US | TCP | ||
| 207.33.192.77 | US | Englewood | TCP | |
| 57.3.247.227 | BE | TCP | ||
| 0.0.163.21 | TCP | |||
| 0.0.58.164 | TCP | |||
| 0.0.104.113 | TCP | |||
| 0.0.221.90 | TCP | |||
| 0.0.190.196 | TCP | |||
| 0.0.209.250 | TCP | |||
| 0.0.141.90 | TCP | |||
| 0.0.15.69 | TCP | |||
| net-37-119-98-212.cust.vodafonedsl.it | 37.119.98.212 | IT | TCP | |
| 4.97.161.234 | US | TCP | ||
| fm-dyn-139-193-140-65.fast.net.id | 139.193.140.65 | ID | Jakarta | TCP |
| 113.106.123.188 | CN | Zhuhai | TCP | |
| 0.0.120.95 | TCP | |||
| 66-189-3-101.static.oxfr.ma.charter.com | 66.189.3.101 | US | TCP | |
| 0.0.90.79 | TCP | |||
| 42.116.252.242 | VN | Ho Chi Minh City | TCP | |
| 0.0.110.18 | TCP | |||
| 20.225.210.231 | US | Falls Church | TCP | |
| 0.0.142.206 | TCP | |||
| 144.248.162.146 | BE | Brussel | TCP | |
| 0.0.37.3 | TCP | |||
| 0.0.66.121 | TCP | |||
| 142.pool85-48-184.static.orange.es | 85.48.184.142 | ES | Fuente-lamo | TCP |
| 0.0.52.114 | TCP | |||
| 26.238.176.205 | US | TCP | ||
| 0.0.189.43 | TCP | |||
| 28.55.106.229 | US | TCP | ||
| 48.153.125.213 | US | Newark | TCP | |
| mobile-107-233-99-113.mycingular.net | 107.233.99.113 | US | TCP | |
| 0.0.38.13 | TCP | |||
| 148.7.210.217 | US | Burlington | TCP | |
| 79.95.235.110 | FR | Le Passage | TCP | |
| 0.0.120.123 | TCP | |||
| 0.0.114.168 | TCP | |||
| 219.90.38.197 | TW | TCP | ||
| ool-4351acc7.dyn.optonline.net | 67.81.172.199 | US | Elizabeth | TCP |
| 79.164.121.233 | RU | Moscow | TCP | |
| 102.241.90.84 | TCP | |||
| 72.252.110.251 | JM | Kingston | TCP | |
| 0.0.60.74 | TCP | |||
| 0.0.163.7 | TCP | |||
| 167.180.155.112 | US | Raleigh | TCP | |
| 198.112.151.83 | US | Cambridge | TCP | |
| 0.0.128.40 | TCP | |||
| 12.127.144.250 | US | TCP | ||
| 62.41.186.77 | NL | TCP | ||
| 33.43.199.122 | US | TCP | ||
| 0.0.35.123 | TCP | |||
| 66.67.132.203 | US | TCP | ||
| 22.57.2.43 | US | TCP | ||
| 7.103.13.232 | US | TCP | ||
| 53.172.149.116 | DE | TCP | ||
| 179.130.218.40 | BR | Parob | TCP | |
| 52.234.9.28 | US | San Jose | TCP | |
| softbank060148055009.bbtec.net | 60.148.55.9 | JP | TCP | |
| 0.0.10.254 | TCP | |||
| 0.0.9.80 | TCP | |||
| 0.0.126.149 | TCP | |||
| 0.0.43.190 | TCP | |||
| 0.0.44.205 | TCP | |||
| 0.0.216.179 | TCP | |||
| 0.0.199.136 | TCP | |||
| 0.0.119.251 | TCP | |||
| 0.0.154.229 | TCP | |||
| mvx-200-196-48-170.mundivox.com | 200.196.48.170 | BR | Rio De Janeiro | TCP |
| 196.171.98.250 | TG | TCP | ||
| 0.0.126.154 | TCP | |||
| 228-198.dsl.iskon.hr | 89.164.228.198 | HR | Zagreb | TCP |
| 145.170.246.8 | NL | Utrecht | TCP | |
| 9.0.243.152 | US | Durham | TCP | |
| 0.0.248.144 | TCP | |||
| iptv-mlibrasgw2-50dda1-14.dhcp.inet.fi | 80.221.161.14 | FI | Mikkeli | TCP |
| 68.161.76.228 | US | TCP | ||
| 0.0.15.205 | TCP | |||
| 0.0.129.128 | TCP | |||
| 0.0.55.13 | TCP | |||
| 0.0.240.252 | TCP | |||
| 200.146.205.105 | BR | TCP | ||
| 0.0.49.11 | TCP | |||
| 159.187.158.190 | US | Orange Park | TCP | |
| 18.247.72.111 | US | Cambridge | TCP | |
| cpe-71-77-128-72.nc.res.rr.com | 71.77.128.72 | US | Lumberton | TCP |
| 213.239.6.39 | NL | TCP | ||
| 0.0.243.43 | TCP | |||
| 45.19.87.115 | US | TCP | ||
| 0.0.106.236 | TCP | |||
| dynamic-74-1-205-88.b2bdsl.de | 88.205.1.74 | DE | Krefeld | TCP |
| 216.152.219.68 | US | Bountiful | TCP | |
| 46.101.26.71 | GB | London | TCP | |
| 0.0.160.105 | TCP | |||
| 0.0.61.96 | TCP | |||
| 0.0.221.84 | TCP | |||
| 0.0.243.178 | TCP | |||
| 132.24.246.5 | US | Montgomery | TCP | |
| 164.147.100.202.broad.xn.qh.dynamic.163data.com.cn | 202.100.147.164 | CN | Xining | TCP |
| 210-86-73-197.jetstream.xtra.co.nz | 210.86.73.197 | NZ | Wellington | TCP |
| 117.109.174.4 | JP | Nara | TCP | |
| 188.241.250.142 | RO | TCP | ||
| ec2-54-70-88-11.us-west-2.compute.amazonaws.com | 54.70.88.11 | US | Boardman | TCP |
| 0.0.127.180 | TCP | |||
| 23.89.107.192 | US | Los Angeles | TCP | |
| 27.50.115.145 | JP | Tokyo | TCP | |
| 122.151.111.180 | AU | TCP | ||
| 67.40.110.101 | US | TCP | ||
| 0.0.251.205 | TCP | |||
| 123.165.28.166 | CN | Harbin | TCP | |
| 48.203.103.22 | US | Newark | TCP | |
| 171.77.1.229 | IN | TCP | ||
| 136.235.120.179 | US | Carmichael | TCP | |
| 11.17.98.209 | US | TCP | ||
| 69.232.188.108 | US | TCP | ||
| 0.0.154.228 | TCP | |||
| 0.0.43.219 | TCP | |||
| 0.0.108.161 | TCP | |||
| 0.0.180.138 | TCP | |||
| tor.server-02.r3t.at | 78.142.142.246 | AT | Vienna | TCP |
| tor.dizum.com | 194.109.206.212 | NL | TCP | |
| 0.0.179.195 | TCP | |||
| 0.0.124.205 | TCP | |||
| 0.0.130.22 | TCP | |||
| 0.0.18.98 | TCP | |||
| 0.0.63.195 | TCP | |||
| 0.0.8.73 | TCP | |||
| 196.108.23.246 | KE | TCP | ||
| 205.227.173.198 | US | TCP | ||
| 0.0.20.249 | TCP | |||
| 185.46.112.187 | GB | TCP | ||
| 4.95.53.14 | US | TCP | ||
| 0.0.73.224 | TCP | |||
| 122.194.154.69 | CN | Nanjing | TCP | |
| 0.0.67.54 | TCP | |||
| 132.140.4.179 | US | Fort Huachuca | TCP | |
| ip187-86-8-49.anid.com.br | 187.86.8.49 | BR | TCP | |
| 223.20.43.8 | CN | Beijing | TCP | |
| 0.0.245.196 | TCP | |||
| 0.0.124.169 | TCP | |||
| 0.0.98.70 | TCP | |||
| 20.99.98.8 | US | Falls Church | TCP | |
| 0.0.242.129 | TCP | |||
| 73.42.194.28 | US | Tacoma | TCP | |
| 0.0.77.73 | TCP | |||
| 28.37.67.74 | US | TCP | ||
| 0.0.202.178 | TCP | |||
| 32.90.91.30 | US | TCP | ||
| 143.194.135.192 | US | Fort Huachuca | TCP | |
| 223.105.92.106 | CN | TCP | ||
| 81.20.144.3 | EE | TCP | ||
| 0.0.246.190 | TCP | |||
| 0.0.103.141 | TCP | |||
| 0.0.28.175 | TCP | |||
| 0.0.166.37 | TCP | |||
| 221.184.115.201 | JP | Niigata | TCP | |
| 167.25.160.204 | US | Exton | TCP | |
| 9.55.181.237 | US | Durham | TCP | |
| 74.230.49.128 | US | TCP | ||
| 0.0.148.220 | TCP | |||
| 80.sub-174-207-112.myvzw.com | 174.207.112.80 | US | TCP | |
| ip-87-84-116-91.easynet.co.uk | 87.84.116.91 | GB | Epsom | TCP |
| 79.sub-72-127-156.myvzw.com | 72.127.156.79 | US | TCP | |
| 107-55-138-73.pools.spcsdns.net | 107.55.138.73 | US | TCP | |
| 143.71.203.173 | US | Fort Huachuca | TCP | |
| 23.244.245.250 | US | Portland | TCP | |
| 0.0.111.56 | TCP | |||
| 220.12.190.199 | JP | TCP | ||
| 39.17.35.52 | KR | TCP | ||
| 134.184.61.170 | BE | Brussel | TCP | |
| 66.197.183.158 | US | Wilmington | TCP | |
| 6.41.236.122 | US | Fort Huachuca | TCP | |
| softbank221030228013.bbtec.net | 221.30.228.13 | JP | TCP | |
| 21.49.101.167 | US | TCP | ||
| 0.0.9.83 | TCP | |||
| 0.0.242.181 | TCP | |||
| 0.0.236.151 | TCP | |||
| 0.0.175.46 | TCP | |||
| 0.0.214.161 | TCP | |||
| 0.0.32.31 | TCP | |||
| 0.0.5.241 | TCP | |||
| 0.0.0.212 | TCP | |||
| 12.151.252.167 | US | TCP | ||
| 0.0.134.224 | TCP | |||
| 0.0.235.162 | TCP | |||
| ec2-34-254-164-193.eu-west-1.compute.amazonaws.com | 34.254.164.193 | US | TCP | |
| 121.172.119.222 | KR | Incheon | TCP | |
| 0.0.47.186 | TCP | |||
| host68-254-static.3-79-b.business.telecomitalia.it | 79.3.254.68 | IT | Malcesine | TCP |
| 0.0.223.67 | TCP | |||
| 186.100.176.25 | AR | Buenos Aires | TCP | |
| 156.132.152.99 | US | Washington | TCP | |
| 165.158.103.174 | US | Washington | TCP | |
| 0.0.26.59 | TCP | |||
| 0.0.142.199 | TCP | |||
| 0.0.239.226 | TCP | |||
| 0.0.90.15 | TCP | |||
| c-75-70-41-137.hsd1.co.comcast.net | 75.70.41.137 | US | Colorado Springs | TCP |
| 0.0.130.13 | TCP | |||
| bba448120.alshamil.net.ae | 83.110.77.64 | AE | Sharjah | TCP |
| ai126250035194.11.tss.access-internet.ne.jp | 126.250.35.194 | JP | Kyoto | TCP |
| 34.124.209.223 | US | TCP | ||
| net-2-37-148-164.cust.vodafonedsl.it | 2.37.148.164 | IT | Imola | TCP |
| 150.221.237.44 | US | Rochester | TCP | |
| 28.220.112.164 | US | TCP | ||
| 0.0.50.170 | TCP | |||
| 7.114.6.190 | US | TCP | ||
| 0.0.159.243 | TCP | |||
| 0.0.202.58 | TCP | |||
| 0.0.188.74 | TCP | |||
| 0.0.247.172 | TCP | |||
| 0.0.238.87 | TCP | |||
| 0.0.224.160 | TCP | |||
| 93-97-152-111.zone5.bethere.co.uk | 93.97.152.111 | GB | London | TCP |
| 168-93-197-107.ipv4.firstcomm.com | 168.93.197.107 | US | Akron | TCP |
| 218.197.190.13 | CN | Wuhan | TCP | |
| 187.153.179.23 | MX | TCP | ||
| 25.0.13.84 | GB | TCP | ||
| 10.206.81.223 | TCP | |||
| 54.sub-97-34-133.myvzw.com | 97.34.133.54 | US | Jacksonville Beach | TCP |
| 43.81.251.189 | JP | Tokyo | TCP | |
| 136.168.88.121 | US | Bakersfield | TCP | |
| 193.144.223.78 | ES | Santander | TCP | |
| 89.56.249.186 | DE | TCP | ||
| 157.96.98.194 | GB | London | TCP | |
| 203.182.148.46 | JP | TCP | ||
| 0.0.50.18 | TCP | |||
| 36.40.204.175 | CN | Xian | TCP | |
| 5.114.172.84 | IR | TCP | ||
| 39.48.63.115 | PK | Karachi | TCP | |
| 142.49.15.120 | CA | Toronto | TCP | |
| 0.0.71.108 | TCP | |||
| 0.0.166.38 | TCP | |||
| 0.0.95.145 | TCP | |||
| 0.0.209.0 | TCP | |||
| 0.0.12.82 | TCP | |||
| 0.0.54.236 | TCP | |||
| 0.0.26.85 | TCP | |||
| 0.0.74.12 | TCP | |||
| 0.0.91.32 | TCP | |||
| 0.0.5.134 | TCP | |||
| 0.0.56.233 | TCP | |||
| 158.21.68.174 | US | Irving | TCP | |
| 26.207.12.65 | US | TCP | ||
| 0.0.19.236 | TCP | |||
| 12.227.92.220 | US | TCP | ||
| 132.56.82.160 | US | Montgomery | TCP | |
| 0.0.128.242 | TCP | |||
| 0.0.144.253 | TCP | |||
| 30.43.85.218.broad.fz.fj.dynamic.163data.com.cn | 218.85.43.30 | CN | Fuzhou | TCP |
| 210.133.225.253 | JP | TCP | ||
| c-98-248-133-214.hsd1.ca.comcast.net | 98.248.133.214 | US | Fremont | TCP |
| 0.0.241.230 | TCP | |||
| 0.0.77.92 | TCP | |||
| 0.0.134.237 | TCP | |||
| ec2-52-60-128-102.ca-central-1.compute.amazonaws.com | 52.60.128.102 | US | Seattle | TCP |
| 0.0.166.204 | TCP | |||
| 11.246.158.62 | US | TCP | ||
| 51.104.13.135 | GB | TCP | ||
| 0.0.139.166 | TCP | |||
| 121.57.171.150 | CN | Baotou | TCP | |
| 27.110.180.226 | PH | Pasong Tamo | TCP | |
| customer-PUE-174-222.megared.net.mx | 189.193.174.222 | MX | Puebla | TCP |
| 137.2.6.121 | US | Montgomery | TCP | |
| 134.70.199.234 | US | Torrance | TCP | |
| 0.0.47.214 | TCP | |||
| 0.0.169.9 | TCP | |||
| 0.0.2.169 | TCP | |||
| 0.0.239.251 | TCP | |||
| 0.0.193.18 | TCP | |||
| 0.0.43.34 | TCP | |||
| 10.86.98.132 | TCP | |||
| 162.149.253.8 | US | TCP | ||
| 26.73.168.226 | US | TCP | ||
| 223.154.249.37 | CN | Changsha | TCP | |
| 31.76.225.252 | GB | Newcastle | TCP | |
| 163.29.125.88 | TW | Taipei | TCP | |
| 96.122.15.136 | US | TCP | ||
| 189.206.206.37 | MX | Garza Garca | TCP | |
| host-209-164-202-213.metlife.com | 209.164.202.213 | US | Long Island City | TCP |
| 158.191.239.136 | FR | TCP | ||
| 151.62.163.223 | IT | Verona | TCP | |
| 0.0.9.53 | TCP | |||
| 0.0.36.223 | TCP | |||
| 131.170.11.145 | AU | Melbourne | TCP | |
| 7.50.4.146 | US | TCP | ||
| 197.108.132.79 | ZA | Benoni | TCP | |
| 212.239.65.231 | IT | TCP | ||
| 0.0.2.189 | TCP | |||
| 150.128.83.204 | ES | Castelln | TCP | |
| 186.215.18.51 | BR | So Leopoldo | TCP | |
| 0.0.81.177 | TCP | |||
| 0.0.99.221 | TCP | |||
| 0.0.223.7 | TCP | |||
| 0.0.221.105 | TCP | |||
| 0.0.97.151 | TCP | |||
| 0.0.194.197 | TCP | |||
| 0.0.212.93 | TCP | |||
| 0.0.225.118 | TCP | |||
| 136.118.197.197 | US | Dearborn | TCP | |
| 0.0.16.197 | TCP | |||
| 49.62.78.252 | KR | TCP | ||
| 110.246.117.66 | CN | Hebei | TCP | |
| 0.0.155.242 | TCP | |||
| 180.135.45.28 | KR | TCP | ||
| 0.0.168.141 | TCP | |||
| 89.56.86.27 | DE | TCP | ||
| 138.141.222.37 | US | Virginia Beach | TCP | |
| 188.43.231.63 | RU | TCP | ||
| 0.0.86.77 | TCP | |||
| 0.0.90.175 | TCP | |||
| 0.0.232.187 | TCP | |||
| 0.0.43.246 | TCP | |||
| 81.65.173.248 | FR | Toulouse | TCP | |
| 0.0.51.61 | TCP | |||
| 223.184.205.111 | IN | Delhi | TCP | |
| 191.60.75.211 | BR | Rio De Janeiro | TCP | |
| 0.0.158.13 | TCP | |||
| 36.0.156.179 | CN | Beijing | TCP | |
| 83.190.124.100 | LT | Kaunas | TCP | |
| 122.230.244.24 | CN | Huzhou | TCP | |
| 117.109.40.185 | JP | Nara | TCP | |
| 11.135.21.11 | US | TCP | ||
| 0.0.154.181 | TCP | |||
| 0.0.155.112 | TCP | |||
| 0.0.19.216 | TCP | |||
| 0.0.218.34 | TCP | |||
| 0.0.42.7 | TCP | |||
| 0.0.44.110 | TCP | |||
| 49.6.5.239 | CN | Beijing | TCP | |
| 8.184.193.166 | US | TCP | ||
| 51.229.47.147 | GB | TCP | ||
| p57919B86.dip0.t-ipconnect.de | 87.145.155.134 | DE | TCP | |
| c-3629e455.0287628-0-646f63736973.cust.bredbandsbolaget.se | 85.228.41.103 | SE | Stockholm | TCP |
| 200.22.10.115 | CL | Santiago | TCP | |
| 118.95.214.160 | IN | TCP | ||
| 211.224.139.59 | KR | Gyeongju | TCP | |
| 5.98.176.189 | IT | TCP | ||
| 206.196.3.159 | US | Charlotte | TCP | |
| 177.167.218.29 | BR | So Paulo | TCP | |
| 97.148.244.47 | US | TCP | ||
| 188.212.138.67 | RO | Brasov | TCP | |
| 107-213-210-150.lightspeed.tukrga.sbcglobal.net | 107.213.210.150 | US | Smyrna | TCP |
| 144.109.205.67 | US | Fort Huachuca | TCP | |
| 0.0.9.9 | TCP | |||
| 0.0.52.181 | TCP | |||
| 197.201.187.52 | DZ | TCP | ||
| 221.35.190.252 | JP | TCP | ||
| 0.0.24.206 | TCP | |||
| 0.0.199.58 | TCP | |||
| 0.0.17.137 | TCP | |||
| 0.0.15.146 | TCP | |||
| 0.0.88.64 | TCP | |||
| 0.0.153.210 | TCP | |||
| 0.0.132.160 | TCP | |||
| 0.0.237.136 | TCP | |||
| 0.0.13.242 | TCP | |||
| 0.0.165.104 | TCP | |||
| 19.13.247.188 | US | Dearborn | TCP | |
| 198.14.110.165 | US | Los Angeles | TCP | |
| 0.0.50.172 | TCP | |||
| 72.254.59.166 | US | TCP | ||
| 0.0.102.194 | TCP | |||
| 0.0.172.118 | TCP | |||
| 77-110-193-191.inet.signal.no | 77.110.193.191 | NO | Stokmarknes | TCP |
| 143.35.140.50 | US | Cincinnati | TCP | |
| 175-99-74-253.static.tfn.net.tw | 175.99.74.253 | TW | Taipei | TCP |
| 0.0.15.236 | TCP | |||
| 61.136.49.42 | CN | Tianjin | TCP | |
| 0.0.18.100 | TCP | |||
| 0.0.62.30 | TCP | |||
| 0.0.145.80 | TCP | |||
| 53.233.130.253 | DE | TCP | ||
| 0.0.72.180 | TCP | |||
| 175.196.212.65 | KR | TCP | ||
| 53.38.240.126 | DE | TCP | ||
| 0.0.210.92 | TCP | |||
| 55.154.132.148 | US | Fort Huachuca | TCP | |
| 88.135.231.202 | UA | Dnepropetrovsk | TCP | |
| 93.240.235.104 | DE | TCP | ||
| 134-249-120-28.broadband.kyivstar.net | 134.249.120.28 | UA | TCP | |
| 174.123.55.84 | US | Houston | TCP | |
| 0.0.96.95 | TCP | |||
| 0.0.128.78 | TCP | |||
| 0.0.118.42 | TCP | |||
| 0.0.120.217 | TCP | |||
| 0.0.200.159 | TCP | |||
| 0.0.98.112 | TCP | |||
| 110.32.12.183 | AU | Brisbane | TCP | |
| 6.223.83.202 | US | Fort Huachuca | TCP | |
| 43.154.51.182 | JP | Tokyo | TCP | |
| 148.176.249.244 | GB | Glasgow | TCP | |
| ARennes-658-1-116-156.w83-199.abo.wanadoo.fr | 83.199.116.156 | FR | Saint Malo | TCP |
| 31.106.209.252 | GB | Manchester | TCP | |
| 169.163.143.128 | US | Reston | TCP | |
| 63.169.137.146 | US | TCP | ||
| 151.92.212.193.static.cust.telenor.com | 193.212.92.151 | NO | TCP | |
| 15.208.137.195 | US | Palo Alto | TCP | |
| host-156.197.3.82-static.tedata.net | 156.197.82.3 | EG | Cairo | TCP |
| 0.0.153.173 | TCP | |||
| 0.0.102.2 | TCP | |||
| 209.189.107.8 | US | Englewood | TCP | |
| 209-170-114-143.customer.teliacarrier.com | 209.170.114.143 | GB | London | TCP |
| 170.102.127.253 | US | Greensboro | TCP | |
| 20.199.19.62 | US | Falls Church | TCP | |
| 0.0.105.27 | TCP | |||
| 0.0.107.219 | TCP | |||
| 175.210.240.101 | KR | Bucheon | TCP | |
| 50.100.204.48 | CA | Cornwall | TCP | |
| 0.0.195.234 | TCP | |||
| 0.0.136.234 | TCP | |||
| 0.0.16.242 | TCP | |||
| 0.0.244.92 | TCP | |||
| 0.0.137.226 | TCP | |||
| 0.0.203.218 | TCP | |||
| 0.0.223.85 | TCP | |||
| 0.0.7.176 | TCP | |||
| 185.92.57.99 | GE | TCP | ||
| 109-61-33-106.adsl-pool.dravanet.hu | 109.61.33.106 | HU | TCP | |
| 0.0.51.229 | TCP | |||
| 40.102.38.31 | NL | Amsterdam | TCP | |
| 0.0.3.186 | TCP | |||
| 0.0.116.108 | TCP | |||
| static-pool-100-079.flagman.zp.ua | 46.46.100.79 | UA | Zaporozhye | TCP |
| 214.40.161.254 | US | TCP | ||
| 0.0.53.95 | TCP | |||
| 0.0.135.229 | TCP | |||
| 12.37.242.171 | US | TCP | ||
| 0.0.173.115 | TCP | |||
| 38.57.66.143 | US | TCP | ||
| 56.180.173.232 | US | Raleigh | TCP | |
| 0.0.159.196 | TCP | |||
| 0.0.87.65 | TCP | |||
| 0.0.0.95 | TCP | |||
| 81.239.176.24 | SE | TCP | ||
| KD059133112144.ppp.dion.ne.jp | 59.133.112.144 | JP | TCP | |
| 0.0.220.226 | TCP | |||
| 74.91.20.176 | US | Kansas City | TCP | |
| 69.90.161.73 | CA | Oakville | TCP | |
| 170.154.77.36 | US | Boston | TCP | |
| 29.185.146.201 | US | TCP | ||
| 168.129.217.154 | US | Wood Dale | TCP | |
| 0.0.92.19 | TCP | |||
| 0.0.200.152 | TCP | |||
| 0.0.44.123 | TCP | |||
| 0.0.40.212 | TCP | |||
| 29.142.150.223 | US | TCP | ||
| 91.53.120.195 | DE | Naila | TCP | |
| 194.252.187.202 | FI | TCP | ||
| 15.23.125.199 | US | Palo Alto | TCP | |
| 0.0.75.38 | TCP | |||
| 0.0.150.90 | TCP | |||
| 154.54.128.238 | US | TCP | ||
| 50.58.186.84 | US | TCP | ||
| 211.48.118.12 | KR | Suwon | TCP | |
| 128.216.223.175 | US | Montgomery | TCP | |
| pool-70-18-184-130.pskn.east.verizon.net | 70.18.184.130 | US | Long Valley | TCP |
| adsl-76-212-3-13.dsl.pltn13.sbcglobal.net | 76.212.3.13 | US | Oakland | TCP |
| host-41.39.17.82.tedata.net | 41.39.17.82 | EG | Alexandria | TCP |
| 0.0.158.69 | TCP | |||
| 0.0.129.145 | TCP | |||
| 195.92.133.135 | GB | TCP | ||
| 0.0.172.106 | TCP | |||
| 151.211.197.166 | GB | London | TCP | |
| 155.17.84.247 | US | Round Rock | TCP | |
| 102.108.27.75 | TCP | |||
| 0.0.4.122 | TCP | |||
| 180.102.83.238 | CN | Nanjing | TCP | |
| 139.83.203.149 | PT | Lisbon | TCP | |
| 0.0.143.166 | TCP | |||
| 0.0.187.243 | TCP | |||
| 0.0.57.146 | TCP | |||
| 0.0.32.172 | TCP | |||
| 0.0.89.38 | TCP | |||
| 0.0.162.167 | TCP | |||
| 0.0.75.227 | TCP | |||
| 0.0.54.232 | TCP | |||
| 85.163.41.76 | CZ | Prague | TCP | |
| 140.226.191.78 | US | Aurora | TCP | |
| 0.0.96.155 | TCP | |||
| 0.0.60.56 | TCP | |||
| 17.152.26.109 | US | Cupertino | TCP | |
| 110.195.180.90 | CN | Beijing | TCP | |
| 169.115.60.116 | US | New York | TCP | |
| 0.0.187.125 | TCP | |||
| 0.0.26.80 | TCP | |||
| s3eea6496.adsl.online.nl | 62.234.100.150 | NL | Oude-niedorp | TCP |
| 211.93.133.157 | CN | TCP | ||
| 0.0.198.193 | TCP | |||
| a172-226-77-233.deploy.static.akamaitechnologies.com | 172.226.77.233 | US | Cambridge | TCP |
| 0.0.13.244 | TCP | |||
| 0.0.245.106 | TCP | |||
| 0.0.88.151 | TCP | |||
| iix-116-210.jr-webhost.net | 111.68.116.210 | ID | Jakarta | TCP |
| 51.81.158.121 | GB | TCP | ||
| 0.0.143.161 | TCP | |||
| 116.137.2.103 | CN | Chaoyang | TCP | |
| user-89-108-224-190.play-internet.pl | 89.108.224.190 | PL | TCP | |
| 0.0.108.207 | TCP | |||
| 146.54.187.93 | US | Deridder | TCP | |
| 67.red-81-38-200.dynamicip.rima-tde.net | 81.38.200.67 | ES | A Corua | TCP |
| ip2-1896.netxbb.net | 66.209.39.103 | US | Greenville | TCP |
| 0.0.254.254 | TCP | |||
| 0.0.140.159 | TCP | |||
| 0.0.81.232 | TCP | |||
| 0.0.226.132 | TCP | |||
| 89.87.48.48 | FR | Houilles | TCP | |
| 5.37.51.130 | OM | TCP | ||
| softbank220060143015.bbtec.net | 220.60.143.15 | JP | TCP | |
| 26.20.228.139 | US | TCP | ||
| 0.0.243.144 | TCP | |||
| 0.0.93.111 | TCP | |||
| 174-124-202-229.dyn.centurytel.net | 174.124.202.229 | US | Chesaning | TCP |
| 8.29.5.122 | US | Mesa | TCP | |
| 185.151.119.95 | PL | TCP | ||
| 51.145.130.191 | GB | TCP | ||
| KD106169043214.au-net.ne.jp | 106.169.43.214 | JP | TCP | |
| 95.63.186.218.starhub.net.sg | 218.186.63.95 | SG | Singapore | TCP |
| 136.104.87.218 | US | Dearborn | TCP | |
| 0.0.69.143 | TCP | |||
| 0.0.12.120 | TCP | |||
| 110.45.237.4 | KR | Seoul | TCP | |
| 173.91.61.218 | US | Cleveland | TCP | |
| 0.0.213.202 | TCP | |||
| 24-111-171-107-dynamic.midco.net | 24.111.171.107 | US | Moorhead | TCP |
| 8.155.168.2 | US | TCP | ||
| 193.68.42.45 | HU | Valk | TCP | |
| 185.143.128.153 | KZ | TCP | ||
| 0.0.56.190 | TCP | |||
| 0.0.205.167 | TCP | |||
| 0.0.196.114 | TCP | |||
| 0.0.0.145 | TCP | |||
| ks.rufoa.com | 37.187.22.87 | FR | TCP | |
| 0.0.11.110 | TCP | |||
| 0.0.135.118 | TCP | |||
| 0.0.77.52 | TCP | |||
| 0.0.190.203 | TCP | |||
| 0.0.116.164 | TCP | |||
| entrenanet--191-5-176-147.enn.net.br | 191.5.176.147 | BR | Jaragu Do Sul | TCP |
| r167-116-119-48.dialup.mobile.ancel.net.uy | 167.116.119.48 | UY | Montevideo | TCP |
| 0.0.6.107 | TCP | |||
| 0.0.243.63 | TCP | |||
| 129.128.160.19 | CA | Edmonton | TCP | |
| 0.0.53.208 | TCP | |||
| 40.200.221.219 | US | TCP | ||
| 70.54.243.192 | CA | TCP | ||
| 0.0.197.116 | TCP | |||
| 0.0.237.29 | TCP | |||
| 0.0.34.86 | TCP | |||
| 0.0.106.133 | TCP | |||
| 0.0.99.27 | TCP | |||
| 148.11.130.181 | US | TCP | ||
| 0.0.102.107 | TCP | |||
| 54.34.228.65 | US | Woodbridge | TCP | |
| 0.0.199.141 | TCP | |||
| 215.253.151.179 | US | TCP | ||
| 33.140.183.196 | US | TCP | ||
| 0.0.109.144 | TCP | |||
| 118.92.188.175 | NZ | Palmerston North | TCP | |
| 65-86-169-105.client.dsl.net | 65.86.169.105 | US | Pleasanton | TCP |
| 221x243x32x187.ap221.ftth.ucom.ne.jp | 221.243.32.187 | JP | Tokyo | TCP |
| 18.189.110.6 | US | Cambridge | TCP | |
| 222.64.127.252 | CN | Shanghai | TCP | |
| 0.0.140.200 | TCP | |||
| 0.0.110.53 | TCP | |||
| 0.0.153.50 | TCP | |||
| 0.0.137.89 | TCP | |||
| 109.195.223.4 | RU | Magnitogorsk | TCP | |
| 36.243.161.49 | JP | TCP | ||
| 249.243.092.145.hva.nl | 145.92.243.249 | NL | Amsterdam | TCP |
| 46.47.213.48 | RU | TCP | ||
| 0.0.26.18 | TCP | |||
| 0.0.233.120 | TCP | |||
| 215.128.23.217 | US | TCP | ||
| 13.209.40.195 | US | Norwalk | TCP | |
| 0.0.229.246 | TCP | |||
| 254.153.251.179.isp.timbrasil.com.br | 179.251.153.254 | BR | TCP | |
| 115.122.194.36 | CN | Beijing | TCP | |
| 158.234.134.162 | GB | Reading | TCP | |
| 136.219.4.109.rev.sfr.net | 109.4.219.136 | FR | TCP | |
| 112.220.61.158 | KR | TCP | ||
| 224.73.174.59.broad.wh.hb.dynamic.163data.com.cn | 59.174.73.224 | CN | Wuhan | TCP |
| 11.194.193.107 | US | TCP | ||
| 102.185.49.195 | TCP | |||
| 0.0.48.223 | TCP | |||
| 217.200.227.218 | IT | TCP | ||
| 147.138.139.140 | US | Bridgewater | TCP | |
| 0.0.66.117 | TCP | |||
| 0.0.141.119 | TCP | |||
| 0.0.189.151 | TCP | |||
| bl8-79-130.dsl.telepac.pt | 85.241.79.130 | PT | Faro | TCP |
| 0.0.41.242 | TCP | |||
| 0.0.109.179 | TCP | |||
| 0.0.47.152 | TCP | |||
| 0.0.192.161 | TCP | |||
| 0.0.98.189 | TCP | |||
| 0.0.124.220 | TCP | |||
| 0.0.191.9 | TCP | |||
| 254.red-79-156-177.staticip.rima-tde.net | 79.156.177.254 | ES | Murcia | TCP |
| 27.36.253.205 | CN | Foshan | TCP | |
| 0.0.70.187 | TCP | |||
| 0.0.85.21 | TCP | |||
| 45.209.228.54 | GH | TCP | ||
| 0.0.95.82 | TCP | |||
| 26.206.147.70 | US | TCP | ||
| 188.41.87.109.triolan.net | 109.87.41.188 | UA | Kharkiv | TCP |
| 0.0.153.73 | TCP | |||
| 0.0.34.36 | TCP | |||
| 152.82.156.11 | US | TCP | ||
| 32.193.56.22 | US | TCP | ||
| 0.0.14.247 | TCP | |||
| 44.165.134.138 | US | San Diego | TCP | |
| 0.0.193.6 | TCP | |||
| 0.0.178.229 | TCP | |||
| 0.0.11.92 | TCP | |||
| 39.135.74.39 | CN | TCP | ||
| 75-93-185-41.day.clearwire-dns.net | 75.93.185.41 | US | Middletown | TCP |
| 0.0.234.79 | TCP | |||
| 118-69-225-159-static.hcm.fpt.vn | 118.69.225.159 | VN | Ho Chi Minh City | TCP |
| 180.191.252.162 | PH | TCP | ||
| 0.0.135.233 | TCP | |||
| 144.174.112.172 | US | Tallahassee | TCP | |
| 20.34.147.160 | US | Falls Church | TCP | |
| 190.183.75.103 | AR | Corrientes | TCP | |
| 0.0.29.241 | TCP | |||
| 0.0.113.103 | TCP | |||
| 0.0.25.7 | TCP | |||
| 0.0.150.76 | TCP | |||
| 178.155.42.47 | RU | Volgograd | TCP | |
| 28.195.186.186 | US | TCP | ||
| KD111099020172.ppp-bb.dion.ne.jp | 111.99.20.172 | JP | Tokyo | TCP |
| 0.0.3.83 | TCP | |||
| 0.0.190.86 | TCP | |||
| 169.39.152.98 | CH | TCP | ||
| 190-179-161-138.speedy.com.ar | 190.179.161.138 | AR | TCP | |
| 254.253.61.188.dynamic.wline.res.cust.swisscom.ch | 188.61.253.254 | CH | Schaffhausen | TCP |
| 0.0.37.157 | TCP | |||
| 213.25.67.49 | PL | Kozienice | TCP | |
| 129.165.4.250 | US | Huntsville | TCP | |
| 160.241.167.183 | JP | TCP | ||
| c-68-55-229-74.hsd1.mi.comcast.net | 68.55.229.74 | US | Southgate | TCP |
| 49.100.10.20 | JP | Tokyo | TCP | |
| 123.228.27.99 | KR | TCP | ||
| ipb21b7ab1.dynamic.kabel-deutschland.de | 178.27.122.177 | DE | Augsburg | TCP |
| 119.210.136.195 | KR | TCP | ||
| 0.0.199.92 | TCP | |||
| 0.0.156.64 | TCP | |||
| 0.0.140.161 | TCP | |||
| 99.223.237.3 | CA | TCP | ||
| 11.106.85.0 | US | TCP | ||
| 0.0.6.229 | TCP | |||
| 0.0.172.103 | TCP | |||
| 0.0.189.143 | TCP | |||
| 0.0.239.105 | TCP | |||
| 0.0.247.160 | TCP | |||
| 0.0.135.154 | TCP | |||
| 0.0.141.166 | TCP | |||
| 0.0.31.141 | TCP | |||
| 0.0.211.56 | TCP | |||
| 84-72-137-189.dclient.hispeed.ch | 84.72.137.189 | CH | Riehen | TCP |
| 0.sub-75-248-151.myvzw.com | 75.248.151.0 | US | TCP | |
| 0.0.78.244 | TCP | |||
| 0.0.226.94 | TCP | |||
| 43.37.65.129 | JP | Tokyo | TCP | |
| 0.0.91.62 | TCP | |||
| 77.166.214.231 | NL | Steggerda | TCP | |
| customer-189-184-130-95.uninet.net.mx | 189.184.130.95 | MX | TCP | |
| 132.90.127.237 | US | Fort Huachuca | TCP | |
| 0.0.68.18 | TCP | |||
| softbank219031097188.bbtec.net | 219.31.97.188 | JP | TCP | |
| 147.79.247.136 | US | Portland | TCP | |
| 0.0.245.42 | TCP | |||
| 0.0.147.203 | TCP | |||
| host229-8-static.49-88-b.business.telecomitalia.it | 88.49.8.229 | IT | TCP | |
| 0.0.73.205 | TCP | |||
| dsl-189-175-69-144-dyn.prod-infinitum.com.mx | 189.175.69.144 | MX | Chihuahua | TCP |
| 37.59.73.140 | FR | TCP | ||
| 0.0.81.154 | TCP | |||
| 0.0.67.153 | TCP | |||
| 0.0.243.235 | TCP | |||
| 0.0.10.92 | TCP | |||
| 61.6.90.74 | MY | Kuala Lumpur | TCP | |
| 51.136.142.97 | GB | TCP | ||
| 104.36.107.74 | US | Stockton | TCP | |
| 53.121.25.61 | DE | TCP | ||
| 0.0.188.108 | TCP | |||
| 0.0.207.220 | TCP | |||
| 0.0.200.197 | TCP | |||
| 0.0.106.179 | TCP | |||
| 190.147.250.168 | CO | TCP | ||
| 134.152.158.155 | US | Arlington | TCP | |
| 211.93.112.181.static.pichincha.andinanet.net | 181.112.93.211 | EC | Quito | TCP |
| 0.0.76.160 | TCP | |||
| 0.0.192.248 | TCP | |||
| 143.128.125.17 | ZA | Pietermaritzburg | TCP | |
| p5780466e.dip0.t-ipconnect.de | 87.128.70.110 | DE | Kalletal | TCP |
| c-71-192-27-37.hsd1.ma.comcast.net | 71.192.27.37 | US | Florence | TCP |
| 0.0.120.230 | TCP | |||
| 88-96-60-87.dsl.zen.co.uk | 88.96.60.87 | GB | TCP | |
| 87.61.73.1 | DK | Kastrup | TCP | |
| 191.191.124.36 | BR | Florianpolis | TCP | |
| 102.230.128.151 | TCP | |||
| 164.77.89.244 | CL | Santiago | TCP | |
| 139.184.249.103 | GB | Brighton | TCP | |
| 202.100.40.170 | CN | Xian | TCP | |
| 132.44.158.241 | US | Montgomery | TCP | |
| 0.0.134.35 | TCP | |||
| 182.218.5.79 | KR | Seoul | TCP | |
| 0.0.133.13 | TCP | |||
| 0.0.177.176 | TCP | |||
| 222.217.239.22 | CN | Nanning | TCP | |
| hst-59-60.telelanas.lt | 77.79.59.60 | LT | Klaipeda | TCP |
| 0.0.12.0 | TCP | |||
| 0.0.36.238 | TCP | |||
| 0.0.178.21 | TCP | |||
| 0.0.91.38 | TCP | |||
| 0.0.112.182 | TCP | |||
| 0.0.9.232 | TCP | |||
| 0.0.227.210 | TCP | |||
| 0.0.209.206 | TCP | |||
| 0.0.101.217 | TCP | |||
| pl40306.ag5354.nttpc.ne.jp | 128.28.14.114 | JP | Katsuta | TCP |
| 155.120.227.223 | US | Cincinnati | TCP | |
| 0.0.205.228 | TCP | |||
| 0.0.112.145 | TCP | |||
| 52.106.132.36 | US | Redmond | TCP | |
| 0.0.242.120 | TCP | |||
| 145.233.83.219 | GB | TCP | ||
| 175.175.250.158 | CN | Shenyang | TCP | |
| 22-45-111-185-reverse.unikloud.com | 185.111.45.22 | FR | TCP | |
| 47.229.12.187 | CA | Ottawa | TCP | |
| 0.0.120.214 | TCP | |||
| 45.88.160.38 | TCP | |||
| 183.17.222.57 | CN | Shenzhen | TCP | |
| 211.70.54.31 | CN | Hefei | TCP | |
| 0.0.14.82 | TCP | |||
| 185.112.44.62 | DE | TCP | ||
| 0.0.163.18 | TCP | |||
| 0.0.4.228 | TCP | |||
| 185.179.2.178 | TCP | |||
| 0.0.247.3 | TCP | |||
| 0.0.27.78 | TCP | |||
| 0.0.81.204 | TCP | |||
| 0.0.173.62 | TCP | |||
| 222.122.224.234 | KR | TCP | ||
| 19.217.206.207 | US | Dearborn | TCP | |
| 170.162.187.244 | US | Deerfield | TCP | |
| 0.0.36.209 | TCP | |||
| 0.0.170.42 | TCP | |||
| 0.0.157.192 | TCP | |||
| 0.0.113.225 | TCP | |||
| 4.166.55.54 | US | TCP | ||
| segment-124-30.sify.net | 124.30.86.41 | IN | TCP | |
| 0.0.27.230 | TCP | |||
| 14.222.84.63 | CN | Guangzhou | TCP | |
| 169.207.253.88 | US | Buffalo | TCP | |
| 39.242.140.241 | ID | TCP | ||
| 136.246.148.90 | US | Orland Park | TCP | |
| 0.0.49.79 | TCP | |||
| 25.110.20.31 | GB | TCP | ||
| 0.0.122.218 | TCP | |||
| 114.245.187.112 | CN | Beijing | TCP | |
| 132.85.54.65 | US | Fort Huachuca | TCP | |
| 78-71-87-46-no271.tbcn.telia.com | 78.71.87.46 | SE | ml | TCP |
| 220.8.99.241 | JP | TCP | ||
| 101.104.226.64 | CN | Beijing | TCP | |
| 3.43.254.27 | US | Fairfield | TCP | |
| 0.0.126.146 | TCP | |||
| 16.134.179.77 | US | Palo Alto | TCP | |
| 197.123.0.142 | EG | Cairo | TCP | |
| 0.0.15.238 | TCP | |||
| 0.0.163.108 | TCP | |||
| 76.6.235.79 | US | TCP | ||
| 146.19.47.85 | FR | Nmes | TCP | |
| 0.0.20.80 | TCP | |||
| 0.0.168.187 | TCP | |||
| 0.0.84.116 | TCP | |||
| 0.0.79.85 | TCP | |||
| 0.0.232.122 | TCP | |||
| 0.0.92.63 | TCP | |||
| 0.0.197.252 | TCP | |||
| 0.0.227.204 | TCP | |||
| 0.0.14.81 | TCP | |||
| 0.0.201.46 | TCP | |||
| 66.9.64.98 | US | Corona | TCP | |
| 129.198.182.71 | US | Montgomery | TCP | |
| 0.0.130.191 | TCP | |||
| 142.42.195.26 | CA | Ottawa | TCP | |
| 0.0.61.188 | TCP | |||
| 0.0.33.161 | TCP | |||
| 80.81.95.53 | ES | TCP | ||
| 167.3.12.234 | US | Ventura | TCP | |
| 165.41.151.132 | US | Concord | TCP | |
| 0.0.27.175 | TCP | |||
| softbank060115084123.bbtec.net | 60.115.84.123 | JP | TCP | |
| 57.87.17.252 | RU | Moscow | TCP | |
| 167.230.216.68 | US | Livingston | TCP | |
| 0.0.50.183 | TCP | |||
| 160.94.162.90 | US | Minneapolis | TCP | |
| 228.224-34-163.hydro.com | 163.34.224.228 | NO | TCP | |
| 0.0.32.97 | TCP | |||
| 0.0.38.52 | TCP | |||
| a184-50-40-137.deploy.static.akamaitechnologies.com | 184.50.40.137 | US | Cambridge | TCP |
| 0.0.173.181 | TCP | |||
| 0.0.8.230 | TCP | |||
| 0.0.164.17 | TCP | |||
| 0.0.180.9 | TCP | |||
| 57.174.103.121 | BE | TCP | ||
| 166.224.132.32 | US | TCP | ||
| 0.0.30.185 | TCP | |||
| 105.107.19.111 | DZ | Jijel | TCP | |
| 119.230.48.19 | JP | Akashi | TCP | |
| 32.250.68.220 | US | TCP | ||
| 0.0.140.107 | TCP | |||
| 0.0.206.108 | TCP | |||
| 0.0.92.251 | TCP | |||
| ec2-34-213-237-9.us-west-2.compute.amazonaws.com | 34.213.237.9 | US | TCP | |
| 0.0.84.215 | TCP | |||
| 0.0.236.188 | TCP | |||
| p4FC6E8F1.dip0.t-ipconnect.de | 79.198.232.241 | DE | Retterath | TCP |
| mm-246-131-127-178.mogilev.dynamic.pppoe.byfly.by | 178.127.131.246 | BY | Mogilev | TCP |
| 143.30.196.217 | US | Cincinnati | TCP | |
| 0.0.188.47 | TCP | |||
| client-adsl-95-138-124-183.mediaserv.net | 95.138.124.183 | MQ | Schoelcher | TCP |
| 27.212.226.189 | CN | Jinan | TCP | |
| 10.179.199.11 | TCP | |||
| 157.78.140.95 | JP | TCP | ||
| 212.15.209.119 | DE | TCP | ||
| 155.118.41.229 | US | Cincinnati | TCP | |
| ec2-52-39-155-196.us-west-2.compute.amazonaws.com | 52.39.155.196 | US | Boardman | TCP |
| blmgroup.static.gvt.net.br | 179.184.249.70 | BR | So Paulo | TCP |
| 0.0.28.25 | TCP | |||
| 147.61.117.106 | US | Chelmsford | TCP | |
| 0.0.37.56 | TCP | |||
| 0.0.221.220 | TCP | |||
| 214.30.54.130 | US | TCP | ||
| 214.39.34.252 | US | TCP | ||
| 0.0.214.192 | TCP | |||
| 0.0.199.81 | TCP | |||
| 0.0.62.70 | TCP | |||
| 0.0.212.115 | TCP | |||
| 0.0.179.90 | TCP | |||
| 0.0.126.32 | TCP | |||
| 0.0.197.81 | TCP | |||
| 0.0.154.109 | TCP | |||
| 0.0.174.200 | TCP | |||
| 0.0.30.208 | TCP | |||
| 207.234.235.196 | US | Chicago | TCP | |
| 163.92.80.229 | FR | TCP | ||
| ec2-23-22-93-100.compute-1.amazonaws.com | 23.22.93.100 | US | Ashburn | TCP |
| 0.0.129.44 | TCP | |||
| 170.121.156.128 | US | Washington | TCP | |
| 47.147.105.46 | US | TCP | ||
| 0.0.78.177 | TCP | |||
| 0.0.191.106 | TCP | |||
| 0.0.49.119 | TCP | |||
| 32.169.155.35 | US | TCP | ||
| 225.104.092.145.hva.nl | 145.92.104.225 | NL | Amsterdam | TCP |
| 0.0.175.26 | TCP | |||
| 236.sub-70-206-241.myvzw.com | 70.206.241.236 | US | TCP | |
| 63.191.89.229 | US | TCP | ||
| ADSL-176.67.126.182.mada.ps | 176.67.126.182 | PS | TCP | |
| 0.0.177.173 | TCP | |||
| 167.132.240.203 | US | Omaha | TCP | |
| 0.0.175.157 | TCP | |||
| 0.0.235.6 | TCP | |||
| 53.253.185.32 | DE | TCP | ||
| 0.0.29.62 | TCP | |||
| 0.0.140.158 | TCP | |||
| 0.0.79.233 | TCP | |||
| 53.241.120.78 | DE | TCP | ||
| 13.128.164.227 | US | Norwalk | TCP | |
| 49.234.64.147 | CN | Beijing | TCP | |
| 0.0.192.134 | TCP | |||
| 0.0.154.81 | TCP | |||
| 0.0.183.92 | TCP | |||
| 0.0.42.217 | TCP | |||
| 93.68.221.63 | IT | Sotto Il Monte | TCP | |
| 0.0.41.197 | TCP | |||
| srv-178-217-191-28.htdedicated.pl | 178.217.191.28 | PL | TCP | |
| 112.207.11.116.pldt.net | 112.207.11.116 | PH | Bagong Silang | TCP |
| 219.167.71.208 | JP | Tokyo | TCP | |
| 113.119.133.107 | CN | Guangzhou | TCP | |
| 0.0.241.170 | TCP | |||
| 214.120.165.252 | US | TCP | ||
| 68.78.158.124 | US | TCP | ||
| 13.136.200.79 | US | Norwalk | TCP | |
| 159.53.223.128 | US | New York | TCP | |
| 0.0.147.153 | TCP | |||
| 0.0.201.154 | TCP | |||
| 15.63.198.36 | US | Palo Alto | TCP | |
| 95.187.110.191 | SA | Jeddah | TCP | |
| 2.10.50.96 | FR | Saint-divy | TCP | |
| 97.198.4.120 | US | TCP | ||
| 0.0.99.89 | TCP | |||
| 198.149.178.113 | US | Milpitas | TCP | |
| 0.0.143.39 | TCP | |||
| 185.215.78.207 | TCP | |||
| 198.27.111.87 | CA | Montral | TCP | |
| 0.0.1.109 | TCP | |||
| 0.0.188.56 | TCP | |||
| 0.0.73.173 | TCP | |||
| 0.0.238.81 | TCP | |||
| 0.0.20.119 | TCP | |||
| 0.0.72.199 | TCP | |||
| 0.0.144.112 | TCP | |||
| 0.0.86.193 | TCP | |||
| 0.0.142.139 | TCP | |||
| 0.0.150.192 | TCP | |||
| 0.0.214.230 | TCP | |||
| 196.59.144.29 | US | San Diego | TCP | |
| 199.245.41.53 | US | Cambridge | TCP | |
| 0.0.190.231 | TCP | |||
| 171.22.19.5 | NL | TCP | ||
| 0.0.90.186 | TCP | |||
| 0.0.156.234 | TCP | |||
| 17.241.48.148 | US | Cupertino | TCP | |
| 103.186.211.37 | TCP | |||
| 0.0.163.131 | TCP | |||
| mobile-107-94-173-156.mycingular.net | 107.94.173.156 | US | TCP | |
| 0.0.108.230 | TCP | |||
| 99-53-197-204.lightspeed.stlsmo.sbcglobal.net | 99.53.197.204 | US | Saint Louis | TCP |
| 0.0.215.161 | TCP | |||
| 114-41-185-235.dynamic-ip.hinet.net | 114.41.185.235 | TW | Taichung | TCP |
| 146.3.65.133 | LU | TCP | ||
| 0.0.55.17 | TCP | |||
| 21.157.148.228 | US | TCP | ||
| 0.0.48.174 | TCP | |||
| 0.0.112.195 | TCP | |||
| host31-53-228-208.range31-53.btcentralplus.com | 31.53.228.208 | GB | TCP | |
| 0.0.235.191 | TCP | |||
| 0.0.63.239 | TCP | |||
| 0.0.44.241 | TCP | |||
| 0.0.101.136 | TCP | |||
| 163.81.88.152 | FR | TCP | ||
| 194.204.163.162 | PL | TCP | ||
| 110.245.103.99 | CN | Hebei | TCP | |
| 56.25.199.76 | US | Raleigh | TCP | |
| 90.82.87.231 | FR | TCP | ||
| 0.0.140.42 | TCP | |||
| 0.0.52.191 | TCP | |||
| 197.61.183.248 | EG | TCP | ||
| mno5-ppp7663.docomo.sannet.ne.jp | 110.165.222.12 | JP | Tokyo | TCP |
| 141.27.2.59 | DE | Wrzburg | TCP | |
| 1.149.134.208 | AU | TCP | ||
| 0.0.125.186 | TCP | |||
| 0.0.140.55 | TCP | |||
| 160.187.157.110 | JP | TCP | ||
| 4.234.219.67 | US | TCP | ||
| 53.173.28.63 | DE | TCP | ||
| 151.75.11.222 | IT | Pellezzano | TCP | |
| 131.38.61.233 | US | Montgomery | TCP | |
| 198.222.76.81 | US | Montgomery | TCP | |
| 0.0.220.92 | TCP | |||
| CPE-121-220-199-78.lns5.way.bigpond.net.au | 121.220.199.78 | AU | Adelaide | TCP |
| 185.170.33.198 | PL | TCP | ||
| 0.0.76.146 | TCP | |||
| i114-189-244-38.s11.a023.ap.plala.or.jp | 114.189.244.38 | JP | Nagoya | TCP |
| 71.148.52.145 | US | TCP | ||
| 0.0.163.240 | TCP | |||
| 167.159.12.158 | US | Memphis | TCP | |
| 0.0.76.93 | TCP | |||
| 0.0.48.12 | TCP | |||
| 0.0.139.212 | TCP | |||
| 0.0.183.27 | TCP | |||
| 0.0.209.208 | TCP | |||
| 0.0.124.37 | TCP | |||
| 0.0.29.52 | TCP | |||
| 0.0.251.81 | TCP | |||
| 0.0.183.120 | TCP | |||
| 0.0.149.24 | TCP | |||
| 0.0.218.58 | TCP | |||
| 113.117.155.84 | CN | Guangzhou | TCP | |
| 200.194.1.150 | BR | TCP | ||
| x1-6-20-e5-2a-e1-2c-12.cpe.webspeed.dk | 2.104.95.154 | DK | Hinnerup | TCP |
| 0.0.62.140 | TCP | |||
| 40.74.219.197 | US | San Antonio | TCP | |
| 0.0.57.19 | TCP | |||
| 77.39.148.105 | IT | TCP | ||
| 0.0.97.95 | TCP | |||
| 109-93-105-94.dynamic.isp.telekom.rs | 109.93.105.94 | RS | Belgrade | TCP |
| 57.103.123.126 | FR | TCP | ||
| 32.150.9.235 | US | TCP | ||
| 0.0.233.133 | TCP | |||
| ip68-109-26-129.ri.ri.cox.net | 68.109.26.129 | US | Manchester | TCP |
| 0.0.41.233 | TCP | |||
| 56.190.207.81 | US | Raleigh | TCP | |
| 0.0.10.89 | TCP | |||
| 196.112.138.16 | MA | TCP | ||
| 0.0.96.245 | TCP | |||
| 0.0.151.244 | TCP | |||
| 49.84.147.82 | CN | Nanjing | TCP | |
| 0.0.170.9 | TCP | |||
| 0.0.0.189 | TCP | |||
| 0.0.201.108 | TCP | |||
| 0.0.129.147 | TCP | |||
| 89.75.44.238 | PL | Dabrowa Gornicza | TCP | |
| 0.0.245.57 | TCP | |||
| 88.198.192.217 | DE | TCP | ||
| 122-120-178-248.dynamic-ip.hinet.net | 122.120.178.248 | TW | TCP | |
| user-119a6np.biz.mindspring.com | 66.149.26.249 | US | TCP | |
| no-reverse-dns-set.gradwell.com | 212.11.84.240 | GB | TCP | |
| 220.67.21.175 | KR | TCP | ||
| 84.175.222.130 | DE | TCP | ||
| 68.10.116.134 | US | Virginia Beach | TCP | |
| 0.0.208.239 | TCP | |||
| 0.0.247.144 | TCP | |||
| 0.0.47.107 | TCP | |||
| 123.184.126.55 | CN | Shenyang | TCP | |
| 60.74.113.148 | JP | TCP | ||
| 43.185.21.180 | JP | Tokyo | TCP | |
| 216.250.57.8 | US | Miami | TCP | |
| 186.20.79.241 | CL | Santiago | TCP | |
| 0.0.9.44 | TCP | |||
| 0.0.208.60 | TCP | |||
| 162.185.121.118 | US | TCP | ||
| adsl-67-65-117-76.dsl.okcyok.swbell.net | 67.65.117.76 | US | TCP | |
| pre60873.fip.synapse.ne.jp | 124.146.115.111 | JP | Kagoshima | TCP |
| 150.150.215.240 | KR | TCP | ||
| 0.0.89.78 | TCP | |||
| 32.199.85.221 | US | TCP | ||
| 0.0.29.80 | TCP | |||
| 135.153.31.54 | US | TCP | ||
| 102.5.203.1 | TCP | |||
| 0.0.179.152 | TCP | |||
| 0.0.183.87 | TCP | |||
| 0.0.105.63 | TCP | |||
| 0.0.114.35 | TCP | |||
| 0.0.156.93 | TCP | |||
| 0.0.50.8 | TCP | |||
| 0.0.101.204 | TCP | |||
| 0.0.246.209 | TCP | |||
| 0.0.225.14 | TCP | |||
| 0.0.0.152 | TCP | |||
| 0.0.114.34 | TCP | |||
| 0.0.12.238 | TCP | |||
| 52.81.37.23 | CN | Beijing | TCP | |
| 77.194.150.72 | FR | Cormeilles | TCP | |
| 0.0.106.107 | TCP | |||
| 47.75.30.179 | US | San Mateo | TCP | |
| 0.0.124.171 | TCP | |||
| 0.0.13.136 | TCP | |||
| 164.164.82.27 | IN | Bangalore | TCP | |
| 113.96.100.66 | CN | Guangzhou | TCP | |
| 23.162.126.151 | TCP | |||
| 220-128-133-140.HINET-IP.hinet.net | 220.128.133.140 | TW | TCP | |
| 0.0.109.18 | TCP | |||
| 38.103.208.46 | US | Seguin | TCP | |
| 180.113.103.124 | CN | Nanjing | TCP | |
| 13.188.88.209 | US | Norwalk | TCP | |
| 0.0.131.113 | TCP | |||
| 200.237.56.177 | BR | TCP | ||
| 0.0.70.179 | TCP | |||
| 0.0.165.28 | TCP | |||
| 0.0.251.149 | TCP | |||
| 191.128.209.151 | BR | TCP | ||
| 177.107.122.136 | BR | Cascavel | TCP | |
| 0.0.1.177 | TCP | |||
| 110.112.246.164 | CN | Beijing | TCP | |
| 0.0.214.200 | TCP | |||
| 0.0.41.125 | TCP | |||
| 0.0.211.181 | TCP | |||
| 0.0.122.72 | TCP | |||
| 60.65.193.32 | JP | Tokyo | TCP | |
| 41.15.45.133 | ZA | Randfontein | TCP | |
| 104.26.98.40 | US | San Francisco | TCP | |
| 213.219.147.55 | BE | TCP | ||
| 106.49.25.133 | CN | Beijing | TCP | |
| 30.37.114.191 | US | TCP | ||
| 0.0.33.6 | TCP | |||
| 0.0.118.240 | TCP | |||
| 162.34.189.44 | US | Alton | TCP | |
| 40.98.157.62 | US | TCP | ||
| 182.40.173.232 | CN | Jinan | TCP | |
| 190.126.106.123 | CO | TCP | ||
| 176.100.144.129 | RU | Vladivostok | TCP | |
| 204.236.46.112 | US | Broken Arrow | TCP | |
| 0.0.168.195 | TCP | |||
| 0.0.197.182 | TCP | |||
| 53.180.79.125 | DE | TCP | ||
| 87.201.117.161 | AE | TCP | ||
| 158.67.102.73 | EU | TCP | ||
| 0.0.119.240 | TCP | |||
| adsl-76-230-34-110.dsl.irvnca.sbcglobal.net | 76.230.34.110 | US | TCP | |
| 0.0.204.88 | TCP | |||
| 38.227.136.239 | US | TCP | ||
| 56.95.213.122 | US | Raleigh | TCP | |
| 0.0.4.40 | TCP | |||
| 0.0.163.98 | TCP | |||
| 0.0.243.50 | TCP | |||
| 0.0.124.130 | TCP | |||
| 0.0.184.94 | TCP | |||
| 0.0.8.100 | TCP | |||
| 0.0.35.86 | TCP | |||
| 0.0.148.157 | TCP | |||
| 0.0.144.247 | TCP | |||
| 0.0.210.228 | TCP | |||
| 0.0.33.20 | TCP | |||
| 0.0.25.120 | TCP | |||
| 166.7.33.58.broad.xw.sh.dynamic.163data.com.cn | 58.33.7.166 | CN | Shanghai | TCP |
| 107.102.68.172 | US | TCP | ||
| 183.130.206.243 | CN | TCP | ||
| 0.0.118.204 | TCP | |||
| 0.0.222.138 | TCP | |||
| 0.0.14.122 | TCP | |||
| 44.81.158.245 | US | San Diego | TCP | |
| 148.35.211.166 | US | TCP | ||
| 0.0.196.95 | TCP | |||
| 163.177.35.140 | CN | Guangzhou | TCP | |
| 17.241.13.34 | US | Cupertino | TCP | |
| 59.83.12.112 | CN | Jinan | TCP | |
| 42.247.102.182 | CN | Nanjing | TCP | |
| 0.0.114.118 | TCP | |||
| 0.0.226.1 | TCP | |||
| 0.0.178.83 | TCP | |||
| cpe-174-97-160-214.wi.res.rr.com | 174.97.160.214 | US | Neenah | TCP |
| 0.0.160.96 | TCP | |||
| isdo-18-0.noi.mvdc.jp | 218.216.128.228 | JP | TCP | |
| 0.0.215.69 | TCP | |||
| 0.0.80.112 | TCP | |||
| 0.0.117.95 | TCP | |||
| 0.0.248.205 | TCP | |||
| 42.157.105.1 | CN | Xiamen | TCP | |
| 0.0.36.30 | TCP | |||
| 196.64.96.28 | MA | TCP | ||
| 191.101.125.198 | DE | Frankfurt Am Main | TCP | |
| 114.47.16.211 | TW | TCP | ||
| 77.95.239.131 | BG | TCP | ||
| 0.0.45.150 | TCP | |||
| 102.121.158.125 | TCP | |||
| 30.18.164.118 | US | TCP | ||
| 211.181.25.113 | KR | TCP | ||
| ai126167209250.37.access-internet.ne.jp | 126.167.209.250 | JP | Tokyo | TCP |
| 0.0.160.139 | TCP | |||
| 0.0.211.49 | TCP | |||
| 0.0.67.243 | TCP | |||
| 95.10.175.74 | TR | Antalya | TCP | |
| 124.46.2.104 | KR | TCP | ||
| 223.4.51.58 | CN | Hangzhou | TCP | |
| 123.75.31.112 | CN | Beijing | TCP | |
| 21.162.97.185 | US | TCP | ||
| 122.100.113.4 | TW | Taipei | TCP | |
| 139.135.220.232 | US | Madison | TCP | |
| x5f751d47.dyn.telefonica.de | 95.117.29.71 | DE | Dreieich | TCP |
| 146.161.91.205 | FI | Turku | TCP | |
| 0.0.63.36 | TCP | |||
| 0.0.171.12 | TCP | |||
| 0.0.145.141 | TCP | |||
| 0.0.209.94 | TCP | |||
| 114.90.254.100 | CN | Shanghai | TCP | |
| 145.91.221.180 | NL | Utrecht | TCP | |
| 0.0.92.245 | TCP | |||
| 205.244.3.39 | FR | Sucy | TCP | |
| 0.0.16.89 | TCP | |||
| 0.0.88.136 | TCP | |||
| 0.0.87.125 | TCP | |||
| 0.0.77.184 | TCP | |||
| 0.0.246.156 | TCP | |||
| 0.0.79.128 | TCP | |||
| 0.0.145.114 | TCP | |||
| 0.0.135.195 | TCP | |||
| 0.0.188.169 | TCP | |||
| 0.0.16.227 | TCP | |||
| 0.0.179.5 | TCP | |||
| 0.0.96.7 | TCP | |||
| 71-212-162-23.hlrn.qwest.net | 71.212.162.23 | US | Denver | TCP |
| 0.0.207.125 | TCP | |||
| 121.197.120.252 | CN | Hangzhou | TCP | |
| 0.0.49.162 | TCP | |||
| 0.0.16.145 | TCP | |||
| 88.168.217.33 | FR | La Talaudire | TCP | |
| 7.181.246.209 | US | TCP | ||
| 0.0.59.32 | TCP | |||
| 211.105.116.13 | KR | Daegu | TCP | |
| 10.203.16.62 | TCP | |||
| softbank126082126027.bbtec.net | 126.82.126.27 | JP | Kumamoto | TCP |
| ppp-187.net-188-130-87.static.magiconline.fr | 188.130.87.187 | FR | Paris | TCP |
| 0.0.179.77 | TCP | |||
| 195.95.149.83 | TR | TCP | ||
| 0.0.124.250 | TCP | |||
| 0.0.203.20 | TCP | |||
| 0.0.136.80 | TCP | |||
| 0.0.6.88 | TCP | |||
| 0.0.74.19 | TCP | |||
| 0.0.235.3 | TCP | |||
| 0.0.166.129 | TCP | |||
| 125.210.113.94 | CN | TCP | ||
| 164.22.160.143 | DE | TCP | ||
| 153.36.206.99 | CN | Nanjing | TCP | |
| 0.0.131.234 | TCP | |||
| 25.180.74.184 | GB | TCP | ||
| 0.0.244.116 | TCP | |||
| 220.3.25.0 | JP | TCP | ||
| 23.207.82.62 | NL | Amsterdam | TCP | |
| 171.3.39.53 | JP | Tokyo | TCP | |
| 96.64.140.201 | US | Zionsville | TCP | |
| 223.131.107.177 | KR | Seoul | TCP | |
| 116.20.171.181 | CN | Guangzhou | TCP | |
| 199.116.190.35 | US | Frisco | TCP | |
| 3.180.153.202 | US | Fairfield | TCP | |
| 100.57.133.4 | US | TCP | ||
| 0.0.247.193 | TCP | |||
| 0.0.250.160 | TCP | |||
| softbank126216213225.bbtec.net | 126.216.213.225 | JP | Tokyo | TCP |
| 111.85.160.50 | CN | Guiyang | TCP | |
| 44.8.73.166 | US | San Diego | TCP | |
| 0.0.98.98 | TCP | |||
| 0.0.168.71 | TCP | |||
| 70.32.237.110 | US | Elizabethtown | TCP | |
| 182.107.88.35 | CN | Nanchang | TCP | |
| 133.226.38.0 | JP | TCP | ||
| 0.0.85.146 | TCP | |||
| 0.0.84.5 | TCP | |||
| 0.0.125.94 | TCP | |||
| softbank218134106032.bbtec.net | 218.134.106.32 | JP | TCP | |
| 149.120.246.31 | US | TCP | ||
| 0.0.124.72 | TCP | |||
| 51.197.163.83 | GB | TCP | ||
| 0.0.219.238 | TCP | |||
| 0.0.15.142 | TCP | |||
| 0.0.122.197 | TCP | |||
| 0.0.248.48 | TCP | |||
| 0.0.110.28 | TCP | |||
| 0.0.75.200 | TCP | |||
| 0.0.142.226 | TCP | |||
| 0.0.31.78 | TCP | |||
| 0.0.152.38 | TCP | |||
| 0.0.38.26 | TCP | |||
| 48.234.52.126 | US | Newark | TCP | |
| 2.28.99.134 | GB | March | TCP | |
| 184-229-225-72.pools.spcsdns.net | 184.229.225.72 | US | TCP | |
| 0.0.86.190 | TCP | |||
| 0.0.117.205 | TCP | |||
| 0.0.152.144 | TCP | |||
| 27.211.66.0 | CN | Jinan | TCP | |
| 200.234.40.139 | BR | TCP | ||
| 0.0.206.105 | TCP | |||
| 212.206.38.3 | NL | TCP | ||
| 0.0.207.13 | TCP | |||
| 211.169.20.157 | KR | TCP | ||
| 0.0.163.189 | TCP | |||
| 206.215.142.37 | US | TCP | ||
| 243.17.200.77.rev.sfr.net | 77.200.17.243 | FR | Aigrefeuille-d'aunis | TCP |
| 99.167.58.153 | US | TCP | ||
| 0.0.104.29 | TCP | |||
| 0.0.70.123 | TCP | |||
| 0.0.30.250 | TCP | |||
| 0.0.97.155 | TCP | |||
| 0.0.240.118 | TCP | |||
| 0.0.186.143 | TCP | |||
| 218.88.213.47 | CN | Chengdu | TCP | |
| 188.17.10.1 | RU | TCP | ||
| 37.185.232.92 | BE | Leest | TCP | |
| 0.0.89.15 | TCP | |||
| 79-71-149-237.dynamic.dsl.as9105.com | 79.71.149.237 | GB | Manchester | TCP |
| 0.0.51.165 | TCP | |||
| 64.208.94.248 | US | TCP | ||
| ip-78-45-163-110.net.upcbroadband.cz | 78.45.163.110 | CZ | Drachkov | TCP |
| c-24-15-90-196.hsd1.il.comcast.net | 24.15.90.196 | US | Homer Glen | TCP |
| 131.138.166.59 | CA | Ottawa | TCP | |
| 171.201.4.202 | US | Concord | TCP | |
| 120.244.159.51 | CN | TCP | ||
| 0.0.128.226 | TCP | |||
| 0.0.49.8 | TCP | |||
| 0.0.138.189 | TCP | |||
| 193.89.225.148 | DK | TCP | ||
| dsl-189-191-143-216-dyn.prod-infinitum.com.mx | 189.191.143.216 | MX | Mexico | TCP |
| 210.12.223.30 | CN | Tong | TCP | |
| 202.115.32.119 | CN | Chengdu | TCP | |
| 187.131.170.70 | MX | Jurez | TCP | |
| 1.46.16.92 | TH | Bangkok | TCP | |
| 125.135.238.75 | KR | TCP | ||
| host253-77-dynamic.2-87-r.retail.telecomitalia.it | 87.2.77.253 | IT | Capizzone | TCP |
| 80.104.129.166 | IT | TCP | ||
| 0.0.102.155 | TCP | |||
| 0.0.129.210 | TCP | |||
| 0.0.184.229 | TCP | |||
| 0.0.192.178 | TCP | |||
| 152.196.20.93 | US | Ashburn | TCP | |
| 198.254.251.119 | CA | Picton | TCP | |
| 0.0.99.126 | TCP | |||
| ALyon-659-1-72-24.w109-213.abo.wanadoo.fr | 109.213.207.24 | FR | Romain | TCP |
| 0.0.199.64 | TCP | |||
| 0.0.18.97 | TCP | |||
| 0.0.224.159 | TCP | |||
| 0.0.68.78 | TCP | |||
| 0.0.156.137 | TCP | |||
| 0.0.200.246 | TCP | |||
| 0.0.105.155 | TCP | |||
| 0.0.71.11 | TCP | |||
| 0.0.228.147 | TCP | |||
| 0.0.204.233 | TCP | |||
| 0.0.239.24 | TCP | |||
| adsl-99-22-117-223.dsl.rcsntx.sbcglobal.net | 99.22.117.223 | US | Euless | TCP |
| 131.242.37.15 | AU | Brisbane | TCP | |
| 17.124.212.109 | US | Cupertino | TCP | |
| 0.0.207.93 | TCP | |||
| 112.16.7.244 | CN | Wenzhou | TCP | |
| 120.230.160.243 | CN | TCP | ||
| 0.0.241.248 | TCP | |||
| 0.0.224.219 | TCP | |||
| 0.0.42.87 | TCP | |||
| 0.0.74.206 | TCP | |||
| 8.217.241.90 | US | TCP | ||
| 35.21.202.10 | US | East Lansing | TCP | |
| 0.0.214.91 | TCP | |||
| 0.0.137.185 | TCP | |||
| 31.204.21.154 | RU | Zheleznogorsk | TCP | |
| 99.228.139.42 | CA | New Hamburg | TCP | |
| 58.102.131.150 | KR | Seoul | TCP | |
| 0.0.85.33 | TCP | |||
| 0.0.21.150 | TCP | |||
| 216.181.231.47 | US | TCP | ||
| 30.176.144.62 | US | TCP | ||
| 109.113.27.235 | IT | Guidonia | TCP | |
| 0.0.47.36 | TCP | |||
| 0.0.141.167 | TCP | |||
| 0.0.178.174 | TCP | |||
| 25.188.61.68 | GB | TCP | ||
| 171.7.142.35 | TH | Bangkok | TCP | |
| game-83.metin2.gfsrv.net | 79.110.92.83 | DE | TCP | |
| 59.68.241.69 | CN | Wuhan | TCP | |
| 10.190.130.162 | TCP | |||
| 31.72.118.151 | GB | London | TCP | |
| 0.0.61.192 | TCP | |||
| a23-43-207-237.deploy.static.akamaitechnologies.com | 23.43.207.237 | US | Cambridge | TCP |
| 195.148.101.200 | FI | Helsinki | TCP | |
| 113.176.30.116 | VN | Hanoi | TCP | |
| 0.0.115.193 | TCP | |||
| 0.0.166.109 | TCP | |||
| 0.0.80.46 | TCP | |||
| 119.1.101.230 | CN | Guizhou | TCP | |
| 61.4.36.199 | HK | Central District | TCP | |
| 157.26.70.39 | CH | Saint-imier | TCP | |
| 0.0.53.89 | TCP | |||
| 0.0.1.101 | TCP | |||
| 27.18.112.21 | CN | Wuhan | TCP | |
| 134.147.6.2 | DE | Bochum | TCP | |
| node238200.gprs.orange.nl | 62.234.238.200 | NL | Amsterdam | TCP |
| 0.0.243.2 | TCP | |||
| 0.0.23.73 | TCP | |||
| 0.0.60.38 | TCP | |||
| jcruiz.lcon.puc.cl | 146.155.180.116 | CL | Santiago | TCP |
| 151.53.13.8 | IT | Catania | TCP | |
| 0.0.225.61 | TCP | |||
| dsl-189-128-131-80-dyn.prod-infinitum.com.mx | 189.128.131.80 | MX | Puebla | TCP |
| 0.0.205.154 | TCP | |||
| 0.0.249.201 | TCP | |||
| 0.0.21.65 | TCP | |||
| 0.0.253.212 | TCP | |||
| 0.0.65.225 | TCP | |||
| 0.0.163.54 | TCP | |||
| 0.0.180.95 | TCP | |||
| 0.0.56.131 | TCP | |||
| 0.0.75.56 | TCP | |||
| 0.0.230.89 | TCP | |||
| cpc65070-sutt5-2-0-cust747.19-1.cable.virginm.net | 82.34.98.236 | GB | Sutton Coldfield | TCP |
| 101.242.61.243 | CN | Beijing | TCP | |
| 80.97.215.108 | RO | Bucharest | TCP | |
| 0.0.19.169 | TCP | |||
| 0.0.193.5 | TCP | |||
| 0.0.84.99 | TCP | |||
| 140.40.155.238 | US | TCP | ||
| 66-168-189-112.dhcp.gwnt.ga.charter.com | 66.168.189.112 | US | Valley | TCP |
| longclaw.riseup.net | 199.254.238.52 | US | Seattle | TCP |
| 0.0.42.140 | TCP | |||
| 0.0.121.26 | TCP | |||
| 140.151.38.195 | FI | Uusikaupunki | TCP | |
| 0.0.59.248 | TCP | |||
| 0.0.39.6 | TCP | |||
| 210.57.12.155 | JP | TCP | ||
| 0.0.121.49 | TCP | |||
| 33.105.224.132 | US | TCP | ||
| 162.176.181.132 | US | TCP | ||
| pool-71-115-228-177.spknwa.dsl-w.verizon.net | 71.115.228.177 | US | Kennewick | TCP |
| 0.0.232.98 | TCP | |||
| 89-171-44-153.static.ip.netia.com.pl | 89.171.44.153 | PL | Poznan | TCP |
| 38.141.221.60.adsl-pool.sx.cn | 60.221.141.38 | CN | Taiyuan | TCP |
| 0.0.79.57 | TCP | |||
| 191.87.183.183 | BR | So Paulo | TCP | |
| 0.0.12.73 | TCP | |||
| 0.0.191.98 | TCP | |||
| 0.0.12.176 | TCP | |||
| 0.0.148.192 | TCP | |||
| 0.0.95.103 | TCP | |||
| ec2-54-196-225-168.compute-1.amazonaws.com | 54.196.225.168 | US | Ashburn | TCP |
| 109.160.22.162 | BG | Burgas | TCP | |
| 17.68.201.106 | US | Cupertino | TCP | |
| 134.206.117.65 | FR | Tourcoing | TCP | |
| 129.70.186.92 | DE | Bielefeld | TCP | |
| 102.35.141.179 | TCP | |||
| m90C7928DF9BF.bvrt2.or.comcast.net | 74.144.145.100 | US | TCP | |
| 0.0.240.217 | TCP | |||
| 0.0.208.94 | TCP | |||
| 1.125.69.82 | AU | TCP | ||
| 80.81.201.31 | DE | Dsseldorf | TCP | |
| xd9bd4111.dyn.telefonica.de | 217.189.65.17 | DE | Koblenz | TCP |
| 0.0.20.212 | TCP | |||
| 117.130.117.88 | CN | TCP | ||
| CableLink-187-160-38-65.PCs.InterCable.net | 187.160.38.65 | MX | Monterrey | TCP |
| 215.13.89.232 | US | TCP | ||
| 0.0.48.124 | TCP | |||
| 4.21.22.155 | US | TCP | ||
| 22.red-83-49-95.dynamicip.rima-tde.net | 83.49.95.22 | ES | Calvi | TCP |
| 0.0.101.238 | TCP | |||
| 0.0.223.247 | TCP | |||
| 123.167.220.144 | CN | Harbin | TCP | |
| 0.0.178.205 | TCP | |||
| 0.0.82.235 | TCP | |||
| 0.0.81.97 | TCP | |||
| h90.178.184.173.dynamic.ip.windstream.net | 173.184.178.90 | US | Tulsa | TCP |
| 190.239.27.109 | PE | TCP | ||
| 0.0.170.104 | TCP | |||
| 0.0.177.220 | TCP | |||
| 0.0.140.193 | TCP | |||
| 6.128.251.160 | US | Fort Huachuca | TCP | |
| 0.0.162.36 | TCP | |||
| 0.0.21.228 | TCP | |||
| 0.0.41.168 | TCP | |||
| 0.0.12.234 | TCP | |||
| 0.0.229.178 | TCP | |||
| 0.0.2.188 | TCP | |||
| 0.0.205.107 | TCP | |||
| 0.0.222.247 | TCP | |||
| 0.0.206.167 | TCP | |||
| 215.179.229.150 | US | TCP | ||
| wvps80-237-170-239.dedicated.hosteurope.de | 80.237.170.239 | DE | Hst | TCP |
| 147.243.99.86 | FI | Nokia | TCP | |
| 0.0.147.46 | TCP | |||
| 221.127.180.157 | HK | Central District | TCP | |
| 196.212.5.110 | ZA | Gauteng | TCP | |
| 0.0.197.44 | TCP | |||
| 0.0.222.45 | TCP | |||
| 0.0.34.198 | TCP | |||
| 0.0.166.88 | TCP | |||
| host114.181-107-117.telecom.net.ar | 181.107.117.114 | AR | TCP | |
| 147.7.40.74 | HU | Budapest | TCP | |
| 0.0.96.206 | TCP | |||
| 0.0.71.230 | TCP | |||
| 0.0.220.220 | TCP | |||
| 117.198.196.226 | IN | Vadodara | TCP | |
| 57.172.137.141 | BE | TCP | ||
| 43.144.21.67 | JP | Tokyo | TCP | |
| 0.0.156.24 | TCP | |||
| 0.0.111.132 | TCP | |||
| 66-111-35-79.static.sagonet.net | 66.111.35.79 | US | Norcross | TCP |
| 0.0.101.201 | TCP | |||
| pool-141-157-117-107.balt.east.verizon.net | 141.157.117.107 | US | TCP | |
| 140.137.14.173 | TW | TCP | ||
| 0.0.45.123 | TCP | |||
| 0.0.119.158 | TCP | |||
| 0.0.144.16 | TCP | |||
| 0.0.161.156 | TCP | |||
| 81.201.118.195 | DE | TCP | ||
| 33.11.22.99 | US | TCP | ||
| 191-210-123-47.user.vivozap.com.br | 191.210.123.47 | BR | TCP | |
| 19.29.173.169 | US | Dearborn | TCP | |
| 51.4.110.239 | DE | Frankfurt | TCP | |
| 43.147.123.34 | JP | Tokyo | TCP | |
| cpe.ge-2-2-9-100.bynqe10.dk.customer.tdc.net | 94.189.16.98 | DK | Gentofte | TCP |
| 0.0.60.98 | TCP | |||
| c-98-240-97-92.hsd1.tn.comcast.net | 98.240.97.92 | US | Mount Juliet | TCP |
| 146.149.8.99 | US | New York | TCP | |
| p5DECE2EC.dip0.t-ipconnect.de | 93.236.226.236 | DE | TCP | |
| 0.0.209.151 | TCP | |||
| 0.0.11.216 | TCP | |||
| 0.0.165.125 | TCP | |||
| 102.219.148.111 | TCP | |||
| 137.92.28.21 | AU | Braddon | TCP | |
| 154.48.227.55 | US | TCP | ||
| 0.0.121.250 | TCP | |||
| 0.0.113.211 | TCP | |||
| 141.139.203.18 | US | Tiffin | TCP | |
| 82.153.205.77 | GB | TCP | ||
| 158.107.173.121 | US | Bayport | TCP | |
| 0.0.16.22 | TCP | |||
| 0.0.250.133 | TCP | |||
| 0.0.121.117 | TCP | |||
| 189-25-7-99.user.veloxzone.com.br | 189.25.7.99 | BR | Duque De Caxias | TCP |
| zaq7ac4fe88.zaq.ne.jp | 122.196.254.136 | JP | Takatsuki | TCP |
| 0.0.76.61 | TCP | |||
| 40.214.43.33 | US | TCP | ||
| 0.0.70.213 | TCP | |||
| 0.0.44.10 | TCP | |||
| 0.0.254.65 | TCP | |||
| 0.0.177.109 | TCP | |||
| 0.0.164.2 | TCP | |||
| 0.0.249.3 | TCP | |||
| 0.0.216.104 | TCP | |||
| 0.0.152.217 | TCP | |||
| 0.0.249.121 | TCP | |||
| 0.0.161.114 | TCP | |||
| 0.0.229.99 | TCP | |||
| 204.206.193.156 | US | TCP | ||
| 94.199.248.245 | NL | TCP | ||
| 210-228-105-69.north.dsl.telkomsa.net | 105.228.210.69 | ZA | Johannesburg | TCP |
| 0.0.252.251 | TCP | |||
| 0.0.203.40 | TCP | |||
| 0.0.238.121 | TCP | |||
| 12.93.144.26 | US | TCP | ||
| 146.69.106.191 | US | Denver | TCP | |
| 0.0.34.64 | TCP | |||
| 0.0.141.168 | TCP | |||
| 0.0.11.3 | TCP | |||
| 29.180.99.84.rev.sfr.net | 84.99.180.29 | FR | Le Thillot | TCP |
| 0.0.178.30 | TCP | |||
| 0.0.109.220 | TCP | |||
| 151-241-247-181.shatel.ir | 151.241.247.181 | IR | TCP | |
| 0.0.44.91 | TCP | |||
| 141.104.238.190 | US | Richmond | TCP | |
| 171.229.70.212 | VN | Hanoi | TCP | |
| 102.123.109.181 | TCP | |||
| 0.0.102.60 | TCP | |||
| 0.0.39.116 | TCP | |||
| 129.203.219.160 | US | Marlton | TCP | |
| 0.0.191.206 | TCP | |||
| 0.0.156.141 | TCP | |||
| 0.0.40.215 | TCP | |||
| p508E37B6.dip0.t-ipconnect.de | 80.142.55.182 | DE | TCP | |
| dynamic.isp.ooredoo.om | 37.200.155.38 | OM | TCP | |
| c-50-140-4-223.hsd1.fl.comcast.net | 50.140.4.223 | US | Boca Raton | TCP |
| 170.218.172.165 | US | Cleveland | TCP | |
| 0.0.170.132 | TCP | |||
| 0.0.100.179 | TCP | |||
| 0.0.146.54 | TCP | |||
| 99-44-185-77.lightspeed.nsvltn.sbcglobal.net | 99.44.185.77 | US | Clarksville | TCP |
| 131.sub-75-214-209.myvzw.com | 75.214.209.131 | US | TCP | |
| cpe-76-94-21-51.socal.res.rr.com | 76.94.21.51 | US | TCP | |
| 76.152.23.246 | US | TCP | ||
| 58.113.132.62 | JP | Tokyo | TCP | |
| dialpool-210-214-187-162.maa.sify.net | 210.214.187.162 | IN | TCP | |
| 215.3.94.140 | US | TCP | ||
| 177-1-116-215.cto-go-a1k-01.dsl.brasiltelecom.net.br | 177.1.116.215 | BR | Trindade | TCP |
| 0.0.75.230 | TCP | |||
| 0.0.141.78 | TCP | |||
| md-188-69-63-231.omni.lt | 188.69.63.231 | LT | TCP | |
| 76.206.160.93 | US | TCP | ||
| 22.152.226.63 | US | TCP | ||
| 0.0.53.210 | TCP | |||
| 0.0.45.213 | TCP | |||
| 0.0.181.217 | TCP | |||
| 1.3.67.57 | CN | Guangzhou | TCP | |
| non-routed-un-exposed-IP.45.146.in-addr.arpa | 146.45.86.27 | US | San Ramon | TCP |
| 33.16.23.85 | US | TCP | ||
| 0.0.130.17 | TCP | |||
| 98.123.196.130 | US | TCP | ||
| 0.0.85.141 | TCP | |||
| 47.118.14.94 | CN | Hangzhou | TCP | |
| 0.0.222.2 | TCP | |||
| 0.0.52.72 | TCP | |||
| 0.0.23.6 | TCP | |||
| 102.85.213.28 | TCP | |||
| 0.0.233.46 | TCP | |||
| 0.0.138.3 | TCP | |||
| 0.0.92.241 | TCP | |||
| 0.0.218.54 | TCP | |||
| 0.0.73.215 | TCP | |||
| 0.0.155.91 | TCP | |||
| 0.0.252.184 | TCP | |||
| 0.0.82.178 | TCP | |||
| 6.210.78.49 | US | Fort Huachuca | TCP | |
| 22.202.239.76 | US | TCP | ||
| 0.0.89.146 | TCP | |||
| 0.0.158.122 | TCP | |||
| 133.200.123.33 | JP | TCP | ||
| host-173-230-55-240.unknown.clients.pavlovmedia.com | 173.230.55.240 | US | Englewood | TCP |
| 42.185.27.152 | CN | Harbin | TCP | |
| 0.0.9.196 | TCP | |||
| 0.0.101.32 | TCP | |||
| 0.0.158.26 | TCP | |||
| 0.0.38.200 | TCP | |||
| 0.0.32.82 | TCP | |||
| 165.192.3.197 | US | Crestline | TCP | |
| pD9EEAA5F.dip0.t-ipconnect.de | 217.238.170.95 | DE | TCP | |
| 0.0.215.18 | TCP | |||
| 0.0.93.36 | TCP | |||
| 10.9.90.28 | TCP | |||
| 0.0.204.7 | TCP | |||
| 0.0.244.47 | TCP | |||
| 23-152.dsl.iskon.hr | 89.164.23.152 | HR | Gundinci | TCP |
| 215.76.183.237 | US | TCP | ||
| ppp-61-91-129-104.revip15.asianet.co.th | 61.91.129.104 | TH | Samut Prakan | TCP |
| 0.0.5.1 | TCP | |||
| 31.107.220.145 | GB | Leeds | TCP | |
| 96.143.131.173 | US | TCP | ||
| 0.0.84.195 | TCP | |||
| 0.0.109.160 | TCP | |||
| 0.0.65.188 | TCP | |||
| 195-241-36-228.ip.telfort.nl | 195.241.36.228 | NL | Waalre | TCP |
| 106.74.41.37 | CN | Beijing | TCP | |
| 169.22.18.177 | US | New York | TCP | |
| 0.0.9.65 | TCP | |||
| 0.0.125.225 | TCP | |||
| 0.0.9.225 | TCP | |||
| 17.25.142.116 | US | Cupertino | TCP | |
| 87.73.192.121 | DK | TCP | ||
| 137.206.14.131 | US | Houston | TCP | |
| 12.41.230.127 | US | TCP | ||
| 44.5.46.199 | US | San Diego | TCP | |
| 051-156-053-185.ip-addr.rwe-fibernet.de | 185.53.156.51 | DE | Baasem | TCP |
| 15.142.67.91 | US | Palo Alto | TCP | |
| 0.0.141.107 | TCP | |||
| fiber-166-109.online.com.kh | 124.248.166.109 | KH | TCP | |
| 208.218.123.194 | US | TCP | ||
| 179.253.182.36 | BR | TCP | ||
| 0.0.196.168 | TCP | |||
| 0.0.72.135 | TCP | |||
| 157.96.32.238 | GB | London | TCP | |
| 45.122.28.240 | CN | Kunming | TCP | |
| 116.155.84.13 | CN | Chaoyang | TCP | |
| 0.0.110.152 | TCP | |||
| 0.0.241.123 | TCP | |||
| 0.0.88.134 | TCP | |||
| 0.0.13.39 | TCP | |||
| 0.0.221.227 | TCP | |||
| 118.254.88.91 | CN | Changsha | TCP | |
| 121.230.157.210 | CN | Nanjing | TCP | |
| 0.0.21.86 | TCP | |||
| 108-243-236-150.lightspeed.tulsok.sbcglobal.net | 108.243.236.150 | US | Muskogee | TCP |
| 0.0.228.13 | TCP | |||
| 0.0.130.53 | TCP | |||
| 0.0.250.166 | TCP | |||
| 0.0.160.48 | TCP | |||
| 0.0.4.58 | TCP | |||
| 0.0.191.93 | TCP | |||
| 0.0.164.111 | TCP | |||
| 0.0.177.23 | TCP | |||
| 0.0.133.190 | TCP | |||
| 0.0.156.222 | TCP | |||
| 0.0.239.192 | TCP | |||
| 0.0.115.31 | TCP | |||
| 51.128.201.157 | GB | TCP | ||
| static.237.174.130.94.clients.your-server.de | 94.130.174.237 | UA | TCP | |
| 203.229.136.160 | KR | TCP | ||
| 0.0.131.77 | TCP | |||
| 0.0.147.201 | TCP | |||
| 0.0.54.50 | TCP | |||
| client.fttb.2day.kz | 37.99.70.47 | KZ | Pavlodar | TCP |
| 117.3.29.40 | VN | Da Nang | TCP | |
| 0.0.136.248 | TCP | |||
| 0.0.123.224 | TCP | |||
| 0.0.33.78 | TCP | |||
| 51-218-250-195.pppoe.dyn.broadband.blic.net | 195.250.218.51 | BA | TCP | |
| 212.46.41.4 | SA | Riyadh | TCP | |
| 0.0.62.249 | TCP | |||
| 0.0.85.107 | TCP | |||
| 0.0.69.206 | TCP | |||
| 0.0.176.63 | TCP | |||
| 32.242.226.127 | US | TCP | ||
| ip-109-41-137-163.web.vodafone.de | 109.41.137.163 | DE | Geilenkirchen | TCP |
| 45.184.6.102 | TCP | |||
| 0.0.67.70 | TCP | |||
| 211.228.249.148 | KR | TCP | ||
| 26.88.149.144 | US | TCP | ||
| KD106136039084.au-net.ne.jp | 106.136.39.84 | JP | Osaka | TCP |
| 0.0.228.240 | TCP | |||
| 106.65.170.131 | TW | Taipei | TCP | |
| ec2-52-28-228-212.eu-central-1.compute.amazonaws.com | 52.28.228.212 | DE | Frankfurt | TCP |
| 22.62.173.167 | US | TCP | ||
| 0.0.207.198 | TCP | |||
| 0.0.208.219 | TCP | |||
| 0.0.84.7 | TCP | |||
| x4e3363f8.dyn.telefonica.de | 78.51.99.248 | DE | Langwedel | TCP |
| 83-100-61-189.rev.dnainternet.fi | 83.100.61.189 | FI | TCP | |
| 104.20.21.220 | US | San Francisco | TCP | |
| net-125946.fas.harvard.edu | 140.247.120.237 | US | Cambridge | TCP |
| 106.98.58.194 | KR | Seoul | TCP | |
| 0.0.64.109 | TCP | |||
| 0.0.44.67 | TCP | |||
| 10.234.170.239 | TCP | |||
| 56.78.27.183 | US | Raleigh | TCP | |
| 0.0.159.165 | TCP | |||
| 0.0.172.56 | TCP | |||
| 137.195.170.32 | GB | Heriot | TCP | |
| cpe-76-172-102-55.natsow.res.rr.com | 76.172.102.55 | US | Brawley | TCP |
| 216.181.100.27 | US | Herndon | TCP | |
| 0.0.213.230 | TCP | |||
| 149.158.151.245 | US | Bloomfield | TCP | |
| 18.135.58.171 | US | Cambridge | TCP | |
| 0.0.30.96 | TCP | |||
| 0.0.202.121 | TCP | |||
| 80.158.175.182 | DE | TCP | ||
| 0.0.56.185 | TCP | |||
| 147.168.69.237 | US | TCP | ||
| 0.0.164.203 | TCP | |||
| 0.0.226.78 | TCP | |||
| 147.252.2.180 | IE | Dublin | TCP | |
| 0.0.138.28 | TCP | |||
| 223.230.198.44 | IN | Delhi | TCP | |
| 0.0.185.145 | TCP | |||
| 0.0.142.91 | TCP | |||
| 0.0.118.150 | TCP | |||
| 0.0.42.33 | TCP | |||
| 0.0.36.44 | TCP | |||
| 0.0.147.191 | TCP | |||
| 0.0.166.138 | TCP | |||
| 0.0.162.146 | TCP | |||
| 0.0.224.88 | TCP | |||
| 0.0.8.213 | TCP | |||
| 0.0.18.250 | TCP | |||
| 8.154.251.237 | US | TCP | ||
| 61.36.74.170 | KR | TCP | ||
| 0.0.151.103 | TCP | |||
| 0.0.124.224 | TCP | |||
| host189-114.stru.polimi.it | 131.175.189.114 | IT | Como | TCP |
| 204.30.44.206 | US | TCP | ||
| 168.14.32.186 | US | Athens | TCP | |
| 0.0.170.105 | TCP | |||
| 0.0.59.241 | TCP | |||
| 0.0.237.101 | TCP | |||
| 0.0.124.24 | TCP | |||
| 0.0.213.93 | TCP | |||
| 5.22.215.62 | IR | TCP | ||
| 0.0.184.173 | TCP | |||
| 0.0.98.109 | TCP | |||
| 157.206.210.220 | US | Bridgewater | TCP | |
| 52.103.226.165 | US | Redmond | TCP | |
| 0.0.98.223 | TCP | |||
| 0.0.157.155 | TCP | |||
| 195.185.241.27 | DE | TCP | ||
| 145.191.EARLY-REGISTRATION.of.SURFnet.invalid | 145.191.26.184 | NL | Utrecht | TCP |
| 32.135.236.233 | US | TCP | ||
| 0.0.73.129 | TCP | |||
| 110-96-235-201.fibertel.com.ar | 201.235.96.110 | AR | Cordoba | TCP |
| 123.58.150.83 | CN | Jinhua | TCP | |
| 0.0.29.107 | TCP | |||
| 0.0.29.73 | TCP | |||
| 0.0.19.231 | TCP | |||
| 6.240.27.34 | US | Fort Huachuca | TCP | |
| 123.126.72.77.chtp.net | 77.72.126.123 | RU | Saint Petersburg | TCP |
| 157.61.106.177 | CN | Guangzhou | TCP | |
| 0.0.11.63 | TCP | |||
| 0.0.127.251 | TCP | |||
| 0.0.2.232 | TCP | |||
| 69.169.180.186.static.ip.veracitynetworks.com | 69.169.180.186 | US | Providence | TCP |
| 47.190.230.8 | US | TCP | ||
| 159.183.132.79 | US | Harrisburg | TCP | |
| host-91-237-118-222.finemedia.pl | 91.237.118.222 | PL | TCP | |
| host-92-10-151-225.as43234.net | 92.10.151.225 | GB | Hinckley | TCP |
| h182.57.134.40.static.ip.windstream.net | 40.134.57.182 | US | TCP | |
| 117.20.83.129 | KR | Suwon | TCP | |
| CPE00fc8d8bc453-CM00fc8d8bc450.cpe.net.cable.rogers.com | 99.246.204.23 | CA | Toronto | TCP |
| 0.0.156.165 | TCP | |||
| 187-52-60-253.3g.brasiltelecom.net.br | 187.52.60.253 | BR | Dom Pedrito | TCP |
| h184-61-236-143.mdtnwi.dedicated.static.tds.net | 184.61.236.143 | US | Perry | TCP |
| 124.75.56.44 | CN | Shanghai | TCP | |
| 0.0.205.163 | TCP | |||
| 0.0.30.167 | TCP | |||
| i118-20-70-229.s99.a049.ap.plala.or.jp | 118.20.70.229 | JP | Shiohama | TCP |
| 0.0.16.234 | TCP | |||
| 0.0.178.65 | TCP | |||
| dialin-145-254-114-026.pools.arcor-ip.net | 145.254.114.26 | DE | TCP | |
| 0.0.251.42 | TCP | |||
| 0.0.177.156 | TCP | |||
| 0.0.62.151 | TCP | |||
| 44.250.107.137 | US | San Diego | TCP | |
| 219.147.1.0 | CN | Qingdao | TCP | |
| 0.0.115.111 | TCP | |||
| 68-123.94-24.tampabay.res.rr.com | 24.94.123.68 | US | TCP | |
| 0.0.84.102 | TCP | |||
| 0.0.32.76 | TCP | |||
| 0.0.24.60 | TCP | |||
| 0.0.160.61 | TCP | |||
| 0.0.118.249 | TCP | |||
| 0.0.196.32 | TCP | |||
| 0.0.170.110 | TCP | |||
| 0.0.194.106 | TCP | |||
| 0.0.1.99 | TCP | |||
| 0.0.235.186 | TCP | |||
| 0.0.85.167 | TCP | |||
| 0.0.241.52 | TCP | |||
| 0.0.241.22 | TCP | |||
| 99-114.vpn.rwth-aachen.de | 134.61.99.114 | DE | Aachen | TCP |
| 160.0.216.29 | TCP | |||
| 46.114.138.218 | DE | TCP | ||
| 0.0.10.161 | TCP | |||
| 0.0.216.57 | TCP | |||
| 0.0.84.189 | TCP | |||
| 102.36.250.252 | TCP | |||
| 0.0.65.47 | TCP | |||
| 0.0.96.48 | TCP | |||
| 0.0.7.11 | TCP | |||
| 146.99.128.37 | JP | Tokyo | TCP | |
| ip-062-058-064-178.pools.atnet.ru | 178.64.58.62 | RU | Severodvinsk | TCP |
| 0.0.126.118 | TCP | |||
| 0.0.171.149 | TCP | |||
| netacc-gpn-104-85-24.pool.telenor.hu | 91.104.85.24 | HU | Budapest | TCP |
| 108-66-175-184.lightspeed.livnmi.sbcglobal.net | 108.66.175.184 | US | Eastpointe | TCP |
| 0.0.66.244 | TCP | |||
| 0.0.68.104 | TCP | |||
| 165.101.28.131 | TCP | |||
| 147.139.33.184 | US | Rochester | TCP | |
| 0.0.83.119 | TCP | |||
| 0.0.122.105 | TCP | |||
| 0.0.208.149 | TCP | |||
| 220.174.143.78 | CN | Sanya | TCP | |
| 0.0.101.251 | TCP | |||
| 111.8.87.92 | CN | TCP | ||
| 38.217.43.120.broad.qz.fj.dynamic.163data.com.cn | 120.43.217.38 | CN | Fuzhou | TCP |
| h163-058-071-039.hikari.itscom.jp | 163.58.71.39 | JP | Yokohama | TCP |
| 0.0.177.90 | TCP | |||
| 0.0.165.124 | TCP | |||
| 0.0.219.243 | TCP | |||
| 185.188.112.226 | TCP | |||
| 100.97.195.213 | TCP | |||
| ip165.208-117-30.static.steadfastdns.net | 208.117.30.165 | US | Chicago | TCP |
| dsl-114-130.bl26.telepac.pt | 176.78.114.130 | PT | Lisbon | TCP |
| c-68-36-228-104.hsd1.mi.comcast.net | 68.36.228.104 | US | Hamtramck | TCP |
| 13.133.47.18 | US | Norwalk | TCP | |
| 215.119.147.246 | US | TCP | ||
| 0.0.206.145 | TCP | |||
| 132.72.47.117 | IL | Tel Aviv | TCP | |
| 68-247-241-184.pools.spcsdns.net | 68.247.241.184 | US | TCP | |
| 202.249.47.113 | JP | TCP | ||
| host1-190-static.123-81-b.business.telecomitalia.it | 81.123.190.1 | IT | Rome | TCP |
| 0.0.205.165 | TCP | |||
| 0.0.196.227 | TCP | |||
| adsl-75-25-179-108.dsl.pltn13.sbcglobal.net | 75.25.179.108 | US | San Francisco | TCP |
| 125.81.217.123 | CN | Chongqing | TCP | |
| 0.0.212.153 | TCP | |||
| 0.0.169.220 | TCP | |||
| 0.0.11.47 | TCP | |||
| 209.171.231.197 | CA | TCP | ||
| 0.0.171.140 | TCP | |||
| 0.0.159.145 | TCP | |||
| 51.182.158.193 | GB | TCP | ||
| 150.6.74.213 | JP | TCP | ||
| 0.0.202.24 | TCP | |||
| 0.0.243.12 | TCP | |||
| 0.0.75.163 | TCP | |||
| 0.0.20.146 | TCP | |||
| 0.0.204.62 | TCP | |||
| 0.0.179.32 | TCP | |||
| 0.0.105.146 | TCP | |||
| 0.0.69.101 | TCP | |||
| 0.0.234.90 | TCP | |||
| 0.0.82.198 | TCP | |||
| 0.0.144.248 | TCP | |||
| 0.0.129.41 | TCP | |||
| 0.0.29.150 | TCP | |||
| 163.46.170.21 | JP | Yokkaichi | TCP | |
| 207.208.202.115 | US | Libertyville | TCP | |
| 0.0.240.244 | TCP | |||
| 0.0.4.112 | TCP | |||
| 147.14.133.101 | SE | Alingss | TCP | |
| 116.142.166.208 | CN | Chaoyang | TCP | |
| dialup-4.163.171.205.Dial1.Denver1.Level3.net | 4.163.171.205 | US | TCP | |
| 0.0.26.122 | TCP | |||
| 0.0.47.44 | TCP | |||
| 0.0.233.51 | TCP | |||
| 0.0.160.198 | TCP | |||
| 0.0.33.217 | TCP | |||
| cpe-76-90-143-176.socal.res.rr.com | 76.90.143.176 | US | Playa Del Rey | TCP |
| 0.0.40.108 | TCP | |||
| 5.161.222.47 | IR | TCP | ||
| 156.31.8.227 | BN | TCP | ||
| 15.127.227.191.isp.timbrasil.com.br | 191.227.127.15 | BR | So Paulo | TCP |
| 146.139.58.105 | US | Lemont | TCP | |
| 64.241.131.90 | US | Chesterfield | TCP | |
| 0.0.196.54 | TCP | |||
| 0.0.144.170 | TCP | |||
| 0.0.176.230 | TCP | |||
| 66.153.115.224 | US | North Bergen | TCP | |
| 0.0.102.254 | TCP | |||
| 156.152.145-94-dynamic.movinet.com.uy | 152.156.145.94 | UY | Montevideo | TCP |
| 41.157.101.245 | ZA | TCP | ||
| 0.0.157.174 | TCP | |||
| 0.0.53.83 | TCP | |||
| 27.18.252.117 | CN | Wuhan | TCP | |
| 0.0.25.105 | TCP | |||
| 63.113.81.45 | US | TCP | ||
| 151-239-200-223.shatel.ir | 151.239.200.223 | IR | TCP | |
| 0.0.146.96 | TCP | |||
| 0.0.10.33 | TCP | |||
| 49.131.106.216 | HK | Kwun Tong | TCP | |
| 10.94.36.194 | TCP | |||
| 187.63.126.109 | BR | TCP | ||
| p4FF13858.dip0.t-ipconnect.de | 79.241.56.88 | DE | TCP | |
| ANantes-652-1-276-69.w2-8.abo.wanadoo.fr | 2.8.251.69 | FR | TCP | |
| 10.235.131.24 | TCP | |||
| 5e05f48e.bb.sky.com | 94.5.244.142 | GB | Preston | TCP |
| 217.199.224.125 | UA | Donetsk | TCP | |
| 0.0.43.196 | TCP | |||
| 156.97.63.56 | CL | Santiago | TCP | |
| 75.96.248.51 | US | New York | TCP | |
| 0.0.56.120 | TCP | |||
| 0.0.190.88 | TCP | |||
| 0.0.196.57 | TCP | |||
| 0.0.36.212 | TCP | |||
| a23-49-92-8.deploy.static.akamaitechnologies.com | 23.49.92.8 | US | Cambridge | TCP |
| 0.0.236.82 | TCP | |||
| 0.0.250.192 | TCP | |||
| 0.0.240.134 | TCP | |||
| 43.127.71.12 | JP | Tokyo | TCP | |
| host10311829.vodafone.com.tr | 81.6.118.113 | TR | TCP | |
| 0.0.182.254 | TCP | |||
| jba189216.unoesc.edu.br | 191.52.189.216 | BR | TCP | |
| 0.0.10.201 | TCP | |||
| 0.0.44.229 | TCP | |||
| 0.0.142.57 | TCP | |||
| 0.0.254.123 | TCP | |||
| 0.0.216.231 | TCP | |||
| 0.0.107.125 | TCP | |||
| 0.0.121.27 | TCP | |||
| 0.0.115.73 | TCP | |||
| 0.0.129.17 | TCP | |||
| 0.0.13.21 | TCP | |||
| 0.0.105.197 | TCP | |||
| 0.0.36.217 | TCP | |||
| 0.0.68.119 | TCP | |||
| ool-435486f3.dyn.optonline.net | 67.84.134.243 | US | Bronx | TCP |
| 89.191.67.21 | DE | TCP | ||
| iskon3245.duo.carnet.hr | 31.147.108.173 | HR | TCP | |
| 0.0.78.66 | TCP | |||
| 0.0.25.126 | TCP | |||
| 0.0.87.252 | TCP | |||
| 0.0.110.91 | TCP | |||
| 8.93.113.66 | US | TCP | ||
| bau21-1-82-242-120-198.fbx.proxad.net | 82.242.120.198 | FR | Beaune | TCP |
| 0.0.68.34 | TCP | |||
| 0.0.168.145 | TCP | |||
| 0.0.165.170 | TCP | |||
| 0.0.175.40 | TCP | |||
| 138.228.201.36 | CH | Zurich | TCP | |
| 139.20.40.86 | DE | TCP | ||
| 134.213.79.53 | GB | TCP | ||
| IGLD-84-229-123-220.inter.net.il | 84.229.123.220 | IL | Tel Aviv | TCP |
| 9.4.142.30 | US | Durham | TCP | |
| 0.0.96.200 | TCP | |||
| 0.0.181.19 | TCP | |||
| ppp-208-189-63-92.dialup.tulsok.swbell.net | 208.189.63.92 | US | TCP | |
| 96.103.136.75 | US | TCP | ||
| 212.147.231.178 | IE | TCP | ||
| 0.0.22.68 | TCP | |||
| 19.146.164.240 | US | Dearborn | TCP | |
| 0.0.128.68 | TCP | |||
| 0.0.143.122 | TCP | |||
| 28.211.254.117 | US | TCP | ||
| 0.0.198.105 | TCP | |||
| 221x244x136x59.ap221.ftth.ucom.ne.jp | 221.244.136.59 | JP | Osaka | TCP |
| 48.225.234.248 | US | Newark | TCP | |
| 148.106.196.251 | US | New York | TCP | |
| 0.0.153.190 | TCP | |||
| 0.0.95.176 | TCP | |||
| 25.194.36.160 | GB | TCP | ||
| mcc35404c8c75.atlt1.ga.comcast.net | 98.36.64.194 | US | TCP | |
| 37.43.14.110 | SA | TCP | ||
| abts-north-static-088.254.160.122.airtelbroadband.in | 122.160.254.88 | IN | Delhi | TCP |
| 118.242.197.105 | CN | Shanghai | TCP | |
| 200.249.79.134 | BR | TCP | ||
| 0.0.231.76 | TCP | |||
| 143.29.189.243 | US | Cincinnati | TCP | |
| 113.19.109.193 | IN | Cuttack | TCP | |
| 0.0.6.66 | TCP | |||
| 109.63.55.219 | BH | Manama | TCP | |
| 77.210.6.27 | ES | TCP | ||
| 0.0.96.139 | TCP | |||
| 0.0.247.204 | TCP | |||
| 116.2.112.164 | CN | Shenyang | TCP | |
| 0.0.171.155 | TCP | |||
| 0.0.80.35 | TCP | |||
| 70.100.199.197 | US | Green Bank | TCP | |
| 0.0.216.245 | TCP | |||
| 0.0.250.233 | TCP | |||
| 28.48.12.40 | US | TCP | ||
| 154.212.180.3 | SC | TCP | ||
| 0.0.191.239 | TCP | |||
| 0.0.25.91 | TCP | |||
| 0.0.61.249 | TCP | |||
| 0.0.42.98 | TCP | |||
| 0.0.44.208 | TCP | |||
| 0.0.12.96 | TCP | |||
| 0.0.213.177 | TCP | |||
| 0.0.212.21 | TCP | |||
| 0.0.103.154 | TCP | |||
| 0.0.66.119 | TCP | |||
| 0.0.13.236 | TCP | |||
| 0.0.112.227 | TCP | |||
| 0.0.205.212 | TCP | |||
| 0.0.114.199 | TCP | |||
| host-184-175-186-232.host.ussignalcom.net | 184.175.186.232 | US | Beachwood | TCP |
| 22.63.175.187 | US | TCP | ||
| 0.0.212.97 | TCP | |||
| 0.0.42.150 | TCP | |||
| 18.123.120.40 | US | Cambridge | TCP | |
| 0.0.56.61 | TCP | |||
| 0.0.36.82 | TCP | |||
| 0.0.13.84 | TCP | |||
| softbank126083215092.bbtec.net | 126.83.215.92 | JP | Kochi | TCP |
| 15.95.253.174 | US | Palo Alto | TCP | |
| 0.0.67.217 | TCP | |||
| 0.0.91.131 | TCP | |||
| pool-71-161-43-30.clppva.east.verizon.net | 71.161.43.30 | US | Chantilly | TCP |
| 0.0.30.91 | TCP | |||
| 0.0.6.232 | TCP | |||
| 128.224.12.254 | US | Alameda | TCP | |
| 183.119.90.67 | KR | TCP | ||
| 93.46.202.78 | IT | Milan | TCP | |
| pool-100-12-170-3.nycmny.fios.verizon.net | 100.12.170.3 | US | Oceanside | TCP |
| 97-127-253-96.dvnp.qwest.net | 97.127.253.96 | US | Clinton | TCP |
| 0.0.153.12 | TCP | |||
| 0.0.55.128 | TCP | |||
| 63.70.230.225 | US | TCP | ||
| 0.0.250.76 | TCP | |||
| 160.232.44.234 | US | Fort Collins | TCP | |
| 42.100.38.214 | CN | Harbin | TCP | |
| 118.198.137.180 | CN | Beijing | TCP | |
| 0.0.134.18 | TCP | |||
| 103.129.161.241 | TCP | |||
| 0.0.189.2 | TCP | |||
| 0.0.153.54 | TCP | |||
| 58.206.174.242 | CN | Lanzhou | TCP | |
| 0.0.251.249 | TCP | |||
| 0.0.165.189 | TCP | |||
| 210.92.192.39 | KR | TCP | ||
| dyn-160-39-227-188.dyn.columbia.edu | 160.39.227.188 | US | New York | TCP |
| 169.157.115.192 | US | Jacksonville | TCP | |
| hosted-by.snel.com | 128.204.193.74 | NL | TCP | |
| 164.183.24.174 | US | Washington | TCP | |
| 177.128.133.227 | BR | TCP | ||
| 0.0.191.193 | TCP | |||
| 110.76.86.238 | KR | Daejeon | TCP | |
| 0.0.186.246 | TCP | |||
| 22.249.48.225 | US | TCP | ||
| static-71-115-35-250.rcmdva.fios.verizon.net | 71.115.35.250 | US | TCP | |
| 0.0.183.46 | TCP | |||
| 39.87.128.208 | CN | Jinan | TCP | |
| 0.0.216.155 | TCP | |||
| 37-218-164-136.pppoe.ktnet.kg | 37.218.164.136 | KG | TCP | |
| 0.0.79.216 | TCP | |||
| 0.0.158.127 | TCP | |||
| 27.23.247.235 | CN | Wuhan | TCP | |
| 0.0.191.45 | TCP | |||
| 0.0.40.172 | TCP | |||
| 146.210.98.145 | AT | TCP | ||
| 182.49.194.89 | CN | Wenzhou | TCP | |
| 0.0.85.114 | TCP | |||
| 0.94.75.232 | TCP | |||
| 0.0.32.17 | TCP | |||
| 0.0.235.226 | TCP | |||
| 0.0.119.87 | TCP | |||
| 0.0.77.8 | TCP | |||
| 0.0.47.17 | TCP | |||
| 0.0.1.200 | TCP | |||
| 0.0.170.131 | TCP | |||
| 0.0.79.18 | TCP | |||
| 0.0.48.249 | TCP | |||
| 0.0.102.180 | TCP | |||
| 0.0.166.215 | TCP | |||
| 0.0.103.117 | TCP | |||
| 0.0.196.41 | TCP | |||
| 185.79.201.172 | CH | TCP | ||
| 0.0.43.211 | TCP | |||
| 0.0.68.46 | TCP | |||
| 227.231-129-109.adsl-dyn.isp.belgacom.be | 109.129.231.227 | BE | Brussels | TCP |
| 158.22.54.40 | US | Irving | TCP | |
| 0.0.196.73 | TCP | |||
| 0.0.177.185 | TCP | |||
| 0.0.195.177 | TCP | |||
| dsl-187-221-36-224-dyn.prod-infinitum.com.mx | 187.221.36.224 | MX | Texcoco | TCP |
| 149.215.168.187 | DE | Kiel | TCP | |
| 0.0.178.176 | TCP | |||
| 0.0.249.26 | TCP | |||
| 0.0.141.170 | TCP | |||
| 0.0.227.139 | TCP | |||
| 41.80.218.155 | KE | Nairobi | TCP | |
| 40-189-213-213.dyn.cable.fcom.ch | 213.213.189.40 | CH | Langnau | TCP |
| 61-23-119-76.rev.home.ne.jp | 61.23.119.76 | JP | Yokosuka | TCP |
| 12.22.252.202 | US | TCP | ||
| 193.240.195.130 | GB | TCP | ||
| 0.0.225.198 | TCP | |||
| 0.0.239.2 | TCP | |||
| KD119106211246.ppp-bb.dion.ne.jp | 119.106.211.246 | JP | TCP | |
| ef19.internetdsl.tpnet.pl | 80.53.5.19 | PL | Warsaw | TCP |
| 209.101.228.235 | US | Pleasanton | TCP | |
| 0.0.87.207 | TCP | |||
| 2.168.136.59 | DE | TCP | ||
| 0.0.170.6 | TCP | |||
| 0.0.63.181 | TCP | |||
| 0.0.222.154 | TCP | |||
| 196.58.133.229 | US | San Diego | TCP | |
| 0.0.125.241 | TCP | |||
| 31.234.237.185 | DE | TCP | ||
| 180.35.203.123 | JP | Ueda | TCP | |
| mail.klopmann.com | 62.219.225.37 | IL | Tel Aviv | TCP |
| 0.0.10.19 | TCP | |||
| 0.0.87.187 | TCP | |||
| KD119105211236.ppp-bb.dion.ne.jp | 119.105.211.236 | JP | Tokyo | TCP |
| 40.234.72.21 | US | TCP | ||
| 198.106.186.103 | US | Englewood | TCP | |
| 181.116.129.46 | AR | Federal | TCP | |
| ec2-54-74-132-243.eu-west-1.compute.amazonaws.com | 54.74.132.243 | IE | Dublin | TCP |
| 0.0.123.209 | TCP | |||
| 183.133.100.236 | CN | Ningbo | TCP | |
| 0.0.151.224 | TCP | |||
| 155.144.74.71 | AU | TCP | ||
| dialup-4.185.33.86.Dial1.Washington2.Level3.net | 4.185.33.86 | US | TCP | |
| 0.0.42.184 | TCP | |||
| 21.203.88.214 | US | TCP | ||
| ip200.ip-178-32-8.eu | 178.32.8.200 | FR | TCP | |
| 0.0.73.86 | TCP | |||
| 0.0.173.198 | TCP | |||
| 169.143.broadband2.iol.cz | 83.208.143.169 | CZ | Mesto | TCP |
| 0.0.6.191 | TCP | |||
| 0.0.120.86 | TCP | |||
| 239-114-132-95.pool.ukrtel.net | 95.132.114.239 | UA | Khmelnitskiy | TCP |
| 0.0.243.89 | TCP | |||
| 0.0.71.252 | TCP | |||
| 70-88-228-193-WashingtonDC.hfc.comcastbusiness.net | 70.88.228.193 | US | TCP | |
| 169.130.204.218 | US | Atlanta | TCP | |
| 0.0.103.215 | TCP | |||
| 0.0.220.115 | TCP | |||
| 0.0.111.217 | TCP | |||
| 0.0.37.201 | TCP | |||
| 0.0.21.120 | TCP | |||
| 0.0.30.40 | TCP | |||
| 0.0.130.139 | TCP | |||
| 0.0.192.89 | TCP | |||
| 0.0.247.163 | TCP | |||
| 0.0.101.197 | TCP | |||
| 0.0.57.26 | TCP | |||
| 0.0.235.245 | TCP | |||
| 0.0.196.143 | TCP | |||
| 0.0.19.5 | TCP | |||
| 046124109053.public.telering.at | 46.124.109.53 | AT | TCP | |
| 174-85-122-115.res.bhn.net | 174.85.122.115 | US | TCP | |
| 0.0.165.9 | TCP | |||
| 0.0.161.22 | TCP | |||
| 124.14.154.5 | CN | Beijing | TCP | |
| 0.0.151.93 | TCP | |||
| 0.0.134.32 | TCP | |||
| 0.0.140.204 | TCP | |||
| 182.200.152.111 | CN | Shenyang | TCP | |
| 173-100-97-188.pools.spcsdns.net | 173.100.97.188 | US | TCP | |
| 0.0.78.56 | TCP | |||
| 0.0.226.123 | TCP | |||
| 0.88.72.127 | TCP | |||
| 164.101.139.128 | US | Denver | TCP | |
| 0.0.122.200 | TCP | |||
| 0.0.213.217 | TCP | |||
| 0.0.95.125 | TCP | |||
| 155.95.95.0 | US | Fairfax | TCP | |
| 212.125.115.207 | DE | Augsburg | TCP | |
| 193.11.224.94 | SE | TCP | ||
| 101.70.72.149 | CN | Hangzhou | TCP | |
| 65.144.3.248 | US | TCP | ||
| 0.0.144.254 | TCP | |||
| 0.0.174.178 | TCP | |||
| cpc105310-live28-2-0-cust405.17-2.cable.virginm.net | 82.11.177.150 | GB | London | TCP |
| 0.0.19.55 | TCP | |||
| 165.160.181.192 | US | Wilmington | TCP | |
| 0.0.60.160 | TCP | |||
| 61.240.210.2 | CN | TCP | ||
| 8.173.54.86 | US | TCP | ||
| 204.232.128.234 | US | San Antonio | TCP | |
| 0.0.158.170 | TCP | |||
| softbank126091233017.bbtec.net | 126.91.233.17 | JP | Kyoto | TCP |
| 0.0.59.27 | TCP | |||
| 120.254.181.249 | CN | TCP | ||
| static.kpn.net | 145.43.195.220 | NL | Doetinchem | TCP |
| 0.0.184.73 | TCP | |||
| 0.0.218.239 | TCP | |||
| 0.0.102.39 | TCP | |||
| 30.66.210.29 | US | TCP | ||
| 0.0.155.25 | TCP | |||
| ppp-154-85.31-151.wind.it | 151.31.85.154 | IT | Viterbo | TCP |
| 65.180.238.4 | US | TCP | ||
| 0.0.133.15 | TCP | |||
| ec2-52-59-233-183.eu-central-1.compute.amazonaws.com | 52.59.233.183 | DE | Frankfurt | TCP |
| 130.156.225.88 | US | Newark | TCP | |
| 53.73.227.3 | DE | TCP | ||
| 41.35.54.119.adsl-pool.jlccptt.net.cn | 119.54.35.41 | CN | Changchun | TCP |
| 0.0.117.102 | TCP | |||
| 0.0.43.151 | TCP | |||
| 106.31.67.213 | CN | Changsha | TCP | |
| 0.0.37.97 | TCP | |||
| 0.0.116.216 | TCP | |||
| 191.187.67.32 | BR | Bragana Paulista | TCP | |
| 0.0.77.231 | TCP | |||
| 0.0.170.16 | TCP | |||
| 63.94.28.172 | US | Atlanta | TCP | |
| 0.0.19.42 | TCP | |||
| 117.254.76.235 | IN | TCP | ||
| 0.0.189.103 | TCP | |||
| 0.0.171.245 | TCP | |||
| 0.0.167.170 | TCP | |||
| 0.0.106.131 | TCP | |||
| 0.0.1.219 | TCP | |||
| 144.201.39.9 | US | Irving | TCP | |
| 0.0.32.55 | TCP | |||
| 0.0.83.36 | TCP | |||
| 8.203.54.116 | US | TCP | ||
| 2-75-195-8.kcell.kz | 2.75.195.8 | KZ | TCP | |
| 0.0.92.220 | TCP | |||
| 0.0.21.7 | TCP | |||
| 0.0.122.40 | TCP | |||
| 101.88.98.183 | CN | Shanghai | TCP | |
| 207.154.56.214 | US | Saint Louis | TCP | |
| 0.0.139.50 | TCP | |||
| 0.0.131.18 | TCP | |||
| 0.0.27.227 | TCP | |||
| 0.0.135.248 | TCP | |||
| 0.0.88.187 | TCP | |||
| 0.0.212.111 | TCP | |||
| 0.0.251.15 | TCP | |||
| 0.0.82.33 | TCP | |||
| 0.0.159.120 | TCP | |||
| 0.0.31.81 | TCP | |||
| 0.0.54.22 | TCP | |||
| 25.186.226.192 | GB | TCP | ||
| 101-143-176-192f1.osk2.eonet.ne.jp | 101.143.176.192 | JP | Maizuru | TCP |
| 146.41.199.144 | US | San Ramon | TCP | |
| dsl-189-229-153-212-dyn.prod-infinitum.com.mx | 189.229.153.212 | MX | Ciudad De Mxico | TCP |
| 102.63.160.221 | TCP | |||
| 0.0.225.131 | TCP | |||
| 0.0.174.10 | TCP | |||
| 0.0.32.25 | TCP | |||
| 0.0.28.7 | TCP | |||
| 0.0.178.129 | TCP | |||
| 66.155.243.122 | US | Bergenfield | TCP | |
| 7.107.241.90 | US | TCP | ||
| 0.0.169.48 | TCP | |||
| 0.54.22.57 | TCP | |||
| 0.0.246.244 | TCP | |||
| 169.22.149.24 | US | New York | TCP | |
| 68-244-177-18.pools.spcsdns.net | 68.244.177.18 | US | TCP | |
| 0.0.107.193 | TCP | |||
| 55.182.162.254 | US | Fort Huachuca | TCP | |
| 138.180.38.73 | US | Virginia Beach | TCP | |
| 35.28.109.213 | US | Ann Arbor | TCP | |
| 0.0.73.151 | TCP | |||
| 0.0.17.189 | TCP | |||
| 111-71-186-93.EMOME-IP.hinet.net | 111.71.186.93 | TW | Taipei | TCP |
| 49.154.153.102 | CN | Nanjing | TCP | |
| 0.0.240.170 | TCP | |||
| 18.154.180.110 | US | Cambridge | TCP | |
| 0.0.62.51 | TCP | |||
| host14-176-static.96-5-b.business.telecomitalia.it | 5.96.176.14 | IT | TCP | |
| 74-38-125-229.br1.lby.mt.frontiernet.net | 74.38.125.229 | US | Troy | TCP |
| 0.0.113.130 | TCP | |||
| 113.125.134.167 | CN | Jinan | TCP | |
| 79-66-103-221.dynamic.dsl.as9105.com | 79.66.103.221 | GB | Bath | TCP |
| 0.0.62.88 | TCP | |||
| 0.0.111.60 | TCP | |||
| 0.0.81.117 | TCP | |||
| 44.26.171.92 | US | San Diego | TCP | |
| 106.3.61.188 | CN | Beijing | TCP | |
| 102.128.254.171 | TCP | |||
| 51.242.25.141 | GB | TCP | ||
| 0.0.15.4 | TCP | |||
| 0.0.238.120 | TCP | |||
| 151.111.156.45 | US | Saint Paul | TCP | |
| 214.245.216.71 | US | TCP | ||
| 0.0.90.76 | TCP | |||
| 0.0.122.216 | TCP | |||
| 0.0.38.40 | TCP | |||
| 0.0.126.137 | TCP | |||
| 19.22-183-91.adsl-fix.isp.belgacom.be | 91.183.22.19 | BE | Brussels | TCP |
| 0.0.42.239 | TCP | |||
| 0.0.69.52 | TCP | |||
| h1885694.stratoserver.net | 85.214.206.219 | DE | Berlin | TCP |
| 0.0.67.179 | TCP | |||
| 1.138.201.187 | AU | TCP | ||
| 0.0.251.80 | TCP | |||
| 0.0.225.230 | TCP | |||
| 198.96.134.45 | CA | Toronto | TCP | |
| 132.42.5.12 | US | Montgomery | TCP | |
| 0.0.99.97 | TCP | |||
| 62.155.97.222 | DE | TCP | ||
| 176.197.93.4 | RU | Prokopyevsk | TCP | |
| 0.0.235.98 | TCP | |||
| 0.0.57.233 | TCP | |||
| 0.0.231.143 | TCP | |||
| 0.0.42.251 | TCP | |||
| 0.0.170.202 | TCP | |||
| 0.0.82.130 | TCP | |||
| 0.0.175.79 | TCP | |||
| 0.0.96.199 | TCP | |||
| 0.0.159.67 | TCP | |||
| 0.0.213.87 | TCP | |||
| 0.0.193.180 | TCP | |||
| 0.0.61.36 | TCP | |||
| 0.0.127.247 | TCP | |||
| 216-67-49-244-radius.dynamic.acsalaska.net | 216.67.49.244 | US | Anchorage | TCP |
| 167.245.190.37 | US | New York | TCP | |
| 109.141.241.18 | BE | TCP | ||
| 55.40.81.85 | US | Fort Huachuca | TCP | |
| 0.0.101.82 | TCP | |||
| 0.0.68.231 | TCP | |||
| 0.0.196.21 | TCP | |||
| 0.0.250.190 | TCP | |||
| 157.216.226.151 | US | TCP | ||
| c-24-19-209-44.hsd1.wa.comcast.net | 24.19.209.44 | US | Seattle | TCP |
| 0.0.26.211 | TCP | |||
| host217-37-174-27.in-addr.btopenworld.com | 217.37.174.27 | GB | TCP | |
| 0.0.201.94 | TCP | |||
| 170.24.204.55 | US | Westbury | TCP | |
| 1.152.51.43 | AU | TCP | ||
| 0.0.204.149 | TCP | |||
| 0.0.63.224 | TCP | |||
| 96.107.2.135 | US | TCP | ||
| 35.184.125.78.rev.sfr.net | 78.125.184.35 | FR | Les Vans | TCP |
| 125.20.228.3 | IN | New Delhi | TCP | |
| 163.202.127.22 | ZA | Johannesburg | TCP | |
| 0.0.154.239 | TCP | |||
| ABayonne-652-1-479-153.w109-214.abo.wanadoo.fr | 109.214.136.153 | FR | Orthez | TCP |
| 160.2.162.181 | US | Rochester | TCP | |
| 0.0.131.16 | TCP | |||
| 0.0.82.58 | TCP | |||
| 0.0.209.27 | TCP | |||
| 12.168.172.234 | US | TCP | ||
| 0.0.157.178 | TCP | |||
| 171.sub-75-197-166.myvzw.com | 75.197.166.171 | US | TCP | |
| 10.38.199.250 | TCP | |||
| 102.60.19.13 | TCP | |||
| 0.0.9.108 | TCP | |||
| 0.0.242.46 | TCP | |||
| 0.0.251.25 | TCP | |||
| 170.50.83.137 | US | New York | TCP | |
| 75-95-174-31.lsv.clearwire-wmx.net | 75.95.174.31 | US | Las Vegas | TCP |
| 70.184.8.93.rev.sfr.net | 93.8.184.70 | FR | Villemandeur | TCP |
| 0.0.168.212 | TCP | |||
| 0.0.74.135 | TCP | |||
| 110.62.83.65 | CN | Beijing | TCP | |
| 1.229.204.19 | KR | Seoul | TCP | |
| host-192.83-43-115.dynamic.totalbb.net.tw | 115.43.83.192 | TW | Taipei | TCP |
| 0.0.106.245 | TCP | |||
| 69-106-190-109.lightspeed.snantx.sbcglobal.net | 69.106.190.109 | US | TCP | |
| 0.0.56.140 | TCP | |||
| 0.0.99.127 | TCP | |||
| 0.0.104.88 | TCP | |||
| softbank219205077053.bbtec.net | 219.205.77.53 | JP | TCP | |
| 0.0.252.250 | TCP | |||
| 0.0.125.203 | TCP | |||
| 0.0.131.183 | TCP | |||
| 0.0.214.7 | TCP | |||
| 16.206.71.37 | US | Palo Alto | TCP | |
| 163.250.137.162 | CL | Santiago | TCP | |
| 0.0.204.229 | TCP | |||
| 0.0.107.215 | TCP | |||
| ec2-23-23-67-147.compute-1.amazonaws.com | 23.23.67.147 | US | Ashburn | TCP |
| 0.0.163.230 | TCP | |||
| 185.213.121.60 | TCP | |||
| 0.0.231.186 | TCP | |||
| 0.0.212.99 | TCP | |||
| 0.0.67.10 | TCP | |||
| 128.190.163.245 | US | Manassas | TCP | |
| 0.0.7.16 | TCP | |||
| 0.0.20.247 | TCP | |||
| 0.0.122.245 | TCP | |||
| 0.0.39.0 | TCP | |||
| 0.0.179.107 | TCP | |||
| 0.0.253.113 | TCP | |||
| 0.0.205.205 | TCP | |||
| 0.0.34.8 | TCP | |||
| 0.0.164.140 | TCP | |||
| 0.0.168.45 | TCP | |||
| tcmson2003w-lp130-01-69-156-28-227.dsl.bell.ca | 69.156.28.227 | CA | Windsor | TCP |
| host252.181-86-248.telecom.net.ar | 181.86.248.252 | AR | TCP | |
| 129.84.19.64 | US | Bellevue | TCP | |
| 207.92.185.37 | US | TCP | ||
| 0.0.111.183 | TCP | |||
| 0.0.31.79 | TCP | |||
| 0.0.18.144 | TCP | |||
| 60.194.42.210 | CN | Beijing | TCP | |
| 0.0.37.184 | TCP | |||
| 21.23.144.5 | US | TCP | ||
| 0.0.136.154 | TCP | |||
| cpc122804-stev8-2-0-cust43.9-2.cable.virginm.net | 80.6.143.44 | GB | Whyteleafe | TCP |
| 156.109.211.201 | US | New York | TCP | |
| 0.0.6.213 | TCP | |||
| 2-231-206-96.ip208.fastwebnet.it | 2.231.206.96 | IT | Rome | TCP |
| 64.253.97.152 | US | Lexington | TCP | |
| LFbn-1-4345-192.w92-169.abo.wanadoo.fr | 92.169.92.192 | FR | Paris | TCP |
| 0.0.32.3 | TCP | |||
| 0.0.72.119 | TCP | |||
| 8ta-248-33-64.telkomadsl.co.za | 102.248.33.64 | TCP | ||
| 148.25.100.184 | US | TCP | ||
| 0.0.1.151 | TCP | |||
| 0.0.165.8 | TCP | |||
| 0.0.68.54 | TCP | |||
| 51.138.161.58 | GB | TCP | ||
| 0.0.216.94 | TCP | |||
| 162.57.198.17 | US | Bismarck | TCP | |
| LFbn-1-11786-29.w90-93.abo.wanadoo.fr | 90.93.106.29 | FR | TCP | |
| 0.0.188.77 | TCP | |||
| 150.77.5.186 | JP | TCP | ||
| 23.sub-69-97-240.myvzw.com | 69.97.240.23 | US | TCP | |
| 0.0.180.142 | TCP | |||
| 0.0.235.33 | TCP | |||
| 0.0.60.36 | TCP | |||
| 119.45.123.131 | CN | Guangzhou | TCP | |
| 160.210.14.157 | IS | Reykjavk | TCP | |
| 39.215.109.0 | ID | TCP | ||
| 120.130.229.250 | CN | Beijing | TCP | |
| 0.0.130.184 | TCP | |||
| 0.0.118.49 | TCP | |||
| 137.40.239.114 | US | Palo Alto | TCP | |
| 0.0.241.41 | TCP | |||
| 0.0.16.34 | TCP | |||
| 0.0.115.184 | TCP | |||
| 0.0.18.42 | TCP | |||
| free.msk.ispsystem.net | 92.63.106.71 | RU | Moscow | TCP |
| 0.0.151.174 | TCP | |||
| 0.0.19.179 | TCP | |||
| 0.0.95.119 | TCP | |||
| client.yota.ru | 178.177.40.130 | RU | TCP | |
| 0.0.31.41 | TCP | |||
| 0.0.169.174 | TCP | |||
| 207.211.165.177.isp.timbrasil.com.br | 177.165.211.207 | BR | TCP | |
| 0.0.26.236 | TCP | |||
| 0.0.24.99 | TCP | |||
| i60-34-174-210.s41.a023.ap.plala.or.jp | 60.34.174.210 | JP | Minamiashigara | TCP |
| 28.104.132.12 | US | TCP | ||
| 0.0.147.177 | TCP | |||
| 36.38.86.149 | KR | Incheon | TCP | |
| 0.0.192.58 | TCP | |||
| 0.0.231.124 | TCP | |||
| 0.0.104.198 | TCP | |||
| 200.198.182.176 | BR | TCP | ||
| 0.0.166.40 | TCP | |||
| 0.0.170.67 | TCP | |||
| 0.0.65.70 | TCP | |||
| 0.0.36.43 | TCP | |||
| 0.0.177.209 | TCP | |||
| 0.0.48.155 | TCP | |||
| 0.0.54.144 | TCP | |||
| 0.0.219.219 | TCP | |||
| 0.0.60.59 | TCP | |||
| 0.0.12.210 | TCP | |||
| 196.186.245.218 | TN | TCP | ||
| 158.111.171.139 | US | Atlanta | TCP | |
| 102.46.159.6 | TCP | |||
| 132.147.103.99 | SG | Singapore | TCP | |
| host35.181-8-69.telecom.net.ar | 181.8.69.35 | AR | TCP | |
| 0.0.128.173 | TCP | |||
| 0.0.63.37 | TCP | |||
| 0.0.138.193 | TCP | |||
| 173-101-90-77.pools.spcsdns.net | 173.101.90.77 | US | TCP | |
| 149.pool85-55-99.dynamic.orange.es | 85.55.99.149 | ES | Vallada | TCP |
| 80-108-214-91.cable.dynamic.surfer.at | 80.108.214.91 | AT | Vienna | TCP |
| 0.0.68.187 | TCP | |||
| pa49-199-237-34.pa.vic.optusnet.com.au | 49.199.237.34 | AU | TCP | |
| 48.131.176.7 | US | Newark | TCP | |
| 0.0.163.72 | TCP | |||
| 9.115.34.87 | US | Durham | TCP | |
| 0.0.219.63 | TCP | |||
| 0.0.244.219 | TCP | |||
| 0.0.178.181 | TCP | |||
| 6.203.42.77 | US | Fort Huachuca | TCP | |
| 30.230.144.163 | US | TCP | ||
| 0.0.194.245 | TCP | |||
| 0.0.86.230 | TCP | |||
| 0.0.204.69 | TCP | |||
| 39.198.95.0 | ID | TCP | ||
| customer-mred-1.static.metrored.net.mx | 187.187.149.1 | MX | Ciudad Del Carmen | TCP |
| 218.151.71.37.rev.sfr.net | 37.71.151.218 | FR | TCP | |
| 0.0.245.86 | TCP | |||
| 153.37.69.113 | CN | Nanjing | TCP | |
| 145.8.213.161 | NL | Ijmuiden | TCP | |
| 0.0.77.95 | TCP | |||
| 7.5.81.236 | US | TCP | ||
| 0.0.98.45 | TCP | |||
| 0.0.196.146 | TCP | |||
| 0.0.179.121 | TCP | |||
| 180.251.63.25 | ID | Medan | TCP | |
| 110.192.28.78 | CN | Beijing | TCP | |
| 195.83.215.67 | FR | TCP | ||
| 0.0.48.234 | TCP | |||
| 0.0.102.43 | TCP | |||
| 252.179.217.216.transedge.com | 216.217.179.252 | US | Seattle | TCP |
| 172.45.99.198 | US | TCP | ||
| 86.102.185.74 | RU | TCP | ||
| 162.174.78.179 | US | TCP | ||
| 0.0.236.246 | TCP | |||
| 0.0.138.141 | TCP | |||
| 0.0.24.43 | TCP | |||
| 0.0.61.208 | TCP | |||
| 0.0.81.193 | TCP | |||
| 157.13.144.177 | JP | TCP | ||
| 0.0.103.96 | TCP | |||
| 0.0.51.90 | TCP | |||
| 0.0.222.58 | TCP | |||
| 0.0.23.231 | TCP | |||
| 140.108.23.91 | US | Silver Spring | TCP | |
| broadband-188-32-28-159.moscow.rt.ru | 188.32.28.159 | RU | Moscow | TCP |
| 0.0.205.133 | TCP | |||
| 0.0.36.79 | TCP | |||
| stuxua52.secure.ne.jp | 118.82.90.52 | JP | Tokyo | TCP |
| 0.0.91.173 | TCP | |||
| 211.34.40.99 | KR | TCP | ||
| 0.0.39.184 | TCP | |||
| 0.0.67.144 | TCP | |||
| 0.0.223.122 | TCP | |||
| 157.sub-174-221-50.myvzw.com | 174.221.50.157 | US | TCP | |
| 0.0.181.198 | TCP | |||
| 0.0.14.23 | TCP | |||
| 0.0.99.148 | TCP | |||
| 0.0.221.53 | TCP | |||
| 0.0.61.177 | TCP | |||
| 0.0.163.89 | TCP | |||
| 0.0.220.111 | TCP | |||
| 0.0.251.58 | TCP | |||
| 0.0.52.237 | TCP | |||
| 0.0.13.45 | TCP | |||
| 18.229.131.87 | US | Cambridge | TCP | |
| bdy93-h01-31-34-252-101.dsl.sta.abo.bbox.fr | 31.34.252.101 | FR | Noisy-le-sec | TCP |
| 130.195.188.152 | NZ | Wellington | TCP | |
| apn-95-41-153-228.dynamic.gprs.plus.pl | 95.41.153.228 | PL | Stargard Szczecinski | TCP |
| 0.0.86.206 | TCP | |||
| 0.0.83.38 | TCP | |||
| 0.0.95.204 | TCP | |||
| dsl-201-138-210-48-dyn.prod-infinitum.com.mx | 201.138.210.48 | MX | Barra De Navidad | TCP |
| ec2-34-235-50-145.compute-1.amazonaws.com | 34.235.50.145 | US | TCP | |
| 78.184.123.34.dynamic.ttnet.com.tr | 78.184.123.34 | TR | Akren | TCP |
| 0.0.17.252 | TCP | |||
| 0.0.154.76 | TCP | |||
| 131.214.34.90 | US | Montgomery | TCP | |
| 0.0.85.58 | TCP | |||
| 150.138.249.136 | CN | Jinan | TCP | |
| 170.24.252.142 | US | Westbury | TCP | |
| 0.0.52.246 | TCP | |||
| 129.246.26.156 | US | Alexandria | TCP | |
| 0.0.220.13 | TCP | |||
| 0.0.220.239 | TCP | |||
| 0.0.201.30 | TCP | |||
| bzq-109-66-126-78.red.bezeqint.net | 109.66.126.78 | IL | Tel Aviv | TCP |
| 54.97.199.76 | US | Woodbridge | TCP | |
| 15.179.52.47 | US | Palo Alto | TCP | |
| 0.0.109.150 | TCP | |||
| 0.0.137.124 | TCP | |||
| 81-64-215-13.rev.numericable.fr | 81.64.215.13 | FR | Paris | TCP |
| 94-38-196-105.adsl-ull.clienti.tiscali.it | 94.38.196.105 | IT | Turin | TCP |
| 0.0.18.172 | TCP | |||
| 0.0.222.139 | TCP | |||
| 0.0.139.73 | TCP | |||
| 129.247.194.57 | DE | TCP | ||
| ua-85-227-45-223.cust.bredbandsbolaget.se | 85.227.45.223 | SE | Mrsta | TCP |
| 132.23.232.193 | US | Montgomery | TCP | |
| 0.0.39.54 | TCP | |||
| dsl-187-148-0-157-dyn.prod-infinitum.com.mx | 187.148.0.157 | MX | Guadalajara | TCP |
| 12.44.52.90 | US | Maywood | TCP | |
| 13.17.68.187 | US | Norwalk | TCP | |
| 0.0.127.94 | TCP | |||
| 0.0.130.251 | TCP | |||
| 52.136.128.53 | US | Redmond | TCP | |
| 215.22.156.163 | US | TCP | ||
| vg-1247-13.sl5.fra.routeserver.net | 217.118.27.1 | DE | Hst | TCP |
| bt-222-184.bta.net.cn | 202.106.222.184 | CN | Beijing | TCP |
| 0.0.40.246 | TCP | |||
| 0.0.102.105 | TCP | |||
| 0.0.166.56 | TCP | |||
| 0.0.136.35 | TCP | |||
| 99-2-41-69.lightspeed.hstntx.sbcglobal.net | 99.2.41.69 | US | Houston | TCP |
| 0.0.68.165 | TCP | |||
| 0.0.187.235 | TCP | |||
| 0.0.2.63 | TCP | |||
| 0.0.62.69 | TCP | |||
| 0.0.32.95 | TCP | |||
| 36.45.203.18 | CN | Xian | TCP | |
| 214.94.39.204 | US | TCP | ||
| 0.0.127.252 | TCP | |||
| 0.0.10.56 | TCP | |||
| dialup-16.kaapeli.fi | 194.100.16.137 | FI | TCP | |
| 0.0.59.224 | TCP | |||
| 202.98.221.41 | CN | Guiyang | TCP | |
| 0.0.194.247 | TCP | |||
| 0.0.54.187 | TCP | |||
| 137.195.53.48 | GB | Heriot | TCP | |
| 0.0.161.249 | TCP | |||
| 0.0.116.61 | TCP | |||
| 0.0.78.207 | TCP | |||
| 0.0.98.56 | TCP | |||
| 0.0.99.73 | TCP | |||
| 0.0.38.147 | TCP | |||
| 0.0.167.125 | TCP | |||
| 0.0.162.1 | TCP | |||
| 0.0.163.162 | TCP | |||
| 0.0.101.170 | TCP | |||
| 0.0.184.219 | TCP | |||
| 0.0.200.71 | TCP | |||
| 152.236.60.214 | BR | Belo Horizonte | TCP | |
| 34.68.90.73 | US | TCP | ||
| 52.99.46.12 | US | Redmond | TCP | |
| 11.5.96.6 | US | TCP | ||
| 149.145.203.123 | US | Waltham | TCP | |
| 0.0.230.124 | TCP | |||
| host-120.158-234-182.cable.static.kbtelecom.net | 182.234.158.120 | TW | Tainan | TCP |
| 140.55.182.216 | US | TCP | ||
| 108.sub-70-204-160.myvzw.com | 70.204.160.108 | US | TCP | |
| 91.252.209.95 | IT | TCP | ||
| 0.0.53.48 | TCP | |||
| 14.72.91.55 | KR | TCP | ||
| 0.0.10.37 | TCP | |||
| 0.0.136.62 | TCP | |||
| 0.0.37.18 | TCP | |||
| 35.248.249.197 | US | TCP | ||
| 142.124.43.226 | CA | TCP | ||
| 0.0.95.173 | TCP | |||
| 0.0.111.188 | TCP | |||
| 0.0.44.119 | TCP | |||
| 0.0.184.222 | TCP | |||
| 132.37.170.107 | US | Montgomery | TCP | |
| 149.88.62.131 | IL | Yakum | TCP | |
| 42.83.68.211 | CN | Guangzhou | TCP | |
| 74-60-180-216.par.clearwire-wmx.net | 74.60.180.216 | US | Philadelphia | TCP |
| 0.0.88.37 | TCP | |||
| h-68-165-12-14.miat.fl.globalcapacity.com | 68.165.12.14 | US | Los Angeles | TCP |
| 122.159.155.144 | CN | Harbin | TCP | |
| 118.29.135.139 | CN | Tianjin | TCP | |
| 0.0.177.98 | TCP | |||
| 0.0.101.92 | TCP | |||
| 0.0.146.180 | TCP | |||
| 194.16.252.232 | SE | TCP | ||
| 0.0.0.201 | TCP | |||
| 0.0.101.84 | TCP | |||
| 63.244.19.96 | US | Allston | TCP | |
| n151-186-000-000.static.online-age.net | 151.186.123.246 | US | Schenectady | TCP |
| cpe-24-198-86-17.maine.res.rr.com | 24.198.86.17 | US | Addison | TCP |
| 0.0.217.139 | TCP | |||
| D57C6D0B.static.ziggozakelijk.nl | 213.124.109.11 | NL | Zwolle | TCP |
| 150.147.237.225 | US | Saint Louis | TCP | |
| 0.0.117.83 | TCP | |||
| 0.0.173.224 | TCP | |||
| 0.0.214.81 | TCP | |||
| 0.0.238.217 | TCP | |||
| 0.0.201.4 | TCP | |||
| 0.0.240.127 | TCP | |||
| 191.123.49.221 | BR | Campinas | TCP | |
| 0.0.241.213 | TCP | |||
| 0.0.91.230 | TCP | |||
| 0.0.10.238 | TCP | |||
| 198.134.74.8 | US | TCP | ||
| 0.0.65.97 | TCP | |||
| 0.0.58.52 | TCP | |||
| 193.29.218.85 | DE | Dortmund | TCP | |
| 203-85-224-103.static.hk.net | 203.85.224.103 | HK | Quarry Bay | TCP |
| 0.0.56.109 | TCP | |||
| 0.0.223.212 | TCP | |||
| 43.82.219.34 | JP | Tokyo | TCP | |
| 0.0.192.205 | TCP | |||
| 30.183.220.129 | US | TCP | ||
| 0.0.65.56 | TCP | |||
| 0.0.95.28 | TCP | |||
| 0.0.83.102 | TCP | |||
| 37-146-82-50.broadband.corbina.ru | 37.146.82.50 | RU | Moscow | TCP |
| 0.0.70.97 | TCP | |||
| 0.0.107.21 | TCP | |||
| 0.0.177.62 | TCP | |||
| 0.0.202.27 | TCP | |||
| 0.0.173.208 | TCP | |||
| 0.0.172.2 | TCP | |||
| 0.0.196.215 | TCP | |||
| 0.0.131.156 | TCP | |||
| 0.0.154.153 | TCP | |||
| 0.0.238.251 | TCP | |||
| 0.0.119.65 | TCP | |||
| 0.0.156.150 | TCP | |||
| KD027080061140.ppp-bb.dion.ne.jp | 27.80.61.140 | JP | TCP | |
| a23-3-119-243.deploy.static.akamaitechnologies.com | 23.3.119.243 | US | TCP | |
| 159.215.203.10 | US | St Louis | TCP | |
| 46.243.227.179.leadertelecom.ru | 46.243.227.179 | RU | Sarapul | TCP |
| 197.108.87.74 | ZA | East London | TCP | |
| 193.141.97.125 | DE | Hamburg | TCP | |
| 61-113-71-239.user.win-rd.jp | 61.113.71.239 | JP | TCP | |
| 121.181.164.250 | KR | Daegu | TCP | |
| 0.0.183.174 | TCP | |||
| host-98-205-161-192.newwavecomm.net | 192.161.205.98 | US | Olney | TCP |
| 0.0.154.69 | TCP | |||
| 0.0.15.217 | TCP | |||
| 75.sub-166-169-45.myvzw.com | 166.169.45.75 | US | TCP | |
| 0.0.192.150 | TCP | |||
| 0.0.164.210 | TCP | |||
| 0.0.221.40 | TCP | |||
| 0.0.94.76 | TCP | |||
| 39.78.226.225 | CN | Jinan | TCP | |
| 0.0.142.12 | TCP | |||
| fm-dyn-111-94-253-56.fast.net.id | 111.94.253.56 | ID | TCP | |
| 179.184.112.83.static.adsl.gvt.net.br | 179.184.112.83 | BR | Porto Alegre | TCP |
| 0.0.246.127 | TCP | |||
| 65.152.154.190 | US | TCP | ||
| 191.65.27.0 | CO | TCP | ||
| 42.20.48.26 | KR | TCP | ||
| VDSL-151-118-77-112.DNVR.QWEST.NET | 151.118.77.112 | US | TCP | |
| host-201-183-99-211.ecutel.net | 201.183.99.211 | EC | Quito | TCP |
| 0.0.173.4 | TCP | |||
| 0.0.144.186 | TCP | |||
| 0.0.187.164 | TCP | |||
| 187.113.180.89.dynamic.adsl.gvt.net.br | 187.113.180.89 | BR | Colatina | TCP |
| 0.0.50.114 | TCP | |||
| 0.0.88.205 | TCP | |||
| 137.221.197.161 | GB | Coventry | TCP | |
| 46.105.140.196 | FR | TCP | ||
| 15.154.138.225 | US | Palo Alto | TCP | |
| 0.0.148.240 | TCP | |||
| 124.199.56.3 | KR | Suwon | TCP | |
| 101.133.210.199 | CN | Hangzhou | TCP | |
| 0.0.133.77 | TCP | |||
| host-92-29-67-174.as13285.net | 92.29.67.174 | GB | Rotherham | TCP |
| 0.0.106.21 | TCP | |||
| 0.0.94.200 | TCP | |||
| 0.0.176.92 | TCP | |||
| 0.0.110.75 | TCP | |||
| 0.0.77.70 | TCP | |||
| 0.0.166.25 | TCP | |||
| 178.163.224.185 | BY | TCP | ||
| 0.0.214.145 | TCP | |||
| 0.0.1.23 | TCP | |||
| 0.0.94.68 | TCP | |||
| 0.0.66.194 | TCP | |||
| 144.69.244.37 | US | Dallas | TCP | |
| 59-117-240-222.dynamic-ip.hinet.net | 59.117.240.222 | TW | TCP | |
| 0.0.97.230 | TCP | |||
| 0.0.158.162 | TCP | |||
| mailgw.riksdagen.se | 193.11.1.146 | SE | TCP | |
| 0.0.20.31 | TCP | |||
| 119.233.147.109 | CN | Xiamen | TCP | |
| 0.0.83.150 | TCP | |||
| 0.0.61.143 | TCP | |||
| 0.0.200.164 | TCP | |||
| 72.7.166.172 | US | TCP | ||
| 0.0.17.130 | TCP | |||
| 0.0.81.178 | TCP | |||
| 0.0.184.177 | TCP | |||
| 0.0.100.66 | TCP | |||
| 0.0.37.160 | TCP | |||
| 0.0.114.100 | TCP | |||
| 0.0.233.100 | TCP | |||
| 0.0.18.157 | TCP | |||
| 0.0.166.216 | TCP | |||
| 0.0.231.75 | TCP | |||
| 0.0.71.185 | TCP | |||
| 67.196.145.231 | US | Denver | TCP | |
| 0.0.8.53 | TCP | |||
| 178.229.191.131 | NL | Amsterdam | TCP | |
| ip92-160-59-81.dyndsl.versatel.nl | 81.59.160.92 | NL | Zwolle | TCP |
| 201-5-211-186.user3g.veloxzone.com.br | 201.5.211.186 | BR | TCP | |
| 12.110.76.31 | US | TCP | ||
| 177-156-179-46.mobileinternet.proximus.be | 46.179.156.177 | BE | TCP | |
| 111.4.68.126 | CN | TCP | ||
| 113.6.59.234 | CN | Harbin | TCP | |
| 0.0.23.146 | TCP | |||
| 0.0.100.225 | TCP | |||
| 0.0.122.49 | TCP | |||
| 238.sub-72-96-205.myvzw.com | 72.96.205.238 | US | TCP | |
| 19.249.19.50 | US | Dearborn | TCP | |
| 0.0.115.64 | TCP | |||
| 0.0.86.17 | TCP | |||
| 185.178.190.130 | TCP | |||
| user-119bh2q.biz.mindspring.com | 66.149.196.90 | US | TCP | |
| 0.0.97.127 | TCP | |||
| 0.0.238.100 | TCP | |||
| 0.0.222.97 | TCP | |||
| 253.102.224.140.broad.ly.fj.dynamic.163data.com.cn | 140.224.102.253 | CN | Fuzhou | TCP |
| 55.214.237.160 | US | Fort Huachuca | TCP | |
| 0.0.116.155 | TCP | |||
| 6.94.1.239 | US | Fort Huachuca | TCP | |
| pool-71-162-225-35.phlapa.east.verizon.net | 71.162.225.35 | US | TCP | |
| 0.0.158.160 | TCP | |||
| 0.0.39.31 | TCP | |||
| 181.244.158.19 | CO | TCP | ||
| 211.30.118.253 | AU | TCP | ||
| 92.178.195.113 | FR | TCP | ||
| 183.169.90.81 | CN | Changsha | TCP | |
| 0.0.6.47 | TCP | |||
| 0.0.88.41 | TCP | |||
| 15.104.249.11 | US | Palo Alto | TCP | |
| 0.0.50.179 | TCP | |||
| 0.0.188.61 | TCP | |||
| 69.30.198.89 | US | Kansas City | TCP | |
| 76-193-148-155.lightspeed.kscymo.sbcglobal.net | 76.193.148.155 | US | Overland Park | TCP |
| 0.0.175.175 | TCP | |||
| 12.234.137.11 | US | Mineral Wells | TCP | |
| 104.213.74.9 | US | Redmond | TCP | |
| 0.0.102.59 | TCP | |||
| 0.0.214.173 | TCP | |||
| 0.0.92.187 | TCP | |||
| 0.0.185.240 | TCP | |||
| 0.0.182.42 | TCP | |||
| 99-95-235-82.lightspeed.hstntx.sbcglobal.net | 99.95.235.82 | US | TCP | |
| 0.0.183.59 | TCP | |||
| 0.0.219.71 | TCP | |||
| 0.0.104.166 | TCP | |||
| 55.215.183.226 | US | Fort Huachuca | TCP | |
| 0.0.23.9 | TCP | |||
| 0.0.69.198 | TCP | |||
| 119.125.67.82 | CN | Guangzhou | TCP | |
| 63.red-83-55-82.dynamicip.rima-tde.net | 83.55.82.63 | ES | Madrid | TCP |
| 0.0.41.69 | TCP | |||
| 0.0.141.172 | TCP | |||
| 211.119.141.192 | KR | TCP | ||
| 111.9.122.211 | CN | TCP | ||
| 0.0.44.44 | TCP | |||
| 0.0.242.196 | TCP | |||
| 0.0.169.112 | TCP | |||
| 45.152.33.109 | TCP | |||
| 0.0.12.58 | TCP | |||
| 0.0.210.95 | TCP | |||
| 0.0.29.174 | TCP | |||
| 0.0.96.43 | TCP | |||
| 0.0.243.81 | TCP | |||
| 0.0.179.120 | TCP | |||
| 0.0.193.116 | TCP | |||
| 0.0.223.46 | TCP | |||
| 0.0.156.147 | TCP | |||
| 0.0.137.15 | TCP | |||
| 0.0.169.35 | TCP | |||
| 0.0.104.28 | TCP | |||
| 0.0.82.229 | TCP | |||
| mm-192-214-123-178.gomel.dynamic.pppoe.byfly.by | 178.123.214.192 | BY | Homel | TCP |
| 207.55.164.119 | US | Englewood | TCP | |
| 32.148.166.218 | US | TCP | ||
| 20.222.180.192 | US | Falls Church | TCP | |
| pool-108-6-204-100.nycmny.fios.verizon.net | 108.6.204.100 | US | Brooklyn | TCP |
| 66.70.188.233 | US | Trumbull | TCP | |
| 209.120.168.76 | US | San Francisco | TCP | |
| 0.0.185.39 | TCP | |||
| 0.0.45.41 | TCP | |||
| 81.28.68.216 | DE | TCP | ||
| 0.0.58.46 | TCP | |||
| 33.186.189.58 | US | TCP | ||
| host186-74-static.59-88-b.business.telecomitalia.it | 88.59.74.186 | IT | TCP | |
| 0.0.87.14 | TCP | |||
| 0.0.207.160 | TCP | |||
| 0.0.87.42 | TCP | |||
| 57.171.5.127 | BE | TCP | ||
| 196.91.196.33 | MA | TCP | ||
| 0.0.77.171 | TCP | |||
| 0.0.223.39 | TCP | |||
| 61.38.84ae.static.theplanet.com | 174.132.56.97 | US | Houston | TCP |
| 150.218.95.247 | US | TCP | ||
| 0.0.54.103 | TCP | |||
| 97.f0.acb8.ip4.static.sl-reverse.com | 184.172.240.151 | US | Houston | TCP |
| 213.192.138.167 | FI | TCP | ||
| 213.28.254.12 | FI | TCP | ||
| 143.38.77.169 | US | Cincinnati | TCP | |
| 146.87.164.59 | GB | Salford | TCP | |
| 0.0.229.170 | TCP | |||
| 0.0.43.2 | TCP | |||
| 0.0.27.241 | TCP | |||
| 0.0.117.242 | TCP | |||
| 120.176.25.195 | ID | Jakarta | TCP | |
| 37-164-40-67.coucou-networks.fr | 37.164.40.67 | FR | TCP | |
| 145.26.16.120 | NL | Utrecht | TCP | |
| 0.0.0.178 | TCP | |||
| 214.198.189.32 | US | TCP | ||
| 53.96.217.80 | DE | TCP | ||
| 0.0.22.203 | TCP | |||
| 0.0.171.249 | TCP | |||
| 217-168-73-211.tinp.net.tw | 211.73.168.217 | TW | Taichung | TCP |
| 0.0.14.223 | TCP | |||
| 0.0.108.36 | TCP | |||
| 0.0.238.173 | TCP | |||
| 0.0.138.135 | TCP | |||
| 0.0.167.50 | TCP | |||
| 0.0.209.156 | TCP | |||
| 116.9.90.79 | CN | Nanning | TCP | |
| 0.0.213.169 | TCP | |||
| 11.131.88.75 | US | TCP | ||
| 0.0.198.42 | TCP | |||
| 0.0.102.149 | TCP | |||
| 0.0.60.103 | TCP | |||
| 123.254.156.3 | KR | Seoul | TCP | |
| 0.0.165.208 | TCP | |||
| 0.0.111.195 | TCP | |||
| 65-129-228-22.tcso.qwest.net | 65.129.228.22 | US | Tucson | TCP |
| 0.0.232.238 | TCP | |||
| 0.0.232.112 | TCP | |||
| 0.0.181.36 | TCP | |||
| 161.136.77.55 | US | Buffalo | TCP | |
| 0.0.161.198 | TCP | |||
| 187-70-185-220.3g.claro.net.br | 187.70.185.220 | BR | TCP | |
| 182.43.211.187 | CN | Jinan | TCP | |
| 0.0.49.47 | TCP | |||
| 0.0.97.129 | TCP | |||
| 0.0.114.0 | TCP | |||
| 0.0.78.110 | TCP | |||
| 0.0.218.211 | TCP | |||
| 0.0.74.93 | TCP | |||
| 0.0.69.202 | TCP | |||
| 0.0.174.222 | TCP | |||
| 0.0.56.65 | TCP | |||
| 0.0.212.170 | TCP | |||
| 0.0.99.199 | TCP | |||
| 0.0.98.99 | TCP | |||
| 0.0.123.177 | TCP | |||
| 54.102.31.109.rev.sfr.net | 109.31.102.54 | FR | La Ciotat | TCP |
| 0.0.163.0 | TCP | |||
| 154.34.173.225 | JP | TCP | ||
| 27-33-56-191.tpgi.com.au | 27.33.56.191 | AU | Rose Bay | TCP |
| 194.105.235.32 | IS | TCP | ||
| 152.228.237.229 | US | Valparaiso | TCP | |
| 99.52.46.153 | US | TCP | ||
| AC9573DF.ipt.aol.com | 172.149.115.223 | US | TCP | |
| 20.1.82.155 | US | Falls Church | TCP | |
| 0.0.58.58 | TCP | |||
| 0.0.155.241 | TCP | |||
| 216.199.31.233.nw.nuvox.net | 216.199.31.233 | US | Greenville | TCP |
| 0.0.252.210 | TCP | |||
| 0.0.172.75 | TCP | |||
| 0.0.231.21 | TCP | |||
| 0.0.94.146 | TCP | |||
| host-82-222-13-78.reverse.superonline.net | 82.222.13.78 | TR | TCP | |
| 0.0.63.130 | TCP | |||
| 0.0.122.162 | TCP | |||
| 39.103.94.167 | CN | Hangzhou | TCP | |
| 63.90.235.225 | US | TCP | ||
| 0.0.127.125 | TCP | |||
| 177.238.245.60.cable.dyn.cableonline.com.mx | 177.238.245.60 | MX | Ciudad Valles | TCP |
| 171.21.80.71 | NL | Haarlem | TCP | |
| mcc62-1-78-211-139-48.fbx.proxad.net | 78.211.139.48 | FR | Mricourt | TCP |
| 150.88.97.252 | JP | TCP | ||
| 196.28.11.219.cba.co.ke | 196.28.11.219 | KE | TCP | |
| 108-221-168-34.lightspeed.dybhfl.sbcglobal.net | 108.221.168.34 | US | Palm Coast | TCP |
| 0.0.165.122 | TCP | |||
| 0.0.129.122 | TCP | |||
| 0.0.186.20 | TCP | |||
| 0.0.128.60 | TCP | |||
| 212.105.190.227.ip.static.as44574.net | 212.105.190.227 | GB | TCP | |
| 0.0.99.212 | TCP | |||
| ppp-124-122-219-75.revip2.asianet.co.th | 124.122.219.75 | TH | Bangkok | TCP |
| 209.109.129.225 | US | TCP | ||
| 182.159.232.203 | JP | Tokyo | TCP | |
| 113.199.185.90 | NP | Kathmandu | TCP | |
| 0.0.96.21 | TCP | |||
| 47.91.161.110 | US | San Mateo | TCP | |
| 0.0.157.253 | TCP | |||
| 0.0.133.9 | TCP | |||
| 0.0.208.181 | TCP | |||
| 0.0.139.243 | TCP | |||
| 0.0.110.54 | TCP | |||
| 0.0.160.80 | TCP | |||
| 163.228.14.62.static.jazztel.es | 62.14.228.163 | ES | TCP | |
| 0.0.143.248 | TCP | |||
| 107.84.138.234 | US | TCP | ||
| 0.0.10.192 | TCP | |||
| 0.0.105.4 | TCP | |||
| 0.0.231.249 | TCP | |||
| 0.0.234.138 | TCP | |||
| pool-108-39-76-6.nrflva.fios.verizon.net | 108.39.76.6 | US | Hampton | TCP |
| 21.188.34.2 | US | TCP | ||
| 0.0.181.246 | TCP | |||
| 0.0.107.129 | TCP | |||
| 0.0.195.98 | TCP | |||
| 17.165.5.24 | US | Cupertino | TCP | |
| 0.0.68.58 | TCP | |||
| 0.0.157.137 | TCP | |||
| 0.0.147.8 | TCP | |||
| 133.210.206.237 | JP | TCP | ||
| athedsl-331858.home.otenet.gr | 85.72.151.240 | GR | Attik | TCP |
| 0.0.46.176 | TCP | |||
| 0.0.4.134 | TCP | |||
| 0.0.228.115 | TCP | |||
| 0.0.6.163 | TCP | |||
| 0.0.50.100 | TCP | |||
| 0.0.197.173 | TCP | |||
| 0.0.46.179 | TCP | |||
| 0.0.22.193 | TCP | |||
| 0.0.153.100 | TCP | |||
| 0.0.130.131 | TCP | |||
| 0.0.140.246 | TCP | |||
| 0.0.23.126 | TCP | |||
| 0.0.83.9 | TCP | |||
| adsl-74-178-146-222.sdf.bellsouth.net | 74.178.146.222 | US | TCP | |
| 0.0.187.62 | TCP | |||
| 124.206.7.182 | CN | Beijing | TCP | |
| r190-134-58-197.dialup.adsl.anteldata.net.uy | 190.134.58.197 | UY | Montevideo | TCP |
| 45.109.203.122 | EG | TCP | ||
| relay-5.notifications.oovoo.com | 192.237.159.66 | US | San Antonio | TCP |
| 131.118.200.181 | US | Salisbury | TCP | |
| 0.0.67.145 | TCP | |||
| 164.136.191.209 | GB | TCP | ||
| 0.0.166.7 | TCP | |||
| 167.97.73.34 | US | Feasterville Trevose | TCP | |
| 0.0.231.55 | TCP | |||
| 35.134.192.123 | US | Ann Arbor | TCP | |
| 0.0.216.59 | TCP | |||
| 0.0.88.178 | TCP | |||
| 0.0.1.58 | TCP | |||
| 165.217.42.245 | US | Newton | TCP | |
| 0.0.198.222 | TCP | |||
| 0.0.42.221 | TCP | |||
| 134.154.205.190 | US | Hayward | TCP | |
| ec2-52-206-117-223.compute-1.amazonaws.com | 52.206.117.223 | US | Ashburn | TCP |
| 0.0.234.154 | TCP | |||
| 200.182.65.219 | BR | TCP | ||
| 133.83.115.221 | JP | TCP | ||
| 48.131.72.74 | US | Newark | TCP | |
| 0.33.182.168 | TCP | |||
| 0.0.138.216 | TCP | |||
| 0.0.79.172 | TCP | |||
| 0.0.194.189 | TCP | |||
| 0.0.3.245 | TCP | |||
| 5e0a8aa4.bb.sky.com | 94.10.138.164 | GB | Wandsworth | TCP |
| cpe-72-226-37-46.nyc.res.rr.com | 72.226.37.46 | US | Woodside | TCP |
| 178.46.83.224 | RU | Revda | TCP | |
| n178-p45.kthopen.kth.se | 130.229.178.45 | SE | Stockholm | TCP |
| 0.0.197.193 | TCP | |||
| alibaba1.deu.hp.com | 16.58.2.57 | US | Palo Alto | TCP |
| 0.0.133.159 | TCP | |||
| 129.170.110.165 | US | Hanover | TCP | |
| 25.225.54.49 | GB | TCP | ||
| 0.0.14.137 | TCP | |||
| 202.74.57.97 | AU | TCP | ||
| 0.0.144.156 | TCP | |||
| 0.0.198.16 | TCP | |||
| 0.0.114.203 | TCP | |||
| 0.0.39.132 | TCP | |||
| 0.0.163.200 | TCP | |||
| 0.0.99.154 | TCP | |||
| 0.0.26.251 | TCP | |||
| 220.95.214.220 | KR | TCP | ||
| 0.0.197.65 | TCP | |||
| 100.212.213.159 | US | TCP | ||
| 0.0.114.171 | TCP | |||
| 0.0.239.185 | TCP | |||
| 0.0.101.148 | TCP | |||
| 24-231-167-179.dhcp.bycy.mi.charter.com | 24.231.167.179 | US | Pinckney | TCP |
| 0.0.221.186 | TCP | |||
| 0.0.195.169 | TCP | |||
| 145.71.161.62 | NL | Utrecht | TCP | |
| 0.0.161.211 | TCP | |||
| 0.0.138.240 | TCP | |||
| user-31-175-248-199.play-internet.pl | 31.175.248.199 | PL | Droniowice | TCP |
| 0.0.15.199 | TCP | |||
| 0.0.19.213 | TCP | |||
| 22.183.234.124 | US | TCP | ||
| 57.154.120.222 | BE | TCP | ||
| 0.0.101.18 | TCP | |||
| 0.0.10.22 | TCP | |||
| 0.0.200.57 | TCP | |||
| 0.0.49.210 | TCP | |||
| 0.0.38.84 | TCP | |||
| 0.0.8.25 | TCP | |||
| 0.0.19.181 | TCP | |||
| 0.0.39.63 | TCP | |||
| 0.0.58.113 | TCP | |||
| 0.0.158.150 | TCP | |||
| 0.0.147.95 | TCP | |||
| 0.0.32.132 | TCP | |||
| 0.0.76.144 | TCP | |||
| 0.0.114.28 | TCP | |||
| lav86-1-78-195-11-90.fbx.proxad.net | 78.195.11.90 | FR | Lavausseau | TCP |
| 0.0.34.63 | TCP | |||
| 143.226.15.135 | US | Rock Island | TCP | |
| timeweb.ru | 188.225.44.254 | RU | TCP | |
| 85.232.118.68 | RU | TCP | ||
| 11.98.238.234 | US | TCP | ||
| 20.245.220.233 | US | Falls Church | TCP | |
| 90.117.134.208 | FR | TCP | ||
| 0.0.162.152 | TCP | |||
| 0.0.164.86 | TCP | |||
| 142.92.248.48 | CA | Ottawa | TCP | |
| 0.0.195.88 | TCP | |||
| 170.57.197.29 | US | Houston | TCP | |
| 0.0.108.147 | TCP | |||
| 216.220.2.35 | US | Great Falls | TCP | |
| d51A51FF5.access.telenet.be | 81.165.31.245 | BE | Zandhoven | TCP |
| 8.53.54.147 | US | TCP | ||
| 0.0.110.5 | TCP | |||
| 0.0.229.141 | TCP | |||
| 55.71.190.126 | US | Fort Huachuca | TCP | |
| 0.0.153.181 | TCP | |||
| 52.152.69.202 | US | Redmond | TCP | |
| 192.50.33.202 | JP | TCP | ||
| 163.131.172.179 | JP | TCP | ||
| 0.0.182.34 | TCP | |||
| p241027-ipngn200402kanazawa.ishikawa.ocn.ne.jp | 180.36.149.27 | JP | Kanazawa | TCP |
| 111.73.235.1 | CN | Nanchang | TCP | |
| 0.0.156.9 | TCP | |||
| 0.0.83.19 | TCP | |||
| 0.0.75.27 | TCP | |||
| 0.0.12.128 | TCP | |||
| 34.31.37.212 | US | TCP | ||
| 0.0.111.52 | TCP | |||
| 23-87-157-180.res.bhn.net | 23.87.157.180 | US | TCP | |
| 0.0.118.191 | TCP | |||
| 124.59.122.171 | KR | Busan | TCP | |
| cpc116832-kemp8-2-0-cust3262.9-2.cable.virginm.net | 86.31.156.191 | GB | Bristol | TCP |
| 0.0.70.214 | TCP | |||
| 180.136.229.147 | CN | Nanning | TCP | |
| 0.0.73.91 | TCP | |||
| 139.131.25.203 | US | Elkhorn | TCP | |
| 73.105.191.219 | US | TCP | ||
| 0.0.199.29 | TCP | |||
| 0.0.23.139 | TCP | |||
| 0.0.231.3 | TCP | |||
| 0.0.112.123 | TCP | |||
| 0.0.5.48 | TCP | |||
| 0.0.165.140 | TCP | |||
| 0.0.113.208 | TCP | |||
| 0.0.142.129 | TCP | |||
| 0.0.184.102 | TCP | |||
| 130.72.31.225 | US | Austin | TCP | |
| 0.0.123.128 | TCP | |||
| 193.9.224.15 | DK | TCP | ||
| 116.89.161.136 | KR | Daegu | TCP | |
| ec2-54-73-4-25.eu-west-1.compute.amazonaws.com | 54.73.4.25 | IE | Dublin | TCP |
| 0.0.127.86 | TCP | |||
| 0.0.27.110 | TCP | |||
| 18.223.91.106 | US | Cambridge | TCP | |
| 0.0.1.131 | TCP | |||
| 0.0.100.71 | TCP | |||
| LFbn-1-4425-207.w92-170.abo.wanadoo.fr | 92.170.163.207 | FR | Paris | TCP |
| 0.0.227.206 | TCP | |||
| 0.0.122.241 | TCP | |||
| hn.kd.dhcp | 61.53.221.236 | CN | Zhengzhou | TCP |
| 0.0.1.197 | TCP | |||
| 0.0.212.223 | TCP | |||
| 0.0.147.238 | TCP | |||
| 0.0.32.188 | TCP | |||
| 0.0.141.54 | TCP | |||
| 0.0.248.124 | TCP | |||
| 0.0.12.225 | TCP | |||
| 0.0.25.87 | TCP | |||
| 0.0.138.225 | TCP | |||
| 0.0.58.235 | TCP | |||
| 0.0.230.82 | TCP | |||
| 0.0.227.233 | TCP | |||
| 0.0.40.115 | TCP | |||
| 0.0.175.225 | TCP | |||
| 0.0.186.17 | TCP | |||
| c-73-89-141-124.hsd1.ma.comcast.net | 73.89.141.124 | US | New Bedford | TCP |
| 207.76.158.239 | US | TCP | ||
| 203-96-99-60.dialup.xtra.co.nz | 203.96.99.60 | NZ | TCP | |
| adsl-70-239-54-137.dsl.hstntx.sbcglobal.net | 70.239.54.137 | US | TCP | |
| 32.17.52.99 | US | TCP | ||
| rrcs-50-84-120-186.sw.biz.rr.com | 50.84.120.186 | US | Dallas | TCP |
| 38.226.109.25 | US | TCP | ||
| 0.0.18.248 | TCP | |||
| client-181-43-157-45.imovil.entelpcs.cl | 181.43.157.45 | CL | Santiago | TCP |
| 0.0.211.95 | TCP | |||
| 53.21.61.148 | DE | TCP | ||
| 0.0.228.152 | TCP | |||
| 118.185.64.146 | IN | TCP | ||
| 0.0.5.42 | TCP | |||
| 0.0.52.37 | TCP | |||
| 0.0.130.172 | TCP | |||
| 84.51.124.128 | RU | Odintsovo | TCP | |
| 0.0.120.62 | TCP | |||
| 0.0.231.54 | TCP | |||
| 2.56.72.19 | TCP | |||
| 96.100.192.252 | US | TCP | ||
| 0.0.234.142 | TCP | |||
| 19.93.108.204 | US | Dearborn | TCP | |
| 161.219.186.164 | US | Falls Church | TCP | |
| 168.156.155.124 | US | Vancouver | TCP | |
| 0.0.105.28 | TCP | |||
| 0.0.183.178 | TCP | |||
| 0.0.156.31 | TCP | |||
| 0.0.151.137 | TCP | |||
| 114.170.158.77.rev.sfr.net | 77.158.170.114 | FR | TCP | |
| 202.118.160.219 | CN | Harbin | TCP | |
| 200.47.220.219 | CO | Bogot | TCP | |
| 169.113.80.104 | US | New York | TCP | |
| 0.0.203.148 | TCP | |||
| 223.42.198.91 | KR | TCP | ||
| 0.0.198.251 | TCP | |||
| CPE-124-191-82-207.kxng1.lon.bigpond.net.au | 124.191.82.207 | AU | Bundall | TCP |
| 44.7.98.77 | US | San Diego | TCP | |
| 185.140.165.188 | NL | TCP | ||
| 0.0.67.1 | TCP | |||
| 213.15.254.211 | GB | TCP | ||
| 0.0.51.173 | TCP | |||
| 0.0.230.88 | TCP | |||
| 0.0.82.247 | TCP | |||
| 0.0.235.47 | TCP | |||
| 0.0.25.225 | TCP | |||
| 0.0.246.246 | TCP | |||
| 0.0.249.87 | TCP | |||
| 0.0.196.121 | TCP | |||
| ua-85-231-57-52.cust.bredbandsbolaget.se | 85.231.57.52 | SE | TCP | |
| 0.0.57.113 | TCP | |||
| 0.0.81.57 | TCP | |||
| 0.0.153.199 | TCP | |||
| 181.254.233.3 | CO | TCP | ||
| 0.0.241.215 | TCP | |||
| 0.0.244.8 | TCP | |||
| 12.210.203.70 | US | TCP | ||
| 27.232.223.224 | KR | Seoul | TCP | |
| 0.0.6.141 | TCP | |||
| 0.0.101.23 | TCP | |||
| 101.251.195.90 | CN | Beijing | TCP | |
| 23.232.32.194 | US | Schaumburg | TCP | |
| 0.0.100.34 | TCP | |||
| 0.0.46.52 | TCP | |||
| 0.0.220.217 | TCP | |||
| 0.0.129.59 | TCP | |||
| 0.0.178.43 | TCP | |||
| 0.0.173.106 | TCP | |||
| 0.0.228.42 | TCP | |||
| 0.0.42.222 | TCP | |||
| 0.0.144.141 | TCP | |||
| 0.0.1.213 | TCP | |||
| 0.0.34.188 | TCP | |||
| 0.0.54.86 | TCP | |||
| host188.181-3-124.telecom.net.ar | 181.3.124.188 | AR | TCP | |
| 0.0.217.164 | TCP | |||
| 0.0.130.212 | TCP | |||
| 0.0.160.119 | TCP | |||
| 223.126.235.229 | CN | TCP | ||
| 0.0.39.59 | TCP | |||
| 62.186.117.162 | AT | TCP | ||
| 70.225.120.64 | US | TCP | ||
| 142.148.72.154 | CA | Toronto | TCP | |
| 0.0.37.72 | TCP | |||
| 150.125.38.62 | US | Charleston | TCP | |
| 0.0.147.41 | TCP | |||
| 222.203.41.236 | CN | Guilin | TCP | |
| 165.61.109.125 | ZM | TCP | ||
| 0.0.45.114 | TCP | |||
| 0.0.57.195 | TCP | |||
| 0.0.191.171 | TCP | |||
| 0.0.246.113 | TCP | |||
| 2.79.155.76 | KZ | Aktau | TCP | |
| 23.146.180.161 | TCP | |||
| 0.0.58.23 | TCP | |||
| 0.0.79.212 | TCP | |||
| 163.179.123.27 | CN | Guangzhou | TCP | |
| 108.0.116.79 | US | Huntington Beach | TCP | |
| 0.0.233.117 | TCP | |||
| 0.0.204.253 | TCP | |||
| 0.0.185.100 | TCP | |||
| 29.203.114.219 | US | Ipswich | TCP | |
| 112.213.115.78 | HK | Central District | TCP | |
| 72.84.11.191 | US | TCP | ||
| 0.0.232.96 | TCP | |||
| 148.162.169.51 | US | Hoffman Estates | TCP | |
| 104.202.31.101 | US | Los Angeles | TCP | |
| 30.180.69.148 | US | TCP | ||
| 6.66.239.102 | US | Fort Huachuca | TCP | |
| 0.0.111.58 | TCP | |||
| ec2-13-127-74-123.ap-south-1.compute.amazonaws.com | 13.127.74.123 | US | Norwalk | TCP |
| 92.173.140.60 | FR | TCP | ||
| 220.144.237.140.broad.np.fj.dynamic.163data.com.cn | 140.237.144.220 | CN | Fuzhou | TCP |
| 0.0.170.174 | TCP | |||
| 151.90.45.249 | IT | TCP | ||
| 0.0.67.96 | TCP | |||
| 0.0.68.220 | TCP | |||
| 5.6.215.51 | DE | TCP | ||
| 0.0.66.56 | TCP | |||
| 0.0.212.211 | TCP | |||
| 0.0.113.245 | TCP | |||
| 0.0.19.227 | TCP | |||
| 0.0.131.232 | TCP | |||
| 0.0.128.48 | TCP | |||
| 0.0.86.130 | TCP | |||
| 0.0.190.100 | TCP | |||
| 0.0.152.85 | TCP | |||
| 0.0.170.58 | TCP | |||
| 0.0.16.13 | TCP | |||
| 47.50.155.9 | US | Saint Louis | TCP | |
| 0.0.224.173 | TCP | |||
| host-197.55.226.152.tedata.net | 197.55.226.152 | EG | TCP | |
| 144.25.3.140 | US | Redwood City | TCP | |
| 0.0.195.206 | TCP | |||
| 0.0.36.148 | TCP | |||
| 138.107.67.219 | JP | TCP | ||
| 167.230.209.0 | US | Livingston | TCP | |
| 0.0.247.99 | TCP | |||
| 0.0.118.151 | TCP | |||
| 0.0.117.221 | TCP | |||
| 0.0.210.199 | TCP | |||
| 0.0.241.231 | TCP | |||
| 0.0.49.72 | TCP | |||
| 0.0.16.109 | TCP | |||
| 0.0.88.158 | TCP | |||
| 0.0.134.241 | TCP | |||
| 0.0.58.132 | TCP | |||
| 0.0.10.215 | TCP | |||
| 0.0.250.30 | TCP | |||
| 0.0.169.230 | TCP | |||
| 0.0.237.11 | TCP | |||
| 33.2.114.151 | US | TCP | ||
| host-89-228-112-165.dynamic.mm.pl | 89.228.112.165 | PL | Ostroda | TCP |
| 0.0.146.138 | TCP | |||
| 0.0.155.40 | TCP | |||
| 0.0.119.188 | TCP | |||
| 97-103-50-49.res.bhn.net | 97.103.50.49 | US | Orlando | TCP |
| 113.87.4.4 | CN | Shenzhen | TCP | |
| 43.230.180.67 | SG | TCP | ||
| 0.0.34.169 | TCP | |||
| 55.18.232.107 | US | Fort Huachuca | TCP | |
| 168.44.229.202 | US | Austin | TCP | |
| 0.0.93.204 | TCP | |||
| ODEL-DSL-69-49-211-18.srcaccess.net | 69.49.211.18 | US | Odell | TCP |
| 8.164.191.161 | US | TCP | ||
| 0.0.140.232 | TCP | |||
| c-24-126-41-135.hsd1.wv.comcast.net | 24.126.41.135 | US | Charles Town | TCP |
| 0.0.132.137 | TCP | |||
| 13.163.111.221 | US | Norwalk | TCP | |
| 18.148.112.82.dyn.jtglobal.com | 82.112.148.18 | JE | Saint Helier | TCP |
| 0.0.27.0 | TCP | |||
| 0.0.163.102 | TCP | |||
| 188.224.55.14 | FR | Noyal-sur-vilaine | TCP | |
| 132.18.0.87 | US | Montgomery | TCP | |
| 0.0.248.186 | TCP | |||
| 0.0.202.111 | TCP | |||
| 123.232.44.186 | CN | Jinan | TCP | |
| 136.112.118.169 | US | Dearborn | TCP | |
| 174.64.30.65 | US | Baton Rouge | TCP | |
| 0.0.11.227 | TCP | |||
| 0.0.225.116 | TCP | |||
| 0.0.189.66 | TCP | |||
| 138.225.26.36 | CH | Zurich | TCP | |
| 38.200.219.144 | US | TCP | ||
| 30.145.211.54 | US | TCP | ||
| 0.0.131.194 | TCP | |||
| 17.32.54.20 | US | Cupertino | TCP | |
| 0.0.2.84 | TCP | |||
| 103.68.12.246 | JP | Chuo | TCP | |
| 52.171.198.175 | US | San Antonio | TCP | |
| 88.190.171.206 | FR | Paris | TCP | |
| 0.0.25.28 | TCP | |||
| 44.142.141.175 | US | San Diego | TCP | |
| 0.0.147.187 | TCP | |||
| 0.0.201.22 | TCP | |||
| 113.69.234.181 | CN | Guangzhou | TCP | |
| 0.0.202.81 | TCP | |||
| 0.0.106.40 | TCP | |||
| 0.0.44.179 | TCP | |||
| 0.0.15.53 | TCP | |||
| 0.0.128.34 | TCP | |||
| 0.0.12.110 | TCP | |||
| 0.0.132.221 | TCP | |||
| 0.0.237.188 | TCP | |||
| 27.248.246.35 | IN | Gurgaon | TCP | |
| 0.0.169.203 | TCP | |||
| 0.0.90.153 | TCP | |||
| 0.0.230.177 | TCP | |||
| 48.213.140.243 | US | Newark | TCP | |
| 89.197.249.232 | GB | London | TCP | |
| p50915C11.dip0.t-ipconnect.de | 80.145.92.17 | DE | Herzogenrath | TCP |
| 0.0.250.113 | TCP | |||
| 0.0.153.235 | TCP | |||
| 115.211.0.13 | CN | Jinhua | TCP | |
| 0.0.134.47 | TCP | |||
| 0.0.11.131 | TCP | |||
| 0.0.65.156 | TCP | |||
| 170.9.144.37 | US | Houston | TCP | |
| 34.54.78.186 | US | TCP | ||
| 0.0.242.60 | TCP | |||
| 0.0.153.19 | TCP | |||
| 0.0.86.179 | TCP | |||
| 0.0.51.63 | TCP | |||
| 0.0.157.112 | TCP | |||
| 0.0.113.182 | TCP | |||
| 0.0.220.170 | TCP | |||
| 0.0.180.96 | TCP | |||
| 0.0.118.201 | TCP | |||
| 0.0.176.206 | TCP | |||
| 0.0.191.72 | TCP | |||
| 36.199.177.57 | CN | Beijing | TCP | |
| 0.0.8.221 | TCP | |||
| 0.0.84.146 | TCP | |||
| 0.0.99.29 | TCP | |||
| 0.0.101.45 | TCP | |||
| 36.71.119.201 | ID | Bangkong | TCP | |
| 93.77.5.123 | UA | Khmelnitskiy | TCP | |
| 0.0.174.29 | TCP | |||
| 208.210.207.129 | US | Englewood | TCP | |
| 176.7.6.123 | DE | TCP | ||
| 67.134.22.22 | US | TCP | ||
| 15.71.148.72 | US | Palo Alto | TCP | |
| 0.0.200.53 | TCP | |||
| 191.99.128.55 | EC | Quito | TCP | |
| 6.9.42.160 | US | Fort Huachuca | TCP | |
| 0.0.81.53 | TCP | |||
| 0.0.186.52 | TCP | |||
| 0.0.44.8 | TCP | |||
| 44.203.49.149 | US | San Diego | TCP | |
| 86.74.84.116 | FR | Bihorel | TCP | |
| 0.0.19.87 | TCP | |||
| 153.44.125.140 | NO | Horten | TCP | |
| 0.0.234.125 | TCP | |||
| 182.239.188.219 | AU | Brisbane | TCP | |
| 167.252.21.194 | AR | Quilmes | TCP | |
| 0.0.222.14 | TCP | |||
| 0.0.171.52 | TCP | |||
| 0.0.136.249 | TCP | |||
| 169.78.80.77 | US | New York | TCP | |
| 208.69.123.50 | US | Southfield | TCP | |
| 139.123.21.191 | FI | TCP | ||
| 0.0.41.210 | TCP | |||
| 0.0.78.7 | TCP | |||
| 104.219.125.45 | CA | Sharbot Lake | TCP | |
| 64.161.246.162 | US | TCP | ||
| 15.90.57.113 | US | Palo Alto | TCP | |
| 0.0.140.136 | TCP | |||
| i114-180-242-222.s04.a001.ap.plala.or.jp | 114.180.242.222 | JP | Ebetsu | TCP |
| ip51cf406f.direct-adsl.nl | 81.207.64.111 | NL | TCP | |
| 185.93.105.173 | SI | TCP | ||
| 0.0.192.65 | TCP | |||
| ca.216.202.188.183.gtecablemodem.com | 216.202.188.183 | US | TCP | |
| 0.0.60.217 | TCP | |||
| 0.0.207.26 | TCP | |||
| 122.37.157.135 | KR | Seoul | TCP | |
| 0.0.189.31 | TCP | |||
| 0.0.77.89 | TCP | |||
| 0.0.183.144 | TCP | |||
| 0.0.38.226 | TCP | |||
| 0.0.23.11 | TCP | |||
| 0.0.231.66 | TCP | |||
| 0.0.238.224 | TCP | |||
| 0.0.209.53 | TCP | |||
| 0.0.139.175 | TCP | |||
| 0.0.211.31 | TCP | |||
| 149.184.37.133 | GB | Sunbury | TCP | |
| 0.0.249.244 | TCP | |||
| 0.0.97.28 | TCP | |||
| 54.142.16.161 | US | Woodbridge | TCP | |
| 195.236.148.72 | FI | TCP | ||
| 109.sub-75-215-204.myvzw.com | 75.215.204.109 | US | TCP | |
| 0.0.218.106 | TCP | |||
| 0.0.243.28 | TCP | |||
| 71.22.89.243 | US | San Antonio | TCP | |
| 0.0.41.24 | TCP | |||
| 0.0.85.40 | TCP | |||
| 0.0.229.120 | TCP | |||
| 3.89.119.129 | US | Fairfield | TCP | |
| 18.85.234.174 | US | Cambridge | TCP | |
| 0.0.214.143 | TCP | |||
| 0.0.26.27 | TCP | |||
| 0.0.80.86 | TCP | |||
| 0.0.29.138 | TCP | |||
| 0.0.203.168 | TCP | |||
| 0.0.42.125 | TCP | |||
| 0.0.65.0 | TCP | |||
| 0.0.188.27 | TCP | |||
| 0.0.166.39 | TCP | |||
| 211.103.237.187 | CN | TCP | ||
| 0.0.117.230 | TCP | |||
| 0.0.151.183 | TCP | |||
| 0.0.194.2 | TCP | |||
| 0.0.117.46 | TCP | |||
| 0.0.128.77 | TCP | |||
| 0.0.94.172 | TCP | |||
| 0.0.243.105 | TCP | |||
| 47.177.165.242 | US | TCP | ||
| 163.199.204.12 | ZA | Durban | TCP | |
| 170.254.69.135 | BR | TCP | ||
| 0.0.44.102 | TCP | |||
| 0.0.84.246 | TCP | |||
| 113.7.200.1 | CN | Harbin | TCP | |
| 65.127.0.229 | US | TCP | ||
| 164.176.18.164 | US | Fort Huachuca | TCP | |
| 0.0.100.130 | TCP | |||
| 0.0.131.35 | TCP | |||
| 0.0.149.149 | TCP | |||
| 31.242.34.38 | DE | TCP | ||
| 59.245.151.21 | CN | Beijing | TCP | |
| ALyon-656-1-627-32.w80-9.abo.wanadoo.fr | 80.9.248.32 | FR | Lyon | TCP |
| 0.0.48.110 | TCP | |||
| 165.182.166.211 | CL | TCP | ||
| 0.0.59.51 | TCP | |||
| 23.142.83.26 | TCP | |||
| 98.100.66.112 | US | Youngstown | TCP | |
| 172.148.249.104 | US | TCP | ||
| 0.0.71.210 | TCP | |||
| 0.0.159.13 | TCP | |||
| 0.0.177.142 | TCP | |||
| 153.189.4.224 | JP | Ginowan | TCP | |
| 143.209.0.3 | US | Raleigh | TCP | |
| 223.193.141.142 | CN | Beijing | TCP | |
| 0.0.153.113 | TCP | |||
| 157.73.146.6 | JP | TCP | ||
| 161.38.99.31 | US | TCP | ||
| 0.0.65.235 | TCP | |||
| 18.216.208.150 | US | Cambridge | TCP | |
| 223.243.96.51 | CN | Hefei | TCP | |
| 0.0.215.94 | TCP | |||
| 168.47.68.241 | US | Austin | TCP | |
| 0.0.113.87 | TCP | |||
| 46.158.87.147 | RU | Novorossiysk | TCP | |
| 214.97.234.181 | US | TCP | ||
| 0.0.242.149 | TCP | |||
| 0.0.186.231 | TCP | |||
| c-98-192-165-239.hsd1.ca.comcast.net | 98.192.165.239 | US | Fresno | TCP |
| 0.0.211.32 | TCP | |||
| 0.0.15.230 | TCP | |||
| 0.0.92.168 | TCP | |||
| 0.0.196.61 | TCP | |||
| 0.0.34.74 | TCP | |||
| 0.0.215.11 | TCP | |||
| 0.0.26.171 | TCP | |||
| 151.252.161.69 | SE | TCP | ||
| 0.0.183.226 | TCP | |||
| 0.0.46.4 | TCP | |||
| 0.0.79.118 | TCP | |||
| 0.0.223.234 | TCP | |||
| 0.0.178.62 | TCP | |||
| 60.5.219.76 | CN | Hebei | TCP | |
| 99-60-107-245.lightspeed.wepbfl.sbcglobal.net | 99.60.107.245 | US | Stuart | TCP |
| 48.10.177.103 | US | Newark | TCP | |
| 0.0.160.85 | TCP | |||
| 0.0.34.226 | TCP | |||
| 210.161.79.30 | JP | TCP | ||
| 0.0.215.14 | TCP | |||
| 0.0.216.47 | TCP | |||
| 0.0.254.213 | TCP | |||
| 193.128.65.158 | GB | TCP | ||
| 0.0.143.56 | TCP | |||
| 116.46.244.112 | KR | Seoul | TCP | |
| 0.0.55.79 | TCP | |||
| 0.0.108.86 | TCP | |||
| 0.0.157.202 | TCP | |||
| 0.0.250.109 | TCP | |||
| 0.0.39.203 | TCP | |||
| 0.0.250.14 | TCP | |||
| 0.0.166.218 | TCP | |||
| 0.0.113.234 | TCP | |||
| 0.0.3.46 | TCP | |||
| 0.0.31.54 | TCP | |||
| 0.0.236.68 | TCP | |||
| 186.163.11.152 | PE | Lima | TCP | |
| 0.0.113.72 | TCP | |||
| 0.0.61.37 | TCP | |||
| 0.0.168.0 | TCP | |||
| 0.0.95.45 | TCP | |||
| 10.203.226.183 | TCP | |||
| r127177.ppp.asahi-net.or.jp | 210.167.127.177 | JP | Tokyo | TCP |
| 19.69.158.67 | US | Dearborn | TCP | |
| 0.0.199.208 | TCP | |||
| 0.0.154.50 | TCP | |||
| 0.0.224.156 | TCP | |||
| 172.122.251.200 | JP | Tokyo | TCP | |
| 116-65-110-66.rev.home.ne.jp | 116.65.110.66 | JP | Saitama | TCP |
| 198.194.35.208 | US | Richardson | TCP | |
| 125.71.108.162 | CN | Chengdu | TCP | |
| 0.0.231.71 | TCP | |||
| 0.0.236.174 | TCP | |||
| 167.66.155.179 | US | San Diego | TCP | |
| 23.135.93.159 | TCP | |||
| 190-179-137-234.speedy.com.ar | 190.179.137.234 | AR | Bermejo | TCP |
| 0.0.94.26 | TCP | |||
| 0.0.244.2 | TCP | |||
| 0.0.179.129 | TCP | |||
| host21415157.usmc.mil | 214.15.157.30 | US | TCP | |
| 120.130.197.243 | CN | Beijing | TCP | |
| 152.123.179.214 | US | Washington | TCP | |
| 0.0.222.180 | TCP | |||
| 0.0.68.116 | TCP | |||
| 111.199.232.80 | CN | Beijing | TCP | |
| 220.188.20.227 | CN | Jinhua | TCP | |
| 0.0.241.46 | TCP | |||
| 172.240.234.225 | US | Phoenix | TCP | |
| 0.0.15.46 | TCP | |||
| 180.212.8.142 | CN | Tianjin | TCP | |
| 0.0.147.164 | TCP | |||
| 168.91.27.11 | US | Indianapolis | TCP | |
| 196.109.25.229 | KE | TCP | ||
| 0.0.218.26 | TCP | |||
| 0.0.201.253 | TCP | |||
| 111.219.19.44 | KR | Seoul | TCP | |
| 0.0.125.118 | TCP | |||
| 37.250.205.87 | SE | TCP | ||
| 205.121.182.82 | US | Myton | TCP | |
| 0.0.5.252 | TCP | |||
| 0.0.41.90 | TCP | |||
| 0.0.73.74 | TCP | |||
| 0.0.62.38 | TCP | |||
| 0.0.7.137 | TCP | |||
| 109.5.254.149 | FR | Marckolsheim | TCP | |
| 162.119.80.89 | US | Walnut Creek | TCP | |
| 0.0.106.239 | TCP | |||
| 0.0.190.37 | TCP | |||
| 0.0.187.56 | TCP | |||
| 0.0.93.126 | TCP | |||
| 0.0.71.38 | TCP | |||
| 199.113.192.231 | US | TCP | ||
| 0.0.136.70 | TCP | |||
| 0.0.4.104 | TCP | |||
| 0.0.229.226 | TCP | |||
| host-92-19-121-23.as13285.net | 92.19.121.23 | GB | Glasgow | TCP |
| 14.169.115.94 | VN | Ho Chi Minh City | TCP | |
| 0.0.21.222 | TCP | |||
| 110.132.151.84 | JP | Tokyo | TCP | |
| 0.0.131.94 | TCP | |||
| a104-82-159-87.deploy.static.akamaitechnologies.com | 104.82.159.87 | NL | Amsterdam | TCP |
| 81.95.175.109 | GE | TCP | ||
| 0.0.188.195 | TCP | |||
| 0.0.96.174 | TCP | |||
| 0.0.35.218 | TCP | |||
| 0.0.164.225 | TCP | |||
| 0.0.231.115 | TCP | |||
| 12.66.207.120 | US | TCP | ||
| 0.0.37.48 | TCP | |||
| 0.0.233.152 | TCP | |||
| 0.0.19.187 | TCP | |||
| 0.0.59.40 | TCP | |||
| 0.0.165.138 | TCP | |||
| 0.0.102.133 | TCP | |||
| 0.0.35.235 | TCP | |||
| 0.0.221.45 | TCP | |||
| 88.197.212.1 | BE | TCP | ||
| 0.0.160.78 | TCP | |||
| 0.0.205.56 | TCP | |||
| 0.0.230.249 | TCP | |||
| 63.61.201.137 | US | TCP | ||
| 87-194-108-210.bethere.co.uk | 87.194.108.210 | GB | TCP | |
| 122.154.167.183 | TH | TCP | ||
| 0.0.52.198 | TCP | |||
| 0.0.253.174 | TCP | |||
| 0.0.57.219 | TCP | |||
| 185.64.58.176 | MT | TCP | ||
| 50.116.199.246 | US | Redwood City | TCP | |
| 0.0.78.20 | TCP | |||
| 0.0.105.49 | TCP | |||
| 78.214.45.45 | FR | Obernai | TCP | |
| 19.229.130.165 | US | Dearborn | TCP | |
| 0.0.4.106 | TCP | |||
| 136.166.251.64 | US | Palisades Park | TCP | |
| 99.211.134.56 | CA | TCP | ||
| 198.152.31.116 | US | Basking Ridge | TCP | |
| 0.0.250.136 | TCP | |||
| 211.67.27.153 | CN | Wuhan | TCP | |
| 7.190.22.27 | US | TCP | ||
| 0.0.58.10 | TCP | |||
| 0.0.49.168 | TCP | |||
| 110.116.117.228 | CN | Beijing | TCP | |
| 4.138.149.210 | US | TCP | ||
| 0.0.70.224 | TCP | |||
| 0.0.45.137 | TCP | |||
| 134.8.154.193 | US | Carlsbad | TCP | |
| 0.0.131.220 | TCP | |||
| 162.4.64.67 | TCP | |||
| 0.0.167.216 | TCP | |||
| 0544a355.skybroadband.com | 5.68.163.85 | GB | Antrim | TCP |
| 0.0.75.53 | TCP | |||
| 0.0.43.135 | TCP | |||
| adsl-98-90-111-38.mob.bellsouth.net | 98.90.111.38 | US | Fairhope | TCP |
| 67.219.65.184 | US | Washington | TCP | |
| 0.0.150.77 | TCP | |||
| 6.66.152.118 | US | Fort Huachuca | TCP | |
| 0.0.222.236 | TCP | |||
| 76-216-234-9.lightspeed.sndgca.sbcglobal.net | 76.216.234.9 | US | Oceanside | TCP |
| 6.186.92.93 | US | Fort Huachuca | TCP | |
| 0.0.100.75 | TCP | |||
| 0.0.132.182 | TCP | |||
| 0.0.196.102 | TCP | |||
| 0.0.165.192 | TCP | |||
| 0.0.185.31 | TCP | |||
| 0.0.0.146 | TCP | |||
| 79.125.8.213 | IE | Dublin | TCP | |
| 201.192.39.40 | CR | Escaz | TCP | |
| 0.0.137.26 | TCP | |||
| 0.0.80.253 | TCP | |||
| 0.0.5.9 | TCP | |||
| c-73-30-146-160.hsd1.pa.comcast.net | 73.30.146.160 | US | Philadelphia | TCP |
| 0.0.27.251 | TCP | |||
| 0.0.98.52 | TCP | |||
| 0.0.119.48 | TCP | |||
| 0.0.163.56 | TCP | |||
| 0.0.122.34 | TCP | |||
| 0.0.112.239 | TCP | |||
| 44.20.76.101 | US | San Diego | TCP | |
| 59.192.245.212 | CN | Beijing | TCP | |
| faravahar.redteam.net | 154.35.175.225 | US | TCP | |
| ip68-96-191-108.lv.lv.cox.net | 68.96.191.108 | US | Las Vegas | TCP |
| 0.0.237.47 | TCP | |||
| 0.0.124.90 | TCP | |||
| 56.213.126.38 | US | Raleigh | TCP | |
| 0.0.110.160 | TCP | |||
| 211.81.52.20 | CN | Tianjin | TCP | |
| 0.0.106.36 | TCP | |||
| 0.0.169.18 | TCP | |||
| 165.245.24.225 | US | New York | TCP | |
| 0.0.53.46 | TCP | |||
| 0.0.163.35 | TCP | |||
| 0.0.78.55 | TCP | |||
| 0.0.146.155 | TCP | |||
| 0.0.106.211 | TCP | |||
| 0.0.105.253 | TCP | |||
| 0.0.232.190 | TCP | |||
| 153.199.182.79 | JP | Hiroshima | TCP | |
| 0.0.193.118 | TCP | |||
| 0.0.210.192 | TCP | |||
| 0.0.39.101 | TCP | |||
| 0.0.78.31 | TCP | |||
| 0.0.118.230 | TCP | |||
| 0.0.82.97 | TCP | |||
| 0.0.27.27 | TCP | |||
| 0.0.101.38 | TCP | |||
| 223.175.153.115 | KR | Seoul | TCP | |
| 57.56.23.55 | BE | TCP | ||
| 5.27.218.69 | TR | Istanbul | TCP | |
| 0.0.138.20 | TCP | |||
| 0.0.53.123 | TCP | |||
| 0.0.198.37 | TCP | |||
| 147.172.162.102 | DE | Hildesheim | TCP | |
| 39.51.166.250 | PK | Rawalpindi | TCP | |
| 0.0.215.20 | TCP | |||
| 155.19.18.20 | US | Fort Huachuca | TCP | |
| 169.201.48.186 | TCP | |||
| 0.0.152.153 | TCP | |||
| 0.0.232.83 | TCP | |||
| 75-148-216-119-Houston.hfc.comcastbusiness.net | 75.148.216.119 | US | Houston | TCP |
| 67.137.131.186 | US | Lehi | TCP | |
| 4.221.227.132 | US | TCP | ||
| 15.188.229.208 | US | Palo Alto | TCP | |
| 210.113.224.192 | KR | TCP | ||
| 0.0.128.79 | TCP | |||
| 190.221.207.222 | AR | Buenos Aires | TCP | |
| 179.216.248.9 | BR | Araatuba | TCP | |
| 0.0.249.227 | TCP | |||
| 0.0.202.37 | TCP | |||
| 4.142.62.236 | US | TCP | ||
| 0.0.207.204 | TCP | |||
| 134.56.247.221 | US | Fremont | TCP | |
| adsl-065-012-181-144.sip.asm.bellsouth.net | 65.12.181.144 | US | Columbus | TCP |
| 0.0.39.254 | TCP | |||
| 0.0.180.223 | TCP | |||
| 16.113.173.223 | US | Palo Alto | TCP | |
| 0.0.211.138 | TCP | |||
| 182.96.148.186 | CN | Nanchang | TCP | |
| 38.74.164.91 | US | TCP | ||
| 0.0.37.194 | TCP | |||
| 0.0.237.76 | TCP | |||
| 42.211.172.202 | CN | Beijing | TCP | |
| c-73-97-224-90.hsd1.wa.comcast.net | 73.97.224.90 | US | Seattle | TCP |
| 0.0.103.228 | TCP | |||
| 0.0.146.245 | TCP | |||
| 0.0.120.29 | TCP | |||
| 0.0.186.36 | TCP | |||
| 0.0.76.70 | TCP | |||
| 0.0.68.234 | TCP | |||
| 0.0.55.171 | TCP | |||
| 156.7.212.28 | US | Los Angeles | TCP | |
| 124.145.243.219 | JP | TCP | ||
| 0.0.153.248 | TCP | |||
| 0.0.168.66 | TCP | |||
| 0.0.119.63 | TCP | |||
| 0.0.239.254 | TCP | |||
| 0.0.62.86 | TCP | |||
| 180.159.150.124 | CN | Shanghai | TCP | |
| 0.0.235.246 | TCP | |||
| 0.0.250.182 | TCP | |||
| 0.0.170.71 | TCP | |||
| 195.63.22.135 | DE | TCP | ||
| 43.18.227.136 | JP | Tokyo | TCP | |
| 0.0.250.15 | TCP | |||
| 59.45.80.149 | CN | TCP | ||
| 0.0.38.10 | TCP | |||
| 78.51.214.78 | DE | Berlin | TCP | |
| 129.41.188.130 | US | Durham | TCP | |
| 0.0.164.34 | TCP | |||
| 0.0.102.144 | TCP | |||
| 0.0.68.235 | TCP | |||
| 0.0.101.206 | TCP | |||
| 92.35.137.46 | SE | TCP | ||
| 0.0.34.110 | TCP | |||
| 0.0.196.148 | TCP | |||
| 0.0.5.208 | TCP | |||
| 0.0.183.18 | TCP | |||
| 0.0.119.111 | TCP | |||
| 0.0.221.211 | TCP | |||
| 0.0.173.10 | TCP | |||
| 158.172.84.181 | ES | Madrid | TCP | |
| 0.0.115.49 | TCP | |||
| 0.0.226.237 | TCP | |||
| 0.0.150.236 | TCP | |||
| 0.0.237.4 | TCP | |||
| 140.33.61.74 | US | TCP | ||
| 0.0.5.64 | TCP | |||
| 0.0.11.85 | TCP | |||
| 0.0.100.236 | TCP | |||
| 196.86.56.149 | MA | TCP | ||
| 28.36.110.183 | US | TCP | ||
| 47.133.14.239 | CA | Ottawa | TCP | |
| host-156.189.207.126.etisalat.com.eg | 156.189.207.126 | EG | TCP | |
| 0.0.225.170 | TCP | |||
| 125.169.198.94 | CN | Guangzhou | TCP | |
| rrcs-70-62-61-32.central.biz.rr.com | 70.62.61.32 | US | Farmington | TCP |
| 0.0.223.249 | TCP | |||
| 0.0.233.172 | TCP | |||
| 181.184.29.198 | VE | Caracas | TCP | |
| 41.70.30.96 | MW | Made | TCP | |
| 95.189.70.231 | RU | TCP | ||
| 0.0.9.109 | TCP | |||
| 99.192.204.62 | US | Franklin | TCP | |
| 35.54.82.80 | US | Ann Arbor | TCP | |
| 0.0.169.86 | TCP | |||
| 0.0.150.14 | TCP | |||
| p145154-omed01.tokyo.ocn.ne.jp | 153.147.80.154 | JP | TCP | |
| 3.123.234.138 | US | Fairfield | TCP | |
| D969700A.cm-25.dynamic.ziggo.nl | 217.105.112.10 | NL | TCP | |
| 0.0.168.196 | TCP | |||
| 0.0.204.35 | TCP | |||
| 0.0.234.18 | TCP | |||
| 0.0.132.175 | TCP | |||
| 201.31.67.23 | BR | TCP | ||
| 0.0.150.212 | TCP | |||
| 0.0.35.209 | TCP | |||
| 151.58.72.240 | IT | TCP | ||
| 140.13.206.107 | US | TCP | ||
| 2.185.204.204 | IR | TCP | ||
| 0.0.122.89 | TCP | |||
| 014136190038.ctinets.com | 14.136.190.38 | HK | Central District | TCP |
| 0.0.61.236 | TCP | |||
| 0.0.218.161 | TCP | |||
| 9.131.254.66 | US | Durham | TCP | |
| 223.2.168.173 | CN | Xuzhou | TCP | |
| 0.0.133.192 | TCP | |||
| 0.0.20.128 | TCP | |||
| 0.0.24.80 | TCP | |||
| 0.0.223.195 | TCP | |||
| host160.181-101-138.telecom.net.ar | 181.101.138.160 | AR | TCP | |
| 24.120.185.62 | US | Las Vegas | TCP | |
| 0.0.116.223 | TCP | |||
| 0.0.121.99 | TCP | |||
| 0.0.64.215 | TCP | |||
| 0.0.4.16 | TCP | |||
| 0.0.135.139 | TCP | |||
| 0.0.244.41 | TCP | |||
| 0.0.87.41 | TCP | |||
| 0.0.234.89 | TCP | |||
| 15.26.143.156 | US | Palo Alto | TCP | |
| 0.0.193.15 | TCP | |||
| 0.0.106.76 | TCP | |||
| 0.0.29.184 | TCP | |||
| 8.25.130.146 | US | TCP | ||
| 29.128.238.227 | US | TCP | ||
| 50.66.29.193 | CA | Calgary | TCP | |
| 0.0.177.20 | TCP | |||
| 0.0.3.228 | TCP | |||
| 65.232.176.16 | US | Ashburn | TCP | |
| 0.0.112.159 | TCP | |||
| 14-133-121-195.nagoya1.commufa.jp | 14.133.121.195 | JP | Gifu | TCP |
| 211.245.43.185 | KR | Anjung | TCP | |
| 0.0.147.216 | TCP | |||
| 0.0.248.18 | TCP | |||
| 0.0.150.36 | TCP | |||
| 0.0.12.180 | TCP | |||
| 0.0.209.147 | TCP | |||
| 0.0.104.18 | TCP | |||
| 0.0.80.238 | TCP | |||
| 0.0.19.168 | TCP | |||
| ip-2-202-194-197.web.vodafone.de | 2.202.194.197 | DE | TCP | |
| 0.0.78.248 | TCP | |||
| 0.0.86.201 | TCP | |||
| 0.0.205.145 | TCP | |||
| 0.0.196.134 | TCP | |||
| 0.0.82.172 | TCP | |||
| 0.0.187.225 | TCP | |||
| 0.0.96.64 | TCP | |||
| 0.0.177.49 | TCP | |||
| 0.0.23.30 | TCP | |||
| 212.88.161.251 | AT | TCP | ||
| wifi-auth-188107.inria.fr | 128.93.188.107 | FR | Le Chesnay | TCP |
| 112.227.222.149 | CN | Jinan | TCP | |
| 55.125.232.207 | US | Fort Huachuca | TCP | |
| 0.0.135.170 | TCP | |||
| 72.236.148.68 | US | Somerset | TCP | |
| 0.0.163.49 | TCP | |||
| 0.0.84.162 | TCP | |||
| 59.44.38.206 | CN | Shenyang | TCP | |
| 188x186x185x122.dynamic.tmn.ertelecom.ru | 188.186.185.122 | RU | Tyumen | TCP |
| 205.184.146.171 | US | TCP | ||
| 95.77.154.169 | RO | Bacau | TCP | |
| 53.25.32.137 | DE | TCP | ||
| 0.0.228.215 | TCP | |||
| 0.0.225.176 | TCP | |||
| 157.227.76.229 | IN | Mumbai | TCP | |
| 171.35.139.2 | CN | Nanchang | TCP | |
| 0.0.203.106 | TCP | |||
| 0.0.211.157 | TCP | |||
| 86.226.32.177 | FR | TCP | ||
| 137.53.153.150 | US | Portland | TCP | |
| 0.0.147.93 | TCP | |||
| 0.0.101.142 | TCP | |||
| 163.23.200.180 | TW | TCP | ||
| 0.0.153.225 | TCP | |||
| 153.139.126.101 | JP | TCP | ||
| 173.52.217.166 | US | Suffern | TCP | |
| 0.0.99.48 | TCP | |||
| 0.0.204.180 | TCP | |||
| 83.92.61.208 | DK | Nyborg | TCP | |
| 0.0.113.107 | TCP | |||
| 111.107.149.36 | JP | Tokyo | TCP | |
| 175.100.9.81 | KH | TCP | ||
| 0.0.99.111 | TCP | |||
| 0.0.163.145 | TCP | |||
| ADijon-654-1-268-21.w92-148.abo.wanadoo.fr | 92.148.11.21 | FR | TCP | |
| 79.sub-70-222-189.myvzw.com | 70.222.189.79 | US | TCP | |
| 0.0.85.133 | TCP | |||
| 0.0.204.19 | TCP | |||
| 0.0.244.228 | TCP | |||
| 38.121.93.75 | CA | Toronto | TCP | |
| 0.0.70.98 | TCP | |||
| 0.0.42.235 | TCP | |||
| 217.145.102.132 | DE | Bayreuth | TCP | |
| 0.0.145.229 | TCP | |||
| 0.0.81.248 | TCP | |||
| 80.72.200.10 | PL | TCP | ||
| 0.0.172.222 | TCP | |||
| 0.0.178.121 | TCP | |||
| 0.0.183.83 | TCP | |||
| 0.0.67.201 | TCP | |||
| 0.0.226.149 | TCP | |||
| 0.0.11.48 | TCP | |||
| 0.0.83.204 | TCP | |||
| 0.0.68.30 | TCP | |||
| 107.102.106.143 | US | TCP | ||
| 176.225.97.172 | SA | TCP | ||
| 205.18.161.61 | US | TCP | ||
| 0.0.180.188 | TCP | |||
| 0.0.245.89 | TCP | |||
| softbank221033113030.bbtec.net | 221.33.113.30 | JP | Yamagata | TCP |
| 0.0.135.130 | TCP | |||
| 0.0.100.241 | TCP | |||
| 0.0.249.42 | TCP | |||
| 0.0.100.87 | TCP | |||
| 223.26.176.143 | KR | TCP | ||
| 0.0.149.25 | TCP | |||
| 0.0.150.138 | TCP | |||
| 0.0.177.182 | TCP | |||
| 0.0.206.238 | TCP | |||
| 0.0.207.132 | TCP | |||
| 0.0.73.134 | TCP | |||
| 0.0.156.55 | TCP | |||
| 0.0.88.208 | TCP | |||
| 0.0.243.245 | TCP | |||
| 0.0.21.23 | TCP | |||
| 51.194.31.7 | GB | TCP | ||
| 0.0.161.171 | TCP | |||
| 0.0.196.87 | TCP | |||
| 0.0.201.207 | TCP | |||
| 0.0.122.186 | TCP | |||
| 0.0.124.237 | TCP | |||
| 0.0.86.244 | TCP | |||
| 157.190.82.57 | IE | Cork | TCP | |
| 37.10.38.195 | NL | TCP | ||
| 29.208.171.77 | US | TCP | ||
| 16.247.161.104 | US | Palo Alto | TCP | |
| 0.0.235.164 | TCP | |||
| 184-213-147-226.pools.spcsdns.net | 184.213.147.226 | US | TCP | |
| 0.0.104.52 | TCP | |||
| 0.0.159.97 | TCP | |||
| 162.115.253.203 | US | TCP | ||
| 30.119.45.191 | US | TCP | ||
| 0.0.253.149 | TCP | |||
| 0.0.93.69 | TCP | |||
| 200.22.164.8 | CL | Santiago | TCP | |
| ec2-54-169-176-254.ap-southeast-1.compute.amazonaws.com | 54.169.176.254 | SG | Singapore | TCP |
| 145.42.80.247 | NL | Terneuzen | TCP | |
| ZK122132.ppp.dion.ne.jp | 222.5.122.132 | JP | Towada | TCP |
| 83.222.170.134 | BG | TCP | ||
| 0.0.177.195 | TCP | |||
| 0.0.194.148 | TCP | |||
| liblow1.music.utoronto.ca | 128.100.212.175 | CA | Toronto | TCP |
| 0.0.227.8 | TCP | |||
| 0.0.102.31 | TCP | |||
| 31.236.188.238 | DE | TCP | ||
| 0.0.5.178 | TCP | |||
| 0.0.23.204 | TCP | |||
| 137.52.65.185 | US | Fort Lauderdale | TCP | |
| 0.0.76.151 | TCP | |||
| 123.130.150.153 | CN | Jinan | TCP | |
| 0.0.201.181 | TCP | |||
| 0.0.155.128 | TCP | |||
| ai126174071061.26.access-internet.ne.jp | 126.174.71.61 | JP | TCP | |
| 144.179.17.197 | NO | Lysaker | TCP | |
| 104-10-87-162.lightspeed.austtx.sbcglobal.net | 104.10.87.162 | US | TCP | |
| 69.71.1.25 | US | Nixa | TCP | |
| 0.0.210.63 | TCP | |||
| 209.110.156.100 | US | TCP | ||
| 46.131.113.135 | EE | Tallinn | TCP | |
| 0.0.188.141 | TCP | |||
| 0.0.68.189 | TCP | |||
| 0.0.70.191 | TCP | |||
| 217.173.201.112 | PL | Opole | TCP | |
| 0.0.56.169 | TCP | |||
| 0.0.216.226 | TCP | |||
| 157.26.69.189 | CH | Saint-imier | TCP | |
| 0.0.27.16 | TCP | |||
| 0.0.237.63 | TCP | |||
| 0.0.100.201 | TCP | |||
| 73.43.141.249 | US | Woodstock | TCP | |
| 0.0.80.30 | TCP | |||
| 20.103.222.222 | US | Falls Church | TCP | |
| 0.0.243.188 | TCP | |||
| dialup-4.138.17.109.Dial1.Atlanta1.Level3.net | 4.138.17.109 | US | TCP | |
| c-76-114-81-178.hsd1.tn.comcast.net | 76.114.81.178 | US | Knoxville | TCP |
| 0.0.197.253 | TCP | |||
| 0.0.155.44 | TCP | |||
| 0.0.169.207 | TCP | |||
| 0.0.244.208 | TCP | |||
| 0.0.153.107 | TCP | |||
| 0.0.41.6 | TCP | |||
| 0.0.162.107 | TCP | |||
| 0.0.3.252 | TCP | |||
| 1.239.133.123 | KR | Seoul | TCP | |
| 141.37.151.107 | DE | Bad Drrheim | TCP | |
| 0.0.130.117 | TCP | |||
| 0.0.48.169 | TCP | |||
| 0.0.50.201 | TCP | |||
| 0.0.246.199 | TCP | |||
| 0.0.59.245 | TCP | |||
| 0.0.135.226 | TCP | |||
| host-82-201-238-94.static.link.com.eg | 82.201.238.94 | EG | Cairo | TCP |
| 0.0.204.36 | TCP | |||
| 0.0.170.211 | TCP | |||
| 0.0.212.126 | TCP | |||
| 0.0.96.141 | TCP | |||
| 0.0.111.115 | TCP | |||
| 0.0.227.31 | TCP | |||
| 0.0.115.121 | TCP | |||
| 0.0.189.240 | TCP | |||
| 132.86.73.235 | US | Fort Huachuca | TCP | |
| 0.0.165.19 | TCP | |||
| 0.0.232.77 | TCP | |||
| 0.0.181.206 | TCP | |||
| 0.0.254.103 | TCP | |||
| 0.0.93.27 | TCP | |||
| 0.0.71.69 | TCP | |||
| 129.162.134.126 | US | San Antonio | TCP | |
| 0.0.97.195 | TCP | |||
| 146.187.70.187 | US | Cheney | TCP | |
| 134.156.254.111 | US | Duluth | TCP | |
| LCayenne-656-1-2-13.w81-248.abo.wanadoo.fr | 81.248.37.13 | GF | Cayenne | TCP |
| 0.0.114.110 | TCP | |||
| 0.0.2.64 | TCP | |||
| 119.142.19.23 | CN | Guangzhou | TCP | |
| 218.147.29.155 | KR | TCP | ||
| 116.138.27.197 | CN | Chaoyang | TCP | |
| 0.0.137.176 | TCP | |||
| 0.0.220.80 | TCP | |||
| 171.144.250.117 | US | Concord | TCP | |
| p549200C8.dip0.t-ipconnect.de | 84.146.0.200 | DE | TCP | |
| 0.0.49.221 | TCP | |||
| 0.0.251.83 | TCP | |||
| 218.160.153.93 | TW | TCP | ||
| 145.37.146.169 | NL | Groningen | TCP | |
| 124.71.225.250 | CN | TCP | ||
| 55.121.196.17 | US | Fort Huachuca | TCP | |
| 0.0.236.28 | TCP | |||
| 0.0.116.37 | TCP | |||
| 115.150.240.89 | CN | Nanchang | TCP | |
| 0.0.161.5 | TCP | |||
| 0.0.108.194 | TCP | |||
| 11.178.134.136 | US | TCP | ||
| 160.74.114.114 | JP | TCP | ||
| abts-tn-dynamic-215.158.78.171.airtelbroadband.in | 171.78.158.215 | IN | Bangalore | TCP |
| 0.0.9.74 | TCP | |||
| 36.95.74.68 | ID | TCP | ||
| 0.0.250.100 | TCP | |||
| 0.0.51.92 | TCP | |||
| 25.151.179.227 | GB | TCP | ||
| 77.154.115.210 | FR | TCP | ||
| 0.0.94.58 | TCP | |||
| 0.0.185.162 | TCP | |||
| 117.198.212.166 | IN | Sonepat | TCP | |
| 200-204-28-235.dial-up.telesp.net.br | 200.204.28.235 | BR | TCP | |
| 0.0.245.218 | TCP | |||
| 0.0.205.227 | TCP | |||
| 0.0.122.254 | TCP | |||
| 0.0.206.171 | TCP | |||
| 154.21.55.54 | US | TCP | ||
| 0.0.126.120 | TCP | |||
| 0.0.87.133 | TCP | |||
| 78.31.213.97 | IE | Galway | TCP | |
| 0.0.141.212 | TCP | |||
| 0.0.9.64 | TCP | |||
| 112.60.87.116.starhub.net.sg | 116.87.60.112 | SG | Singapore | TCP |
| 33.229.175.161 | US | TCP | ||
| 0.0.188.168 | TCP | |||
| 112.47.72.247 | CN | TCP | ||
| 0.0.57.13 | TCP | |||
| 0.0.191.175 | TCP | |||
| 0.0.48.239 | TCP | |||
| 0.0.179.20 | TCP | |||
| 122.186.178.125 | IN | Delhi | TCP | |
| 0.0.44.171 | TCP | |||
| 0.0.153.187 | TCP | |||
| 0.0.61.90 | TCP | |||
| 0.0.154.162 | TCP | |||
| 0.0.230.13 | TCP | |||
| 150.99.204.233 | JP | Tokyo | TCP | |
| 162.37.109.8 | US | Columbus | TCP | |
| 0.0.188.166 | TCP | |||
| 0.0.84.9 | TCP | |||
| 0.0.47.227 | TCP | |||
| 44.236.29.250 | US | San Diego | TCP | |
| 0.0.82.13 | TCP | |||
| 0.0.61.155 | TCP | |||
| 0.0.139.0 | TCP | |||
| 0.0.4.6 | TCP | |||
| 0.0.84.211 | TCP | |||
| 0.0.249.171 | TCP | |||
| 0.0.122.140 | TCP | |||
| 0.0.126.185 | TCP | |||
| 0.0.125.250 | TCP | |||
| 0.0.92.67 | TCP | |||
| 96.217.239.33 | US | TCP | ||
| 0.0.124.79 | TCP | |||
| 0.0.175.161 | TCP | |||
| 0.0.29.119 | TCP | |||
| 0.0.38.239 | TCP | |||
| 0.0.151.60 | TCP | |||
| 2.193.168.141 | IT | TCP | ||
| 0.0.159.226 | TCP | |||
| 0.0.131.152 | TCP | |||
| 211.15.54.163 | JP | TCP | ||
| 34.250.151.177.isp.timbrasil.com.br | 177.151.250.34 | BR | TCP | |
| 199.152.206.242.4k.usda.gov | 199.152.206.242 | US | Fort Collins | TCP |
| 0.0.248.247 | TCP | |||
| 160.127.91.229 | US | Virginia Beach | TCP | |
| 110.202.228.128 | CN | Beijing | TCP | |
| 132.56.167.69 | US | Montgomery | TCP | |
| 167.17.132.114 | CA | Mississauga | TCP | |
| 0.0.246.53 | TCP | |||
| 0.0.142.168 | TCP | |||
| 112.150.251.241 | KR | Seoul | TCP | |
| 0.0.131.120 | TCP | |||
| 0.0.20.2 | TCP | |||
| 118.41.131.184 | KR | Daegu | TCP | |
| 38.149.136.157 | US | TCP | ||
| 159.110.88.128 | US | Charlotte | TCP | |
| cpe-76-167-118-31.san.res.rr.com | 76.167.118.31 | US | San Diego | TCP |
| 111.253.192.193 | TW | TCP | ||
| 0.0.246.35 | TCP | |||
| 0.0.43.254 | TCP | |||
| 217.45.121.23 | GB | TCP | ||
| 0.0.76.125 | TCP | |||
| 0.0.61.120 | TCP | |||
| 0.0.209.86 | TCP | |||
| 156.42.34.56 | US | Phoenix | TCP | |
| 0.0.128.217 | TCP | |||
| 215.194.93.137 | US | TCP | ||
| 17.176.109.86 | US | Cupertino | TCP | |
| 0.0.189.47 | TCP | |||
| 0.0.247.249 | TCP | |||
| 46.56.31.230 | BY | TCP | ||
| 58.87.76.239 | CN | Shenzhen | TCP | |
| 15.249.223.195 | US | Palo Alto | TCP | |
| 79.143.72.150 | RU | Moscow | TCP | |
| 0.0.200.245 | TCP | |||
| 0.0.121.191 | TCP | |||
| 0.0.23.38 | TCP | |||
| 69.190.189.92 | US | New York | TCP | |
| 0.0.136.60 | TCP | |||
| 0.0.198.146 | TCP | |||
| 165.134.158.12 | US | Saint Louis | TCP | |
| 0.0.78.34 | TCP | |||
| 0.0.42.160 | TCP | |||
| 0.0.226.109 | TCP | |||
| 31.115.89.167 | GB | Andover | TCP | |
| 0.0.251.214 | TCP | |||
| 203.230.11.215 | KR | TCP | ||
| 0.0.174.196 | TCP | |||
| 102.17.27.234 | TCP | |||
| 22.144.93.153 | US | TCP | ||
| 0.0.23.151 | TCP | |||
| 0.0.105.91 | TCP | |||
| 0.0.161.57 | TCP | |||
| 0.0.103.53 | TCP | |||
| 0.0.122.4 | TCP | |||
| 0.0.22.27 | TCP | |||
| 0.0.174.15 | TCP | |||
| 0.0.186.219 | TCP | |||
| 134.190.3.158 | CA | Halifax | TCP | |
| 0.0.156.112 | TCP | |||
| mo27-229-198-217.air.mopera.net | 27.229.198.217 | JP | Tokyo | TCP |
| 0.0.55.110 | TCP | |||
| 0.0.237.227 | TCP | |||
| 0.0.248.102 | TCP | |||
| 0.0.91.253 | TCP | |||
| 0.0.44.96 | TCP | |||
| 0.0.115.137 | TCP | |||
| 0.0.87.218 | TCP | |||
| 0.0.157.121 | TCP | |||
| 0.0.102.44 | TCP | |||
| 0.0.201.43 | TCP | |||
| 0.0.144.143 | TCP | |||
| 81.89.158.70 | SE | TCP | ||
| 177.151.128.100 | BR | TCP | ||
| 0.0.75.146 | TCP | |||
| 0.0.162.40 | TCP | |||
| 0.0.60.220 | TCP | |||
| 0.0.234.218 | TCP | |||
| 0.0.224.209 | TCP | |||
| 0.0.69.189 | TCP | |||
| 0.0.249.143 | TCP | |||
| 0.0.40.124 | TCP | |||
| 0.0.152.119 | TCP | |||
| 158.182.118.172 | HK | Central District | TCP | |
| 0.0.225.44 | TCP | |||
| 145.127.172.212 | NL | Leeuwarden | TCP | |
| 121.21.221.89 | CN | Hebei | TCP | |
| 54.83.9.131 | US | Ashburn | TCP | |
| 0.0.66.42 | TCP | |||
| 0.0.244.20 | TCP | |||
| 134.43.178.166 | US | White Plains | TCP | |
| 203.185.9.5 | HK | Central District | TCP | |
| 181.223.218.20 | BR | Recife | TCP | |
| 180.64.43.137 | KR | TCP | ||
| 108.228.155.185 | US | Streetsboro | TCP | |
| 0.0.181.229 | TCP | |||
| 0.0.12.25 | TCP | |||
| 156.231.160.139 | ZA | Johannesburg | TCP | |
| 0.0.29.94 | TCP | |||
| 0.0.99.55 | TCP | |||
| 33.122.210.253 | US | TCP | ||
| 53.71.240.160 | DE | TCP | ||
| 187.184.147.119 | MX | Tijuana | TCP | |
| 0.0.250.241 | TCP | |||
| 0.0.111.150 | TCP | |||
| 27.221.87.240 | CN | Jinan | TCP | |
| 0.0.208.102 | TCP | |||
| 0.0.74.4 | TCP | |||
| 29.65.200.26 | US | TCP | ||
| 0.0.172.191 | TCP | |||
| 126.153.238.214 | JP | TCP | ||
| 0.0.189.56 | TCP | |||
| 0.0.21.171 | TCP | |||
| 4.102.170.29 | US | TCP | ||
| 150.74.133.186 | JP | TCP | ||
| 0.0.130.132 | TCP | |||
| 174.53.36.118 | US | Little Rock | TCP | |
| 140.40.236.63 | US | TCP | ||
| 9.119.26.37 | US | Durham | TCP | |
| 209.201.199.184 | US | Stamford | TCP | |
| 0.0.55.136 | TCP | |||
| 0.0.241.109 | TCP | |||
| 0.0.139.100 | TCP | |||
| 0.0.1.38 | TCP | |||
| softbank219208008017.bbtec.net | 219.208.8.17 | JP | TCP | |
| 0.0.50.243 | TCP | |||
| 0.0.135.227 | TCP | |||
| hosted.by.cirn.net | 66.197.47.245 | US | Ashburn | TCP |
| 0.0.64.117 | TCP | |||
| 0.0.155.133 | TCP | |||
| d50-98-8-33.bchsia.telus.net | 50.98.8.33 | CA | New Westminster | TCP |
| 216.109.214.172 | US | Austin | TCP | |
| 0.0.98.24 | TCP | |||
| 155.107.17.44 | US | Fort Lauderdale | TCP | |
| 0.0.235.108 | TCP | |||
| 0.0.114.166 | TCP | |||
| 0.0.247.28 | TCP | |||
| 0.0.122.39 | TCP | |||
| 199.8.223.29 | US | Beech Grove | TCP | |
| 0.0.33.14 | TCP | |||
| 0.0.195.110 | TCP | |||
| 0.0.123.225 | TCP | |||
| 0.0.134.91 | TCP | |||
| 0.0.200.186 | TCP | |||
| 84.251.188.88 | FI | Jyvskyl | TCP | |
| 0.0.196.130 | TCP | |||
| 0.0.162.45 | TCP | |||
| 0.0.244.31 | TCP | |||
| 0.0.55.192 | TCP | |||
| 0.0.189.237 | TCP | |||
| 0.0.196.0 | TCP | |||
| 0.0.67.199 | TCP | |||
| 15.208.207.106 | US | Palo Alto | TCP | |
| 0.0.241.240 | TCP | |||
| 0.0.228.88 | TCP | |||
| 0.0.159.93 | TCP | |||
| 0.0.166.206 | TCP | |||
| 0.0.75.76 | TCP | |||
| 0.0.210.167 | TCP | |||
| 58.200.156.202 | CN | Beijing | TCP | |
| 0.0.237.146 | TCP | |||
| 0.0.201.220 | TCP | |||
| 162-209-193-89.rdns.cloudradium.com | 162.209.193.89 | US | Cheyenne | TCP |
| 0.0.60.42 | TCP | |||
| 0.0.34.139 | TCP | |||
| 0.0.111.167 | TCP | |||
| 0.0.168.92 | TCP | |||
| 0.0.199.233 | TCP | |||
| 0.0.36.254 | TCP | |||
| 0.0.38.210 | TCP | |||
| 178-220-117-105.dynamic.isp.telekom.rs | 178.220.117.105 | RS | TCP | |
| ip-2-203-208-145.web.vodafone.de | 2.203.208.145 | DE | TCP | |
| 0.0.24.159 | TCP | |||
| 52.117.29.77 | US | Dallas | TCP | |
| 107.163.117.140 | US | Forest Hills | TCP | |
| 20.18.254.139 | US | Falls Church | TCP | |
| 7.109.172.224 | US | TCP | ||
| 0.0.131.103 | TCP | |||
| 0.0.136.191 | TCP | |||
| 51.241.120.221 | GB | TCP | ||
| 0.0.224.142 | TCP | |||
| 97.91.16.199 | US | Grand Rapids | TCP | |
| 0.0.179.1 | TCP | |||
| 0.0.27.26 | TCP | |||
| 29.62.222.198 | US | TCP | ||
| pool-108-46-248-106.nycmny.fios.verizon.net | 108.46.248.106 | US | Mineola | TCP |
| 0.0.184.4 | TCP | |||
| 22.225.7.46 | US | TCP | ||
| 159.182.46.56 | US | Iowa City | TCP | |
| 0.0.151.28 | TCP | |||
| 0.0.81.55 | TCP | |||
| 21.179.182.154 | US | TCP | ||
| 0.0.166.137 | TCP | |||
| 0.0.93.131 | TCP | |||
| 92.181.171.77 | FR | TCP | ||
| 0.0.39.97 | TCP | |||
| 0.0.144.120 | TCP | |||
| 160.211.85.216 | DE | Duisburg | TCP | |
| 0.0.98.150 | TCP | |||
| 218.174.204.96 | TW | TCP | ||
| 0.0.199.169 | TCP | |||
| 48.120.42.136 | US | Newark | TCP | |
| 93.95.158.228 | RU | TCP | ||
| 159.165.83.23 | US | Atlanta | TCP | |
| 118.119.170.235 | CN | Chengdu | TCP | |
| 0.0.221.100 | TCP | |||
| 0.0.240.249 | TCP | |||
| 0.0.229.236 | TCP | |||
| 51.114.196.190 | GB | TCP | ||
| 217.238.213.219 | DE | TCP | ||
| 151.84.24.240 | IT | Senago | TCP | |
| 0.0.111.82 | TCP | |||
| 0.0.183.231 | TCP | |||
| 53.81.184.63 | DE | TCP | ||
| 0.0.174.160 | TCP | |||
| 0.0.2.144 | TCP | |||
| 0.0.212.157 | TCP | |||
| 207.88.124.126.ptr.us.xo.net | 207.88.124.126 | US | Post Falls | TCP |
| 0.0.21.117 | TCP | |||
| 151.74.232.241 | IT | Catania | TCP | |
| 217.127.31.197 | ES | Almendralejo | TCP | |
| 0.0.174.93 | TCP | |||
| 0.0.172.161 | TCP | |||
| 0.0.183.104 | TCP | |||
| 210.204.88.128 | KR | TCP | ||
| 0.0.253.79 | TCP | |||
| 0.0.220.237 | TCP | |||
| 0.0.234.56 | TCP | |||
| 0.0.123.229 | TCP | |||
| 0.0.84.157 | TCP | |||
| 0.0.59.240 | TCP | |||
| 0.0.48.14 | TCP | |||
| 0.0.125.54 | TCP | |||
| 0.0.190.248 | TCP | |||
| 0.0.173.24 | TCP | |||
| 0.0.192.153 | TCP | |||
| 0.0.133.229 | TCP | |||
| 0.0.28.181 | TCP | |||
| 0.0.197.49 | TCP | |||
| 0.0.99.25 | TCP | |||
| 0.0.117.180 | TCP | |||
| 160.217.51.35 | CZ | Ceske Budejovice | TCP | |
| 10-151-31-181.fibertel.com.ar | 181.31.151.10 | AR | Cordoba | TCP |
| 80.40.139.43 | GB | Rotherhithe | TCP | |
| 0.0.195.113 | TCP | |||
| 0.0.34.240 | TCP | |||
| 0.0.131.8 | TCP | |||
| 0.0.221.126 | TCP | |||
| 152.74.180.61 | CL | Concepcion | TCP | |
| 0.0.99.231 | TCP | |||
| 0.0.54.122 | TCP | |||
| 0.0.176.209 | TCP | |||
| panix-l.netaxs.net | 207.8.210.125 | US | TCP | |
| 134.120.35.118 | US | San Diego | TCP | |
| 175.88.142.169 | CN | Beijing | TCP | |
| 210.11.45.183 | AU | Bangor | TCP | |
| 112.97.13.179 | CN | Guangzhou | TCP | |
| 111.117.221.134 | CN | Changchun | TCP | |
| 0.0.113.95 | TCP | |||
| 0.0.194.45 | TCP | |||
| weballiancecss2.rbc.com | 142.245.103.97 | CA | Toronto | TCP |
| 0.0.7.64 | TCP | |||
| 128.214.250.163 | FI | TCP | ||
| 0.0.145.87 | TCP | |||
| 0.0.190.28 | TCP | |||
| 0.0.108.227 | TCP | |||
| 76.214.247.95 | US | TCP | ||
| 156.63.5.50 | US | Columbus | TCP | |
| 0.0.63.215 | TCP | |||
| 0.0.150.234 | TCP | |||
| 139.107.87.53 | NO | TCP | ||
| 107.94.218.234 | US | TCP | ||
| 0.0.73.121 | TCP | |||
| 125.87.10.201 | CN | Chongqing | TCP | |
| 6.92.244.182 | US | Fort Huachuca | TCP | |
| 0.0.209.246 | TCP | |||
| 0.0.84.93 | TCP | |||
| 0.0.185.220 | TCP | |||
| 110.183.71.75 | CN | Xian | TCP | |
| 0.0.42.69 | TCP | |||
| 0.0.7.215 | TCP | |||
| 115.161.210.150 | KR | Seoul | TCP | |
| 0.0.219.60 | TCP | |||
| 0.0.112.190 | TCP | |||
| 91.111.11.218 | GB | TCP | ||
| 148.110.234.63 | LU | Luxemburg | TCP | |
| 191.251.179.238 | BR | So Paulo | TCP | |
| 22.127.221.175 | US | TCP | ||
| 33.171.125.237 | US | TCP | ||
| 134.94.78.44 | DE | Jlich | TCP | |
| 0.0.238.223 | TCP | |||
| 0.0.238.33 | TCP | |||
| 0.0.204.234 | TCP | |||
| 19.238.34.107 | US | Dearborn | TCP | |
| 0.0.15.95 | TCP | |||
| 32.78.95.251 | US | TCP | ||
| 0.0.164.141 | TCP | |||
| 0.0.24.46 | TCP | |||
| 0.0.229.90 | TCP | |||
| 0.0.231.165 | TCP | |||
| 143.49.42.42 | US | San Francisco | TCP | |
| 0.0.155.86 | TCP | |||
| 202.174.184.141 | NZ | TCP | ||
| 0.0.207.103 | TCP | |||
| 0.0.246.55 | TCP | |||
| 0.0.82.59 | TCP | |||
| 0.0.134.20 | TCP | |||
| 0.0.34.208 | TCP | |||
| 0.0.50.221 | TCP | |||
| 0.0.168.11 | TCP | |||
| 202.120-180-91.adsl-dyn.isp.belgacom.be | 91.180.120.202 | BE | Brussels | TCP |
| 0.0.43.229 | TCP | |||
| 0.0.228.246 | TCP | |||
| 0.0.34.199 | TCP | |||
| 0.0.241.50 | TCP | |||
| 0.0.165.221 | TCP | |||
| 0.0.5.68 | TCP | |||
| 0.0.139.111 | TCP | |||
| 0.0.150.197 | TCP | |||
| 0.0.157.251 | TCP | |||
| 0.0.12.204 | TCP | |||
| 0.0.132.114 | TCP | |||
| 0.0.71.57 | TCP | |||
| 0.0.121.163 | TCP | |||
| 0.0.58.204 | TCP | |||
| 0.0.145.93 | TCP | |||
| 191.237.168.125 | US | Boydton | TCP | |
| 173-252-204-151.genericreverse.com | 173.252.204.151 | US | Santa Clara | TCP |
| 0.0.216.132 | TCP | |||
| 4.48.13.216 | US | TCP | ||
| 0.0.236.154 | TCP | |||
| 0.0.234.30 | TCP | |||
| 0.0.224.233 | TCP | |||
| 0.0.219.73 | TCP | |||
| 195.106.23.234 | GB | TCP | ||
| 0.0.203.11 | TCP | |||
| 0.0.97.142 | TCP | |||
| 75-143-187-165.dhcp.gnvl.sc.charter.com | 75.143.187.165 | US | Connellys Springs | TCP |
| 0.0.6.82 | TCP | |||
| 71.187.broadband17.iol.cz | 109.80.187.71 | CZ | Lazne Bohdanec | TCP |
| 68-112-123-19.dhcp.stcd.mn.charter.com | 68.112.123.19 | US | Fond Du Lac | TCP |
| 204.247.12.91 | US | Concord | TCP | |
| adsl-99-148-13-65.dsl.pltn13.sbcglobal.net | 99.148.13.65 | US | TCP | |
| 0.0.23.229 | TCP | |||
| 0.0.90.103 | TCP | |||
| vc-gp-n-105-241-234-215.umts.vodacom.co.za | 105.241.234.215 | ZA | TCP | |
| 147.186.208.3 | SE | Kiruna | TCP | |
| 0.0.250.37 | TCP | |||
| 0.0.2.26 | TCP | |||
| 10.91.193.15 | TCP | |||
| 0.0.119.169 | TCP | |||
| 0.0.134.83 | TCP | |||
| 0.0.84.125 | TCP | |||
| 123.134.77.116 | CN | Jinan | TCP | |
| ec2-54-217-11-97.eu-west-1.compute.amazonaws.com | 54.217.11.97 | IE | Dublin | TCP |
| 0.0.134.0 | TCP | |||
| 174-155-174-86.pools.spcsdns.net | 174.155.174.86 | US | TCP | |
| 0.0.230.62 | TCP | |||
| 134.241.138.101 | US | Shrewsbury | TCP | |
| 79.70.61.244 | GB | Godalming | TCP | |
| 0.0.88.81 | TCP | |||
| 0.0.67.33 | TCP | |||
| 220.121.118.59 | KR | Incheon | TCP | |
| 0.0.112.83 | TCP | |||
| 0.0.225.174 | TCP | |||
| 200.191.80.145 | BR | TCP | ||
| 163.254.48.37 | US | Sunnyvale | TCP | |
| 198.125.33.117 | US | Berkeley | TCP | |
| 0.0.109.182 | TCP | |||
| 0.0.108.248 | TCP | |||
| 106.141.161.136 | JP | TCP | ||
| a2-16-222-210.deploy.akamaitechnologies.com | 2.16.222.210 | GR | TCP | |
| 0.0.179.151 | TCP | |||
| 0.0.225.185 | TCP | |||
| 56.105.22.80 | US | Raleigh | TCP | |
| 10.109.200.161 | TCP | |||
| 122.55.19.216.pldt.net | 122.55.19.216 | PH | Davao City | TCP |
| 0.0.110.210 | TCP | |||
| 0.0.109.1 | TCP | |||
| 0.0.213.194 | TCP | |||
| 0.0.35.132 | TCP | |||
| 178.233.158.139 | TR | Ankara | TCP | |
| 0.0.73.181 | TCP | |||
| 0.0.251.3 | TCP | |||
| 0.0.235.70 | TCP | |||
| 141.115.92.244 | FR | Toulouse | TCP | |
| 0.0.35.67 | TCP | |||
| 61.78.218.20 | KR | TCP | ||
| 213.94.223.175 | IE | Dublin | TCP | |
| 0.0.51.223 | TCP | |||
| 0.0.243.191 | TCP | |||
| 0.0.185.18 | TCP | |||
| 0.0.130.217 | TCP | |||
| 0.0.26.67 | TCP | |||
| 0.0.113.131 | TCP | |||
| 0.0.137.20 | TCP | |||
| 0.0.54.230 | TCP | |||
| adsl-074-171-191-056.sip.pns.bellsouth.net | 74.171.191.56 | US | Jay | TCP |
| 0.0.194.233 | TCP | |||
| 0.0.163.213 | TCP | |||
| 0.0.139.162 | TCP | |||
| 0.0.249.68 | TCP | |||
| 0.0.40.107 | TCP | |||
| 0.0.178.19 | TCP | |||
| 0.0.133.181 | TCP | |||
| 0.0.227.179 | TCP | |||
| 0.0.189.40 | TCP | |||
| 0.0.96.178 | TCP | |||
| 0.0.247.32 | TCP | |||
| 0.0.245.120 | TCP | |||
| 0.0.111.20 | TCP | |||
| 0.0.236.13 | TCP | |||
| 186.161.211.8 | PE | Lima | TCP | |
| 94-143-215-160.bitbrains.net | 94.143.215.160 | NL | TCP | |
| 0.0.221.34 | TCP | |||
| 1.29.107.101 | CN | Baotou | TCP | |
| 0.0.160.26 | TCP | |||
| 0.0.252.168 | TCP | |||
| 0.0.127.25 | TCP | |||
| c-50-135-231-179.hsd1.wa.comcast.net | 50.135.231.179 | US | Bellevue | TCP |
| 0.0.101.106 | TCP | |||
| 0.0.33.143 | TCP | |||
| 0.0.166.173 | TCP | |||
| ai126250006106.11.tss.access-internet.ne.jp | 126.250.6.106 | JP | Chofu | TCP |
| 63.171.200.122 | US | TCP | ||
| 0.0.68.190 | TCP | |||
| host-41.234.162.227.tedata.net | 41.234.162.227 | EG | Alexandria | TCP |
| 142.132.95.124 | CA | Winnipeg | TCP | |
| 23.161.231.4 | US | TCP | ||
| 113.249.35.53 | CN | Chongqing | TCP | |
| 0.0.117.253 | TCP | |||
| 38.71.82.107 | US | TCP | ||
| 0.0.188.149 | TCP | |||
| 143.248.213.19 | KR | Daejeon | TCP | |
| 0.0.210.214 | TCP | |||
| 0.0.7.227 | TCP | |||
| 0544e2c2.skybroadband.com | 5.68.226.194 | GB | Nottingham | TCP |
| 0.0.53.93 | TCP | |||
| 52.194.199.253 | US | Seattle | TCP | |
| 0.0.203.57 | TCP | |||
| 0.0.184.14 | TCP | |||
| 0.0.84.207 | TCP | |||
| 18.200.174.93 | US | Cambridge | TCP | |
| 0.0.123.152 | TCP | |||
| 113.3.66.151 | CN | Harbin | TCP | |
| 33.110.153.130 | US | TCP | ||
| 0.0.252.227 | TCP | |||
| 0.0.183.150 | TCP | |||
| 6.75.151.191 | US | Fort Huachuca | TCP | |
| 0.0.167.65 | TCP | |||
| 0.0.229.79 | TCP | |||
| 52.83.2.37 | CN | Beijing | TCP | |
| client-201.240.7.1.speedy.net.pe | 201.240.7.1 | PE | TCP | |
| 161.63.220.222 | US | Seal Beach | TCP | |
| 0.0.158.218 | TCP | |||
| 0.0.5.84 | TCP | |||
| rrcs-74-219-13-95.midsouth.biz.rr.com | 74.219.13.95 | US | Charlotte | TCP |
| 190.dhcp.apogeetelecom.com | 64.189.67.190 | US | Odessa | TCP |
| 221.105.115.78.rev.sfr.net | 78.115.105.221 | FR | Colombes | TCP |
| 0.0.129.48 | TCP | |||
| 102.202.33.134 | TCP | |||
| 112.15.188.78 | CN | Ningbo | TCP | |
| host-197.52.97.54.tedata.net | 197.52.97.54 | EG | Port Said | TCP |
| 0.0.228.196 | TCP | |||
| 0.0.154.88 | TCP | |||
| 0.0.176.142 | TCP | |||
| 41.17.197.109 | ZA | Bedfordview | TCP | |
| 0.0.85.95 | TCP | |||
| 0.0.239.88 | TCP | |||
| 0.0.10.9 | TCP | |||
| 0.0.192.34 | TCP | |||
| 0.0.181.204 | TCP | |||
| 0.0.125.217 | TCP | |||
| 48.167.154.36 | US | Newark | TCP | |
| 0.0.74.78 | TCP | |||
| 63.59.152.169 | US | TCP | ||
| x5d80b11c.dyn.telefonica.de | 93.128.177.28 | DE | Eisenach | TCP |
| 0.0.28.96 | TCP | |||
| 0.0.118.86 | TCP | |||
| 0.0.78.155 | TCP | |||
| 0.0.183.43 | TCP | |||
| 0.0.137.160 | TCP | |||
| 0.0.61.148 | TCP | |||
| 0.0.184.105 | TCP | |||
| 0.0.238.45 | TCP | |||
| softbank219044238062.bbtec.net | 219.44.238.62 | JP | TCP | |
| 0.0.194.81 | TCP | |||
| 0.0.10.175 | TCP | |||
| 0.0.143.173 | TCP | |||
| 0.0.200.195 | TCP | |||
| 0.0.90.109 | TCP | |||
| 0.0.162.222 | TCP | |||
| 0.0.50.54 | TCP | |||
| 0.0.87.235 | TCP | |||
| 0.0.249.254 | TCP | |||
| 0.0.169.155 | TCP | |||
| 0.0.224.141 | TCP | |||
| 0.0.62.39 | TCP | |||
| 0.0.160.3 | TCP | |||
| 94.48.51.108 | SA | Jeddah | TCP | |
| 179-148-89-166.user.vivozap.com.br | 179.148.89.166 | BR | TCP | |
| 0.0.9.193 | TCP | |||
| 0.0.243.14 | TCP | |||
| 0.0.223.197 | TCP | |||
| 0.0.43.35 | TCP | |||
| 0.0.233.220 | TCP | |||
| 128.232.88.117 | GB | Cambridge | TCP | |
| 0.0.17.107 | TCP | |||
| 157.15.13.232 | TCP | |||
| 0.0.10.115 | TCP | |||
| 0.0.159.85 | TCP | |||
| 0.0.175.218 | TCP | |||
| fac34-h05-62-34-114-206.dsl.sta.abo.bbox.fr | 62.34.114.206 | FR | Montpellier | TCP |
| lia.counterthwart.com | 104.206.240.136 | US | Henderson | TCP |
| 0.0.67.3 | TCP | |||
| static-173-56-191-178.nycmny.fios.verizon.net | 173.56.191.178 | US | Bayonne | TCP |
| 104-7-145-223.lightspeed.irvnca.sbcglobal.net | 104.7.145.223 | US | Riverside | TCP |
| 0.0.113.134 | TCP | |||
| 86.43.3.40 | IE | TCP | ||
| 0.0.196.53 | TCP | |||
| 8.110.79.170 | US | TCP | ||
| 17.212.89.165 | US | Cupertino | TCP | |
| 0.0.197.30 | TCP | |||
| 23-121-10-110.lightspeed.jcsnms.sbcglobal.net | 23.121.10.110 | US | Starkville | TCP |
| 119.4.88.197 | CN | Chengdu | TCP | |
| 0.0.249.238 | TCP | |||
| 0.0.24.252 | TCP | |||
| 0.0.57.169 | TCP | |||
| 0.0.109.97 | TCP | |||
| 147.23.23.204 | US | Waltham | TCP | |
| 0.0.17.74 | TCP | |||
| 0.0.94.87 | TCP | |||
| 0.0.89.13 | TCP | |||
| l5-131-173-122.cn.ru | 5.131.173.122 | RU | TCP | |
| v4-86137cca.pool.vitroconnect.de | 134.19.124.202 | DE | Bochum | TCP |
| 0.0.113.77 | TCP | |||
| 156.62.134.88 | NZ | Auckland | TCP | |
| 0.0.153.28 | TCP | |||
| host217-41-1-241.in-addr.btopenworld.com | 217.41.1.241 | GB | TCP | |
| c-174-55-95-121.hsd1.pa.comcast.net | 174.55.95.121 | US | Avis | TCP |
| 2.166.246.187 | DE | TCP | ||
| 0.0.111.45 | TCP | |||
| 0.0.73.163 | TCP | |||
| 31.118.43.233 | GB | Nuneaton | TCP | |
| 0.0.86.64 | TCP | |||
| 166.127.170.215 | US | Houston | TCP | |
| Wimax-Cgena-190-70-52-9.orbitel.net.co | 190.70.52.9 | CO | Manizales | TCP |
| 0.0.92.141 | TCP | |||
| 13.32.235.126 | US | Norwalk | TCP | |
| 150.6.13.120 | JP | TCP | ||
| 0.0.57.220 | TCP | |||
| 222.200.216.216.transedge.com | 216.216.200.222 | US | TCP | |
| 0.0.171.193 | TCP | |||
| 0.0.10.70 | TCP | |||
| 0.0.115.119 | TCP | |||
| 124.232.143.221 | CN | Changsha | TCP | |
| 0.0.175.120 | TCP | |||
| 0.0.151.90 | TCP | |||
| 0.0.91.12 | TCP | |||
| 0.0.204.134 | TCP | |||
| 0.0.164.68 | TCP | |||
| 143.143.195.33 | US | Montgomery | TCP | |
| 0.0.27.128 | TCP | |||
| 171.72.24.153 | US | San Francisco | TCP | |
| 27.184.221.68 | CN | Hebei | TCP | |
| 0.0.101.13 | TCP | |||
| 0.0.34.118 | TCP | |||
| 0.0.158.126 | TCP | |||
| 0.0.19.1 | TCP | |||
| 0.0.29.55 | TCP | |||
| 0.0.27.89 | TCP | |||
| 0.0.71.158 | TCP | |||
| 0.0.13.74 | TCP | |||
| 40.211.91.28 | US | TCP | ||
| 0.0.108.79 | TCP | |||
| 0.0.40.8 | TCP | |||
| 0.0.225.163 | TCP | |||
| 0.0.180.240 | TCP | |||
| 0.0.36.164 | TCP | |||
| 0.0.123.215 | TCP | |||
| 0.0.174.51 | TCP | |||
| 0.0.162.226 | TCP | |||
| 0.0.27.2 | TCP | |||
| 0.0.181.119 | TCP | |||
| 0.0.6.253 | TCP | |||
| 0.0.126.145 | TCP | |||
| 0.0.26.185 | TCP | |||
| 130.218.166.220.broad.cd.sc.dynamic.163data.com.cn | 220.166.218.130 | CN | Chengdu | TCP |
| 160.63.56.88 | CH | Zurich | TCP | |
| 0.0.186.179 | TCP | |||
| 0.0.83.50 | TCP | |||
| 0.0.155.37 | TCP | |||
| 0.0.253.15 | TCP | |||
| 0.0.87.202 | TCP | |||
| 65.228.252.38 | US | Ashburn | TCP | |
| 101.78.205.254 | HK | Kwun Tong | TCP | |
| 0.0.186.161 | TCP | |||
| 0.0.192.240 | TCP | |||
| 0.0.140.134 | TCP | |||
| 41.109.141.93 | DZ | Hadjout | TCP | |
| 0.0.107.137 | TCP | |||
| 162.189.67.227 | US | TCP | ||
| 122-118-28-217.dynamic-ip.hinet.net | 122.118.28.217 | TW | TCP | |
| 10.97.158.125 | TCP | |||
| 0.0.220.140 | TCP | |||
| 49.11.215.148 | KR | Seoul | TCP | |
| 0.0.102.26 | TCP | |||
| 125.166.245.16 | ID | Semarang | TCP | |
| 61.184.106.215 | CN | Wuhan | TCP | |
| p40050-omed01.osaka.ocn.ne.jp | 153.140.51.50 | JP | Yao | TCP |
| 0.0.188.212 | TCP | |||
| 0.0.158.220 | TCP | |||
| walmart.com | 156.88.138.33 | US | Bentonville | TCP |
| 0.0.155.213 | TCP | |||
| 0.0.77.68 | TCP | |||
| 143.164.114.29 | DE | Ingolstadt | TCP | |
| 0.0.16.86 | TCP | |||
| 0.0.78.162 | TCP | |||
| 0.0.118.6 | TCP | |||
| 190.182.84.0 | CO | Barranquilla | TCP | |
| 0.0.112.254 | TCP | |||
| 0.0.22.204 | TCP | |||
| 114.118.13.75 | CN | Beijing | TCP | |
| 202.142.200.60.sta-ip.isp-thailand.com | 202.142.200.60 | TH | TCP | |
| 167.183.134.20 | US | Atlanta | TCP | |
| 0.0.134.15 | TCP | |||
| 120.3.74.228 | CN | Hebei | TCP | |
| 183.204.21.199 | CN | Henan | TCP | |
| 96.147.4.50 | US | TCP | ||
| 0.0.26.112 | TCP | |||
| 100.126.28.5 | TCP | |||
| 0.0.215.149 | TCP | |||
| 0.0.93.46 | TCP | |||
| 174.191.153.232 | US | TCP | ||
| 119.216.119.246 | KR | TCP | ||
| mobile-107-230-146-77.mycingular.net | 107.230.146.77 | US | TCP | |
| 0.0.20.200 | TCP | |||
| 0.0.175.203 | TCP | |||
| 150.184.52.212 | US | Fort Huachuca | TCP | |
| 0.0.6.178 | TCP | |||
| mobile-107-224-243-236.mycingular.net | 107.224.243.236 | US | TCP | |
| 0.0.23.212 | TCP | |||
| customer-QRO-131-63.megared.net.mx | 177.242.131.63 | MX | Quertaro | TCP |
| 0.0.2.47 | TCP | |||
| 0.0.155.210 | TCP | |||
| 0.0.41.153 | TCP | |||
| 0.0.189.69 | TCP | |||
| 0.0.86.4 | TCP | |||
| 0.0.177.191 | TCP | |||
| 110.34.83.94 | KR | Seoul | TCP | |
| 0.0.183.63 | TCP | |||
| remote.gpallc.net | 75.146.253.138 | US | King Of Prussia | TCP |
| 205.138.65.54 | US | Chesterfield | TCP | |
| 0.0.44.58 | TCP | |||
| 0.0.73.96 | TCP | |||
| 0.0.12.32 | TCP | |||
| 0.0.225.53 | TCP | |||
| 0.0.76.169 | TCP | |||
| 0.0.240.75 | TCP | |||
| 0.0.253.128 | TCP | |||
| 0.0.85.182 | TCP | |||
| 92.79.108.63 | DE | TCP | ||
| 0.0.221.24 | TCP | |||
| 0.0.36.154 | TCP | |||
| 0.0.229.74 | TCP | |||
| 0.0.52.90 | TCP | |||
| 0.0.106.128 | TCP | |||
| 0.0.247.158 | TCP | |||
| 0.0.86.160 | TCP | |||
| 0.0.240.15 | TCP | |||
| 0.0.248.187 | TCP | |||
| 0.0.28.61 | TCP | |||
| 0.0.151.97 | TCP | |||
| 0.0.137.238 | TCP | |||
| 0.0.145.211 | TCP | |||
| 0.0.199.132 | TCP | |||
| 0.0.62.242 | TCP | |||
| 0.0.193.47 | TCP | |||
| 0.0.123.221 | TCP | |||
| 0.0.246.207 | TCP | |||
| 0.0.188.132 | TCP | |||
| 47.100.86.68 | CN | Hangzhou | TCP | |
| 24-179-88-36.dhcp.jcsn.tn.charter.com | 24.179.88.36 | US | Lebanon | TCP |
| 87.233.253.38 | NL | TCP | ||
| 209-188-71-61-host.drtel.net | 209.188.71.61 | US | Oakes | TCP |
| 0.0.247.100 | TCP | |||
| 0.0.242.61 | TCP | |||
| 0.0.172.122 | TCP | |||
| 55.85.163.174 | US | Fort Huachuca | TCP | |
| nttkyo496107.tkyo.nt.ftth.ppp.infoweb.ne.jp | 124.25.226.107 | JP | Tokyo | TCP |
| 0.0.151.87 | TCP | |||
| 75-51-145-127.lightspeed.sntcca.sbcglobal.net | 75.51.145.127 | US | San Jose | TCP |
| 112.193.140.138 | CN | Chengdu | TCP | |
| 65.99.136.6 | US | Kennebunk | TCP | |
| 0.0.74.51 | TCP | |||
| customer-201-154-64-248.uninet.net.mx | 201.154.64.248 | MX | TCP | |
| 0.0.245.19 | TCP | |||
| 219.127.36.189 | JP | Osaka | TCP | |
| 0.0.70.222 | TCP | |||
| 0.0.16.159 | TCP | |||
| 149.79-160-95.customer.lyse.net | 79.160.95.149 | NO | Tysvr | TCP |
| 0.0.123.184 | TCP | |||
| 33.38.139.65 | US | TCP | ||
| 0.0.116.80 | TCP | |||
| 0.0.21.253 | TCP | |||
| 0.0.240.222 | TCP | |||
| 119.27.48.178 | JP | TCP | ||
| 0.0.72.166 | TCP | |||
| 0.0.195.251 | TCP | |||
| 162.96.21.77 | US | Minneapolis | TCP | |
| 65-130-168-91.slkc.qwest.net | 65.130.168.91 | US | TCP | |
| 0.0.89.249 | TCP | |||
| 69-172-146-204.cable.teksavvy.com | 69.172.146.204 | CA | Vancouver | TCP |
| 0.0.59.63 | TCP | |||
| 16.245.94.43 | US | Palo Alto | TCP | |
| 151.127.97.181 | FR | TCP | ||
| 111.18.217.218 | CN | TCP | ||
| 139.84.27.245 | US | Philadelphia | TCP | |
| 0.0.185.107 | TCP | |||
| 26.114.40.64 | US | TCP | ||
| 0.0.250.55 | TCP | |||
| 0.0.11.71 | TCP | |||
| 192.187.95.27 | US | Burbank | TCP | |
| 204.245.240.129 | US | Englewood | TCP | |
| 0.0.228.126 | TCP | |||
| 28.73.af0d.ip4.static.sl-reverse.com | 13.175.115.40 | US | TCP | |
| 32.24.32.118 | US | TCP | ||
| 0.0.10.174 | TCP | |||
| ec2-52-49-137-187.eu-west-1.compute.amazonaws.com | 52.49.137.187 | IE | Dublin | TCP |
| 0.0.154.66 | TCP | |||
| 0.0.171.34 | TCP | |||
| 0.0.8.238 | TCP | |||
| 0.0.237.65 | TCP | |||
| 93.248.202.244 | DE | TCP | ||
| 0.0.29.60 | TCP | |||
| 0.0.148.249 | TCP | |||
| 0.0.81.171 | TCP | |||
| 0.0.33.229 | TCP | |||
| p578450B8.dip0.t-ipconnect.de | 87.132.80.184 | DE | TCP | |
| 0.0.147.69 | TCP | |||
| 60.168.109.91 | CN | Hefei | TCP | |
| 128.37.89.24 | US | Fort Huachuca | TCP | |
| 0.0.202.40 | TCP | |||
| 0.0.210.128 | TCP | |||
| 0.0.189.110 | TCP | |||
| 0.0.122.106 | TCP | |||
| 0.0.231.187 | TCP | |||
| 106.208.157.197 | IN | Trivandrum | TCP | |
| 0.0.62.42 | TCP | |||
| 0.0.171.87 | TCP | |||
| 0.0.113.18 | TCP | |||
| 0.0.179.212 | TCP | |||
| 0.0.7.143 | TCP | |||
| 0.0.123.124 | TCP | |||
| 0.0.3.204 | TCP | |||
| 0.0.146.35 | TCP | |||
| 0.0.88.222 | TCP | |||
| 0.0.88.176 | TCP | |||
| 0.0.223.140 | TCP | |||
| 0.0.194.171 | TCP | |||
| 0.0.93.71 | TCP | |||
| 0.0.68.148 | TCP | |||
| 0.0.127.66 | TCP | |||
| 218-166-90-63.dynamic-ip.hinet.net | 218.166.90.63 | TW | TCP | |
| 210.39.244.162 | CN | Zengcheng | TCP | |
| 0.0.39.181 | TCP | |||
| 0.0.79.14 | TCP | |||
| 0.0.69.205 | TCP | |||
| 0.0.190.54 | TCP | |||
| 0.0.102.48 | TCP | |||
| 46-198-70-103.adsl.cyta.gr | 46.198.70.103 | GR | Nepoli | TCP |
| 0.49.44.108 | TCP | |||
| 0.0.252.179 | TCP | |||
| 0.0.61.18 | TCP | |||
| 0.0.191.22 | TCP | |||
| 211.11.24.19 | JP | Koshigaya | TCP | |
| 0.0.112.66 | TCP | |||
| a23-222-105-24.deploy.static.akamaitechnologies.com | 23.222.105.24 | US | Cambridge | TCP |
| p5909073-ipngn27501marunouchi.tokyo.ocn.ne.jp | 114.159.11.73 | JP | Chiba | TCP |
| 216.139.169.252 | US | Ellenwood | TCP | |
| 0.0.113.75 | TCP | |||
| 0.0.76.102 | TCP | |||
| 146.78.83.119 | US | Wilberforce | TCP | |
| business-213-023-181-030.static.arcor-ip.net | 213.23.181.30 | DE | TCP | |
| CPE-121-217-6-219.lnse1.cht.bigpond.net.au | 121.217.6.219 | AU | Hornsby | TCP |
| 0.0.109.35 | TCP | |||
| 0.0.123.219 | TCP | |||
| 0.0.207.100 | TCP | |||
| 211.211.23.184 | KR | Seoul | TCP | |
| 0.0.3.239 | TCP | |||
| host-197.54.66.68.tedata.net | 197.54.66.68 | EG | TCP | |
| 0.0.250.42 | TCP | |||
| 0.0.170.27 | TCP | |||
| 0.0.147.227 | TCP | |||
| 0.0.27.122 | TCP | |||
| 62.133.202.105 | NL | TCP | ||
| 114.208.56.11 | CN | Beijing | TCP | |
| 77-56-217-235.dclient.hispeed.ch | 77.56.217.235 | CH | Hagendorf | TCP |
| 0.0.76.53 | TCP | |||
| adsl-75-43-244-62.dsl.lsan03.sbcglobal.net | 75.43.244.62 | US | TCP | |
| 0.0.72.209 | TCP | |||
| vc-gp-s-41-26-199-194.umts.vodacom.co.za | 41.26.199.194 | ZA | Johannesburg | TCP |
| 45.192.80.215 | ZA | Johannesburg | TCP | |
| 61.254.200.75 | KR | Suwon | TCP | |
| 0.0.6.74 | TCP | |||
| 0.0.41.252 | TCP | |||
| 174.2.75.98 | CA | Saskatoon | TCP | |
| 0.0.60.223 | TCP | |||
| abs-static-86.201.251.27.aircel.co.in | 27.251.201.86 | IN | TCP | |
| 1.226.50.153 | KR | TCP | ||
| 98.60.179.48 | US | TCP | ||
| 0.0.89.160 | TCP | |||
| ACayenne-107-1-6-15.w80-12.abo.wanadoo.fr | 80.12.136.15 | GF | TCP | |
| 0.0.99.68 | TCP | |||
| 0.0.201.155 | TCP | |||
| 0.0.241.119 | TCP | |||
| 108.112.241.122 | US | TCP | ||
| 0.0.116.176 | TCP | |||
| 0.0.175.164 | TCP | |||
| 0.0.131.3 | TCP | |||
| pw126225134009.4.panda-world.ne.jp | 126.225.134.9 | JP | Tokyo | TCP |
| 0.0.170.184 | TCP | |||
| 0.0.241.194 | TCP | |||
| 0.0.3.30 | TCP | |||
| 0.0.236.167 | TCP | |||
| 190-93-118-104.rev.greendottt.net | 190.93.118.104 | TT | Arima | TCP |
| 183.224.16.230 | CN | Kunming | TCP | |
| 0.0.114.250 | TCP | |||
| 129.228.166.215 | US | Chicago | TCP | |
| 0.0.83.66 | TCP | |||
| 0.0.6.48 | TCP | |||
| 0.0.110.197 | TCP | |||
| 0.0.174.192 | TCP | |||
| 0.0.124.48 | TCP | |||
| 0.0.137.90 | TCP | |||
| 0.0.64.198 | TCP | |||
| 0.0.124.144 | TCP | |||
| 0.0.187.38 | TCP | |||
| 154.248.235.24 | DZ | TCP | ||
| 0.0.27.117 | TCP | |||
| 0.0.13.212 | TCP | |||
| 0.0.46.35 | TCP | |||
| 0.0.172.16 | TCP | |||
| 0.0.12.33 | TCP | |||
| 0.0.44.77 | TCP | |||
| 0.0.91.35 | TCP | |||
| 0.0.175.78 | TCP | |||
| 0.0.111.99 | TCP | |||
| 0.0.169.196 | TCP | |||
| 0.0.206.15 | TCP | |||
| 0.0.151.143 | TCP | |||
| 0.0.150.86 | TCP | |||
| 0.0.87.213 | TCP | |||
| bl28-16-116.dsl.telepac.pt | 37.189.16.116 | PT | Valongo | TCP |
| 218.38.169.192 | KR | Seoul | TCP | |
| 102.39.77.93 | TCP | |||
| 0.0.46.152 | TCP | |||
| 0.0.162.215 | TCP | |||
| 0.0.234.71 | TCP | |||
| 0.0.136.194 | TCP | |||
| 0.0.27.36 | TCP | |||
| 203.149.154.4 | SG | Singapore | TCP | |
| 0.0.229.56 | TCP | |||
| 0.0.196.23 | TCP | |||
| 8.78.10.103 | US | TCP | ||
| 148.238.236.190 | MX | Monterrey | TCP | |
| 0.0.239.170 | TCP | |||
| 55.251.177.21 | US | Fort Huachuca | TCP | |
| 0.0.201.206 | TCP | |||
| 104-177-76-47.lightspeed.irvnca.sbcglobal.net | 104.177.76.47 | US | Los Angeles | TCP |
| 0.0.216.189 | TCP | |||
| 128.89.231.169 | US | Cambridge | TCP | |
| 0.0.10.18 | TCP | |||
| 0.0.165.12 | TCP | |||
| 184-217-121-38.pools.spcsdns.net | 184.217.121.38 | US | TCP | |
| 190.62.190.25 | SV | San Salvador | TCP | |
| 158.139.92.142 | US | Bartlesville | TCP | |
| 0.0.65.117 | TCP | |||
| 0.0.233.57 | TCP | |||
| 56.184.105.143 | US | Raleigh | TCP | |
| 0.0.149.253 | TCP | |||
| 0.0.140.186 | TCP | |||
| 0.0.204.9 | TCP | |||
| 131.125.238.169 | US | Union | TCP | |
| 0.0.130.165 | TCP | |||
| 0.0.195.222 | TCP | |||
| 48.6.197.40 | US | Newark | TCP | |
| cpe-72-178-166-83.rgv.res.rr.com | 72.178.166.83 | US | Mcallen | TCP |
| 0.0.147.136 | TCP | |||
| softbank126046117057.bbtec.net | 126.46.117.57 | JP | Matsumoto | TCP |
| 0.0.45.222 | TCP | |||
| 134.1.47.76 | DE | Bremerhaven | TCP | |
| p54BD11F0.dip0.t-ipconnect.de | 84.189.17.240 | DE | Berlin | TCP |
| 20.139.24.211 | US | Falls Church | TCP | |
| 0.0.149.124 | TCP | |||
| 141.121.192.98 | US | Santa Rosa | TCP | |
| 0.0.240.52 | TCP | |||
| 0.0.93.163 | TCP | |||
| dsl-189-142-240-222-dyn.prod-infinitum.com.mx | 189.142.240.222 | MX | Mexico | TCP |
| 0.0.202.3 | TCP | |||
| 213.222.21.33 | NL | Amsterdam | TCP | |
| 219.148.174.145 | CN | Baotou | TCP | |
| 211.116.118.41 | KR | Jeonju | TCP | |
| 0.0.23.75 | TCP | |||
| 0.0.82.46 | TCP | |||
| 73.93.49.176 | US | Vallejo | TCP | |
| 0.0.239.16 | TCP | |||
| 126.126.101.213 | JP | Tokyo | TCP | |
| 0.0.99.84 | TCP | |||
| 0.0.209.29 | TCP | |||
| 0.0.140.228 | TCP | |||
| 0.0.30.129 | TCP | |||
| 146.76.233.237 | US | Olympia | TCP | |
| 0.0.16.103 | TCP | |||
| 0.0.113.217 | TCP | |||
| 36.141.115.41 | CN | TCP | ||
| 216-15-78-31.c3-0.drf-ubr1.atw-drf.pa.cable.rcn.com | 216.15.78.31 | US | Northampton | TCP |
| 0.0.241.218 | TCP | |||
| 0.0.241.137 | TCP | |||
| 0.0.196.218 | TCP | |||
| 14.170.112.222 | VN | Hanoi | TCP | |
| 0.0.86.198 | TCP | |||
| 0.0.13.28 | TCP | |||
| 0.0.91.81 | TCP | |||
| 0.0.35.16 | TCP | |||
| 22.164.24.141 | US | TCP | ||
| 0.0.61.234 | TCP | |||
| 0.0.138.175 | TCP | |||
| 0.0.30.146 | TCP | |||
| 0.0.250.20 | TCP | |||
| 0.0.197.167 | TCP | |||
| 0.0.63.144 | TCP | |||
| 0.0.147.209 | TCP | |||
| 0.0.59.126 | TCP | |||
| 0.0.159.182 | TCP | |||
| 0.0.174.109 | TCP | |||
| 0.0.41.96 | TCP | |||
| 0.0.98.9 | TCP | |||
| 0.0.170.209 | TCP | |||
| 0.0.192.151 | TCP | |||
| 0.0.196.187 | TCP | |||
| non-routed-un-exposed-IP.36.146.in-addr.arpa | 146.36.119.59 | US | San Ramon | TCP |
| b-internet.90.189.180.160.snt.ru | 90.189.180.160 | RU | Novosibirsk | TCP |
| 0.0.239.191 | TCP | |||
| 0.0.29.35 | TCP | |||
| 0.0.171.215 | TCP | |||
| 0.0.45.170 | TCP | |||
| 0.0.234.7 | TCP | |||
| BSN-250-1-21.static.siol.net | 213.250.1.21 | SI | Ljubljana | TCP |
| h-67-100-89-158.snfc.ca.globalcapacity.com | 67.100.89.158 | US | Santa Rosa | TCP |
| 0.0.226.36 | TCP | |||
| 0.0.140.154 | TCP | |||
| 0.0.176.107 | TCP | |||
| 122.247.236.40 | CN | Ningbo | TCP | |
| 0.0.162.21 | TCP | |||
| 136.221.121.0 | US | Fort Huachuca | TCP | |
| 4.80.226.61 | US | TCP | ||
| 169.86.110.120 | US | New York | TCP | |
| 0.0.134.125 | TCP | |||
| 43.103.34.144 | JP | Tokyo | TCP | |
| 0.0.56.133 | TCP | |||
| 75.97.160.247.res-cmts.mnh.ptd.net | 75.97.160.247 | US | Long Pond | TCP |
| 115.7.131.77 | KR | TCP | ||
| 1.243.56.38 | KR | Seoul | TCP | |
| 0.0.244.222 | TCP | |||
| 0.0.158.167 | TCP | |||
| 0.0.16.205 | TCP | |||
| 0.0.5.92 | TCP | |||
| 0.0.28.9 | TCP | |||
| 0.0.126.191 | TCP | |||
| 211.47.117.59 | KR | Seoul | TCP | |
| 0.0.152.42 | TCP | |||
| 35.178.238.48 | US | Seattle | TCP | |
| 195.57.211.228 | ES | TCP | ||
| dsl-189-237-42-119-dyn.prod-infinitum.com.mx | 189.237.42.119 | MX | Tampico | TCP |
| 0.0.5.30 | TCP | |||
| 22.57.80.101 | US | TCP | ||
| m77-218-66-127.cust.tele2.se | 77.218.66.127 | SE | TCP | |
| 162.246.81.188 | US | TCP | ||
| 0.0.136.203 | TCP | |||
| 0.0.149.8 | TCP | |||
| 0.0.23.214 | TCP | |||
| 0.0.126.157 | TCP | |||
| cpc89158-stok18-2-0-cust297.1-4.cable.virginm.net | 86.25.1.42 | GB | Stoke-on-trent | TCP |
| 0.0.138.149 | TCP | |||
| 0.0.63.91 | TCP | |||
| 0.0.52.244 | TCP | |||
| 105.183.44.121 | EG | TCP | ||
| 0.0.38.70 | TCP | |||
| 0.0.222.81 | TCP | |||
| 90.248.178.198 | GB | TCP | ||
| 0.0.75.25 | TCP | |||
| 0.0.163.90 | TCP | |||
| nwokolo.customer.eplus.net | 72.4.32.113 | US | Jackson | TCP |
| 177.158.49.206.dynamic.adsl.gvt.net.br | 177.158.49.206 | BR | Vitria | TCP |
| 0.0.0.103 | TCP | |||
| 157.146.143.7 | US | Purchase | TCP | |
| 0.0.51.37 | TCP | |||
| 123.154.164.136 | CN | Hangzhou | TCP | |
| 0.0.45.53 | TCP | |||
| 55.15.115.190 | US | Fort Huachuca | TCP | |
| 0.0.231.225 | TCP | |||
| cpe-174-108-105-74.carolina.res.rr.com | 174.108.105.74 | US | Charlotte | TCP |
| 0.0.150.168 | TCP | |||
| 0.0.128.237 | TCP | |||
| 14.143.136.89.static-vsnl.net.in | 14.143.136.89 | IN | TCP | |
| 0.0.34.158 | TCP | |||
| 194.140.253.108 | GB | TCP | ||
| 192.170.150.230 | US | New York | TCP | |
| 12.244.183.223 | US | Middletown | TCP | |
| 0.0.47.115 | TCP | |||
| 0.0.151.210 | TCP | |||
| 0.0.166.2 | TCP | |||
| 0.0.240.188 | TCP | |||
| 38.251.67.83 | US | TCP | ||
| 0.0.154.83 | TCP | |||
| 0.0.244.170 | TCP | |||
| 17.158.52.224 | US | Cupertino | TCP | |
| 65.228.121.244 | US | Ashburn | TCP | |
| 0.0.109.199 | TCP | |||
| 146.241.31.156 | US | Dallas | TCP | |
| 0.0.161.52 | TCP | |||
| 0.0.87.51 | TCP | |||
| 0.0.3.150 | TCP | |||
| 8.44.14.49 | US | TCP | ||
| 0.0.60.162 | TCP | |||
| 31.213.23.117 | DE | TCP | ||
| 0.0.110.69 | TCP | |||
| 0.0.135.162 | TCP | |||
| 0.0.58.163 | TCP | |||
| 0.0.203.86 | TCP | |||
| 0.0.95.148 | TCP | |||
| 0.0.155.222 | TCP | |||
| 0.0.31.70 | TCP | |||
| 0.0.157.47 | TCP | |||
| 0.0.63.45 | TCP | |||
| 95.170.2.198 | FR | TCP | ||
| 106.45.182.233 | CN | Yinchuan | TCP | |
| 0.0.106.233 | TCP | |||
| 0.0.200.72 | TCP | |||
| 0.0.142.245 | TCP | |||
| 0.0.192.92 | TCP | |||
| 0.0.4.49 | TCP | |||
| 0.0.101.41 | TCP | |||
| 50.95.64.221 | US | TCP | ||
| 0.0.80.39 | TCP | |||
| 0.0.40.88 | TCP | |||
| 0.0.161.45 | TCP | |||
| 0.0.219.245 | TCP | |||
| 0.0.5.223 | TCP | |||
| 0.0.97.31 | TCP | |||
| 0.0.42.32 | TCP | |||
| 0.0.71.159 | TCP | |||
| 0.0.180.33 | TCP | |||
| 214.205.224.42 | US | TCP | ||
| net-2-35-246-67.cust.vodafonedsl.it | 2.35.246.67 | IT | Aci Castello | TCP |
| 0.0.188.174 | TCP | |||
| 148.188.37.52 | US | Ridgefield | TCP | |
| 7.3.77.251 | US | TCP | ||
| 0.0.159.251 | TCP | |||
| 112.186.247.134 | KR | Cheongju | TCP | |
| 197.142.118.223 | DZ | TCP | ||
| 26.106.65.120 | US | TCP | ||
| 0.0.142.75 | TCP | |||
| 0.0.11.58 | TCP | |||
| 79.sub-97-57-46.myvzw.com | 97.57.46.79 | US | TCP | |
| 0.0.174.108 | TCP | |||
| 0.0.132.11 | TCP | |||
| 0.0.37.130 | TCP | |||
| 0.0.71.179 | TCP | |||
| 0.0.250.119 | TCP | |||
| 0.0.180.90 | TCP | |||
| 162-150-57-12-static.hfc.comcastbusiness.net | 162.150.57.12 | US | TCP | |
| 0.0.100.242 | TCP | |||
| 0.0.2.178 | TCP | |||
| 0.0.209.30 | TCP | |||
| 177.202.73.20 | BR | TCP | ||
| 0.0.187.135 | TCP | |||
| 0.0.240.60 | TCP | |||
| 80.162.111.211 | DK | Randers | TCP | |
| c-0c4fe655.04-40-73746f21.cust.bredbandsbolaget.se | 85.230.79.12 | SE | Sollentuna | TCP |
| 0.0.17.22 | TCP | |||
| KD119105192204.ppp-bb.dion.ne.jp | 119.105.192.204 | JP | Saitama | TCP |
| 0.0.82.171 | TCP | |||
| 156.26.106.12 | US | Wichita | TCP | |
| 216.223.112.172 | CA | Sudbury | TCP | |
| 138.95.146.216.dial.dyn.networkgci.net | 216.146.95.138 | US | Chicago | TCP |
| 28.132.34.230 | US | TCP | ||
| 0.0.133.133 | TCP | |||
| 106.31.69.183 | CN | Changsha | TCP | |
| host12-58-static.14-79-b.business.telecomitalia.it | 79.14.58.12 | IT | Milan | TCP |
| 0.0.178.224 | TCP | |||
| 120.154.1.73 | AU | TCP | ||
| 101.6.123.217 | CN | Beijing | TCP | |
| 54.37.12.53 | US | Woodbridge | TCP | |
| 0.0.145.155 | TCP | |||
| 198-57-243-116.unifiedlayer.com | 198.57.243.116 | US | Provo | TCP |
| 0.0.100.42 | TCP | |||
| 0.0.47.11 | TCP | |||
| 0.0.159.43 | TCP | |||
| 0.0.94.196 | TCP | |||
| 44.84.162.54 | US | San Diego | TCP | |
| 0.0.69.110 | TCP | |||
| 0.0.234.236 | TCP | |||
| 0.0.20.201 | TCP | |||
| 0.0.141.5 | TCP | |||
| 153.60.139.81 | US | Duluth | TCP | |
| 0.0.218.118 | TCP | |||
| 0.0.142.37 | TCP | |||
| 0.0.37.189 | TCP | |||
| 103.136.166.113 | TCP | |||
| 79-113-70-43.rdsnet.ro | 79.113.70.43 | RO | Timisoara | TCP |
| 0.0.214.136 | TCP | |||
| 0.0.40.23 | TCP | |||
| 0.0.129.169 | TCP | |||
| host107.181-6-123.telecom.net.ar | 181.6.123.107 | AR | TCP | |
| 0.0.248.61 | TCP | |||
| 0.0.162.235 | TCP | |||
| host-156.215.154.159-static.tedata.net | 156.215.159.154 | EG | TCP | |
| 0.0.50.19 | TCP | |||
| 0.0.71.246 | TCP | |||
| 0.0.248.85 | TCP | |||
| 0.0.119.29 | TCP | |||
| 0.0.197.45 | TCP | |||
| 0.0.6.205 | TCP | |||
| 0.0.243.202 | TCP | |||
| 0.0.136.101 | TCP | |||
| 11.247.90.251 | US | TCP | ||
| 23.98.155.199 | US | San Antonio | TCP | |
| 0.0.180.135 | TCP | |||
| 0.0.157.243 | TCP | |||
| 0.0.61.250 | TCP | |||
| 0.0.123.163 | TCP | |||
| 0.0.203.99 | TCP | |||
| 177.180.126.243 | BR | Bragana Paulista | TCP | |
| 0.0.184.240 | TCP | |||
| 0.0.219.12 | TCP | |||
| 0.0.46.110 | TCP | |||
| 0.0.131.162 | TCP | |||
| 0.0.13.0 | TCP | |||
| 0.0.95.155 | TCP | |||
| 0.0.103.133 | TCP | |||
| 0.0.61.80 | TCP | |||
| 0.0.181.197 | TCP | |||
| 0.0.198.189 | TCP | |||
| 0.0.26.158 | TCP | |||
| 0.0.222.117 | TCP | |||
| 38.246.211.75 | US | TCP | ||
| 162.65.9.47 | US | Stamford | TCP | |
| 0.0.21.28 | TCP | |||
| 0.0.66.114 | TCP | |||
| 115.95.65.48 | KR | Seoul | TCP | |
| 212.54.51.162 | NL | TCP | ||
| 0.0.140.64 | TCP | |||
| 32.107.195.199 | US | TCP | ||
| adsl-74-250-132-194.ags.bellsouth.net | 74.250.132.194 | US | TCP | |
| 0.0.64.57 | TCP | |||
| 0.0.37.185 | TCP | |||
| 188.92.124.32 | TCP | |||
| 0.0.71.140 | TCP | |||
| 0.0.223.192 | TCP | |||
| 14.93.103.144 | KR | TCP | ||
| 0.0.2.243 | TCP | |||
| 0.0.74.158 | TCP | |||
| 0.0.77.243 | TCP | |||
| 0.0.130.177 | TCP | |||
| 106.188.7.188.rev.sfr.net | 188.7.188.106 | FR | Clouange | TCP |
| 0.0.89.101 | TCP | |||
| 0.0.187.184 | TCP | |||
| 146.205.84.31 | US | Palo Alto | TCP | |
| 172.106.175.205 | US | Ashburn | TCP | |
| 76-14-109-173.rk.wavecable.com | 76.14.109.173 | US | Loomis | TCP |
| 94.165.254.219 | IT | Piacenza | TCP | |
| 161.203.242.177 | US | Washington | TCP | |
| 0.0.244.129 | TCP | |||
| 0.0.55.204 | TCP | |||
| 17.67.188.230 | US | Cupertino | TCP | |
| 196.44.45.118 | ZA | Stellenbosch | TCP | |
| 0.0.21.24 | TCP | |||
| 115.159.89.170 | CN | Beijing | TCP | |
| 0.0.132.162 | TCP | |||
| 60-248-30-230.HINET-IP.hinet.net | 60.248.30.230 | TW | TCP | |
| softbank060122076003.bbtec.net | 60.122.76.3 | JP | Kyoto | TCP |
| 0.0.176.170 | TCP | |||
| 45.164.217.8 | TCP | |||
| 0.0.143.13 | TCP | |||
| 0.0.146.8 | TCP | |||
| 0.0.45.86 | TCP | |||
| 0.0.185.134 | TCP | |||
| 0.0.18.68 | TCP | |||
| 0.0.251.8 | TCP | |||
| 0.0.189.138 | TCP | |||
| 211.50.168.174 | KR | TCP | ||
| 81.5.82.196.dhcp.mipt-telecom.ru | 81.5.82.196 | RU | Dolgoprudnyy | TCP |
| 99.21.136.189 | US | TCP | ||
| 0.0.119.148 | TCP | |||
| 0.0.136.164 | TCP | |||
| 0.0.106.199 | TCP | |||
| 38.51.13.178 | US | TCP | ||
| 0.0.170.145 | TCP | |||
| 0.0.119.238 | TCP | |||
| c-76-107-55-28.hsd1.la.comcast.net | 76.107.55.28 | US | Monroe | TCP |
| 0.0.67.223 | TCP | |||
| 0.0.50.205 | TCP | |||
| 0.0.14.38 | TCP | |||
| 0.0.51.182 | TCP | |||
| 0.0.33.91 | TCP | |||
| 0.0.241.81 | TCP | |||
| 0.0.102.120 | TCP | |||
| 0.0.2.242 | TCP | |||
| dialup-4.139.91.73.Dial1.Baltimore1.Level3.net | 4.139.91.73 | US | TCP | |
| 0.0.242.12 | TCP | |||
| 0.0.107.177 | TCP | |||
| 0.0.10.182 | TCP | |||
| 0.0.227.216 | TCP | |||
| 194.139.100.52 | DE | TCP | ||
| 205.37.10.66 | US | TCP | ||
| 0.0.108.228 | TCP | |||
| 0.0.141.49 | TCP | |||
| 0.0.49.128 | TCP | |||
| 0.0.122.36 | TCP | |||
| 0.0.92.143 | TCP | |||
| 55.103.102.164 | US | Fort Huachuca | TCP | |
| 0.0.75.55 | TCP | |||
| 0.0.237.14 | TCP | |||
| 0.0.13.44 | TCP | |||
| 0.0.2.124 | TCP | |||
| 0.0.214.151 | TCP | |||
| 0.0.0.62 | TCP | |||
| 0.0.133.129 | TCP | |||
| 206.152.126.142 | US | Chesterfield | TCP | |
| 223.210.24.13 | CN | Beijing | TCP | |
| 0.0.158.89 | TCP | |||
| 0.0.162.232 | TCP | |||
| 0.0.233.198 | TCP | |||
| 161.76.155.90 | GB | London | TCP | |
| adsl-74-161-161-177.mia.bellsouth.net | 74.161.161.177 | US | Hialeah | TCP |
| 0.0.179.96 | TCP | |||
| 112.2.238.61 | CN | TCP | ||
| 5.116.85.248 | IR | TCP | ||
| 0.0.206.100 | TCP | |||
| 0.0.76.21 | TCP | |||
| 6.215.109.152 | US | Fort Huachuca | TCP | |
| 0.0.36.231 | TCP | |||
| 0.0.110.237 | TCP | |||
| 0.0.33.169 | TCP | |||
| 43.206.49.70 | JP | Tokyo | TCP | |
| 0.0.3.74 | TCP | |||
| 0.0.188.26 | TCP | |||
| 0.0.128.18 | TCP | |||
| 118.sub-97-151-216.myvzw.com | 97.151.216.118 | US | TCP | |
| 0.0.35.156 | TCP | |||
| 0.0.204.59 | TCP | |||
| 0.0.26.7 | TCP | |||
| 88.225.240.233.dynamic.ttnet.com.tr | 88.225.240.233 | TR | Mersin | TCP |
| 0.0.252.146 | TCP | |||
| 0.0.6.33 | TCP | |||
| softbank220006037245.bbtec.net | 220.6.37.245 | JP | TCP | |
| dsl-olubng11-54f810-165.dhcp.inet.fi | 84.248.16.165 | FI | Turku | TCP |
| 0.0.199.121 | TCP | |||
| 169.222.251.142 | KR | TCP | ||
| 0.0.103.46 | TCP | |||
| 8.234.18.36 | US | TCP | ||
| 85.235.188.127 | RU | Moscow | TCP | |
| 208.207.173.233 | US | Fairfax | TCP | |
| 0.0.15.33 | TCP | |||
| 125.219.233.120 | CN | Wuhan | TCP | |
| 144.128.134.118 | US | TCP | ||
| 0.0.48.87 | TCP | |||
| 0.0.184.161 | TCP | |||
| p59111-ipngn100205takamatu.kagawa.ocn.ne.jp | 123.223.16.111 | JP | Takamatsu | TCP |
| 37.41.51.163 | OM | TCP | ||
| adsl-68-222-37-36.msy.bellsouth.net | 68.222.37.36 | US | TCP | |
| 0.0.236.184 | TCP | |||
| 27.41.165.168 | CN | Guangzhou | TCP | |
| 0.0.90.166 | TCP | |||
| 0.0.228.211 | TCP | |||
| 2-226-169-146.ip181.fastwebnet.it | 2.226.169.146 | IT | Bari | TCP |
| 0.0.178.27 | TCP | |||
| 0.0.116.193 | TCP | |||
| 0.0.189.200 | TCP | |||
| 0.0.227.144 | TCP | |||
| 0.0.118.103 | TCP | |||
| 0.0.27.144 | TCP | |||
| 0.0.45.250 | TCP | |||
| 0.0.66.154 | TCP | |||
| 65.230.122.103 | US | Ashburn | TCP | |
| 148.30.147.245 | US | TCP | ||
| 0.0.217.20 | TCP | |||
| 0.0.94.109 | TCP | |||
| 0.0.89.121 | TCP | |||
| p501071-ipngn5901funabasi.chiba.ocn.ne.jp | 60.39.208.71 | JP | Chiba | TCP |
| 0.0.26.119 | TCP | |||
| 0.0.88.115 | TCP | |||
| 72-164-159-195.dia.static.qwest.net | 72.164.159.195 | US | TCP | |
| 0.0.96.78 | TCP | |||
| 0.0.148.58 | TCP | |||
| 0.0.154.157 | TCP | |||
| 0.0.159.71 | TCP | |||
| 0.0.192.243 | TCP | |||
| 0.0.209.128 | TCP | |||
| 0.0.207.194 | TCP | |||
| tdev198-239.codetel.net.do | 200.88.198.239 | DO | Bajos De Haina | TCP |
| 0.0.13.88 | TCP | |||
| 0.0.104.107 | TCP | |||
| 0.0.151.12 | TCP | |||
| 0.0.197.156 | TCP | |||
| 37x112x235x183.dynamic.rostov.ertelecom.ru | 37.112.235.183 | RU | Rostov-na-donu | TCP |
| 0.0.166.214 | TCP | |||
| 0.0.99.129 | TCP | |||
| 0.0.9.197 | TCP | |||
| 0.0.115.160 | TCP | |||
| 179-240-233-113.3g.claro.net.br | 179.240.233.113 | BR | TCP | |
| 0.0.142.136 | TCP | |||
| 0.0.207.79 | TCP | |||
| 0.0.36.45 | TCP | |||
| 0.0.192.207 | TCP | |||
| 0.0.169.166 | TCP | |||
| 0.0.197.24 | TCP | |||
| 0.0.253.47 | TCP | |||
| 0.0.92.231 | TCP | |||
| 100.203.94.130 | US | TCP | ||
| 54.18.46.117 | US | Woodbridge | TCP | |
| 0.0.160.114 | TCP | |||
| 0.0.87.36 | TCP | |||
| 0.0.79.211 | TCP | |||
| 0.0.148.2 | TCP | |||
| 141.121.188.40 | US | Santa Rosa | TCP | |
| 0.0.176.248 | TCP | |||
| projectrates.com | 170.130.181.220 | US | Henderson | TCP |
| a172-227-182-240.deploy.static.akamaitechnologies.com | 172.227.182.240 | US | Cambridge | TCP |
| 0.0.28.217 | TCP | |||
| 0.0.198.245 | TCP | |||
| mobile-166-196-063-151.mycingular.net | 166.196.63.151 | US | TCP | |
| 0.0.210.79 | TCP | |||
| 0.0.153.157 | TCP | |||
| pc-reit1.cs.tau.ac.il | 132.67.16.163 | IL | Tel Aviv | TCP |
| 200.117.142.233 | AR | Buenos Aires | TCP | |
| 0.0.16.31 | TCP | |||
| 0.0.238.152 | TCP | |||
| 0.0.214.190 | TCP | |||
| 105.188.107.146 | MA | TCP | ||
| 0.0.17.205 | TCP | |||
| p6e437173.gunmnt01.ap.so-net.ne.jp | 110.67.113.115 | JP | Matsudo | TCP |
| 0.0.53.16 | TCP | |||
| 0.0.171.181 | TCP | |||
| 0.0.205.153 | TCP | |||
| 34.22.201.226 | US | TCP | ||
| 0.0.69.44 | TCP | |||
| 139.146.70.40 | US | Leawood | TCP | |
| 58.226.69.39 | KR | Seoul | TCP | |
| 0.0.182.113 | TCP | |||
| 0.0.162.122 | TCP | |||
| 191-23-202-222.user.vivozap.com.br | 191.23.202.222 | BR | TCP | |
| 175.25.99.177 | CN | Beijing | TCP | |
| 212.26.115.108 | SA | Jeddah | TCP | |
| 0.0.136.97 | TCP | |||
| 0.0.155.0 | TCP | |||
| 11.99.134.59 | US | TCP | ||
| dhcp-216-48-154-053.lasallehs.org | 216.48.154.53 | US | Sierra Madre | TCP |
| 0.0.125.208 | TCP | |||
| 0.0.197.204 | TCP | |||
| 20.14.37.24 | US | Falls Church | TCP | |
| 0.0.68.151 | TCP | |||
| 88.87.206.135 | ES | Barcelona | TCP | |
| 0.0.172.63 | TCP | |||
| 154.116.108.170 | GA | TCP | ||
| 0.0.206.219 | TCP | |||
| 0.0.152.37 | TCP | |||
| 148.4.107.139 | US | Greenvale | TCP | |
| 0.0.162.245 | TCP | |||
| 0.0.121.210 | TCP | |||
| 0.0.177.6 | TCP | |||
| 0.0.101.85 | TCP | |||
| 0.0.103.250 | TCP | |||
| 0.0.172.121 | TCP | |||
| 133.92.243.163 | JP | TCP | ||
| 0.222.160.28 | TCP | |||
| 8.159.192.37 | US | TCP | ||
| 0.0.4.217 | TCP | |||
| 11.19.153.158 | US | TCP | ||
| 0.0.190.116 | TCP | |||
| 0.0.233.79 | TCP | |||
| 0.0.163.188 | TCP | |||
| 0.0.161.53 | TCP | |||
| 0.0.239.31 | TCP | |||
| 0.0.203.77 | TCP | |||
| 0.0.159.5 | TCP | |||
| 0.0.245.104 | TCP | |||
| 0.0.72.31 | TCP | |||
| 146.242.91.153 | US | Stamford | TCP | |
| 114.3.180.146 | ID | Jakarta | TCP | |
| 0.0.182.166 | TCP | |||
| 197.64.158.49 | ZA | Johannesburg | TCP | |
| 131.197.123.201 | US | Schaumburg | TCP | |
| 0.0.161.204 | TCP | |||
| 0.0.232.19 | TCP | |||
| x4dbe7e43.dyn.telefonica.de | 77.190.126.67 | DE | TCP | |
| 0.0.145.237 | TCP | |||
| 0.0.60.35 | TCP | |||
| 0.0.195.152 | TCP | |||
| 0.0.55.227 | TCP | |||
| 72.40.26.145 | US | TCP | ||
| c-73-25-124-76.hsd1.or.comcast.net | 73.25.124.76 | US | Eugene | TCP |
| 0.0.72.98 | TCP | |||
| 116.207.65.240 | CN | Wuhan | TCP | |
| 196.138.62.194 | EG | TCP | ||
| 0.0.99.140 | TCP | |||
| 0.0.56.147 | TCP | |||
| 112.20.140.247 | CN | TCP | ||
| 0.0.33.189 | TCP | |||
| 24.18.41.121 | US | Seattle | TCP | |
| 0.0.55.126 | TCP | |||
| 0.0.148.110 | TCP | |||
| 0.0.161.146 | TCP | |||
| 85.130.89.177 | BG | Dimitrovgrad | TCP | |
| 0.0.78.214 | TCP | |||
| c-50-128-128-112.hsd1.fl.comcast.net | 50.128.128.112 | US | Hollywood | TCP |
| 81.31.1.48 | GB | TCP | ||
| 203.180.10.200 | JP | Tokyo | TCP | |
| 0.0.133.186 | TCP | |||
| 0.0.136.19 | TCP | |||
| 75.16.132.202 | US | TCP | ||
| 0.0.228.121 | TCP | |||
| 0.0.222.74 | TCP | |||
| 83.173.97.32 | FR | TCP | ||
| 0.0.223.68 | TCP | |||
| 0.0.223.92 | TCP | |||
| 0.0.58.152 | TCP | |||
| 16.229.161.184 | US | Palo Alto | TCP | |
| 0.0.190.191 | TCP | |||
| 0.0.53.130 | TCP | |||
| 185.0.175.99 | TCP | |||
| 0.0.153.178 | TCP | |||
| 154.113.4.72 | NG | TCP | ||
| 169.170.89.109 | US | Reston | TCP | |
| 8.36.97.164 | US | TCP | ||
| 108-74-112-172.lightspeed.tukrga.sbcglobal.net | 108.74.112.172 | US | TCP | |
| 0.0.121.112 | TCP | |||
| 0.0.153.117 | TCP | |||
| softbank126066218179.bbtec.net | 126.66.218.179 | JP | Narita | TCP |
| 0.0.142.26 | TCP | |||
| 0.0.176.200 | TCP | |||
| 0.0.201.212 | TCP | |||
| 0.0.241.144 | TCP | |||
| 0.0.73.147 | TCP | |||
| 0.0.65.22 | TCP | |||
| 0.0.20.164 | TCP | |||
| 0.0.25.228 | TCP | |||
| 0.0.141.102 | TCP | |||
| 216.249.47.140 | BM | Hamilton | TCP | |
| 206.52.246.188 | US | Englewood | TCP | |
| 0.0.194.160 | TCP | |||
| 0.0.100.110 | TCP | |||
| 0.0.231.125 | TCP | |||
| 0.0.34.194 | TCP | |||
| 33.21.12.178 | US | TCP | ||
| 0.0.171.189 | TCP | |||
| 0.0.30.21 | TCP | |||
| 0.0.83.136 | TCP | |||
| 0.0.200.114 | TCP | |||
| 0.0.5.182 | TCP | |||
| 0.0.181.203 | TCP | |||
| 49.64.5.25 | CN | Nanjing | TCP | |
| 167.237.0.85.dynamic.wline.res.cust.swisscom.ch | 85.0.237.167 | CH | Wabern | TCP |
| 0.0.207.121 | TCP | |||
| 0.0.137.123 | TCP | |||
| 184.200.58.106 | US | TCP | ||
| 0.0.83.130 | TCP | |||
| 0.0.123.88 | TCP | |||
| 29.249.36.32 | US | TCP | ||
| 0.0.141.67 | TCP | |||
| 0.0.95.40 | TCP | |||
| 0.0.251.230 | TCP | |||
| 0.0.205.244 | TCP | |||
| 0.0.228.86 | TCP | |||
| 0.0.84.17 | TCP | |||
| 0.0.243.79 | TCP | |||
| 0.0.219.253 | TCP | |||
| 0.0.111.73 | TCP | |||
| 0.0.204.79 | TCP | |||
| 0.0.170.147 | TCP | |||
| 0.0.19.127 | TCP | |||
| softbank220011016177.bbtec.net | 220.11.16.177 | JP | TCP | |
| 0.0.164.48 | TCP | |||
| 192.229.216.88 | US | Santa Monica | TCP | |
| 0.0.209.13 | TCP | |||
| 188.182.230.7 | DK | Frederiksberg | TCP | |
| 0.0.101.194 | TCP | |||
| 0.0.176.61 | TCP | |||
| 145.46.142.28 | NL | Utrecht | TCP | |
| 169.75.15.53 | US | New York | TCP | |
| 198.217.195.5 | US | San Francisco | TCP | |
| 133.107.200.180 | JP | TCP | ||
| 0.0.193.146 | TCP | |||
| 0.0.22.174 | TCP | |||
| 0.0.61.51 | TCP | |||
| 0.0.203.96 | TCP | |||
| 0.0.192.0 | TCP | |||
| 191-1-86-182.user3g.veloxzone.com.br | 191.1.86.182 | BR | TCP | |
| 79-114-57-66.rdsnet.ro | 79.114.57.66 | RO | Timisoara | TCP |
| 0.0.254.33 | TCP | |||
| 0.0.93.0 | TCP | |||
| 170.94.229.117 | US | Little Rock | TCP | |
| 0.0.184.76 | TCP | |||
| 75-39-177-1.lightspeed.sndgca.sbcglobal.net | 75.39.177.1 | US | TCP | |
| 188-177-189-153-dynamic.dk.customer.tdc.net | 188.177.189.153 | DK | Aarhus | TCP |
| 0.0.191.67 | TCP | |||
| 71.100.173.148 | US | Saint Petersburg | TCP | |
| 0.0.77.80 | TCP | |||
| 0.0.241.238 | TCP | |||
| 0.0.18.1 | TCP | |||
| 15.213.81.226 | US | Palo Alto | TCP | |
| 169.110.19.62 | US | New York | TCP | |
| 0.0.235.190 | TCP | |||
| 0.0.167.228 | TCP | |||
| 21.194.199.43 | US | TCP | ||
| 0.0.64.246 | TCP | |||
| 0.0.89.54 | TCP | |||
| 0.0.86.200 | TCP | |||
| 52-4-170-181.fibertel.com.ar | 181.170.4.52 | AR | Buenos Aires | TCP |
| 0.0.232.90 | TCP | |||
| 0.0.13.193 | TCP | |||
| 37.127.61.139 | SA | Jeddah | TCP | |
| 0.0.40.208 | TCP | |||
| 31.87.198.31 | GB | Newcastle Upon Tyne | TCP | |
| 226.sub-97-241-152.myvzw.com | 97.241.152.226 | US | TCP | |
| adsl-28-50.tricom.net | 148.103.28.50 | DO | Santo Domingo | TCP |
| 0.0.109.218 | TCP | |||
| 0.152.239.190 | TCP | |||
| 0.0.136.177 | TCP | |||
| 39.121.75.205 | KR | Gyeongsan | TCP | |
| 0.0.221.159 | TCP | |||
| 42.240.26.2 | CN | Beijing | TCP | |
| 0.0.135.177 | TCP | |||
| 0.0.88.46 | TCP | |||
| 0.0.177.123 | TCP | |||
| 0.0.247.165 | TCP | |||
| 0.0.117.6 | TCP | |||
| 0.0.130.29 | TCP | |||
| 0.0.73.66 | TCP | |||
| 0.0.140.0 | TCP | |||
| 154.215.241.65 | SC | TCP | ||
| 139.71.112.141 | US | Fort Lauderdale | TCP | |
| 0.0.174.54 | TCP | |||
| 0.0.138.59 | TCP | |||
| 0.0.67.212 | TCP | |||
| 0.0.189.173 | TCP | |||
| 0.0.209.14 | TCP | |||
| c-174-56-59-140.hsd1.nm.comcast.net | 174.56.59.140 | US | Albuquerque | TCP |
| 0.0.176.195 | TCP | |||
| 0.0.216.78 | TCP | |||
| 0.0.43.198 | TCP | |||
| 0.0.140.137 | TCP | |||
| 0.0.160.226 | TCP | |||
| 33.61.101.79 | US | TCP | ||
| 128.159.71.112 | US | Winter Springs | TCP | |
| 0.0.196.252 | TCP | |||
| 83.179.118.117 | EE | TCP | ||
| a23-44-70-252.deploy.static.akamaitechnologies.com | 23.44.70.252 | US | Cambridge | TCP |
| 0.0.109.87 | TCP | |||
| 0.0.52.149 | TCP | |||
| 0.0.58.5 | TCP | |||
| 0.0.54.166 | TCP | |||
| 0.0.207.127 | TCP | |||
| 43.112.38.86 | JP | Tokyo | TCP | |
| 0.0.111.151 | TCP | |||
| 0.0.237.180 | TCP | |||
| 0.0.233.217 | TCP | |||
| 0.0.88.26 | TCP | |||
| 0.0.251.125 | TCP | |||
| 0.0.8.32 | TCP | |||
| 0.0.33.87 | TCP | |||
| 0.0.62.231 | TCP | |||
| 0.0.19.85 | TCP | |||
| 0.0.139.11 | TCP | |||
| 0.0.158.165 | TCP | |||
| 189-44-4-39.customer.tdatabrasil.net.br | 189.44.4.39 | BR | TCP | |
| 0.0.175.237 | TCP | |||
| 145.102.159.56.dynamic.summacollege.nl | 145.102.159.56 | NL | Eindhoven | TCP |
| 54.102.138.107 | US | Woodbridge | TCP | |
| 131.228.215.222 | FI | TCP | ||
| rev.193.68.62.125.euroweb.hu | 193.68.62.125 | HU | Komoro | TCP |
| 45.35.85.42 | US | Dallas | TCP | |
| 0.0.99.96 | TCP | |||
| 0.0.131.206 | TCP | |||
| 101.122.74.116 | CN | Beijing | TCP | |
| 0.0.75.72 | TCP | |||
| 157.159.160.212 | FR | vry | TCP | |
| 144.54.155.161 | NL | Eindhoven | TCP | |
| 0.0.108.1 | TCP | |||
| 0.0.156.243 | TCP | |||
| 0.0.1.246 | TCP | |||
| 0.0.219.117 | TCP | |||
| 0.0.130.75 | TCP | |||
| 202.153.65.72 | AU | Banora Point | TCP | |
| 30.26.43.7 | US | TCP | ||
| 0.0.79.223 | TCP | |||
| 223.236.226.83 | IN | Mumbai | TCP | |
| 0.0.60.0 | TCP | |||
| 0.0.144.92 | TCP | |||
| 152.133.178.166 | US | TCP | ||
| 0.0.53.142 | TCP | |||
| softbank218135035028.bbtec.net | 218.135.35.28 | JP | TCP | |
| 18.182.40.41 | US | Cambridge | TCP | |
| 0.0.250.203 | TCP | |||
| 196.77.51.51 | MA | TCP | ||
| 0.0.78.24 | TCP | |||
| 0.0.242.2 | TCP | |||
| 0.0.175.65 | TCP | |||
| 125-215-156-161.static.imsbiz.com | 125.215.156.161 | HK | Central District | TCP |
| 0.0.34.203 | TCP | |||
| mvx-200-201-176-220.mundivox.com | 200.201.176.220 | BR | Rio De Janeiro | TCP |
| 0.0.219.143 | TCP | |||
| 0.0.214.55 | TCP | |||
| 106.28.128.127 | CN | Changsha | TCP | |
| 0.0.208.89 | TCP | |||
| 101-136-73-77.mobile.dynamic.aptg.com.tw | 101.136.73.77 | TW | Taipei | TCP |
| host113-71-static.58-88-b.business.telecomitalia.it | 88.58.71.113 | IT | TCP | |
| 93.94.69.58 | CH | Basel | TCP | |
| 146.8.237.42 | US | Troy | TCP | |
| 0.0.159.168 | TCP | |||
| 0.0.119.209 | TCP | |||
| 105.56.162.107 | KE | TCP | ||
| 0.0.14.8 | TCP | |||
| 0.0.72.12 | TCP | |||
| 0.0.27.167 | TCP | |||
| 0.0.185.91 | TCP | |||
| 0.0.116.119 | TCP | |||
| 0.0.221.254 | TCP | |||
| 142.59.22.190 | CA | Drayton Valley | TCP | |
| 0.0.134.46 | TCP | |||
| 0.0.196.153 | TCP | |||
| 0.0.56.116 | TCP | |||
| 0.0.94.69 | TCP | |||
| 0.0.104.145 | TCP | |||
| 0.0.72.186 | TCP | |||
| 12.29.185.247 | US | TCP | ||
| 0.0.127.51 | TCP | |||
| ip67-153-166-117.z166-153-67.customer.algx.net | 67.153.166.117 | US | TCP | |
| 0.0.186.109 | TCP | |||
| 0.0.231.74 | TCP | |||
| 0.0.234.159 | TCP | |||
| 0.0.72.231 | TCP | |||
| 0.0.195.149 | TCP | |||
| 140.213.103.203 | ID | TCP | ||
| 7.222.160.239 | US | TCP | ||
| 0.0.204.28 | TCP | |||
| 221.219.71.185 | CN | Beijing | TCP | |
| 0.0.118.95 | TCP | |||
| cpe-24-175-190-35.stx.res.rr.com | 24.175.190.35 | US | TCP | |
| 0.0.152.130 | TCP | |||
| 0.0.197.137 | TCP | |||
| 0.0.133.70 | TCP | |||
| 0.0.186.92 | TCP | |||
| ip-78-44-182-47.net.upcbroadband.cz | 78.44.182.47 | CZ | TCP | |
| 0.0.94.254 | TCP | |||
| 0.0.181.133 | TCP | |||
| 0.0.175.162 | TCP | |||
| 0.0.0.6 | TCP | |||
| 0.0.80.240 | TCP | |||
| 0.0.171.196 | TCP | |||
| 0.0.193.156 | TCP | |||
| 0.0.207.123 | TCP | |||
| 0.0.151.113 | TCP | |||
| 0.0.214.150 | TCP | |||
| 0.0.119.155 | TCP | |||
| 105.199.253.57 | EG | TCP | ||
| 0.0.46.245 | TCP | |||
| 146.226.48.1 | VI | TCP | ||
| 0.0.27.22 | TCP | |||
| 102.211.24.206 | TCP | |||
| ARouen-653-1-76-66.w82-126.abo.wanadoo.fr | 82.126.219.66 | FR | Rouen | TCP |
| 194.185.50.216 | IT | TCP | ||
| 104.61.7.187 | US | TCP | ||
| 211.38.242.0 | KR | Cheongju | TCP | |
| 7.230.82.59 | US | TCP | ||
| 0.0.226.2 | TCP | |||
| 0.0.157.160 | TCP | |||
| host-92-16-4-190.as13285.net | 92.16.4.190 | GB | Inverness | TCP |
| 0.0.19.155 | TCP | |||
| 0.0.166.41 | TCP | |||
| 0.0.106.230 | TCP | |||
| 0.0.60.151 | TCP | |||
| 0.0.147.110 | TCP | |||
| 0.0.16.93 | TCP | |||
| 0.0.15.176 | TCP | |||
| 0.0.103.213 | TCP | |||
| 0.0.143.70 | TCP | |||
| 0.0.159.148 | TCP | |||
| 44.3.4.54 | US | San Diego | TCP | |
| 0.0.121.9 | TCP | |||
| 199.197.75.237 | US | Madison | TCP | |
| 55.66.37.221 | US | Fort Huachuca | TCP | |
| 0.0.156.90 | TCP | |||
| 213.191.104.107 | CZ | TCP | ||
| 0.0.169.82 | TCP | |||
| 56.147.46.239 | US | Raleigh | TCP | |
| 140.236.187.49 | US | Westborough | TCP | |
| 0.0.191.157 | TCP | |||
| 0.0.107.197 | TCP | |||
| 203.66.104.149 | TW | TCP | ||
| 0.0.31.48 | TCP | |||
| 0.0.10.178 | TCP | |||
| 0.0.23.193 | TCP | |||
| 40.65.140.166 | US | TCP | ||
| 0.0.172.112 | TCP | |||
| 205.125.225.98 | US | Salt Lake City | TCP | |
| 0.0.138.25 | TCP | |||
| 78.199.194.67 | FR | Saint Etienne | TCP | |
| 0.0.56.199 | TCP | |||
| 44.153.9.167 | US | San Diego | TCP | |
| 0.0.170.28 | TCP | |||
| 66.111.69.138 | US | Atlanta | TCP | |
| 152.153.26.224 | TCP | |||
| 0.0.72.105 | TCP | |||
| 63.163.167.223 | US | Newport | TCP | |
| 0.0.0.227 | TCP | |||
| 0.0.135.225 | TCP | |||
| 0.0.215.49 | TCP | |||
| ai126140088041.4.tss.access-internet.ne.jp | 126.140.88.41 | JP | TCP | |
| 0.0.69.178 | TCP | |||
| 0.0.89.102 | TCP | |||
| 0.0.107.52 | TCP | |||
| 0.0.239.248 | TCP | |||
| 0.0.71.59 | TCP | |||
| 0.0.122.164 | TCP | |||
| 190.89.75.125 | CW | TCP | ||
| 0.0.57.177 | TCP | |||
| 0.0.156.2 | TCP | |||
| 88-111-62-161.dynamic.dsl.as9105.com | 88.111.62.161 | GB | Aberdare | TCP |
| 0.0.101.212 | TCP | |||
| 121.10.10.254 | CN | Guangzhou | TCP | |
| 0.0.223.121 | TCP | |||
| 0.0.19.78 | TCP | |||
| 0.0.211.100 | TCP | |||
| 117.51.183.44 | CN | Hangzhou | TCP | |
| 0.0.91.125 | TCP | |||
| 0.0.90.71 | TCP | |||
| 208.144.190.220 | US | Chesterfield | TCP | |
| 0.0.134.156 | TCP | |||
| 223.187.42.33 | IN | Coimbatore | TCP | |
| 0.0.231.237 | TCP | |||
| 175.195.5.152 | KR | Koyang | TCP | |
| 0.0.244.70 | TCP | |||
| 0.0.241.49 | TCP | |||
| 0.0.169.118 | TCP | |||
| 0.0.229.240 | TCP | |||
| 0.0.27.209 | TCP | |||
| 0.0.8.102 | TCP | |||
| 124-143-27-253.rev.home.ne.jp | 124.143.27.253 | JP | TCP | |
| 0.0.199.62 | TCP | |||
| 0.0.164.126 | TCP | |||
| 0.0.170.199 | TCP | |||
| 0.0.58.140 | TCP | |||
| 0.0.212.2 | TCP | |||
| 0.0.17.63 | TCP | |||
| 0.0.223.95 | TCP | |||
| 0.0.30.141 | TCP | |||
| 0.0.39.227 | TCP | |||
| 0.0.198.13 | TCP | |||
| 0.0.74.35 | TCP | |||
| 49.213.115.40 | VN | Thanh | TCP | |
| 0.0.195.86 | TCP | |||
| 117.183.42.87 | CN | TCP | ||
| 20.231.171.165 | US | Falls Church | TCP | |
| 209.249.143.195.available.above.net | 209.249.143.195 | US | Louisville | TCP |
| 1.220.171.32 | KR | Seoul | TCP | |
| 0.0.115.200 | TCP | |||
| 0.0.218.29 | TCP | |||
| pcv-vid1.adm.skm.vutbr.cz | 147.229.185.213 | CZ | Brno | TCP |
| 85.143.106.18 | RU | Moscow | TCP | |
| 141.246.192.29 | US | Omaha | TCP | |
| 0.0.140.138 | TCP | |||
| 0.0.159.221 | TCP | |||
| 0.0.145.186 | TCP | |||
| 0.0.104.109 | TCP | |||
| 0.0.17.13 | TCP | |||
| 0.0.197.226 | TCP | |||
| 168.17.138.90 | US | Athens | TCP | |
| 0.0.237.97 | TCP | |||
| 0.0.118.15 | TCP | |||
| 0.0.6.197 | TCP | |||
| 125.153.155.232 | KR | TCP | ||
| 0.0.17.99 | TCP | |||
| 168.87.155.230 | US | Palo Alto | TCP | |
| 0.0.119.162 | TCP | |||
| 75.19.177.20 | US | TCP | ||
| 143.110.54.172 | US | Duluth | TCP | |
| 0.0.89.33 | TCP | |||
| 51.139.143.130 | GB | TCP | ||
| 0.0.125.122 | TCP | |||
| 0.0.223.213 | TCP | |||
| 107.131.57.86 | US | TCP | ||
| bgdbid-232-172.slb.com | 163.183.232.172 | US | Houston | TCP |
| 0.0.230.206 | TCP | |||
| 0.0.11.26 | TCP | |||
| 0.0.98.92 | TCP | |||
| 151.39.181.86 | IT | TCP | ||
| 0.0.114.77 | TCP | |||
| 128.170.219.40 | US | New York | TCP | |
| 0.0.223.126 | TCP | |||
| 76.56.178.173 | US | TCP | ||
| 0.0.254.64 | TCP | |||
| 39.181.1.248 | CN | Hangzhou | TCP | |
| 0.0.137.182 | TCP | |||
| 198.113.66.133 | US | TCP | ||
| 153.23.185.73 | US | Montgomery | TCP | |
| 222.128.157.97 | CN | Beijing | TCP | |
| 0.0.67.222 | TCP | |||
| 173.194.166.198 | US | Mountain View | TCP | |
| 0.0.34.30 | TCP | |||
| 0.0.149.178 | TCP | |||
| 0.0.45.52 | TCP | |||
| 0.0.15.64 | TCP | |||
| 0.0.75.7 | TCP | |||
| 0.0.223.168 | TCP | |||
| 0.0.110.6 | TCP | |||
| 0.0.196.9 | TCP | |||
| 0.0.47.240 | TCP | |||
| 0.0.27.72 | TCP | |||
| 0.0.143.218 | TCP | |||
| 84.154.155.10 | DE | Singen | TCP | |
| 0.0.234.55 | TCP | |||
| 0.0.136.38 | TCP | |||
| 0.0.176.6 | TCP | |||
| 0.0.186.228 | TCP | |||
| 171.219.251.81 | CN | Chengdu | TCP | |
| 0.0.186.215 | TCP | |||
| 55.37.25.2 | US | Fort Huachuca | TCP | |
| 0.0.121.86 | TCP | |||
| 0.0.227.118 | TCP | |||
| 0.0.57.42 | TCP | |||
| 195.75.50.159 | EU | TCP | ||
| 76.66.150.72 | CA | Deep River | TCP | |
| 0.0.118.198 | TCP | |||
| 108.174.246.66 | US | Herndon | TCP | |
| 0.0.246.161 | TCP | |||
| KD121108116129.ppp-bb.dion.ne.jp | 121.108.116.129 | JP | Tokyo | TCP |
| 0.0.41.245 | TCP | |||
| 0.0.58.118 | TCP | |||
| 0.0.99.57 | TCP | |||
| 0.0.240.155 | TCP | |||
| 0.0.249.59 | TCP | |||
| 113.97.160.107 | CN | Shenzhen | TCP | |
| 0.0.190.179 | TCP | |||
| 0.0.93.108 | TCP | |||
| 0.0.226.179 | TCP | |||
| 0.0.204.191 | TCP | |||
| 0.0.147.18 | TCP | |||
| 0.0.93.191 | TCP | |||
| 0.0.245.217 | TCP | |||
| 0.0.110.56 | TCP | |||
| 0.0.85.233 | TCP | |||
| 0.0.64.124 | TCP | |||
| 0.0.111.49 | TCP | |||
| 0.0.187.161 | TCP | |||
| adsl-74-234-7-242.jax.bellsouth.net | 74.234.7.242 | US | TCP | |
| 0.0.161.90 | TCP | |||
| 164.152.98.121 | US | Maynard | TCP | |
| 0.0.78.97 | TCP | |||
| 124.233.167.46 | CN | Changsha | TCP | |
| 145.141.EARLY-REGISTRATION.of.SURFnet.invalid | 145.141.76.176 | NL | Utrecht | TCP |
| host104.181-4-237.telecom.net.ar | 181.4.237.104 | AR | TCP | |
| 0.0.241.112 | TCP | |||
| 0.0.19.167 | TCP | |||
| 21.44.215.67 | US | TCP | ||
| 175.252.106.238 | KR | TCP | ||
| 152.133.87.130 | US | TCP | ||
| 0.0.146.176 | TCP | |||
| 0.0.57.211 | TCP | |||
| 0.0.166.196 | TCP | |||
| crj95-h05-89-83-21-118.dsl.sta.abo.bbox.fr | 89.83.21.118 | FR | Saint-mand | TCP |
| 26.56.199.231 | US | TCP | ||
| 0.0.66.28 | TCP | |||
| 214.254.32.212 | US | TCP | ||
| 0.0.100.79 | TCP | |||
| 102.49.224.53 | TCP | |||
| 9.126.185.228 | US | Durham | TCP | |
| 0.0.46.30 | TCP | |||
| 0.0.131.111 | TCP | |||
| 0.0.188.104 | TCP | |||
| 0.0.174.172 | TCP | |||
| 0.0.114.152 | TCP | |||
| 0.0.109.168 | TCP | |||
| 0.0.93.115 | TCP | |||
| 92.254.32.113 | NL | TCP | ||
| 0.0.85.232 | TCP | |||
| 145.76.128.180 | NL | Enschede | TCP | |
| 0.0.111.38 | TCP | |||
| 0.0.108.77 | TCP | |||
| 0.0.251.19 | TCP | |||
| g9w0267g-hb.houston.hp.com | 16.217.192.209 | US | Palo Alto | TCP |
| 0.0.224.248 | TCP | |||
| 74.213.8.145 | US | Oklahoma City | TCP | |
| 0.0.135.44 | TCP | |||
| 169-45-136-123.ip.esc.net.au | 123.136.45.169 | AU | Plympton | TCP |
| 59.234.147.159 | CN | Beijing | TCP | |
| 0.0.142.28 | TCP | |||
| 107-222-117-60.lightspeed.lsvlky.sbcglobal.net | 107.222.117.60 | US | Danville | TCP |
| adsl-ull-130-225.50-151.wind.it | 151.50.225.130 | IT | Molfetta | TCP |
| 37.151.64.220.megaline.telecom.kz | 37.151.64.220 | KZ | Taraz | TCP |
| 0.0.144.88 | TCP | |||
| 0.0.62.29 | TCP | |||
| 0.0.96.247 | TCP | |||
| 0.0.181.67 | TCP | |||
| 0.0.56.71 | TCP | |||
| 216.85.2.20 | US | O Fallon | TCP | |
| 0.0.254.244 | TCP | |||
| 0.0.125.220 | TCP | |||
| 0.0.129.160 | TCP | |||
| 0.0.153.74 | TCP | |||
| 0.0.92.188 | TCP | |||
| 0.0.1.78 | TCP | |||
| 174-28-138-79.albq.qwest.net | 174.28.138.79 | US | Santa Fe | TCP |
| 0.0.28.33 | TCP | |||
| 0.0.143.82 | TCP | |||
| 108.84.155.248 | US | TCP | ||
| 0.0.184.13 | TCP | |||
| 0.0.138.247 | TCP | |||
| 0.0.82.68 | TCP | |||
| 0.0.216.108 | TCP | |||
| 0.0.167.132 | TCP | |||
| 0.0.187.189 | TCP | |||
| 187.76.206.12 | BR | TCP | ||
| 0.0.11.171 | TCP | |||
| 0.0.218.177 | TCP | |||
| 184.111.214.170 | US | TCP | ||
| 0.0.230.171 | TCP | |||
| 108.76.148.170 | US | TCP | ||
| 5.237.34.158 | IR | Tehran | TCP | |
| 0.0.125.60 | TCP | |||
| 0.0.114.194 | TCP | |||
| 0.0.218.172 | TCP | |||
| 0.0.183.242 | TCP | |||
| 0.0.89.164 | TCP | |||
| 194.18.71.42 | SE | TCP | ||
| 0.0.106.252 | TCP | |||
| 0.0.205.25 | TCP | |||
| 199.175.218.82 | CA | Vancouver | TCP | |
| 0.0.92.110 | TCP | |||
| 0.0.217.65 | TCP | |||
| 0.0.192.87 | TCP | |||
| 0.0.49.42 | TCP | |||
| 0.0.240.64 | TCP | |||
| 0.0.114.156 | TCP | |||
| 0.0.31.130 | TCP | |||
| 0.0.20.103 | TCP | |||
| 0.0.233.215 | TCP | |||
| 0.0.26.124 | TCP | |||
| 147.181.83.9 | NL | TCP | ||
| 196.37.85.153 | ZA | Benoni | TCP | |
| 0.0.216.244 | TCP | |||
| 28.104.59.213 | US | TCP | ||
| 0.0.245.64 | TCP | |||
| 116.103.190.101 | VN | Hoi An | TCP | |
| 16.8.184.126 | US | Palo Alto | TCP | |
| 151.164.164.4 | US | Richardson | TCP | |
| vsat-148-70-223-190.static.spacenet.com | 148.70.223.190 | US | TCP | |
| c83-253-128-80.bredband.comhem.se | 83.253.128.80 | SE | Karlstad | TCP |
| 0.0.59.174 | TCP | |||
| 0.0.147.28 | TCP | |||
| 163.151.208.50 | US | White Plains | TCP | |
| 0.0.193.198 | TCP | |||
| 0.0.158.6 | TCP | |||
| 0.0.131.251 | TCP | |||
| 0.0.180.222 | TCP | |||
| 0.0.51.163 | TCP | |||
| 0.0.234.239 | TCP | |||
| 0.0.74.0 | TCP | |||
| 168.78.127.173 | KR | TCP | ||
| 164.23.164.66 | DE | TCP | ||
| 0.0.205.28 | TCP | |||
| 103.76.22.224 | ID | Jakarta | TCP | |
| 0.0.56.16 | TCP | |||
| 222.183.108.234 | CN | Chongqing | TCP | |
| 0.0.55.43 | TCP | |||
| 214.29.95.176 | US | TCP | ||
| 0.0.212.233 | TCP | |||
| 0.0.51.224 | TCP | |||
| 0.0.95.175 | TCP | |||
| 0.0.96.13 | TCP | |||
| 0.0.183.156 | TCP | |||
| 0.0.84.23 | TCP | |||
| 0.0.228.106 | TCP | |||
| 0.0.209.200 | TCP | |||
| 0.0.41.14 | TCP | |||
| 64.36.206.112 | US | TCP | ||
| 168.29.25.145 | US | Athens | TCP | |
| 201.216.55.133 | CO | Bogot | TCP | |
| 0.0.192.239 | TCP | |||
| 128.110.103.212 | US | Salt Lake City | TCP | |
| 133.27.116.78 | JP | TCP | ||
| p1876205-omed01.tokyo.ocn.ne.jp | 153.158.23.204 | JP | TCP | |
| 0.0.68.152 | TCP | |||
| www17031uj.sakura.ne.jp | 153.120.74.45 | JP | Osaka | TCP |
| 218.176.70.145 | JP | TCP | ||
| 0.0.75.211 | TCP | |||
| 0.0.130.215 | TCP | |||
| 0.0.103.10 | TCP | |||
| 0.0.147.194 | TCP | |||
| 29.232.71.74 | US | TCP | ||
| 0.0.28.171 | TCP | |||
| 0.0.161.189 | TCP | |||
| 0.0.176.1 | TCP | |||
| 0.0.10.177 | TCP | |||
| 0.0.216.187 | TCP | |||
| 0.0.164.49 | TCP | |||
| 0.0.13.135 | TCP | |||
| 0.0.76.0 | TCP | |||
| 0.0.136.74 | TCP | |||
| 120.147.192.40 | AU | Saint Kilda | TCP | |
| 0.0.218.96 | TCP | |||
| 0.0.160.169 | TCP | |||
| 0.0.194.64 | TCP | |||
| 0.0.130.109 | TCP | |||
| 150.181.58.95 | US | Spokane | TCP | |
| 157.243.82.177 | FR | Puteaux | TCP | |
| 0.0.85.134 | TCP | |||
| 98.137.123.235 | US | Sunnyvale | TCP | |
| 0.0.207.141 | TCP | |||
| 14.82.191.172 | KR | TCP | ||
| a104-96-80-222.deploy.static.akamaitechnologies.com | 104.96.80.222 | US | Cambridge | TCP |
| 0.0.48.3 | TCP | |||
| 0.0.45.138 | TCP | |||
| 0.0.97.37 | TCP | |||
| 0.0.206.110 | TCP | |||
| 0.0.106.232 | TCP | |||
| 198.129.58.253 | US | Berkeley | TCP | |
| 96.94.102.13 | US | Pittsburgh | TCP | |
| 0.0.1.103 | TCP | |||
| 0.0.160.167 | TCP | |||
| 0.0.87.28 | TCP | |||
| 0.0.47.33 | TCP | |||
| 0.0.166.232 | TCP | |||
| 0.0.244.32 | TCP | |||
| 0.0.121.104 | TCP | |||
| 0.0.133.48 | TCP | |||
| 0.0.190.139 | TCP | |||
| 0.0.79.234 | TCP | |||
| 0.0.252.24 | TCP | |||
| 0.0.79.99 | TCP | |||
| 0.0.14.217 | TCP | |||
| 8.174.168.57 | US | TCP | ||
| 154.207.188.142 | SC | TCP | ||
| 0.0.8.75 | TCP | |||
| softbank219203060134.bbtec.net | 219.203.60.134 | JP | TCP | |
| 0.0.254.32 | TCP | |||
| 42.53.182.48 | CN | Shenyang | TCP | |
| 156.131.39.54 | US | Washington | TCP | |
| 0.0.241.97 | TCP | |||
| cable-24-135-226-32.dynamic.sbb.rs | 24.135.226.32 | RS | Belgrade | TCP |
| 32.209.7.219 | US | Danbury | TCP | |
| 122.203.215.181 | KR | Seoul | TCP | |
| 0.0.11.44 | TCP | |||
| 0.0.105.60 | TCP | |||
| 0.0.121.136 | TCP | |||
| 0.0.152.77 | TCP | |||
| 128.1.132.209 | US | Los Angeles | TCP | |
| 0.0.89.247 | TCP | |||
| 0.0.59.16 | TCP | |||
| 0.0.134.95 | TCP | |||
| 0.0.106.174 | TCP | |||
| gen-46-226-152.videoplaza.net | 46.226.152.236 | SE | TCP | |
| 0.0.87.247 | TCP | |||
| 57.104.128.176 | FR | TCP | ||
| ip184-176-29-54.ok.ok.cox.net | 184.176.29.54 | US | TCP | |
| 0.0.102.35 | TCP | |||
| 141.131.112.89 | US | Austin | TCP | |
| 0.0.192.225 | TCP | |||
| 223.178.111.143 | IN | TCP | ||
| 0.0.162.16 | TCP | |||
| 0.0.85.83 | TCP | |||
| 0.0.201.177 | TCP | |||
| 0.0.79.46 | TCP | |||
| 0.0.112.48 | TCP | |||
| 0.0.4.46 | TCP | |||
| 101.192.17.203 | CN | Beijing | TCP | |
| 48.145.22.173 | US | Newark | TCP | |
| 0.0.217.166 | TCP | |||
| 0.0.162.13 | TCP | |||
| 159.80.63.128 | JP | TCP | ||
| 102.234.140.191 | TCP | |||
| 0.0.218.104 | TCP | |||
| bdhbee-13-97.slb.com | 137.144.13.97 | US | Houston | TCP |
| 0.0.203.93 | TCP | |||
| 0.0.7.98 | TCP | |||
| cpe-24-160-193-74.insight.res.rr.com | 24.160.193.74 | US | TCP | |
| 7.228.92.186 | US | TCP | ||
| 0.0.220.5 | TCP | |||
| 0.0.223.224 | TCP | |||
| 0.0.232.109 | TCP | |||
| 0.0.103.187 | TCP | |||
| cpe-174-106-217-88.ec.res.rr.com | 174.106.217.88 | US | Southport | TCP |
| 0.0.118.243 | TCP | |||
| 0.0.91.149 | TCP | |||
| 0.0.161.106 | TCP | |||
| 0.0.10.147 | TCP | |||
| 0.0.25.190 | TCP | |||
| 28.177.70.178 | US | TCP | ||
| 0.0.48.103 | TCP | |||
| 0.0.42.188 | TCP | |||
| 0.0.72.10 | TCP | |||
| 0.0.232.92 | TCP | |||
| 99-95-53-26.lightspeed.dybhfl.sbcglobal.net | 99.95.53.26 | US | Cocoa | TCP |
| 0.0.208.66 | TCP | |||
| 0.0.30.116 | TCP | |||
| 0.0.72.223 | TCP | |||
| 0.0.133.40 | TCP | |||
| 0.0.84.136 | TCP | |||
| 190.218.215.138 | PA | TCP | ||
| 0.0.217.70 | TCP | |||
| 0.0.73.254 | TCP | |||
| 152.53.84.76 | US | Durham | TCP | |
| 0.0.83.86 | TCP | |||
| 148.155.124.10 | US | Monroe | TCP | |
| 0.0.97.206 | TCP | |||
| 0.0.99.141 | TCP | |||
| 0.0.237.239 | TCP | |||
| 0.0.23.65 | TCP | |||
| 118.109.35.178 | JP | Tokyo | TCP | |
| non-routed-un-exposed-IP.44.146.in-addr.arpa | 146.44.232.161 | US | San Ramon | TCP |
| 0.0.160.86 | TCP | |||
| 0.0.25.102 | TCP | |||
| 197.129.60.163 | MA | TCP | ||
| 0.0.117.124 | TCP | |||
| 0.0.129.107 | TCP | |||
| 0.0.240.180 | TCP | |||
| 0.0.215.139 | TCP | |||
| 0.0.116.116 | TCP | |||
| 0.0.167.169 | TCP | |||
| 0.0.224.104 | TCP | |||
| 0.0.63.254 | TCP | |||
| 0.0.65.98 | TCP | |||
| 0.0.181.6 | TCP | |||
| cpe-104-228-204-105.maine.res.rr.com | 104.228.204.105 | US | Buxton | TCP |
| 115.172.55.54 | CN | Beijing | TCP | |
| 191-212-15-20.user3g.veloxzone.com.br | 191.212.15.20 | BR | TCP | |
| 0.0.199.153 | TCP | |||
| 166.103.179.238 | KR | TCP | ||
| 144.27.217.83 | SE | Vrbacka | TCP | |
| 0.0.248.121 | TCP | |||
| 28.203.254.172 | US | TCP | ||
| n1164965054.netvigator.com | 116.49.65.54 | HK | Sham Shui Po | TCP |
| ai126156135248.42.access-internet.ne.jp | 126.156.135.248 | JP | TCP | |
| 0.0.29.167 | TCP | |||
| 0.0.157.0 | TCP | |||
| 0.0.189.81 | TCP | |||
| 0.0.23.79 | TCP | |||
| 0.0.51.97 | TCP | |||
| 0.0.6.209 | TCP | |||
| 102.91.182.75 | TCP | |||
| 0.0.185.172 | TCP | |||
| 0.0.40.133 | TCP | |||
| 0.0.3.8 | TCP | |||
| 0.0.245.33 | TCP | |||
| 134.158.43.139 | FR | Villeurbanne | TCP | |
| 134.160.152.83 | JP | TCP | ||
| 222.218.231.253 | CN | Nanning | TCP | |
| 0.0.66.252 | TCP | |||
| 0.0.251.222 | TCP | |||
| 132.240.201.198 | TCP | |||
| KD106179110018.au-net.ne.jp | 106.179.110.18 | JP | TCP | |
| 0.0.62.56 | TCP | |||
| cpe-66-75-32-119.san.res.rr.com | 66.75.32.119 | US | San Diego | TCP |
| 215.39.149.147 | US | TCP | ||
| 0.0.127.175 | TCP | |||
| 0.0.149.244 | TCP | |||
| 0.0.183.254 | TCP | |||
| 128.147.100.92 | US | Irwin | TCP | |
| 0.0.92.7 | TCP | |||
| 206.205.221.206 | US | TCP | ||
| 0.0.155.120 | TCP | |||
| 0.0.131.21 | TCP | |||
| 0.0.163.130 | TCP | |||
| 0.0.211.108 | TCP | |||
| 91.245.209.96 | RO | TCP | ||
| 0.0.86.144 | TCP | |||
| 0.0.56.70 | TCP | |||
| 39.40.113.106 | PK | Islamabad | TCP | |
| 87.233.142.38 | NL | TCP | ||
| 0.0.145.228 | TCP | |||
| 0.0.120.211 | TCP | |||
| 0.0.182.45 | TCP | |||
| CPE1859339ef371-CM1859339ef36e.cpe.net.cable.rogers.com | 174.119.113.234 | CA | Kitchener | TCP |
| 0.0.223.223 | TCP | |||
| 0.0.150.40 | TCP | |||
| 0.0.153.183 | TCP | |||
| 0.0.161.17 | TCP | |||
| 0.0.60.202 | TCP | |||
| 0.0.12.151 | TCP | |||
| 0.0.206.41 | TCP | |||
| 0.0.100.70 | TCP | |||
| 0.0.198.221 | TCP | |||
| 0.0.164.163 | TCP | |||
| 0.0.44.15 | TCP | |||
| p9210-ipngn3901funabasi.chiba.ocn.ne.jp | 153.223.40.210 | JP | Yachiyo | TCP |
| 0.0.113.167 | TCP | |||
| 0.0.2.106 | TCP | |||
| 93.68.62.81 | IT | TCP | ||
| 0.0.17.69 | TCP | |||
| 0.0.78.25 | TCP | |||
| 143.77.193.32 | US | Fort Huachuca | TCP | |
| 0.0.129.233 | TCP | |||
| 27.203.177.103 | CN | Jinan | TCP | |
| 0.0.179.135 | TCP | |||
| 0.0.93.74 | TCP | |||
| 156.131.144.60 | US | Washington | TCP | |
| 31.166.143.39 | SA | Riyadh | TCP | |
| 163.248.185.10 | US | Sandy | TCP | |
| 0.0.111.218 | TCP | |||
| 0.0.192.171 | TCP | |||
| 0.0.20.138 | TCP | |||
| 0.0.247.233 | TCP | |||
| 165.82.31.165 | US | Haverford | TCP | |
| 0.0.16.190 | TCP | |||
| 0.0.135.231 | TCP | |||
| 0.0.101.44 | TCP | |||
| 0.0.83.109 | TCP | |||
| 0.0.230.235 | TCP | |||
| 0.0.203.203 | TCP | |||
| host-219-71-57-54.dynamic.kbtelecom.net | 219.71.57.54 | TW | TCP | |
| 202.175.208.206 | PH | TCP | ||
| unallocated-static.rogers.com | 72.143.36.152 | CA | Brampton | TCP |
| 0.0.206.94 | TCP | |||
| 204.32.73.199 | US | TCP | ||
| 179.0.221.100 | CR | Heredia | TCP | |
| 0.0.178.141 | TCP | |||
| 0.0.184.171 | TCP | |||
| 0.0.200.228 | TCP | |||
| 0.0.231.9 | TCP | |||
| 0.0.246.94 | TCP | |||
| 0.0.46.183 | TCP | |||
| 0.0.59.42 | TCP | |||
| 0.0.228.116 | TCP | |||
| 0.0.165.77 | TCP | |||
| 183.cpe-190-155-118.gye.satnet.net | 190.155.118.183 | EC | Guayaquil | TCP |
| host-32-net-17.astra.od.ua | 91.197.17.32 | UA | Odessa | TCP |
| 63.174.165.39 | US | TCP | ||
| 0.0.182.89 | TCP | |||
| 0.0.121.70 | TCP | |||
| 0.0.216.219 | TCP | |||
| 0.0.190.2 | TCP | |||
| 0.0.104.172 | TCP | |||
| 99-43-190-105.lightspeed.moblal.sbcglobal.net | 99.43.190.105 | US | Pensacola | TCP |
| 0.0.242.249 | TCP | |||
| 0.0.241.66 | TCP | |||
| 0.0.116.194 | TCP | |||
| 82.100.187.146 | SY | TCP | ||
| host205110.usmc.mil | 205.110.233.248 | US | Virginia Beach | TCP |
| p50805F4A.dip0.t-ipconnect.de | 80.128.95.74 | DE | Wiesbaden | TCP |
| 34.109.171.254 | US | TCP | ||
| 0.0.149.165 | TCP | |||
| 0.0.28.82 | TCP | |||
| BVI484.edge-a-asr.fac001.algartelecom.com.br | 187.72.185.58 | BR | TCP | |
| 130.180.147.1 | SY | TCP | ||
| 0.0.31.138 | TCP | |||
| 0.0.53.26 | TCP | |||
| 190-180-233-109.bas.movistar.cl | 190.180.233.109 | CL | TCP | |
| 0.0.132.120 | TCP | |||
| 0.0.52.212 | TCP | |||
| 0.0.1.56 | TCP | |||
| p1041063-omed01.tokyo.ocn.ne.jp | 153.248.48.63 | JP | TCP | |
| dsl-189-176-120-162-dyn.prod-infinitum.com.mx | 189.176.120.162 | MX | Heroica Guaymas | TCP |
| 0.0.243.228 | TCP | |||
| 0.0.111.140 | TCP | |||
| 0.0.15.94 | TCP | |||
| 0.0.27.233 | TCP | |||
| 0.0.18.151 | TCP | |||
| host148-187-static.23-80-b.business.telecomitalia.it | 80.23.187.148 | IT | TCP | |
| 0.0.151.241 | TCP | |||
| 0.0.20.253 | TCP | |||
| 0.0.7.44 | TCP | |||
| 0.0.105.238 | TCP | |||
| 47-48-135-17.static.leds.al.charter.com | 47.48.135.17 | US | Opelika | TCP |
| 112.94.15.141 | CN | Guangzhou | TCP | |
| 0.0.2.111 | TCP | |||
| 0.0.89.83 | TCP | |||
| 0.0.73.48 | TCP | |||
| 208.34.143.95 | US | TCP | ||
| 18.17.160.196 | US | Cambridge | TCP | |
| 0.0.131.145 | TCP | |||
| 0.0.143.149 | TCP | |||
| 0.0.235.204 | TCP | |||
| 0.0.243.192 | TCP | |||
| 0.0.124.215 | TCP | |||
| 0.0.155.51 | TCP | |||
| 0.0.163.43 | TCP | |||
| 0.0.37.224 | TCP | |||
| 0.0.111.201 | TCP | |||
| 0.0.81.70 | TCP | |||
| 0.0.204.171 | TCP | |||
| 0.0.28.31 | TCP | |||
| 131.108.237.203 | BR | TCP | ||
| 0.0.229.215 | TCP | |||
| 0.0.74.166 | TCP | |||
| no-dns-yet.demon.co.uk | 212.228.40.117 | GB | TCP | |
| 0.0.74.120 | TCP | |||
| 210.87.170.214 | CN | Taiyuan | TCP | |
| 158.234.222.211 | GB | Reading | TCP | |
| 184.16.251.220 | US | Fort Wayne | TCP | |
| 0.0.182.236 | TCP | |||
| 0.0.182.104 | TCP | |||
| 58.212.74.202 | CN | Nanjing | TCP | |
| 0.0.27.71 | TCP | |||
| 0.0.154.60 | TCP | |||
| 25.0.197.178.dynamic.wline.res.cust.swisscom.ch | 178.197.0.25 | CH | TCP | |
| 0.0.69.138 | TCP | |||
| 0.0.167.183 | TCP | |||
| 0.0.226.193 | TCP | |||
| 0.0.139.77 | TCP | |||
| 0.0.90.209 | TCP | |||
| 0.0.253.229 | TCP | |||
| 0.0.18.254 | TCP | |||
| 0.0.116.24 | TCP | |||
| 0.0.76.223 | TCP | |||
| 0.0.88.57 | TCP | |||
| 1.225.249.102 | KR | Anyang | TCP | |
| 88.251.174.151 | TR | Denizli | TCP | |
| 149.111.25.73 | US | Plymouth | TCP | |
| 0.0.8.142 | TCP | |||
| 204.3.112.30 | US | Englewood | TCP | |
| adsl-68-253-159-250.dsl.emhril.ameritech.net | 68.253.159.250 | US | Louisville | TCP |
| 0.0.42.81 | TCP | |||
| 0.0.146.9 | TCP | |||
| 0.0.66.163 | TCP | |||
| 0.0.92.208 | TCP | |||
| 0.0.218.142 | TCP | |||
| 0.0.248.123 | TCP | |||
| 0.0.69.126 | TCP | |||
| 0.0.130.181 | TCP | |||
| 0.0.48.101 | TCP | |||
| 55.104.165.189 | US | Fort Huachuca | TCP | |
| c-73-14-64-200.hsd1.co.comcast.net | 73.14.64.200 | US | Loveland | TCP |
| 156.247.1.195 | ZA | Johannesburg | TCP | |
| 0.0.204.75 | TCP | |||
| 0.0.59.212 | TCP | |||
| 85.196.60.178 | GR | TCP | ||
| 0.0.136.167 | TCP | |||
| 0.0.108.167 | TCP | |||
| 0.0.236.230 | TCP | |||
| 0.0.74.203 | TCP | |||
| 37.154.191.43 | TR | Istanbul | TCP | |
| 0.0.12.212 | TCP | |||
| 0.0.70.212 | TCP | |||
| 0.0.153.93 | TCP | |||
| 0.0.220.234 | TCP | |||
| 0.0.175.50 | TCP | |||
| 0.0.6.126 | TCP | |||
| host-107.18-235-182.cable.dynamic.kbtelecom.net | 182.235.18.107 | TW | TCP | |
| 184-231-171-184.pools.spcsdns.net | 184.231.171.184 | US | TCP | |
| 140.119.127.219 | TW | TCP | ||
| 0.0.143.144 | TCP | |||
| host86-167-66-65.range86-167.btcentralplus.com | 86.167.66.65 | GB | Dumfries | TCP |
| 0.0.87.69 | TCP | |||
| 0.0.173.72 | TCP | |||
| cpe-76-182-161-92.sc.res.rr.com | 76.182.161.92 | US | Myrtle Beach | TCP |
| 106.34.224.44 | CN | Zhengzhou | TCP | |
| 0.0.99.64 | TCP | |||
| 0.0.138.100 | TCP | |||
| 0.0.63.84 | TCP | |||
| 36.128.250.82 | CN | TCP | ||
| 33.169.185.136 | US | TCP | ||
| 0.0.41.47 | TCP | |||
| 0.0.217.81 | TCP | |||
| 0.0.21.164 | TCP | |||
| 0.0.2.129 | TCP | |||
| 17.29.174.234 | US | Cupertino | TCP | |
| 0.0.90.200 | TCP | |||
| 0.0.87.157 | TCP | |||
| 0.0.187.43 | TCP | |||
| 0.0.176.250 | TCP | |||
| 204-98-212-50.dia.static.qwest.net | 204.98.212.50 | FR | Paris | TCP |
| 111-252-32-105.dynamic-ip.hinet.net | 111.252.32.105 | TW | Taichung | TCP |
| 0.0.106.206 | TCP | |||
| 0.0.253.192 | TCP | |||
| 0.0.35.102 | TCP | |||
| 22.130.156.70 | US | TCP | ||
| 22.99.103.57 | US | TCP | ||
| 0.0.202.147 | TCP | |||
| 0.0.228.124 | TCP | |||
| 0.0.62.176 | TCP | |||
| 0.0.218.227 | TCP | |||
| 0.0.185.105 | TCP | |||
| 0.0.103.144 | TCP | |||
| 0.0.133.26 | TCP | |||
| 0.0.206.57 | TCP | |||
| 0.0.248.224 | TCP | |||
| 17.62.111.101 | US | Cupertino | TCP | |
| 0.0.41.221 | TCP | |||
| 0.0.95.183 | TCP | |||
| 0.0.177.198 | TCP | |||
| 0.0.252.217 | TCP | |||
| lvps80-237-167-148.dedicated.hosteurope.de | 80.237.167.148 | DE | Hst | TCP |
| 0.0.194.246 | TCP | |||
| 182.221.76.146 | KR | Seoul | TCP | |
| 108-252-91-109.lightspeed.irvnca.sbcglobal.net | 108.252.91.109 | US | Torrance | TCP |
| 0.0.144.71 | TCP | |||
| 0.0.170.203 | TCP | |||
| 16.139.95.41 | US | Palo Alto | TCP | |
| 59.241.91.129 | CN | Beijing | TCP | |
| 0.0.17.71 | TCP | |||
| t3c2-ge0-1-2.fi-hel.eu.bt.net | 166.49.194.140 | GB | London | TCP |
| 0.0.225.209 | TCP | |||
| 0.0.205.177 | TCP | |||
| 0.0.95.105 | TCP | |||
| 0.0.135.128 | TCP | |||
| 0.0.13.11 | TCP | |||
| 0.0.126.250 | TCP | |||
| 17.220.51.103 | US | Cupertino | TCP | |
| 0.0.119.151 | TCP | |||
| 0.0.10.44 | TCP | |||
| 0.0.107.19 | TCP | |||
| 0.0.138.106 | TCP | |||
| 141.174.229.187 | US | Woodland | TCP | |
| 180.8.73.132 | JP | TCP | ||
| 139.12.115.216 | DE | Bonn | TCP | |
| 0.0.192.76 | TCP | |||
| 156.106.111.102 | CH | Geneva | TCP | |
| 207.4.82.135 | US | Biscoe | TCP | |
| 0.0.140.205 | TCP | |||
| 0.0.31.178 | TCP | |||
| 0.0.145.89 | TCP | |||
| 0.0.110.249 | TCP | |||
| 0.0.114.99 | TCP | |||
| 0.0.3.167 | TCP | |||
| 0.0.133.12 | TCP | |||
| 0.0.2.190 | TCP | |||
| 0.0.197.77 | TCP | |||
| 23.143.1.12 | TCP | |||
| dyndsl-178-142-106-056.ewe-ip-backbone.de | 178.142.106.56 | DE | Schwarme | TCP |
| 160.78.48.239 | IT | Parma | TCP | |
| 0.0.124.242 | TCP | |||
| 0.0.52.9 | TCP | |||
| 0.0.104.47 | TCP | |||
| 0.0.210.9 | TCP | |||
| 0.0.219.87 | TCP | |||
| 146.158.55.191 | RU | Noyabrsk | TCP | |
| 0.0.239.112 | TCP | |||
| 0.0.14.126 | TCP | |||
| 0.0.59.169 | TCP | |||
| ACC83B06.ipt.aol.com | 172.200.59.6 | GB | TCP | |
| cpe-70-94-109-240.kc.res.rr.com | 70.94.109.240 | US | Gardner | TCP |
| 35.88.145.42 | US | Ann Arbor | TCP | |
| 8.124.38.69 | US | TCP | ||
| 0.0.232.21 | TCP | |||
| 0.0.191.142 | TCP | |||
| 0.0.40.223 | TCP | |||
| 147.168.223.195 | US | TCP | ||
| 0.0.81.151 | TCP | |||
| 0.0.158.172 | TCP | |||
| 134.5.40.48 | US | Denver | TCP | |
| 0.0.17.180 | TCP | |||
| 0.0.137.223 | TCP | |||
| 168.253.29.119 | LR | TCP | ||
| 21.23.81.180 | US | TCP | ||
| 0.0.65.196 | TCP | |||
| 0.0.3.12 | TCP | |||
| 0.0.32.109 | TCP | |||
| dsl-206-131-113-40.dsl.ties2.net | 206.131.113.40 | US | Saint Paul | TCP |
| 0.0.152.166 | TCP | |||
| 0.0.206.183 | TCP | |||
| 11.236.10.18 | US | TCP | ||
| 0.0.168.253 | TCP | |||
| 0.0.235.154 | TCP | |||
| 44.211.19.103 | US | San Diego | TCP | |
| 0.0.3.174 | TCP | |||
| 0.0.82.157 | TCP | |||
| 0.0.11.220 | TCP | |||
| 177.130.121.116 | BR | So Paulo | TCP | |
| 28.38.232.58 | US | TCP | ||
| 0.0.134.127 | TCP | |||
| 0.0.119.116 | TCP | |||
| 0.0.217.150 | TCP | |||
| 0.0.5.40 | TCP | |||
| cu0063b.smtpx.saremail.com | 195.16.156.62 | ES | TCP | |
| dsl-208-102-56-10.fuse.net | 208.102.56.10 | US | TCP | |
| 0.0.80.21 | TCP | |||
| 0.0.51.209 | TCP | |||
| 0.0.126.52 | TCP | |||
| 0.0.119.84 | TCP | |||
| 0.0.169.116 | TCP | |||
| 0.0.222.203 | TCP | |||
| 0.0.12.167 | TCP | |||
| 0.0.7.221 | TCP | |||
| 181.250.196.37 | CO | TCP | ||
| 0.0.170.63 | TCP | |||
| 0.0.72.27 | TCP | |||
| 0.0.60.180 | TCP | |||
| 0.0.170.221 | TCP | |||
| 0.0.10.134 | TCP | |||
| 161.48.179.101 | FR | Provins | TCP | |
| ADijon-656-1-156-225.w90-33.abo.wanadoo.fr | 90.33.191.225 | FR | Luxeuil-les-bains | TCP |
| 0.0.164.144 | TCP | |||
| 0.0.110.133 | TCP | |||
| 16.48.86.208 | US | Palo Alto | TCP | |
| 45.82.194.231 | TCP | |||
| 0.0.71.80 | TCP | |||
| 134.190.10.220 | CA | Halifax | TCP | |
| 0.0.56.84 | TCP | |||
| pl37843.ag1212.nttpc.ne.jp | 157.65.241.211 | JP | Fukuoka | TCP |
| 0.0.95.238 | TCP | |||
| 0.0.62.164 | TCP | |||
| 0.0.235.147 | TCP | |||
| 0.0.43.144 | TCP | |||
| 0.0.187.34 | TCP | |||
| 0.0.243.254 | TCP | |||
| 0.0.89.151 | TCP | |||
| 0.0.49.34 | TCP | |||
| 0.0.123.61 | TCP | |||
| 0.0.227.135 | TCP | |||
| 0.0.193.217 | TCP | |||
| softbank126003062138.bbtec.net | 126.3.62.138 | JP | TCP | |
| 33-137-92-64.skybeam.com | 64.92.137.33 | US | Rifle | TCP |
| 9.30.117.16 | US | Durham | TCP | |
| 0.0.184.170 | TCP | |||
| 0.0.50.156 | TCP | |||
| 0.0.102.128 | TCP | |||
| 145.243.79.79 | DE | TCP | ||
| p549C4B30.dip0.t-ipconnect.de | 84.156.75.48 | DE | Hamburg | TCP |
| 0.0.100.252 | TCP | |||
| 0.0.213.106 | TCP | |||
| 0.0.172.188 | TCP | |||
| 0.0.192.194 | TCP | |||
| 0.0.202.203 | TCP | |||
| 0.0.52.54 | TCP | |||
| 99-38-146-211.lightspeed.hstntx.sbcglobal.net | 99.38.146.211 | US | TCP | |
| 160.131.161.155 | US | Bainbridge | TCP | |
| 99-35-101-119.lightspeed.livnmi.sbcglobal.net | 99.35.101.119 | US | Farmington | TCP |
| 0.0.144.155 | TCP | |||
| 0.0.150.201 | TCP | |||
| 0.0.70.184 | TCP | |||
| 193.185.134.187 | FI | TCP | ||
| 0.0.4.252 | TCP | |||
| 0.0.240.194 | TCP | |||
| 0.0.187.84 | TCP | |||
| 0.0.194.130 | TCP | |||
| 0.0.29.105 | TCP | |||
| 143.190.63.48 | US | TCP | ||
| 57.70.37.2 | AU | TCP | ||
| 119.193.212.119 | KR | Seoul | TCP | |
| 174-134-118-199.res.bhn.net | 174.134.118.199 | US | Bakersfield | TCP |
| 0.0.156.172 | TCP | |||
| 0.0.22.208 | TCP | |||
| 0.0.118.48 | TCP | |||
| 202.76.147.164.dynamic.rev.eftel.com | 202.76.147.164 | AU | Brisbane | TCP |
| 0.0.91.91 | TCP | |||
| 0.0.47.225 | TCP | |||
| 156.115.25.183 | CH | Zurich | TCP | |
| 0.0.64.183 | TCP | |||
| 0.0.244.239 | TCP | |||
| 0.0.226.198 | TCP | |||
| 10.117.233.75 | TCP | |||
| 0.0.214.207 | TCP | |||
| 0.0.193.167 | TCP | |||
| 0.0.69.199 | TCP | |||
| 101.194.107.207 | CN | Beijing | TCP | |
| 179.188.136.94 | BR | TCP | ||
| 200-168-105-92.dsl.telesp.net.br | 200.168.105.92 | BR | TCP | |
| 0.0.201.125 | TCP | |||
| 0.0.204.16 | TCP | |||
| 0.0.209.203 | TCP | |||
| 175.117.65.169 | KR | TCP | ||
| 0.0.240.31 | TCP | |||
| 0.0.199.178 | TCP | |||
| 0.0.254.93 | TCP | |||
| 218.219.197.52 | JP | TCP | ||
| 184.38.76.10 | US | Slidell | TCP | |
| 0.0.156.15 | TCP | |||
| 0.0.9.37 | TCP | |||
| 10.79.34.168 | TCP | |||
| 121.238.219.178 | CN | Nanjing | TCP | |
| 0.0.35.154 | TCP | |||
| 0.0.219.0 | TCP | |||
| 0.0.233.109 | TCP | |||
| 0.0.175.19 | TCP | |||
| 0.0.145.116 | TCP | |||
| 0.0.153.226 | TCP | |||
| 0.0.15.127 | TCP | |||
| 0.0.234.194 | TCP | |||
| 0.0.170.8 | TCP | |||
| 0.0.191.57 | TCP | |||
| 0.0.139.143 | TCP | |||
| 0.0.4.169 | TCP | |||
| 0.0.113.194 | TCP | |||
| 0.0.65.230 | TCP | |||
| 90.251.160.46 | GB | TCP | ||
| 0.0.222.173 | TCP | |||
| 136.18.53.23 | US | Dearborn | TCP | |
| 0.0.44.76 | TCP | |||
| 173-12-174-132-oregon.hfc.comcastbusiness.net | 173.12.174.132 | US | Portland | TCP |
| 175.157.182.60.broad.jh.zj.dynamic.163data.com.cn | 60.182.157.175 | CN | Jinhua | TCP |
| 0.0.113.100 | TCP | |||
| 0.0.207.46 | TCP | |||
| 86.188.213.148 | GB | TCP | ||
| mail.lintasarta.co.id | 202.152.1.148 | ID | Jakarta | TCP |
| 0.0.122.250 | TCP | |||
| 0.0.186.150 | TCP | |||
| 0.0.155.202 | TCP | |||
| 0.0.21.242 | TCP | |||
| 0.0.5.114 | TCP | |||
| 0.0.205.68 | TCP | |||
| 70.251.72.37 | US | TCP | ||
| 0.0.116.138 | TCP | |||
| 0.0.187.206 | TCP | |||
| 0.0.20.222 | TCP | |||
| 0.0.146.126 | TCP | |||
| 0.0.105.89 | TCP | |||
| 0.0.101.50 | TCP | |||
| 195.215.245.231 | DK | Humlebk | TCP | |
| 0.0.176.99 | TCP | |||
| 0.0.155.153 | TCP | |||
| 125.62.11.50 | CN | Beijing | TCP | |
| 44.205.6.102 | US | San Diego | TCP | |
| 0.0.93.72 | TCP | |||
| 0.0.61.15 | TCP | |||
| softbank126004134147.bbtec.net | 126.4.134.147 | JP | Osaka | TCP |
| 58.154.25.153 | CN | Shenyang | TCP | |
| 0.0.142.40 | TCP | |||
| 0.0.121.131 | TCP | |||
| 0.0.4.168 | TCP | |||
| 0.0.36.89 | TCP | |||
| 0.0.164.122 | TCP | |||
| 0.0.41.55 | TCP | |||
| 0.0.23.211 | TCP | |||
| 0.0.22.75 | TCP | |||
| 194.178.242.43 | NL | TCP | ||
| 177.red-79-144-220.dynamicip.rima-tde.net | 79.144.220.177 | ES | Baralla | TCP |
| cau33-2-82-225-78-56.fbx.proxad.net | 82.225.78.56 | FR | Bordeaux | TCP |
| 0.0.215.191 | TCP | |||
| 0.0.104.143 | TCP | |||
| 0.0.120.49 | TCP | |||
| 0.0.132.111 | TCP | |||
| 40.27.147.254 | US | TCP | ||
| 0.0.231.197 | TCP | |||
| 0.0.47.218 | TCP | |||
| 154.35.193.164 | US | TCP | ||
| 0.0.152.200 | TCP | |||
| 0.0.92.1 | TCP | |||
| 0.0.96.128 | TCP | |||
| 0.0.204.195 | TCP | |||
| 0.0.108.198 | TCP | |||
| 177.25.17.151 | BR | TCP | ||
| 222.40.106.85 | CN | Beijing | TCP | |
| c1.44.5646.static.theplanet.com | 70.86.68.193 | US | Houston | TCP |
| 58-block.connectregus.com | 75.103.58.82 | US | Addison | TCP |
| adsl-184-32-120-250.mia.bellsouth.net | 184.32.120.250 | US | Miami | TCP |
| 0.0.145.96 | TCP | |||
| 0.0.129.250 | TCP | |||
| 158.26.152.151.duarte.coh.org | 151.152.26.158 | US | Duarte | TCP |
| 0.0.252.41 | TCP | |||
| 0.0.17.140 | TCP | |||
| 0.0.163.250 | TCP | |||
| 194.160.141.41 | SK | TCP | ||
| 0.0.231.39 | TCP | |||
| 0.0.144.63 | TCP | |||
| 131.150.225.249 | CA | Ottawa | TCP |
| Information | Value |
|---|---|
| ID | #1 |
| File Name | c:\users\dssdpmx042\desktop\wanadecrypt0r.bin.exe |
| Command Line | "C:\Users\DSsDPMx042\Desktop\WanaDecrypt0r.bin.exe" |
| Initial Working Directory | C:\Users\DSsDPMx042\Desktop |
| Monitor | Start Time: 00:00:21, Reason: Analysis Target |
| Unmonitor | End Time: 00:01:03, Reason: Terminated |
| Monitor Duration | 00:00:42 |
| Information | Value |
|---|---|
| PID | 0x924 |
| Parent PID | 0x4fc (c:\windows\explorer.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | High (Elevated) |
| Username | N3EERVTWSM\DSsDPMx042 |
| Groups |
|
| Enabled Privileges | SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege |
| Thread IDs |
0x
928
0x
934
0x
938
0x
93C
0x
940
0x
944
0x
948
|
| Filename | File Size | Hash Values | YARA Match | Actions |
|---|---|---|---|---|
| c:\windows\tasksche.exe | 3.35 MB (3514368 bytes) |
MD5:
84c82835a5d21bbcf75a61706d8ab549
SHA1: 5ff465afaabcbf0150d1a3ab2c2e74f3a4426467 SHA256: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa |
|
|
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| CREATE | c:\windows\tasksche.exe | desired_access = GENERIC_WRITE, create_disposition = CREATE_ALWAYS, file_attributes = FILE_ATTRIBUTE_SYSTEM |
|
1 | |
| MOVE | c:\windows\qeriuwjhrf | source_file_name = c:\windows\tasksche.exe |
|
1 | |
| WRITE | c:\windows\tasksche.exe | size = 3514368 |
|
1 |
| Operation | Process Name | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| CREATE | C:\WINDOWS\tasksche.exe \i | os_tid = 0x9bc, os_pid = 0x9b8, creation_flags = CREATE_NO_WINDOW, startup_flags = STARTF_USESHOWWINDOW, STARTF_FORCEOFFFEEDBACK, show_window = SW_HIDE |
|
1 |
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| GET_HANDLE | c:\users\dssdpmx042\desktop\wanadecrypt0r.bin.exe | base_address = 0x400000 |
|
1 | |
| GET_HANDLE | c:\windows\system32\kernel32.dll | base_address = 0x75d30000 |
|
1 | |
| GET_FILENAME | C:\Users\DSsDPMx042\Desktop\WanaDecrypt0r.bin.exe |
|
1 | ||
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = CreateProcessA, address = 0x75d32082 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = CreateFileA, address = 0x75d7cee8 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = WriteFile, address = 0x75d81400 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = CloseHandle, address = 0x75d7ca7c |
|
1 |
| Operation | Service | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| OPEN_MGR | SERVICES_ACTIVE_DATABASE | host = Localhost, desired_access = SC_MANAGER_CONNECT, SC_MANAGER_CREATE_SERVICE, SC_MANAGER_ENUMERATE_SERVICE, SC_MANAGER_LOCK, SC_MANAGER_QUERY_LOCK_STATUS, SC_MANAGER_MODIFY_BOOT_CONFIG, DELETE, READ_CONTROL, WRITE_DAC, WRITE_OWNER |
|
1 | |
| CREATE | mssecsvc2.0 | file_name = C:\Users\DSsDPMx042\Desktop\WanaDecrypt0r.bin.exe -m security, database_name = SERVICES_ACTIVE_DATABASE, display_name = Microsoft Security Center (2.0) Service, desired_access = SERVICE_QUERY_CONFIG, SERVICE_CHANGE_CONFIG, SERVICE_QUERY_STATUS, SERVICE_ENUMERATE_DEPENDENTS, SERVICE_START, SERVICE_STOP, SERVICE_PAUSE_CONTINUE, SERVICE_INTERROGATE, SERVICE_USER_DEFINED_CONTROL, DELETE, READ_CONTROL, WRITE_DAC, WRITE_OWNER, service_type = SERVICE_WIN32_OWN_PROCESS, start_type = SERVICE_AUTO_START |
|
1 | |
| START | mssecsvc2.0 | parameters = 0 |
|
1 |
| Remote Address | Remote Port | Username | Password | Success | Count |
|---|---|---|---|---|---|
| www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com | 80 |
|
1 |
| Method | URL | Success | Count |
|---|---|---|---|
| GET | http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com |
|
1 |
| Remote Address | Remote Port | L7Protocol | Success | Count |
|---|---|---|---|---|
| www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com | 80 | http |
|
1 |
| Information | Value |
|---|---|
| ID | #2 |
| File Name | c:\windows\system32\svchost.exe |
| Command Line | C:\Windows\system32\svchost.exe -k LocalService |
| Initial Working Directory | C:\Windows\system32 |
| Monitor | Start Time: 00:00:36, Reason: RPC Server |
| Unmonitor | End Time: 00:04:59, Reason: Terminated by Timeout |
| Monitor Duration | 00:04:23 |
| Remarks | No high level activity detected in monitored regions |
| Information | Value |
|---|---|
| PID | 0x3f4 |
| Parent PID | 0x1d4 (c:\windows\system32\services.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\Local Service |
| Groups |
|
| Enabled Privileges | SeSystemtimePrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege |
| Thread IDs |
0x
838
0x
834
0x
7C8
0x
7C4
0x
7A0
0x
790
0x
778
0x
768
0x
764
0x
6B8
0x
4D8
0x
428
0x
418
0x
40C
0x
408
0x
404
0x
3F8
0x
CD8
0x
8A4
0x
B8
0x
BC
0x
910
0x
924
0x
9FC
0x
A80
0x
A0C
0x
ABC
0x
B04
0x
DE4
0x
DF8
0x
E38
0x
E98
0x
EC8
0x
F00
0x
850
0x
828
0x
4E4
|
| Name | Start VA | End VA | Type | Permissions | Monitored | Dump | YARA Match | Actions |
|---|---|---|---|---|---|---|---|---|
| pagefile_0x0000000000010000 | 0x00010000 | 0x0001ffff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000020000 | 0x00020000 | 0x00026fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x0000000000030000 | 0x00030000 | 0x00033fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x0000000000040000 | 0x00040000 | 0x00040fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x0000000000050000 | 0x00050000 | 0x00051fff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000060000 | 0x00060000 | 0x00060fff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000070000 | 0x00070000 | 0x000affff | Private Memory | Readable, Writable |
|
|
|
|
| locale.nls | 0x000b0000 | 0x00116fff | Memory Mapped File | Readable |
|
|
|
|
| private_0x0000000000120000 | 0x00120000 | 0x00120fff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000130000 | 0x00130000 | 0x00130fff | Pagefile Backed Memory | Readable |
|
|
|
|
| es.dll | 0x00140000 | 0x0014ffff | Memory Mapped File | Readable |
|
|
|
|
| svchost.exe | 0x00150000 | 0x00157fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| pagefile_0x0000000000160000 | 0x00160000 | 0x00227fff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x0000000000230000 | 0x00230000 | 0x0026ffff | Private Memory | Readable, Writable |
|
|
|
|
| stdole2.tlb | 0x00270000 | 0x00273fff | Memory Mapped File | Readable |
|
|
|
|
| private_0x0000000000280000 | 0x00280000 | 0x0037ffff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000380000 | 0x00380000 | 0x00480fff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x0000000000490000 | 0x00490000 | 0x004cffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x00000000004d0000 | 0x004d0000 | 0x004dffff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x00000000004e0000 | 0x004e0000 | 0x0055ffff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x0000000000560000 | 0x00560000 | 0x00952fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x0000000000960000 | 0x00960000 | 0x00961fff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x0000000000970000 | 0x00970000 | 0x00970fff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x00000000009a0000 | 0x009a0000 | 0x00a1ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000a30000 | 0x00a30000 | 0x00a6ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000a70000 | 0x00a70000 | 0x00aaffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000af0000 | 0x00af0000 | 0x00b2ffff | Private Memory | Readable, Writable |
|
|
|
|
| sortdefault.nls | 0x00b30000 | 0x00dfefff | Memory Mapped File | Readable |
|
|
|
|
| private_0x0000000000e00000 | 0x00e00000 | 0x00e3ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000e40000 | 0x00e40000 | 0x00e7ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000e90000 | 0x00e90000 | 0x00e9ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000ed0000 | 0x00ed0000 | 0x00f0ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000f10000 | 0x00f10000 | 0x00f4ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000fc0000 | 0x00fc0000 | 0x00ffffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000001020000 | 0x01020000 | 0x0105ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x00000000010d0000 | 0x010d0000 | 0x0110ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000001110000 | 0x01110000 | 0x0114ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000001150000 | 0x01150000 | 0x0124ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000001250000 | 0x01250000 | 0x0125ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000001290000 | 0x01290000 | 0x012cffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000001340000 | 0x01340000 | 0x0137ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000001380000 | 0x01380000 | 0x0147ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000001480000 | 0x01480000 | 0x014bffff | Private Memory | Readable, Writable |
|
|
|
|
| kernelbase.dll.mui | 0x014c0000 | 0x0157ffff | Memory Mapped File | Readable, Writable |
|
|
|
|
| private_0x0000000001640000 | 0x01640000 | 0x0167ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000001690000 | 0x01690000 | 0x016cffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000001820000 | 0x01820000 | 0x0182ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x00000000019f0000 | 0x019f0000 | 0x01a2ffff | Private Memory | Readable, Writable |
|
|
|
|
| w32time.dll | 0x6f660000 | 0x6f6a9fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| vmictimeprovider.dll | 0x70450000 | 0x70461fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| wdi.dll | 0x70f90000 | 0x70fa4fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| webio.dll | 0x710d0000 | 0x7111efff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| winhttp.dll | 0x71120000 | 0x71177fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| wer.dll | 0x71bf0000 | 0x71c50fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| apphelp.dll | 0x72190000 | 0x721dbfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| dhcpcsvc.dll | 0x727a0000 | 0x727b1fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| dhcpcsvc6.dll | 0x727c0000 | 0x727ccfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| fwpuclnt.dll | 0x727f0000 | 0x72827fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| winrnr.dll | 0x733f0000 | 0x733f7fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| pnrpnsp.dll | 0x73400000 | 0x73411fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| napinsp.dll | 0x73430000 | 0x7343ffff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| sfc_os.dll | 0x73570000 | 0x7357cfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| sfc.dll | 0x73580000 | 0x73582fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| aepic.dll | 0x73590000 | 0x735a1fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| perftrack.dll | 0x735b0000 | 0x7363ffff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| npmproxy.dll | 0x73660000 | 0x73667fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| rasadhlp.dll | 0x73750000 | 0x73755fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| netprofm.dll | 0x738e0000 | 0x73939fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| nsisvc.dll | 0x73ce0000 | 0x73ce7fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| winnsi.dll | 0x73d20000 | 0x73d26fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| iphlpapi.dll | 0x73d30000 | 0x73d4bfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| es.dll | 0x73d60000 | 0x73da6fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| dsrole.dll | 0x73dc0000 | 0x73dc8fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| nlaapi.dll | 0x73e70000 | 0x73e7ffff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| dwmapi.dll | 0x74520000 | 0x74532fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| version.dll | 0x74f40000 | 0x74f48fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| wshtcpip.dll | 0x74fd0000 | 0x74fd4fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| gpapi.dll | 0x75080000 | 0x75095fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| userenv.dll | 0x750a0000 | 0x750b6fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| credssp.dll | 0x75190000 | 0x75197fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| rsaenh.dll | 0x75260000 | 0x7529afff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| logoncli.dll | 0x75310000 | 0x75331fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| dnsapi.dll | 0x75340000 | 0x75383fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| wship6.dll | 0x75470000 | 0x75475fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| mswsock.dll | 0x75480000 | 0x754bbfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| cryptsp.dll | 0x754c0000 | 0x754d5fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| cryptdll.dll | 0x756d0000 | 0x756e0fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| secur32.dll | 0x75900000 | 0x75907fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| sspicli.dll | 0x75920000 | 0x7593afff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| cryptbase.dll | 0x75940000 | 0x7594bfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| sxs.dll | 0x75950000 | 0x759aefff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| rpcrtremote.dll | 0x759e0000 | 0x759edfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| profapi.dll | 0x759f0000 | 0x759fafff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| kernelbase.dll | 0x75c10000 | 0x75c59fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| kernel32.dll | 0x75d30000 | 0x75e03fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| imm32.dll | 0x75e10000 | 0x75e2efff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| user32.dll | 0x75f70000 | 0x76038fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| rpcrt4.dll | 0x76220000 | 0x762c0fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| ole32.dll | 0x762d0000 | 0x7642bfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| ws2_32.dll | 0x77080000 | 0x770b4fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| clbcatq.dll | 0x770c0000 | 0x77142fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| oleaut32.dll | 0x77150000 | 0x771defff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| usp10.dll | 0x771e0000 | 0x7727cfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| gdi32.dll | 0x77280000 | 0x772cdfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| shlwapi.dll | 0x77530000 | 0x77586fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| msvcrt.dll | 0x77590000 | 0x7763bfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| advapi32.dll | 0x77640000 | 0x776dffff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| sechost.dll | 0x776e0000 | 0x776f8fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| ntdll.dll | 0x778a0000 | 0x779dbfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| lpk.dll | 0x779e0000 | 0x779e9fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| nsi.dll | 0x779f0000 | 0x779f5fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| msctf.dll | 0x77a00000 | 0x77acbfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| apisetschema.dll | 0x77ae0000 | 0x77ae0fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| pagefile_0x000000007f6f0000 | 0x7f6f0000 | 0x7f7effff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x000000007ffaa000 | 0x7ffaa000 | 0x7ffaafff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffab000 | 0x7ffab000 | 0x7ffabfff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffad000 | 0x7ffad000 | 0x7ffadfff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffae000 | 0x7ffae000 | 0x7ffaefff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffaf000 | 0x7ffaf000 | 0x7ffaffff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x000000007ffb0000 | 0x7ffb0000 | 0x7ffd2fff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x000000007ffd3000 | 0x7ffd3000 | 0x7ffd3fff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffd4000 | 0x7ffd4000 | 0x7ffd4fff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffd5000 | 0x7ffd5000 | 0x7ffd5fff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffd6000 | 0x7ffd6000 | 0x7ffd6fff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffd7000 | 0x7ffd7000 | 0x7ffd7fff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffd8000 | 0x7ffd8000 | 0x7ffd8fff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffd9000 | 0x7ffd9000 | 0x7ffd9fff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffda000 | 0x7ffda000 | 0x7ffdafff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffdb000 | 0x7ffdb000 | 0x7ffdbfff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffdc000 | 0x7ffdc000 | 0x7ffdcfff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffdd000 | 0x7ffdd000 | 0x7ffddfff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffde000 | 0x7ffde000 | 0x7ffdefff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffdf000 | 0x7ffdf000 | 0x7ffdffff | Private Memory | Readable, Writable |
|
|
|
|
| Information | Value |
|---|---|
| ID | #4 |
| File Name | System |
| Command Line | |
| Initial Working Directory | |
| Monitor | Start Time: 00:00:48, Reason: Created Daemon |
| Unmonitor | End Time: 00:04:59, Reason: Terminated by Timeout |
| Monitor Duration | 00:04:11 |
| Remarks | No high level activity detected in monitored regions |
| Information | Value |
|---|---|
| PID | 0x4 |
| Parent PID | 0xffffffffffffffff (Unknown) |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Groups |
|
| Enabled Privileges | SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege |
| Thread IDs |
0x
970
0x
8E4
0x
804
0x
468
0x
474
0x
12C
0x
510
0x
130
0x
1C8
0x
748
0x
734
0x
730
0x
724
0x
718
0x
708
0x
6B4
0x
694
0x
64C
0x
648
0x
63C
0x
608
0x
600
0x
544
0x
540
0x
53C
0x
3D0
0x
3CC
0x
304
0x
288
0x
194
0x
188
0x
154
0x
150
0x
14C
0x
148
0x
130
0x
12C
0x
128
0x
124
0x
120
0x
11C
0x
118
0x
108
0x
104
0x
F8
0x
F4
0x
F0
0x
EC
0x
E8
0x
E4
0x
E0
0x
DC
0x
D8
0x
D4
0x
D0
0x
CC
0x
C8
0x
C4
0x
C0
0x
BC
0x
B8
0x
B4
0x
B0
0x
AC
0x
A8
0x
A4
0x
A0
0x
9C
0x
98
0x
94
0x
90
0x
8C
0x
88
0x
84
0x
80
0x
7C
0x
78
0x
70
0x
6C
0x
68
0x
60
0x
5C
0x
58
0x
54
0x
50
0x
4C
0x
74
0x
48
0x
44
0x
40
0x
3C
0x
38
0x
34
0x
30
0x
2C
0x
28
0x
24
0x
20
0x
1C
0x
18
0x
C
0x
10
0x
14
0x
8
0x
A10
0x
A14
0x
8A0
0x
3FC
0x
594
0x
300
0x
944
0x
940
0x
A24
0x
AAC
0x
AD0
0x
B00
0x
BFC
0x
E20
0x
E28
0x
BEC
|
| Name | Start VA | End VA | Type | Permissions | Monitored | Dump | YARA Match | Actions |
|---|---|---|---|---|---|---|---|---|
| pagefile_0x0000000000010000 | 0x00010000 | 0x00032fff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000040000 | 0x00040000 | 0x0005ffff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000060000 | 0x00060000 | 0x0007ffff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000080000 | 0x00080000 | 0x0009ffff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| pagefile_0x00000000000a0000 | 0x000a0000 | 0x000bffff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| pagefile_0x00000000000c0000 | 0x000c0000 | 0x000dffff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| pagefile_0x00000000000e0000 | 0x000e0000 | 0x000fffff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000100000 | 0x00100000 | 0x0011ffff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000120000 | 0x00120000 | 0x0013ffff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000140000 | 0x00140000 | 0x0015ffff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000160000 | 0x00160000 | 0x00160fff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| ntdll.dll | 0x778a0000 | 0x779dbfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| Information | Value |
|---|---|
| ID | #5 |
| File Name | c:\users\dssdpmx042\desktop\wanadecrypt0r.bin.exe |
| Command Line | C:\Users\DSsDPMx042\Desktop\WanaDecrypt0r.bin.exe -m security |
| Initial Working Directory | C:\Windows\system32 |
| Monitor | Start Time: 00:00:48, Reason: Created Daemon |
| Unmonitor | End Time: 00:04:59, Reason: Terminated by Timeout |
| Monitor Duration | 00:04:11 |
| Information | Value |
|---|---|
| PID | 0x984 |
| Parent PID | 0x1d4 (c:\windows\system32\services.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Groups |
|
| Enabled Privileges | SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege |
| Thread IDs |
0x
988
0x
98C
0x
990
0x
994
0x
998
0x
99C
0x
9A0
0x
9A4
0x
9A8
0x
9AC
0x
9B0
0x
9B4
0x
9C4
0x
9C8
0x
9CC
0x
9D0
0x
9D4
0x
9D8
0x
9DC
0x
9E0
0x
9E4
0x
9E8
0x
9F4
0x
9F8
0x
9FC
0x
A08
0x
A0C
0x
A18
0x
A1C
0x
A20
0x
A24
0x
A28
0x
A2C
0x
A30
0x
A34
0x
A38
0x
A3C
0x
A40
0x
A44
0x
A48
0x
A4C
0x
A50
0x
A54
0x
A58
0x
A7C
0x
A88
0x
A8C
0x
A94
0x
A98
0x
AA0
0x
AA4
0x
AA8
0x
AAC
0x
AB0
0x
AB4
0x
AB8
0x
ABC
0x
AC0
0x
AC4
0x
AC8
0x
ACC
0x
AD0
0x
AD4
0x
AD8
0x
ADC
0x
AE0
0x
AE4
0x
AE8
0x
AEC
0x
AF0
0x
AF4
0x
AF8
0x
AFC
0x
B00
0x
B04
0x
B08
0x
B0C
0x
B14
0x
B18
0x
B1C
0x
B20
0x
B24
0x
B28
0x
B2C
0x
B30
0x
B34
0x
B38
0x
B3C
0x
B40
0x
B44
0x
B48
0x
B4C
0x
B50
0x
B54
0x
B58
0x
B5C
0x
B60
0x
B64
0x
B68
0x
B6C
0x
B70
0x
B78
0x
B80
0x
B88
0x
B8C
0x
BA0
0x
BA4
0x
BA8
0x
BB0
0x
BBC
0x
BCC
0x
BD0
0x
BD4
0x
BD8
0x
BDC
0x
BE0
0x
BE4
0x
BE8
0x
BF4
0x
BF8
0x
BFC
0x
C00
0x
C04
0x
C0C
0x
C10
0x
C18
0x
C1C
0x
C28
0x
C2C
0x
C30
0x
C34
0x
C3C
0x
C40
0x
C48
0x
C5C
0x
C68
0x
C6C
0x
C70
0x
C74
0x
C84
0x
CF8
0x
CFC
0x
D00
0x
D04
0x
D08
0x
D0C
0x
D10
0x
D14
0x
D18
0x
D1C
0x
D20
0x
D24
0x
D28
0x
D2C
0x
D34
0x
D38
0x
D3C
0x
D40
0x
D50
0x
D54
0x
D58
0x
D5C
0x
D60
0x
D64
0x
D68
0x
D70
0x
D74
0x
D78
0x
D7C
0x
D80
0x
D84
0x
D88
0x
D8C
0x
D90
0x
D94
0x
D98
0x
D9C
0x
DA0
0x
DA4
0x
DA8
0x
DAC
0x
DB0
0x
DB4
0x
DB8
0x
DC4
0x
DC8
0x
DCC
0x
DD0
0x
DD4
0x
DD8
0x
DDC
0x
DE0
0x
DE4
0x
DE8
0x
DEC
0x
DF0
0x
DF4
0x
DF8
0x
DFC
0x
E00
0x
E04
0x
E08
0x
E0C
0x
E10
0x
E14
0x
E18
0x
E1C
0x
E20
0x
E24
0x
E28
0x
E2C
0x
E30
0x
E34
0x
E38
0x
E3C
0x
E40
0x
E44
0x
E48
0x
E4C
0x
E50
0x
E54
0x
E58
0x
E5C
0x
E60
0x
E64
0x
E68
0x
E6C
0x
E70
0x
E74
0x
E78
0x
E7C
0x
E80
0x
E84
0x
E88
0x
E90
0x
E94
0x
E98
0x
E9C
0x
EA0
0x
EA4
0x
EA8
0x
EB4
0x
EB8
0x
EBC
0x
EC0
0x
EC4
0x
EC8
0x
ECC
0x
ED0
0x
ED4
0x
ED8
0x
EDC
0x
EE0
0x
EEC
0x
EF4
0x
F0C
0x
F14
0x
F1C
0x
F20
0x
F24
0x
F28
0x
F2C
0x
F3C
0x
F40
0x
F44
0x
F48
0x
F4C
0x
F50
0x
F54
0x
F58
0x
F5C
0x
F60
0x
F64
0x
F68
0x
F6C
0x
F70
0x
F7C
0x
F80
0x
F84
0x
F88
0x
F8C
0x
F90
0x
F9C
0x
FA8
0x
FAC
0x
FB4
0x
FC0
0x
FD4
0x
FE4
0x
FE8
0x
C0
0x
858
0x
43C
0x
E8
0x
6D4
0x
118
0x
324
0x
4DC
0x
8F8
0x
888
0x
8E0
0x
870
0x
958
0x
908
0x
7DC
0x
208
0x
554
0x
794
0x
5E8
0x
9E0
0x
A28
0x
A3C
0x
A58
0x
A88
0x
A64
0x
AB0
0x
AC4
0x
ADC
0x
B08
0x
B18
0x
B40
0x
B48
0x
B5C
0x
B64
0x
BD0
0x
C34
0x
D20
0x
D4C
0x
D50
0x
D60
0x
D84
0x
DA0
0x
DAC
0x
DB4
0x
DDC
0x
DE0
0x
770
0x
DFC
0x
E1C
0x
BC0
0x
E4C
0x
E48
0x
E6C
0x
E94
0x
EA8
0x
EB8
0x
EBC
0x
ECC
0x
ED4
0x
F28
0x
F44
0x
F64
0x
F6C
0x
F84
0x
77C
0x
A14
0x
C44
0x
11C
0x
714
0x
398
0x
304
0x
7C0
0x
FC8
0x
FC4
0x
840
0x
45C
0x
990
0x
818
0x
14C
0x
76C
|
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| CREATE | c:\users\dssdpmx042\desktop\wanadecrypt0r.bin.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, create_disposition = OPEN_EXISTING, file_attributes = FILE_ATTRIBUTE_SYSTEM |
|
1 | |
| READ | c:\users\dssdpmx042\desktop\wanadecrypt0r.bin.exe | size = 3723264 |
|
1 |
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| GET_HANDLE | c:\users\dssdpmx042\desktop\wanadecrypt0r.bin.exe | base_address = 0x400000 |
|
1 | |
| GET_FILENAME | C:\Users\DSsDPMx042\Desktop\WanaDecrypt0r.bin.exe |
|
1 |
| Operation | Service | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| OPEN_MGR | SERVICES_ACTIVE_DATABASE | host = Localhost, desired_access = SC_MANAGER_CONNECT, SC_MANAGER_CREATE_SERVICE, SC_MANAGER_ENUMERATE_SERVICE, SC_MANAGER_LOCK, SC_MANAGER_QUERY_LOCK_STATUS, SC_MANAGER_MODIFY_BOOT_CONFIG, DELETE, READ_CONTROL, WRITE_DAC, WRITE_OWNER |
|
1 | |
| OPEN | mssecsvc2.0 | database_name = SERVICES_ACTIVE_DATABASE, desired_access = SERVICE_QUERY_CONFIG, SERVICE_CHANGE_CONFIG, SERVICE_QUERY_STATUS, SERVICE_ENUMERATE_DEPENDENTS, SERVICE_START, SERVICE_STOP, SERVICE_PAUSE_CONTINUE, SERVICE_INTERROGATE, SERVICE_USER_DEFINED_CONTROL, DELETE, READ_CONTROL, WRITE_DAC, WRITE_OWNER |
|
1 | |
| SET_CONFIG | mssecsvc2.0 |
|
1 | ||
| REGISTER_HANDLER | mssecsvc2.0 |
|
1 |
| Operation | Information | Success | Count | Logfile |
|---|---|---|---|---|
| SLEEP | duration = 2000 milliseconds (2.000 seconds) |
|
102 | |
| SLEEP | duration = 50 milliseconds (0.050 seconds) |
|
254 | |
| SLEEP | duration = 100 milliseconds (0.100 seconds) |
|
9603 | |
| SLEEP | duration = 3000 milliseconds (3.000 seconds) |
|
1 |
| Remote Address | Remote Port | Username | Password | Success | Count |
|---|---|---|---|---|---|
| www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com | 80 |
|
1 |
| Method | URL | Success | Count |
|---|---|---|---|
| GET | http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com |
|
1 |
| Remote Address | Remote Port | L7Protocol | Success | Count |
|---|---|---|---|---|
| 144.217.74.156 | 80 | http |
|
9896 |
| Information | Value |
|---|---|
| ID | #6 |
| File Name | c:\windows\tasksche.exe |
| Command Line | C:\WINDOWS\tasksche.exe /i |
| Initial Working Directory | C:\Users\DSsDPMx042\Desktop |
| Monitor | Start Time: 00:01:02, Reason: Child Process |
| Unmonitor | End Time: 00:01:37, Reason: Terminated |
| Monitor Duration | 00:00:35 |
| Information | Value |
|---|---|
| PID | 0x9b8 |
| Parent PID | 0x924 (c:\users\dssdpmx042\desktop\wanadecrypt0r.bin.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | High (Elevated) |
| Username | N3EERVTWSM\DSsDPMx042 |
| Groups |
|
| Enabled Privileges | SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege |
| Thread IDs |
0x
9BC
0x
F94
|
| Filename | File Size | Hash Values | YARA Match | Actions |
|---|---|---|---|---|
| c:\programdata\qxtqusdnjzrizx418\tasksche.exe | 3.35 MB (3514368 bytes) |
MD5:
84c82835a5d21bbcf75a61706d8ab549
SHA1: 5ff465afaabcbf0150d1a3ab2c2e74f3a4426467 SHA256: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa |
|
|
| c:\programdata\qxtqusdnjzrizx418\tasksche.exe | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| CREATE_DIR | c:\programdata |
|
1 | ||
| CREATE_DIR | c:\programdata\qxtqusdnjzrizx418 |
|
1 | ||
| COPY | c:\programdata\qxtqusdnjzrizx418\tasksche.exe | source_file_name = c:\windows\tasksche.exe, fail_if_exists = 0 |
|
1 | |
| FIND | C:\ProgramData |
|
1 | ||
| FIND | qxtqusdnjzrizx418 |
|
1 | ||
| FIND | tasksche.exe |
|
1 |
| Operation | Process Name | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| SET_CURDIR | c:\windows\tasksche.exe | os_pid = 0x9b8, new_path_name = c:\programdata |
|
1 | |
| SET_CURDIR | c:\windows\tasksche.exe | os_pid = 0x9b8, new_path_name = c:\programdata\qxtqusdnjzrizx418 |
|
1 |
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| GET_HANDLE | c:\windows\tasksche.exe | base_address = 0x400000 |
|
1 | |
| GET_FILENAME | C:\WINDOWS\tasksche.exe |
|
1 |
| Operation | Service | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| OPEN_MGR | SERVICES_ACTIVE_DATABASE | host = Localhost, desired_access = SC_MANAGER_CONNECT, SC_MANAGER_CREATE_SERVICE, SC_MANAGER_ENUMERATE_SERVICE, SC_MANAGER_LOCK, SC_MANAGER_QUERY_LOCK_STATUS, SC_MANAGER_MODIFY_BOOT_CONFIG, DELETE, READ_CONTROL, WRITE_DAC, WRITE_OWNER |
|
1 | |
| CREATE | qxtqusdnjzrizx418 | file_name = cmd.exe /c "C:\ProgramData\qxtqusdnjzrizx418\tasksche.exe", database_name = SERVICES_ACTIVE_DATABASE, display_name = qxtqusdnjzrizx418, desired_access = SERVICE_QUERY_CONFIG, SERVICE_CHANGE_CONFIG, SERVICE_QUERY_STATUS, SERVICE_ENUMERATE_DEPENDENTS, SERVICE_START, SERVICE_STOP, SERVICE_PAUSE_CONTINUE, SERVICE_INTERROGATE, SERVICE_USER_DEFINED_CONTROL, DELETE, READ_CONTROL, WRITE_DAC, WRITE_OWNER, service_type = SERVICE_WIN32_OWN_PROCESS, start_type = SERVICE_AUTO_START |
|
1 | |
| OPEN | qxtqusdnjzrizx418 | database_name = SERVICES_ACTIVE_DATABASE, desired_access = SERVICE_QUERY_CONFIG, SERVICE_CHANGE_CONFIG, SERVICE_QUERY_STATUS, SERVICE_ENUMERATE_DEPENDENTS, SERVICE_START, SERVICE_STOP, SERVICE_PAUSE_CONTINUE, SERVICE_INTERROGATE, SERVICE_USER_DEFINED_CONTROL, DELETE, READ_CONTROL, WRITE_DAC, WRITE_OWNER |
|
1 | |
| START | qxtqusdnjzrizx418 | parameters = 0 |
|
1 |
| Operation | Name | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| OPEN | Global\MsWinZonesCacheCounterMutexA0 | desired_access = SYNCHRONIZE |
|
1 |
| Information | Value |
|---|---|
| ID | #7 |
| File Name | c:\windows\system32\cmd.exe |
| Command Line | cmd.exe /c "C:\ProgramData\qxtqusdnjzrizx418\tasksche.exe" |
| Initial Working Directory | C:\Windows\system32 |
| Monitor | Start Time: 00:01:03, Reason: Created Daemon |
| Unmonitor | End Time: 00:01:36, Reason: Terminated |
| Monitor Duration | 00:00:33 |
| Information | Value |
|---|---|
| PID | 0x9ec |
| Parent PID | 0x1d4 (c:\windows\system32\services.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Groups |
|
| Enabled Privileges | SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege |
| Thread IDs |
0x
9F0
|
| Name | Start VA | End VA | Type | Permissions | Monitored | Dump | YARA Match | Actions |
|---|---|---|---|---|---|---|---|---|
| private_0x0000000000010000 | 0x00010000 | 0x0002ffff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000010000 | 0x00010000 | 0x0001ffff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000020000 | 0x00020000 | 0x00026fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x0000000000030000 | 0x00030000 | 0x00033fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x0000000000040000 | 0x00040000 | 0x00040fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x0000000000050000 | 0x00050000 | 0x00051fff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000060000 | 0x00060000 | 0x00060fff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000070000 | 0x00070000 | 0x00070fff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000090000 | 0x00090000 | 0x0018ffff | Private Memory | Readable, Writable |
|
|
|
|
| locale.nls | 0x00190000 | 0x001f6fff | Memory Mapped File | Readable |
|
|
|
|
| private_0x0000000000210000 | 0x00210000 | 0x0030ffff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000310000 | 0x00310000 | 0x003d7fff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x0000000000410000 | 0x00410000 | 0x0041ffff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000420000 | 0x00420000 | 0x00520fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x0000000000530000 | 0x00530000 | 0x005affff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x00000000005b0000 | 0x005b0000 | 0x0083afff | Pagefile Backed Memory | Readable |
|
|
|
|
| sortdefault.nls | 0x00840000 | 0x00b0efff | Memory Mapped File | Readable |
|
|
|
|
| cmd.exe | 0x4aa20000 | 0x4aa6bfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| winbrand.dll | 0x70830000 | 0x70836fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| kernelbase.dll | 0x75c10000 | 0x75c59fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| kernel32.dll | 0x75d30000 | 0x75e03fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| imm32.dll | 0x75e10000 | 0x75e2efff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| user32.dll | 0x75f70000 | 0x76038fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| usp10.dll | 0x771e0000 | 0x7727cfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| gdi32.dll | 0x77280000 | 0x772cdfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| msvcrt.dll | 0x77590000 | 0x7763bfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| ntdll.dll | 0x778a0000 | 0x779dbfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| lpk.dll | 0x779e0000 | 0x779e9fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| msctf.dll | 0x77a00000 | 0x77acbfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| apisetschema.dll | 0x77ae0000 | 0x77ae0fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| pagefile_0x000000007f6f0000 | 0x7f6f0000 | 0x7f7effff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x000000007ffb0000 | 0x7ffb0000 | 0x7ffd2fff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x000000007ffde000 | 0x7ffde000 | 0x7ffdefff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffdf000 | 0x7ffdf000 | 0x7ffdffff | Private Memory | Readable, Writable |
|
|
|
|
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| OPEN | STD_OUTPUT_HANDLE |
|
2 | ||
| OPEN | STD_INPUT_HANDLE |
|
1 | ||
| FIND | C:\Windows\system32 |
|
2 | ||
| FIND | C:\Windows |
|
1 | ||
| FIND | C:\Windows\System32 |
|
1 |
| Operation | Process Name | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| CREATE | C:\ProgramData\qxtqusdnjzrizx418\tasksche.exe | os_tid = 0xa04, os_pid = 0xa00, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, current_directory = C:\Windows\system32, show_window = SW_SHOWNORMAL |
|
1 | |
| SET_CURDIR | c:\windows\system32\cmd.exe | os_pid = 0x9ec, new_path_name = c:\windows\system32 |
|
1 |
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| GET_HANDLE | c:\windows\system32\cmd.exe | base_address = 0x4aa20000 |
|
1 | |
| GET_HANDLE | c:\windows\system32\kernel32.dll | base_address = 0x75d30000 |
|
2 | |
| GET_FILENAME | C:\Windows\system32\cmd.exe |
|
1 | ||
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = SetThreadUILanguage, address = 0x75d824c2 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = CopyFileExW, address = 0x75d6ac6c |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = IsDebuggerPresent, address = 0x75d73ea8 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = SetConsoleInputExeNameW, address = 0x75d82732 |
|
1 |
| Operation | Key | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| OPEN_KEY | HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System |
|
1 | ||
| OPEN_KEY | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor |
|
1 | ||
| OPEN_KEY | HKEY_CURRENT_USER\Software\Microsoft\Command Processor |
|
1 | ||
| READ_VALUE | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = DisableUNCCheck, data_ident_out = 216 |
|
1 | |
| READ_VALUE | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = EnableExtensions, data_ident_out = 1 |
|
1 | |
| READ_VALUE | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = DelayedExpansion, data_ident_out = 1 |
|
1 | |
| READ_VALUE | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = DefaultColor, data_ident_out = 0 |
|
1 | |
| READ_VALUE | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = CompletionChar, data_ident_out = 64 |
|
1 | |
| READ_VALUE | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = PathCompletionChar, data_ident_out = 64 |
|
1 | |
| READ_VALUE | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = AutoRun, data_ident_out = 64 |
|
1 | |
| READ_VALUE | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = DisableUNCCheck, data_ident_out = 64 |
|
1 | |
| READ_VALUE | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = EnableExtensions, data_ident_out = 1 |
|
1 | |
| READ_VALUE | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = DelayedExpansion, data_ident_out = 1 |
|
1 | |
| READ_VALUE | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = DefaultColor, data_ident_out = 0 |
|
1 | |
| READ_VALUE | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = CompletionChar, data_ident_out = 9 |
|
1 | |
| READ_VALUE | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = PathCompletionChar, data_ident_out = 9 |
|
1 | |
| READ_VALUE | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = AutoRun, data_ident_out = 9 |
|
1 |
| Information | Value |
|---|---|
| ID | #8 |
| File Name | c:\programdata\qxtqusdnjzrizx418\tasksche.exe |
| Command Line | C:\ProgramData\qxtqusdnjzrizx418\tasksche.exe |
| Initial Working Directory | C:\Windows\system32 |
| Monitor | Start Time: 00:01:04, Reason: Child Process |
| Unmonitor | End Time: 00:04:59, Reason: Terminated by Timeout |
| Monitor Duration | 00:03:55 |
| Information | Value |
|---|---|
| PID | 0xa00 |
| Parent PID | 0x9ec (c:\windows\system32\cmd.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Groups |
|
| Enabled Privileges | SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege |
| Thread IDs |
0x
A04
0x
A9C
0x
B74
0x
B7C
0x
B84
0x
B90
0x
B9C
0x
BAC
0x
C80
0x
FA0
0x
FA4
|
| Filename | File Size | Hash Values | YARA Match | Actions |
|---|---|---|---|---|
| c:\programdata\qxtqusdnjzrizx418\@wanadecryptor@.exe | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\users\default\desktop\~sd927e.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\users\default\desktop\~sd92dd.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\users\dssdpmx042\desktop\~sd92ed.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\users\dssdpmx042\desktop\pgm8zh2abxrdyc7agszx\~sd9761.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\users\dssdpmx042\desktop\pgm8zh2abxrdyc7agszx\0qdvmg\~sd97c0.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\users\dssdpmx042\desktop\pgm8zh2abxrdyc7agszx\k8vahpvastg\~sd983e.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\users\dssdpmx042\desktop\pgm8zh2abxrdyc7agszx\lsxsfgzrgx3ysj1\~sd98ac.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\users\dssdpmx042\desktop\pgm8zh2abxrdyc7agszx\lsxsfgzrgx3ysj1\2tpofaj-rucn\~sd98dc.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\users\public\desktop\~sda1e1.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\users\default\documents\~sda433.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\users\default\documents\~sda444.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\users\dssdpmx042\documents\~sda493.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\~sdb085.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\j9gd3zhd03fzbccc\~sdb289.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\j9gd3zhd03fzbccc\3e4ho\~sdb2f7.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\kfd49gef82k2wc1srgu\~sdb356.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\kfd49gef82k2wc1srgu\tedc-nspy xfvlw3\~sdb412.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\users\public\documents\~sdb72f.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\~sdb73f.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\$recycle.bin\~sdb79e.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\$recycle.bin\s-1-5-21-3385616887-338319549-3229196192-1000\~sdb79f.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\boot\~sdb7bf.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\boot\cs-cz\~sdb81e.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\boot\da-dk\~sdb82e.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\boot\de-de\~sdb84f.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\boot\el-gr\~sdb85f.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\boot\en-us\~sdb870.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\boot\es-es\~sdb890.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\boot\fi-fi\~sdb8b0.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\boot\fonts\~sdb8e0.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\boot\fr-fr\~sdb93f.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\boot\hu-hu\~sdb95f.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\boot\it-it\~sdb96f.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\boot\ja-jp\~sdb980.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\boot\ko-kr\~sdb991.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\boot\nb-no\~sdb9a1.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\boot\nl-nl\~sdb9b2.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\boot\pl-pl\~sdb9c2.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\boot\pt-br\~sdb9d3.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\boot\pt-pt\~sdb9e4.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\boot\ru-ru\~sdb9e5.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\boot\sv-se\~sdb9f5.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\boot\tr-tr\~sdb9f6.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\boot\zh-cn\~sdba07.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\boot\zh-hk\~sdba17.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\boot\zh-tw\~sdba18.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\perflogs\~sdba29.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\perflogs\admin\~sdba2a.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\recovery\~sdba2b.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\recovery\a8ef0822-7920-11e5-85b1-fee83b99d226\~sdba3c.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\system volume information\~sdba4c.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\system volume information\spp\~sdba8c.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\system volume information\spp\onlinemetadatacache\~sdba9c.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\system volume information\spp\sppcbshivestore\~sdbaad.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\system volume information\spp\sppgroupcache\~sdbaae.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\users\~sdbabe.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\~sdbacf.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\~sdbaff.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\assistance\~sdbb2f.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\assistance\client\~sdbb30.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\assistance\client\1.0\~sdbb31.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\assistance\client\1.0\en-us\~sdbb41.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\crypto\~sdbb52.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\crypto\dss\~sdbb53.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\crypto\dss\machinekeys\~sdbb54.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\crypto\keys\~sdbb64.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\crypto\rsa\~sdbb65.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\crypto\rsa\machinekeys\~sdbb66.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\crypto\rsa\s-1-5-18\~sdbb77.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\device stage\~sdbb78.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\device stage\device\~sdbb89.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\~sdbb8a.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}\~sdbb9a.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\device stage\task\~sdbb9b.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\~sdbb9c.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-us\~sdbbad.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\~sdbbae.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-us\~sdbbbe.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\devicesync\~sdbbcf.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\drm\~sdbbd0.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\drm\server\~sdbbe1.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\ehome\~sdbbe2.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\ehome\logs\~sdbbe3.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\event viewer\~sdbbe4.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\event viewer\views\~sdbbf4.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\event viewer\views\applicationviewsrootnode\~sdbbf5.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\identitycrl\~sdbbf6.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\media player\~sdbc07.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\mf\~sdbc08.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\network\~sdbc09.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\network\connections\~sdbc0a.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\network\downloader\~sdbc59.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\rac\~sdbc5a.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\rac\outbound\~sdbc6a.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\rac\publisheddata\~sdbc7b.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\rac\statedata\~sdbc7c.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\rac\temp\~sdbc7d.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\search\~sdbc7e.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\search\data\~sdbc8f.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\search\data\applications\~sdbc90.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\search\data\applications\windows\~sdbca0.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\search\data\applications\windows\config\~sdbca1.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\search\data\applications\windows\gatherlogs\~sdbca2.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\search\data\applications\windows\gatherlogs\systemindex\~sdbcb3.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\search\data\applications\windows\projects\~sdbcb4.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\search\data\applications\windows\projects\systemindex\~sdbcb5.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\search\data\applications\windows\projects\systemindex\indexer\~sdbcb6.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\~sdbcb7.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\search\data\applications\windows\projects\systemindex\propmap\~sdbcb8.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\search\data\applications\windows\projects\systemindex\secstore\~sdbcb9.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\search\data\temp\~sdbcba.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\user account pictures\~sdbcbb.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\user account pictures\default pictures\~sdbccb.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\vault\~sdbcdc.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\windows\~sdbcdd.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\windows\ait\~sdbcde.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\windows\caches\~sdbcef.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\windows\devicemetadatastore\~sdbcf0.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\windows\devicemetadatastore\en-us\~sdbd00.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\windows\drm\~sdbd11.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\windows\drm\cache\~sdbd12.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\windows\gameexplorer\~sdbd13.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\windows\power efficiency diagnostics\~sdbd23.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\windows\ringtones\~sdbd24.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\windows\sqm\~sdbd45.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\windows\sqm\manifest\~sdbd55.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\windows\sqm\sessions\~sdbd56.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\windows\sqm\upload\~sdbd57.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\windows\start menu\~sdbd58.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\windows\start menu\programs\~sdbd78.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\windows\start menu\programs\accessories\~sdbd79.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\windows\start menu\programs\accessories\accessibility\~sdbd8a.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\windows\start menu\programs\accessories\system tools\~sdbd9b.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\windows\start menu\programs\accessories\tablet pc\~sdbd9c.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\windows\start menu\programs\accessories\windows powershell\~sdbdac.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\windows\start menu\programs\administrative tools\~sdbdad.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\windows\start menu\programs\games\~sdbdae.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\windows\start menu\programs\java\~sdbdbf.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\windows\start menu\programs\maintenance\~sdbdc0.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\windows\start menu\programs\startup\~sdbe3e.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\windows\start menu\programs\tablet pc\~sdbe3f.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\windows\templates\~sdbe4f.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\windows\wer\~sdbe50.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\windows\wer\reportarchive\~sdbe61.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\windows\wer\reportarchive\noncritical_x86_38e744f5ed92b6643d4610f93acebec71c7d44_03443294\~sdbe62.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\windows\wer\reportarchive\noncritical_x86_5164e364f554d49c65173057b5da44f5956558a_03444874\~sdbe63.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\windows\wer\reportarchive\noncritical_x86_7125ba86c55facb797ac343822852efc7fde5bb0_03681e87\~sdbe64.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\windows\wer\reportqueue\~sdbe74.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\windows defender\~sdbe85.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\windows defender\definition updates\~sdbe86.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\windows defender\definition updates\backup\~sdbe97.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\windows defender\definition updates\updates\~sdbe98.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\windows defender\definition updates\{21833c5a-be0d-427d-b68e-efa18747b9cf}\~sdbeb8.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\windows defender\localcopy\~sdbeb9.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\windows defender\quarantine\~sdbec9.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\windows defender\scans\~sdbeca.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\windows defender\scans\cleanstore\~sdbedb.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\windows defender\scans\cleanstore\entries\~sdbefb.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\windows defender\scans\cleanstore\resourcedata\~sdbefc.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\windows defender\scans\cleanstore\resources\~sdbf0d.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\windows defender\scans\history\~sdbf0e.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\windows defender\scans\history\cachemanager\~sdbf0f.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\windows defender\scans\history\results\~sdbf1f.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\windows defender\scans\history\results\resource\~sdbf20.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\windows defender\scans\history\service\~sdbf41.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\windows defender\scans\history\store\~sdbf42.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\windows defender\support\~sdbf43.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\windows nt\~sdbf53.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\windows nt\msfax\~sdbf64.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\windows nt\msfax\activitylog\~sdbf65.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\windows nt\msfax\common coverpages\~sdbf75.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\windows nt\msfax\common coverpages\en-us\~sdbf86.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\windows nt\msfax\inbox\~sdbf87.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\windows nt\msfax\queue\~sdbf88.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\windows nt\msfax\sentitems\~sdbf99.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\windows nt\msfax\virtualinbox\~sdbf9a.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\windows nt\msfax\virtualinbox\en-us\~sdbf9b.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\windows nt\msscan\~sdbfab.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\microsoft\wwansvc\~sdc048.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\mozilla\~sdc0c7.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\mozilla\logs\~sdc0c8.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\oracle\~sdc0d9.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\oracle\java\~sdc0da.tmp | 0.00 KB (0 bytes) |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
|
| c:\programdata\qxtqusdnjzrizx418\b.wnry | 1.37 MB (1440054 bytes) |
MD5:
c17170262312f3be7027bc2ca825bf0c
SHA1: f19eceda82973239a1fdc5826bce7691e5dcb4fb SHA256: d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa |
|
|
| c:\programdata\qxtqusdnjzrizx418\c.wnry | 0.76 KB (780 bytes) |
MD5:
ae08f79a0d800b82fcbe1b43cdbdbefc
SHA1: f6b08523b1a836e2112875398ffefffde98ad3ca SHA256: 055c7760512c98c8d51e4427227fe2a7ea3b34ee63178fe78631fa8aa6d15622 |
|
|
| c:\programdata\qxtqusdnjzrizx418\msg\m_bulgarian.wnry | 46.76 KB (47879 bytes) |
MD5:
95673b0f968c0f55b32204361940d184
SHA1: 81e427d15a1a826b93e91c3d2fa65221c8ca9cff SHA256: 40b37e7b80cf678d7dd302aaf41b88135ade6ddf44d89bdba19cf171564444bd |
|
|
| c:\programdata\qxtqusdnjzrizx418\msg\m_chinese (simplified).wnry | 53.08 KB (54359 bytes) |
MD5:
0252d45ca21c8e43c9742285c48e91ad
SHA1: 5c14551d2736eef3a1c1970cc492206e531703c1 SHA256: 845d0e178aeebd6c7e2a2e9697b2bf6cf02028c50c288b3ba88fe2918ea2834a |
|
|
| c:\programdata\qxtqusdnjzrizx418\msg\m_chinese (traditional).wnry | 77.49 KB (79346 bytes) |
MD5:
2efc3690d67cd073a9406a25005f7cea
SHA1: 52c07f98870eabace6ec370b7eb562751e8067e9 SHA256: 5c7f6ad1ec4bc2c8e2c9c126633215daba7de731ac8b12be10ca157417c97f3a |
|
|
| c:\programdata\qxtqusdnjzrizx418\msg\m_croatian.wnry | 38.15 KB (39070 bytes) |
MD5:
17194003fa70ce477326ce2f6deeb270
SHA1: e325988f68d327743926ea317abb9882f347fa73 SHA256: 3f33734b2d34cce83936ce99c3494cd845f1d2c02d7f6da31d42dfc1ca15a171 |
|
|
| c:\programdata\qxtqusdnjzrizx418\msg\m_czech.wnry | 39.56 KB (40512 bytes) |
MD5:
537efeecdfa94cc421e58fd82a58ba9e
SHA1: 3609456e16bc16ba447979f3aa69221290ec17d0 SHA256: 5afa4753afa048c6d6c39327ce674f27f5f6e5d3f2a060b7a8aed61725481150 |
|
|
| c:\programdata\qxtqusdnjzrizx418\msg\m_danish.wnry | 36.18 KB (37045 bytes) |
MD5:
2c5a3b81d5c4715b7bea01033367fcb5
SHA1: b548b45da8463e17199daafd34c23591f94e82cd SHA256: a75bb44284b9db8d702692f84909a7e23f21141866adf3db888042e9109a1cb6 |
|
|
| c:\programdata\qxtqusdnjzrizx418\msg\m_dutch.wnry | 36.12 KB (36987 bytes) |
MD5:
7a8d499407c6a647c03c4471a67eaad7
SHA1: d573b6ac8e7e04a05cbbd6b7f6a9842f371d343b SHA256: 2c95bef914da6c50d7bdedec601e589fbb4fda24c4863a7260f4f72bd025799c |
|
|
| c:\programdata\qxtqusdnjzrizx418\msg\m_english.wnry | 36.11 KB (36973 bytes) |
MD5:
fe68c2dc0d2419b38f44d83f2fcf232e
SHA1: 6c6e49949957215aa2f3dfb72207d249adf36283 SHA256: 26fd072fda6e12f8c2d3292086ef0390785efa2c556e2a88bd4673102af703e5 |
|
|
| c:\programdata\qxtqusdnjzrizx418\msg\m_filipino.wnry | 36.70 KB (37580 bytes) |
MD5:
08b9e69b57e4c9b966664f8e1c27ab09
SHA1: 2da1025bbbfb3cd308070765fc0893a48e5a85fa SHA256: d8489f8c16318e524b45de8b35d7e2c3cd8ed4821c136f12f5ef3c9fc3321324 |
|
|
| c:\programdata\qxtqusdnjzrizx418\msg\m_finnish.wnry | 37.48 KB (38377 bytes) |
MD5:
35c2f97eea8819b1caebd23fee732d8f
SHA1: e354d1cc43d6a39d9732adea5d3b0f57284255d2 SHA256: 1adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e |
|
|
| c:\programdata\qxtqusdnjzrizx418\msg\m_french.wnry | 37.54 KB (38437 bytes) |
MD5:
4e57113a6bf6b88fdd32782a4a381274
SHA1: 0fccbc91f0f94453d91670c6794f71348711061d SHA256: 9bd38110e6523547aed50617ddc77d0920d408faeed2b7a21ab163fda22177bc |
|
|
| c:\programdata\qxtqusdnjzrizx418\msg\m_german.wnry | 36.31 KB (37181 bytes) |
MD5:
3d59bbb5553fe03a89f817819540f469
SHA1: 26781d4b06ff704800b463d0f1fca3afd923a9fe SHA256: 2adc900fafa9938d85ce53cb793271f37af40cf499bcc454f44975db533f0b61 |
|
|
| c:\programdata\qxtqusdnjzrizx418\msg\m_greek.wnry | 47.89 KB (49044 bytes) |
MD5:
fb4e8718fea95bb7479727fde80cb424
SHA1: 1088c7653cba385fe994e9ae34a6595898f20aeb SHA256: e13cc9b13aa5074dc45d50379eceb17ee39a0c2531ab617d93800fe236758ca9 |
|
|
| c:\programdata\qxtqusdnjzrizx418\msg\m_indonesian.wnry | 36.32 KB (37196 bytes) |
MD5:
3788f91c694dfc48e12417ce93356b0f
SHA1: eb3b87f7f654b604daf3484da9e02ca6c4ea98b7 SHA256: 23e5e738aad10fb8ef89aa0285269aff728070080158fd3e7792fe9ed47c51f4 |
|
|
| c:\programdata\qxtqusdnjzrizx418\msg\m_italian.wnry | 36.02 KB (36883 bytes) |
MD5:
30a200f78498990095b36f574b6e8690
SHA1: c4b1b3c087bd12b063e98bca464cd05f3f7b7882 SHA256: 49f2c739e7d9745c0834dc817a71bf6676ccc24a4c28dcddf8844093aab3df07 |
|
|
| c:\programdata\qxtqusdnjzrizx418\msg\m_japanese.wnry | 79.93 KB (81844 bytes) |
MD5:
b77e1221f7ecd0b5d696cb66cda1609e
SHA1: 51eb7a254a33d05edf188ded653005dc82de8a46 SHA256: 7e491e7b48d6e34f916624c1cda9f024e86fcbec56acda35e27fa99d530d017e |
|
|
| c:\programdata\qxtqusdnjzrizx418\msg\m_korean.wnry | 89.36 KB (91501 bytes) |
MD5:
6735cb43fe44832b061eeb3f5956b099
SHA1: d636daf64d524f81367ea92fdafa3726c909bee1 SHA256: 552aa0f82f37c9601114974228d4fc54f7434fe3ae7a276ef1ae98a0f608f1d0 |
|
|
| c:\programdata\qxtqusdnjzrizx418\msg\m_latvian.wnry | 40.20 KB (41169 bytes) |
MD5:
c33afb4ecc04ee1bcc6975bea49abe40
SHA1: fbea4f170507cde02b839527ef50b7ec74b4821f SHA256: a0356696877f2d94d645ae2df6ce6b370bd5c0d6db3d36def44e714525de0536 |
|
|
| c:\programdata\qxtqusdnjzrizx418\msg\m_norwegian.wnry | 36.70 KB (37577 bytes) |
MD5:
ff70cc7c00951084175d12128ce02399
SHA1: 75ad3b1ad4fb14813882d88e952208c648f1fd18 SHA256: cb5da96b3dfcf4394713623dbf3831b2a0b8be63987f563e1c32edeb74cb6c3a |
|
|
| c:\programdata\qxtqusdnjzrizx418\msg\m_polish.wnry | 38.96 KB (39896 bytes) |
MD5:
e79d7f2833a9c2e2553c7fe04a1b63f4
SHA1: 3d9f56d2381b8fe16042aa7c4feb1b33f2baebff SHA256: 519ad66009a6c127400c6c09e079903223bd82ecc18ad71b8e5cd79f5f9c053e |
|
|
| c:\programdata\qxtqusdnjzrizx418\msg\m_portuguese.wnry | 37.03 KB (37917 bytes) |
MD5:
fa948f7d8dfb21ceddd6794f2d56b44f
SHA1: ca915fbe020caa88dd776d89632d7866f660fc7a SHA256: bd9f4b3aedf4f81f37ec0a028aabcb0e9a900e6b4de04e9271c8db81432e2a66 |
|
|
| c:\programdata\qxtqusdnjzrizx418\msg\m_romanian.wnry | 50.94 KB (52161 bytes) |
MD5:
313e0ececd24f4fa1504118a11bc7986
SHA1: e1b9ae804c7fb1d27f39db18dc0647bb04e75e9d SHA256: 70c0f32ed379ae899e5ac975e20bbbacd295cf7cd50c36174d2602420c770ac1 |
|
|
| c:\programdata\qxtqusdnjzrizx418\msg\m_russian.wnry | 46.00 KB (47108 bytes) |
MD5:
452615db2336d60af7e2057481e4cab5
SHA1: 442e31f6556b3d7de6eb85fbac3d2957b7f5eac6 SHA256: 02932052fafe97e6acaaf9f391738a3a826f5434b1a013abbfa7a6c1ade1e078 |
|
|
| c:\programdata\qxtqusdnjzrizx418\msg\m_slovak.wnry | 40.42 KB (41391 bytes) |
MD5:
c911aba4ab1da6c28cf86338ab2ab6cc
SHA1: fee0fd58b8efe76077620d8abc7500dbfef7c5b0 SHA256: e64178e339c8e10eac17a236a67b892d0447eb67b1dcd149763dad6fd9f72729 |
|
|
| c:\programdata\qxtqusdnjzrizx418\msg\m_spanish.wnry | 36.50 KB (37381 bytes) |
MD5:
8d61648d34cba8ae9d1e2a219019add1
SHA1: 2091e42fc17a0cc2f235650f7aad87abf8ba22c2 SHA256: 72f20024b2f69b45a1391f0a6474e9f6349625ce329f5444aec7401fe31f8de1 |
|
|
| c:\programdata\qxtqusdnjzrizx418\msg\m_swedish.wnry | 37.58 KB (38483 bytes) |
MD5:
c7a19984eb9f37198652eaf2fd1ee25c
SHA1: 06eafed025cf8c4d76966bf382ab0c5e1bd6a0ae SHA256: 146f61db72297c9c0facffd560487f8d6a2846ecec92ecc7db19c8d618dbc3a4 |
|
|
| c:\programdata\qxtqusdnjzrizx418\msg\m_turkish.wnry | 41.58 KB (42582 bytes) |
MD5:
531ba6b1a5460fc9446946f91cc8c94b
SHA1: cc56978681bd546fd82d87926b5d9905c92a5803 SHA256: 6db650836d64350bbde2ab324407b8e474fc041098c41ecac6fd77d632a36415 |
|
|
| c:\programdata\qxtqusdnjzrizx418\msg\m_vietnamese.wnry | 91.58 KB (93778 bytes) |
MD5:
8419be28a0dcec3f55823620922b00fa
SHA1: 2e4791f9cdfca8abf345d606f313d22b36c46b92 SHA256: 1f21838b244c80f8bed6f6977aa8a557b419cf22ba35b1fd4bf0f98989c5bdf8 |
|
|
| c:\programdata\qxtqusdnjzrizx418\r.wnry | 0.84 KB (864 bytes) |
MD5:
3e0020fc529b1c2a061016dd2469ba96
SHA1: c3a91c22b63f6fe709e7c29cafb29a2ee83e6ade SHA256: 402751fa49e0cb68fe052cb3db87b05e71c1d950984d339940cf6b29409f2a7c |
|
|
| c:\programdata\qxtqusdnjzrizx418\s.wnry | 2.90 MB (3038286 bytes) |
MD5:
ad4c9de7c8c40813f200ba1c2fa33083
SHA1: d1af27518d455d432b62d73c6a1497d032f6120e SHA256: e18fdd912dfe5b45776e68d578c3af3547886cf1353d7086c8bee037436dff4b |
|
|
| c:\programdata\qxtqusdnjzrizx418\t.wnry | 64.27 KB (65816 bytes) |
MD5:
5dcaac857e695a65f5c3ef1441a73a8f
SHA1: 7b10aaeee05e7a1efb43d9f837e9356ad55c07dd SHA256: 97ebce49b14c46bebc9ec2448d00e1e397123b256e2be9eba5140688e7bc0ae6 |
|
|
| c:\programdata\qxtqusdnjzrizx418\taskdl.exe | 20.00 KB (20480 bytes) |
MD5:
4fef5e34143e646dbf9907c4374276f5
SHA1: 47a9ad4125b6bd7c55e4e7da251e23f089407b8f SHA256: 4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79 |
|
|
| c:\programdata\qxtqusdnjzrizx418\taskse.exe | 20.00 KB (20480 bytes) |
MD5:
8495400f199ac77853c53b5a3f278f3e
SHA1: be5d6279874da315e3080b06083757aad9b32c23 SHA256: 2ca2d550e603d74dedda03156023135b38da3630cb014e3d00b1263358c5f00d |
|
|
| c:\programdata\qxtqusdnjzrizx418\u.wnry | 240.00 KB (245760 bytes) |
MD5:
7bf2b57f2a205768755c07f238fb32cc
SHA1: 45356a9dd616ed7161a3b9192e2f318d0ab5ad10 SHA256: b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25 |
|
|
| c:\programdata\qxtqusdnjzrizx418\@wanadecryptor@.exe | 240.00 KB (245760 bytes) |
MD5:
7bf2b57f2a205768755c07f238fb32cc
SHA1: 45356a9dd616ed7161a3b9192e2f318d0ab5ad10 SHA256: b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25 |
|
|
| c:\users\dssdpmx042\desktop\@wanadecryptor@.exe | 240.00 KB (245760 bytes) |
MD5:
7bf2b57f2a205768755c07f238fb32cc
SHA1: 45356a9dd616ed7161a3b9192e2f318d0ab5ad10 SHA256: b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25 |
|
|
| c:\users\dssdpmx042\documents\@wanadecryptor@.exe | 240.00 KB (245760 bytes) |
MD5:
7bf2b57f2a205768755c07f238fb32cc
SHA1: 45356a9dd616ed7161a3b9192e2f318d0ab5ad10 SHA256: b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25 |
|
|
| c:\@wanadecryptor@.exe | 240.00 KB (245760 bytes) |
MD5:
7bf2b57f2a205768755c07f238fb32cc
SHA1: 45356a9dd616ed7161a3b9192e2f318d0ab5ad10 SHA256: b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25 |
|
|
| c:\system volume information\@wanadecryptor@.exe | 240.00 KB (245760 bytes) |
MD5:
7bf2b57f2a205768755c07f238fb32cc
SHA1: 45356a9dd616ed7161a3b9192e2f318d0ab5ad10 SHA256: b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25 |
|
|
| c:\programdata\qxtqusdnjzrizx418\c.wnry | 0.76 KB (780 bytes) |
MD5:
8124a611153cd3aceb85a7ac58eaa25d
SHA1: c1d5cd8774261d810dca9b6a8e478d01cd4995d6 SHA256: 0ceb451c1dbefaa8231eeb462e8ce639863eb5b8ae4fa63a353eb6e86173119e |
|
|
| c:\programdata\qxtqusdnjzrizx418\00000000.pky | 0.27 KB (276 bytes) |
MD5:
c65cd5243e61572568ee2734832269ca
SHA1: 2e60cb6febfa6ef982b8688f35394930a37a9b33 SHA256: 8af6fa9d5c84effc0750fb63c5c647c40652bdb6f0e3ed7c772c543256b62ddc |
|
|
| c:\programdata\qxtqusdnjzrizx418\00000000.res | 0.13 KB (136 bytes) |
MD5:
f4774cee1d903fe496a65a20e25e2526
SHA1: e7bb9c2daf8f9ce6e73b46b4e1169f1832ce855d SHA256: 504dd383ab440e1978b0f59a4046feaa06eefbdf29abdc30dfff1f7f5ea488ab |
|
|
| c:\programdata\qxtqusdnjzrizx418\00000000.res | 0.13 KB (136 bytes) |
MD5:
b62e5cd65ff0cfd7005629cc01a6bed2
SHA1: 0e301c6876e4d84a47cfd259bab12b3ae80ca17b SHA256: 28c0beeb1d6405d223b5c64684a18663aff9e82643e93cde1a26939a157c0542 |
|
|
| c:\programdata\qxtqusdnjzrizx418\29121494860050.bat | 0.33 KB (338 bytes) |
MD5:
ae6ebda4ab7f0b299a6509d4a01b4ec3
SHA1: d81627bc1826d2a35631fb8f49428780037a6941 SHA256: 680261f622218754b126f3f21ec64aab7dbcca2e62dabd10e2b0967c35f694b1 |
|
|
| c:\programdata\qxtqusdnjzrizx418\@please_read_me@.txt | 0.91 KB (933 bytes) |
MD5:
7a2726bb6e6a79fb1d092b7f2b688af0
SHA1: b3effadce8b76aee8cd6ce2eccbb8701797468a2 SHA256: 840ab19c411c918ea3e7526d0df4b9cb002de5ea15e854389285df0d1ea9a8e5 |
|
|
| c:\users\dssdpmx042\desktop\@please_read_me@.txt | 0.91 KB (933 bytes) |
MD5:
7a2726bb6e6a79fb1d092b7f2b688af0
SHA1: b3effadce8b76aee8cd6ce2eccbb8701797468a2 SHA256: 840ab19c411c918ea3e7526d0df4b9cb002de5ea15e854389285df0d1ea9a8e5 |
|
|
| c:\users\dssdpmx042\desktop\pgm8zh2abxrdyc7agszx\@please_read_me@.txt | 0.91 KB (933 bytes) |
MD5:
7a2726bb6e6a79fb1d092b7f2b688af0
SHA1: b3effadce8b76aee8cd6ce2eccbb8701797468a2 SHA256: 840ab19c411c918ea3e7526d0df4b9cb002de5ea15e854389285df0d1ea9a8e5 |
|
|
| c:\users\dssdpmx042\desktop\pgm8zh2abxrdyc7agszx\0qdvmg\@please_read_me@.txt | 0.91 KB (933 bytes) |
MD5:
7a2726bb6e6a79fb1d092b7f2b688af0
SHA1: b3effadce8b76aee8cd6ce2eccbb8701797468a2 SHA256: 840ab19c411c918ea3e7526d0df4b9cb002de5ea15e854389285df0d1ea9a8e5 |
|
|
| c:\users\dssdpmx042\desktop\pgm8zh2abxrdyc7agszx\k8vahpvastg\@please_read_me@.txt | 0.91 KB (933 bytes) |
MD5:
7a2726bb6e6a79fb1d092b7f2b688af0
SHA1: b3effadce8b76aee8cd6ce2eccbb8701797468a2 SHA256: 840ab19c411c918ea3e7526d0df4b9cb002de5ea15e854389285df0d1ea9a8e5 |
|
|
| c:\users\dssdpmx042\desktop\pgm8zh2abxrdyc7agszx\lsxsfgzrgx3ysj1\@please_read_me@.txt | 0.91 KB (933 bytes) |
MD5:
7a2726bb6e6a79fb1d092b7f2b688af0
SHA1: b3effadce8b76aee8cd6ce2eccbb8701797468a2 SHA256: 840ab19c411c918ea3e7526d0df4b9cb002de5ea15e854389285df0d1ea9a8e5 |
|
|
| c:\users\dssdpmx042\documents\@please_read_me@.txt | 0.91 KB (933 bytes) |
MD5:
7a2726bb6e6a79fb1d092b7f2b688af0
SHA1: b3effadce8b76aee8cd6ce2eccbb8701797468a2 SHA256: 840ab19c411c918ea3e7526d0df4b9cb002de5ea15e854389285df0d1ea9a8e5 |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\@please_read_me@.txt | 0.91 KB (933 bytes) |
MD5:
7a2726bb6e6a79fb1d092b7f2b688af0
SHA1: b3effadce8b76aee8cd6ce2eccbb8701797468a2 SHA256: 840ab19c411c918ea3e7526d0df4b9cb002de5ea15e854389285df0d1ea9a8e5 |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\j9gd3zhd03fzbccc\@please_read_me@.txt | 0.91 KB (933 bytes) |
MD5:
7a2726bb6e6a79fb1d092b7f2b688af0
SHA1: b3effadce8b76aee8cd6ce2eccbb8701797468a2 SHA256: 840ab19c411c918ea3e7526d0df4b9cb002de5ea15e854389285df0d1ea9a8e5 |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\kfd49gef82k2wc1srgu\@please_read_me@.txt | 0.91 KB (933 bytes) |
MD5:
7a2726bb6e6a79fb1d092b7f2b688af0
SHA1: b3effadce8b76aee8cd6ce2eccbb8701797468a2 SHA256: 840ab19c411c918ea3e7526d0df4b9cb002de5ea15e854389285df0d1ea9a8e5 |
|
|
| c:\@please_read_me@.txt | 0.91 KB (933 bytes) |
MD5:
7a2726bb6e6a79fb1d092b7f2b688af0
SHA1: b3effadce8b76aee8cd6ce2eccbb8701797468a2 SHA256: 840ab19c411c918ea3e7526d0df4b9cb002de5ea15e854389285df0d1ea9a8e5 |
|
|
| c:\system volume information\@please_read_me@.txt | 0.91 KB (933 bytes) |
MD5:
7a2726bb6e6a79fb1d092b7f2b688af0
SHA1: b3effadce8b76aee8cd6ce2eccbb8701797468a2 SHA256: 840ab19c411c918ea3e7526d0df4b9cb002de5ea15e854389285df0d1ea9a8e5 |
|
|
| c:\programdata\microsoft\user account pictures\@please_read_me@.txt | 0.91 KB (933 bytes) |
MD5:
7a2726bb6e6a79fb1d092b7f2b688af0
SHA1: b3effadce8b76aee8cd6ce2eccbb8701797468a2 SHA256: 840ab19c411c918ea3e7526d0df4b9cb002de5ea15e854389285df0d1ea9a8e5 |
|
|
| c:\programdata\microsoft\user account pictures\default pictures\@please_read_me@.txt | 0.91 KB (933 bytes) |
MD5:
7a2726bb6e6a79fb1d092b7f2b688af0
SHA1: b3effadce8b76aee8cd6ce2eccbb8701797468a2 SHA256: 840ab19c411c918ea3e7526d0df4b9cb002de5ea15e854389285df0d1ea9a8e5 |
|
|
| c:\programdata\microsoft\windows\caches\@please_read_me@.txt | 0.91 KB (933 bytes) |
MD5:
7a2726bb6e6a79fb1d092b7f2b688af0
SHA1: b3effadce8b76aee8cd6ce2eccbb8701797468a2 SHA256: 840ab19c411c918ea3e7526d0df4b9cb002de5ea15e854389285df0d1ea9a8e5 |
|
|
| c:\programdata\microsoft\windows\ringtones\@please_read_me@.txt | 0.91 KB (933 bytes) |
MD5:
7a2726bb6e6a79fb1d092b7f2b688af0
SHA1: b3effadce8b76aee8cd6ce2eccbb8701797468a2 SHA256: 840ab19c411c918ea3e7526d0df4b9cb002de5ea15e854389285df0d1ea9a8e5 |
|
|
| c:\programdata\microsoft\windows nt\msscan\@please_read_me@.txt | 0.91 KB (933 bytes) |
MD5:
7a2726bb6e6a79fb1d092b7f2b688af0
SHA1: b3effadce8b76aee8cd6ce2eccbb8701797468a2 SHA256: 840ab19c411c918ea3e7526d0df4b9cb002de5ea15e854389285df0d1ea9a8e5 |
|
|
| c:\users\dssdpmx042\desktop\bibagpmyuse2qjdfr.jpg.wncryt | 11.09 KB (11352 bytes) |
MD5:
da73798452b7fba062b913ecd37286d9
SHA1: 09e66ad856a76c12806015851eef0765bc3dea89 SHA256: 256d273f5d6539d8db02951fde28b43d616167b1a89a2f1ef79e5b7850d374ba |
|
|
| c:\users\dssdpmx042\desktop\bibagpmyuse2qjdfr.jpg.wncry | 11.09 KB (11352 bytes) |
MD5:
da73798452b7fba062b913ecd37286d9
SHA1: 09e66ad856a76c12806015851eef0765bc3dea89 SHA256: 256d273f5d6539d8db02951fde28b43d616167b1a89a2f1ef79e5b7850d374ba |
|
|
| c:\users\dssdpmx042\desktop\h yrmf.docx.wncryt | 22.27 KB (22808 bytes) |
MD5:
d905808e8ea2e805e6b416d70d608d48
SHA1: e7b7c3cbd769eb79150298bfccab1310fcd35e1a SHA256: 83a8094789c016d13b8a78da188d017f0106e42da605cd3ac8d3882155a51c22 |
|
|
| c:\users\dssdpmx042\desktop\h yrmf.docx.wncry | 22.27 KB (22808 bytes) |
MD5:
d905808e8ea2e805e6b416d70d608d48
SHA1: e7b7c3cbd769eb79150298bfccab1310fcd35e1a SHA256: 83a8094789c016d13b8a78da188d017f0106e42da605cd3ac8d3882155a51c22 |
|
|
| c:\users\dssdpmx042\desktop\hwef8jg56gk9dlonf.csv.wncryt | 80.85 KB (82792 bytes) |
MD5:
c2672dd7ed6ec9eab03386340c7a6f3b
SHA1: e02f3f0271f5b7a2d9641cf6d102da77f9e661ce SHA256: f91df75053d0e25cab35b9e1d18f90c06c534a7f42d6a0c7b41ea3d34440adcd |
|
|
| c:\users\dssdpmx042\desktop\hwef8jg56gk9dlonf.csv.wncry | 80.85 KB (82792 bytes) |
MD5:
c2672dd7ed6ec9eab03386340c7a6f3b
SHA1: e02f3f0271f5b7a2d9641cf6d102da77f9e661ce SHA256: f91df75053d0e25cab35b9e1d18f90c06c534a7f42d6a0c7b41ea3d34440adcd |
|
|
| c:\users\dssdpmx042\desktop\lt4b3l1iwxyf2bnrt.xlsx.wncryt | 71.76 KB (73480 bytes) |
MD5:
a6dd8e06654780956483155b8978d3b9
SHA1: 10d3576c3629eb2dcc107a704932f1f122845782 SHA256: c4a9dd89f615c007f3fc4e973151bde2641a97976c3aee52dbefa8477a79ce54 |
|
|
| c:\users\dssdpmx042\desktop\lt4b3l1iwxyf2bnrt.xlsx.wncry | 71.76 KB (73480 bytes) |
MD5:
a6dd8e06654780956483155b8978d3b9
SHA1: 10d3576c3629eb2dcc107a704932f1f122845782 SHA256: c4a9dd89f615c007f3fc4e973151bde2641a97976c3aee52dbefa8477a79ce54 |
|
|
| c:\users\dssdpmx042\desktop\qb17mfblutnx_jw3.jpg.wncryt | 40.27 KB (41240 bytes) |
MD5:
fbfbc94fc6e4b8991ec3c3d1f0d2f24d
SHA1: f8b71fb844dad50980fe4a9dbd0103e51502d0b7 SHA256: 6e97389728e6d4a105bf9c6ad55b9c1d8a67b080aa3ee26e1e77f4b405faacff |
|
|
| c:\users\dssdpmx042\desktop\qb17mfblutnx_jw3.jpg.wncry | 40.27 KB (41240 bytes) |
MD5:
fbfbc94fc6e4b8991ec3c3d1f0d2f24d
SHA1: f8b71fb844dad50980fe4a9dbd0103e51502d0b7 SHA256: 6e97389728e6d4a105bf9c6ad55b9c1d8a67b080aa3ee26e1e77f4b405faacff |
|
|
| c:\users\dssdpmx042\desktop\xirvpsv.pptx.wncryt | 58.68 KB (60088 bytes) |
MD5:
6ffb6e3ba17774fc339b5a4fce9ecfc8
SHA1: 9e2d2bd67b9c9744cd436e5d782d934c5f2d25bc SHA256: 83e55942a55f35ba23f9d39fa08f7128b913db96067dd2449bfcf27bdbdaa10d |
|
|
| c:\users\dssdpmx042\desktop\xirvpsv.pptx.wncry | 58.68 KB (60088 bytes) |
MD5:
6ffb6e3ba17774fc339b5a4fce9ecfc8
SHA1: 9e2d2bd67b9c9744cd436e5d782d934c5f2d25bc SHA256: 83e55942a55f35ba23f9d39fa08f7128b913db96067dd2449bfcf27bdbdaa10d |
|
|
| c:\users\dssdpmx042\desktop\z89la7110x3isdf6.doc.wncryt | 36.18 KB (37048 bytes) |
MD5:
13b6e76d17664e4139909e5715759d72
SHA1: 099e59de271053fba210f46c16b2c13c0b2047e9 SHA256: edc3026ed54fcebe8f1c14bf9dcd39ce12211609f46e0ff094a94802b7a46cfa |
|
|
| c:\users\dssdpmx042\desktop\z89la7110x3isdf6.doc.wncry | 36.18 KB (37048 bytes) |
MD5:
13b6e76d17664e4139909e5715759d72
SHA1: 099e59de271053fba210f46c16b2c13c0b2047e9 SHA256: edc3026ed54fcebe8f1c14bf9dcd39ce12211609f46e0ff094a94802b7a46cfa |
|
|
| c:\users\dssdpmx042\desktop\pgm8zh2abxrdyc7agszx\6pkpcf4uawtzg4xqlmdz.jpg.wncryt | 97.88 KB (100232 bytes) |
MD5:
d84d799e738f66bfce9cde9b40a91260
SHA1: 77fc587cb2112358c1e092c8734b21c19bac7935 SHA256: 5e28b3b281e21be78021b437c4b34ed1515cff0b81a3721af41c1dd1d6e1e8f7 |
|
|
| c:\users\dssdpmx042\desktop\pgm8zh2abxrdyc7agszx\6pkpcf4uawtzg4xqlmdz.jpg.wncry | 97.88 KB (100232 bytes) |
MD5:
d84d799e738f66bfce9cde9b40a91260
SHA1: 77fc587cb2112358c1e092c8734b21c19bac7935 SHA256: 5e28b3b281e21be78021b437c4b34ed1515cff0b81a3721af41c1dd1d6e1e8f7 |
|
|
| c:\users\dssdpmx042\desktop\pgm8zh2abxrdyc7agszx\lsxsfgzrgx3ysj1\2tpofaj-rucn\yluqbrq8d4aff5hp.jpg.wncryt | 80.52 KB (82456 bytes) |
MD5:
36e3118e2afa6bfce7b6bfbc73f932d8
SHA1: 157aa2923213757beaf68ce4237ff888b58737f8 SHA256: 64c56afd39cd0bbefc9e10f60a890b1167a321df6f545e340101c41bc24cee71 |
|
|
| c:\users\dssdpmx042\desktop\pgm8zh2abxrdyc7agszx\lsxsfgzrgx3ysj1\2tpofaj-rucn\yluqbrq8d4aff5hp.jpg.wncry | 80.52 KB (82456 bytes) |
MD5:
36e3118e2afa6bfce7b6bfbc73f932d8
SHA1: 157aa2923213757beaf68ce4237ff888b58737f8 SHA256: 64c56afd39cd0bbefc9e10f60a890b1167a321df6f545e340101c41bc24cee71 |
|
|
| c:\users\dssdpmx042\desktop\3kmod_2d6ued.swf.wncryt | 85.85 KB (87912 bytes) |
MD5:
42017c1c061981b4ebc20902da1da1bb
SHA1: 7c4a69ebcadd3ea52fc99f9a806359f4e12c6370 SHA256: 418ee8a260e253bf75ec03d0814e7348dbdd71237edec560bd4e35ac5c5d5411 |
|
|
| c:\users\dssdpmx042\desktop\3kmod_2d6ued.swf.wncry | 85.85 KB (87912 bytes) |
MD5:
42017c1c061981b4ebc20902da1da1bb
SHA1: 7c4a69ebcadd3ea52fc99f9a806359f4e12c6370 SHA256: 418ee8a260e253bf75ec03d0814e7348dbdd71237edec560bd4e35ac5c5d5411 |
|
|
| c:\users\dssdpmx042\desktop\acndlsz4zhbdyziqkotj.mp3.wncryt | 79.96 KB (81880 bytes) |
MD5:
4bd46bfbfee74c352c12f5a34a6fedf0
SHA1: 1e36078bbe9c22780cfc552c60c388756dfeb7ca SHA256: 4a93d21635ff083cbde13e3d65fbe1645476c599fc9b66c414dfdca75aea8bea |
|
|
| c:\users\dssdpmx042\desktop\acndlsz4zhbdyziqkotj.mp3.wncry | 79.96 KB (81880 bytes) |
MD5:
4bd46bfbfee74c352c12f5a34a6fedf0
SHA1: 1e36078bbe9c22780cfc552c60c388756dfeb7ca SHA256: 4a93d21635ff083cbde13e3d65fbe1645476c599fc9b66c414dfdca75aea8bea |
|
|
| c:\users\dssdpmx042\desktop\ajkh5gnvfe8rqzavym.png.wncryt | 74.54 KB (76328 bytes) |
MD5:
8c663eca804cdd5a480bc4e979bf3750
SHA1: 90ba13476718190673f31eebca2c6c7ca7efc0d5 SHA256: 374122d65d1ae83cf168f24e9e5bab6501fe50d80036933962f18523427dbd7c |
|
|
| c:\users\dssdpmx042\desktop\ajkh5gnvfe8rqzavym.png.wncry | 74.54 KB (76328 bytes) |
MD5:
8c663eca804cdd5a480bc4e979bf3750
SHA1: 90ba13476718190673f31eebca2c6c7ca7efc0d5 SHA256: 374122d65d1ae83cf168f24e9e5bab6501fe50d80036933962f18523427dbd7c |
|
|
| c:\users\dssdpmx042\desktop\blw7.png.wncryt | 47.10 KB (48232 bytes) |
MD5:
ab4509f821c27a880cf7feac0224a7d2
SHA1: 4d9318a4ecf0c3336c69983856278ed64443b818 SHA256: 2f9bdb8686832ca0e00fb01c38256d1efdcad25daf5b6627f1c170a04d2875d1 |
|
|
| c:\users\dssdpmx042\desktop\blw7.png.wncry | 47.10 KB (48232 bytes) |
MD5:
ab4509f821c27a880cf7feac0224a7d2
SHA1: 4d9318a4ecf0c3336c69983856278ed64443b818 SHA256: 2f9bdb8686832ca0e00fb01c38256d1efdcad25daf5b6627f1c170a04d2875d1 |
|
|
| c:\users\dssdpmx042\desktop\c9dt7ht6ochw_r.flv.wncryt | 80.63 KB (82568 bytes) |
MD5:
76ddd940e7c32cc548fdab729abc0f48
SHA1: 94127bfbc185a21d98c217a251ec1f2dddc60fd6 SHA256: 384af03e528328c41049253d3ce218270fa1c30fc3d49cb52b906e2aa360e041 |
|
|
| c:\users\dssdpmx042\desktop\c9dt7ht6ochw_r.flv.wncry | 80.63 KB (82568 bytes) |
MD5:
76ddd940e7c32cc548fdab729abc0f48
SHA1: 94127bfbc185a21d98c217a251ec1f2dddc60fd6 SHA256: 384af03e528328c41049253d3ce218270fa1c30fc3d49cb52b906e2aa360e041 |
|
|
| c:\users\dssdpmx042\desktop\fycbs5cumf6dh_fs.ods.wncryt | 15.26 KB (15624 bytes) |
MD5:
3a4985c992305883bf7b975e1d69f93c
SHA1: 5ba82c399772db385ea5dcb0444a092dffea7cc6 SHA256: 9ecf8c1e10ad2602e3c9730937582b0507979470ee1d9bbbd89fa3922102d656 |
|
|
| c:\users\dssdpmx042\desktop\fycbs5cumf6dh_fs.ods.wncry | 15.26 KB (15624 bytes) |
MD5:
3a4985c992305883bf7b975e1d69f93c
SHA1: 5ba82c399772db385ea5dcb0444a092dffea7cc6 SHA256: 9ecf8c1e10ad2602e3c9730937582b0507979470ee1d9bbbd89fa3922102d656 |
|
|
| c:\users\dssdpmx042\desktop\gfs3quzvztmy-jq6xox.bmp.wncryt | 38.90 KB (39832 bytes) |
MD5:
69502155b2d8d433667fa4de8cf4c0f2
SHA1: 61ec970083abf70dfb42a794d1eb58e59a0acd88 SHA256: 7037a6d1f279e3b2ab40261f6f0570899b07b53a690e70291e56828ce40f3e0b |
|
|
| c:\users\dssdpmx042\desktop\gfs3quzvztmy-jq6xox.bmp.wncry | 38.90 KB (39832 bytes) |
MD5:
69502155b2d8d433667fa4de8cf4c0f2
SHA1: 61ec970083abf70dfb42a794d1eb58e59a0acd88 SHA256: 7037a6d1f279e3b2ab40261f6f0570899b07b53a690e70291e56828ce40f3e0b |
|
|
| c:\users\dssdpmx042\desktop\h4mzf.bmp.wncryt | 28.51 KB (29192 bytes) |
MD5:
1b303c5b36b5d39525f246e4a2dd94f1
SHA1: f2fcdc4d92936a7c6b8b6836c5b7b401868c67ed SHA256: f300f57084f087228ab36a24db06915ba3f051cfd29e4c3a393fb64d70c08190 |
|
|
| c:\users\dssdpmx042\desktop\h4mzf.bmp.wncry | 28.51 KB (29192 bytes) |
MD5:
1b303c5b36b5d39525f246e4a2dd94f1
SHA1: f2fcdc4d92936a7c6b8b6836c5b7b401868c67ed SHA256: f300f57084f087228ab36a24db06915ba3f051cfd29e4c3a393fb64d70c08190 |
|
|
| c:\users\dssdpmx042\desktop\hyxaas7ppqlngg5ir6.mp4.wncryt | 44.84 KB (45912 bytes) |
MD5:
552bc4665b02329c4824f2604d8e3b0f
SHA1: 28096706b049fab8b6282751ec3850c5e01a6de1 SHA256: 1292feeb57d78c3d747bb9bdd726c7baa718ee7602b07fc98d873cb657839033 |
|
|
| c:\users\dssdpmx042\desktop\hyxaas7ppqlngg5ir6.mp4.wncry | 44.84 KB (45912 bytes) |
MD5:
552bc4665b02329c4824f2604d8e3b0f
SHA1: 28096706b049fab8b6282751ec3850c5e01a6de1 SHA256: 1292feeb57d78c3d747bb9bdd726c7baa718ee7602b07fc98d873cb657839033 |
|
|
| c:\users\dssdpmx042\desktop\kit3qjluq u1ehoy.wav.wncryt | 73.35 KB (75112 bytes) |
MD5:
194b0b2856ef040070481da4ecac6ce5
SHA1: 157d99cbe3b9b9806e2c9c5421d2ae7ea7879e9a SHA256: acbd352f371765bcb5f9c64e27f4c58968b5f0f8972777c1dde9acd1d7961e10 |
|
|
| c:\users\dssdpmx042\desktop\kit3qjluq u1ehoy.wav.wncry | 73.35 KB (75112 bytes) |
MD5:
194b0b2856ef040070481da4ecac6ce5
SHA1: 157d99cbe3b9b9806e2c9c5421d2ae7ea7879e9a SHA256: acbd352f371765bcb5f9c64e27f4c58968b5f0f8972777c1dde9acd1d7961e10 |
|
|
| c:\users\dssdpmx042\desktop\lkwb.wav.wncryt | 74.02 KB (75800 bytes) |
MD5:
94fdedf3962f05deda10d3222c81b753
SHA1: 5223e95d4f39b8a6e8b826e0bc5fce97d66f7565 SHA256: f94e3f65475b440981571afb6c3b5cf877b575adc23dae70d9340ec8edf4bcdb |
|
|
| c:\users\dssdpmx042\desktop\lkwb.wav.wncry | 74.02 KB (75800 bytes) |
MD5:
94fdedf3962f05deda10d3222c81b753
SHA1: 5223e95d4f39b8a6e8b826e0bc5fce97d66f7565 SHA256: f94e3f65475b440981571afb6c3b5cf877b575adc23dae70d9340ec8edf4bcdb |
|
|
| c:\users\dssdpmx042\desktop\m-flkfw.pps.wncryt | 41.13 KB (42120 bytes) |
MD5:
a9d9c012f146cdc7ee766cc425e8e489
SHA1: 133f658cae905b2561597b2a13c8909166611b47 SHA256: 03c38620aecef400199018ffd28abf07db0059fe68b7be695c587968111ec4ce |
|
|
| c:\users\dssdpmx042\desktop\m-flkfw.pps.wncry | 41.13 KB (42120 bytes) |
MD5:
a9d9c012f146cdc7ee766cc425e8e489
SHA1: 133f658cae905b2561597b2a13c8909166611b47 SHA256: 03c38620aecef400199018ffd28abf07db0059fe68b7be695c587968111ec4ce |
|
|
| c:\users\dssdpmx042\desktop\p6tg4g.bmp.wncryt | 90.57 KB (92744 bytes) |
MD5:
fd398b116d80e42e94cd79a343afd17c
SHA1: ceccb5a5ec206bb74d9bd01346eb354b8434e104 SHA256: e8d14faf7b9e1c855c4942f81f5f873edba0dc58771f73be3116b5c7279ccffa |
|
|
| c:\users\dssdpmx042\desktop\p6tg4g.bmp.wncry | 90.57 KB (92744 bytes) |
MD5:
fd398b116d80e42e94cd79a343afd17c
SHA1: ceccb5a5ec206bb74d9bd01346eb354b8434e104 SHA256: e8d14faf7b9e1c855c4942f81f5f873edba0dc58771f73be3116b5c7279ccffa |
|
|
| c:\users\dssdpmx042\desktop\ytaj9x8n5wxojmujtmi.gif.wncryt | 31.49 KB (32248 bytes) |
MD5:
16562bbf4a3cba18dff4a8ee5f88e2ec
SHA1: 4a4121347609f93f690bec4191e333ffd8acef10 SHA256: 51b202fd4f17cdc4f344d9f8292850962fa0923544ca53560b9bc80b1a33d47a |
|
|
| c:\users\dssdpmx042\desktop\ytaj9x8n5wxojmujtmi.gif.wncry | 31.49 KB (32248 bytes) |
MD5:
16562bbf4a3cba18dff4a8ee5f88e2ec
SHA1: 4a4121347609f93f690bec4191e333ffd8acef10 SHA256: 51b202fd4f17cdc4f344d9f8292850962fa0923544ca53560b9bc80b1a33d47a |
|
|
| c:\users\dssdpmx042\desktop\zb1nbq.mp4.wncryt | 42.49 KB (43512 bytes) |
MD5:
38f2f91a7383f903bf02b4a8f244fb54
SHA1: 2aa50360e212ace0b47aa88d89d1ad657a59263c SHA256: 0de0e567f4914a8f03f00e0a947ee60ab605f86627ba9684aa21089af4bba48d |
|
|
| c:\users\dssdpmx042\desktop\zb1nbq.mp4.wncry | 42.49 KB (43512 bytes) |
MD5:
38f2f91a7383f903bf02b4a8f244fb54
SHA1: 2aa50360e212ace0b47aa88d89d1ad657a59263c SHA256: 0de0e567f4914a8f03f00e0a947ee60ab605f86627ba9684aa21089af4bba48d |
|
|
| c:\users\dssdpmx042\desktop\zu3ocp3f88cn.flv.wncryt | 87.12 KB (89208 bytes) |
MD5:
3112a3bd65a2cf8800290d9898775062
SHA1: f1a2f51591db9d3649b2f70bada7d1b83e81105d SHA256: bda21f175ae835c44771303814a084919b2f56f4fd17ecf5f65e6cd4fb09c60c |
|
|
| c:\users\dssdpmx042\desktop\zu3ocp3f88cn.flv.wncry | 87.12 KB (89208 bytes) |
MD5:
3112a3bd65a2cf8800290d9898775062
SHA1: f1a2f51591db9d3649b2f70bada7d1b83e81105d SHA256: bda21f175ae835c44771303814a084919b2f56f4fd17ecf5f65e6cd4fb09c60c |
|
|
| c:\users\dssdpmx042\desktop\pgm8zh2abxrdyc7agszx\- jmajpm5_rro.bmp.wncryt | 84.73 KB (86760 bytes) |
MD5:
c0a1e95102cfa081ba164890ab5f23b7
SHA1: 283aa92034f79a22d49ab5bd9452bd4a4b4296f9 SHA256: 3a2124af4527c49ea8dbd7d29ec769d059ec61b7febc6864ae318e32f6b2767d |
|
|
| c:\users\dssdpmx042\desktop\pgm8zh2abxrdyc7agszx\- jmajpm5_rro.bmp.wncry | 84.73 KB (86760 bytes) |
MD5:
c0a1e95102cfa081ba164890ab5f23b7
SHA1: 283aa92034f79a22d49ab5bd9452bd4a4b4296f9 SHA256: 3a2124af4527c49ea8dbd7d29ec769d059ec61b7febc6864ae318e32f6b2767d |
|
|
| c:\users\dssdpmx042\desktop\pgm8zh2abxrdyc7agszx\mf1nbo.swf.wncryt | 19.51 KB (19976 bytes) |
MD5:
735bfd9387bf698c126ab60a1caba50e
SHA1: 397826b07e7d830d2de4f716646db233b85ad8ac SHA256: f432be570f44fe6452518eaa39b4be8ea4ac84b5734f02c6fea9f5be1696579c |
|
|
| c:\users\dssdpmx042\desktop\pgm8zh2abxrdyc7agszx\mf1nbo.swf.wncry | 19.51 KB (19976 bytes) |
MD5:
735bfd9387bf698c126ab60a1caba50e
SHA1: 397826b07e7d830d2de4f716646db233b85ad8ac SHA256: f432be570f44fe6452518eaa39b4be8ea4ac84b5734f02c6fea9f5be1696579c |
|
|
| c:\users\dssdpmx042\desktop\pgm8zh2abxrdyc7agszx\0qdvmg\kslni5puyuj.flv.wncryt | 69.74 KB (71416 bytes) |
MD5:
44d19ffd3b90a9983dbdd954adda1d81
SHA1: f534fbfe610f4f22fe135d2f151a8cfce526f58a SHA256: 18a31d90aca846c7cdeafcafc4092633e01b2373a58eedae644084c454b3dd26 |
|
|
| c:\users\dssdpmx042\desktop\pgm8zh2abxrdyc7agszx\0qdvmg\kslni5puyuj.flv.wncry | 69.74 KB (71416 bytes) |
MD5:
44d19ffd3b90a9983dbdd954adda1d81
SHA1: f534fbfe610f4f22fe135d2f151a8cfce526f58a SHA256: 18a31d90aca846c7cdeafcafc4092633e01b2373a58eedae644084c454b3dd26 |
|
|
| c:\users\dssdpmx042\desktop\pgm8zh2abxrdyc7agszx\0qdvmg\ntjkr9csa.mp4.wncryt | 84.21 KB (86232 bytes) |
MD5:
c44e0b52bfc6faab6166f6f995c03105
SHA1: 65a9b98a894b2430908085831ae5f00c82b387c1 SHA256: 0593c78de2d09db0bf2f50cbd45278afa1fda4e1aa50cafb615638d74119b528 |
|
|
| c:\users\dssdpmx042\desktop\pgm8zh2abxrdyc7agszx\0qdvmg\ntjkr9csa.mp4.wncry | 84.21 KB (86232 bytes) |
MD5:
c44e0b52bfc6faab6166f6f995c03105
SHA1: 65a9b98a894b2430908085831ae5f00c82b387c1 SHA256: 0593c78de2d09db0bf2f50cbd45278afa1fda4e1aa50cafb615638d74119b528 |
|
|
| c:\users\dssdpmx042\desktop\pgm8zh2abxrdyc7agszx\0qdvmg\nxds miu.odp.wncryt | 25.59 KB (26200 bytes) |
MD5:
ce620ffb12daad223156420c81e89f46
SHA1: 99f0381eaf741b944cd9db8de55a61fd54aaba29 SHA256: 78c0840bc0b88471f469dfe96ac704384134b55d316b80d9f85df369184d9224 |
|
|
| c:\users\dssdpmx042\desktop\pgm8zh2abxrdyc7agszx\0qdvmg\nxds miu.odp.wncry | 25.59 KB (26200 bytes) |
MD5:
ce620ffb12daad223156420c81e89f46
SHA1: 99f0381eaf741b944cd9db8de55a61fd54aaba29 SHA256: 78c0840bc0b88471f469dfe96ac704384134b55d316b80d9f85df369184d9224 |
|
|
| c:\users\dssdpmx042\desktop\pgm8zh2abxrdyc7agszx\k8vahpvastg\2h9gjyzxutjtaj vlt76.ods.wncryt | 24.45 KB (25032 bytes) |
MD5:
4475f660c80fcc798bc38bfa610a5c1d
SHA1: 5dcf3f204f7a1e5cfccd7a104b3a36cb5c0fd0e6 SHA256: a0320f90e59ae3eb355040dfe89be684eb0411663835ebf88597e990386c5a7e |
|
|
| c:\users\dssdpmx042\desktop\pgm8zh2abxrdyc7agszx\k8vahpvastg\2h9gjyzxutjtaj vlt76.ods.wncry | 24.45 KB (25032 bytes) |
MD5:
4475f660c80fcc798bc38bfa610a5c1d
SHA1: 5dcf3f204f7a1e5cfccd7a104b3a36cb5c0fd0e6 SHA256: a0320f90e59ae3eb355040dfe89be684eb0411663835ebf88597e990386c5a7e |
|
|
| c:\users\dssdpmx042\desktop\pgm8zh2abxrdyc7agszx\k8vahpvastg\9wcvzyuqncphgsqczkn.png.wncryt | 94.63 KB (96904 bytes) |
MD5:
e07ff506d192e05ac03f058f313ce6b8
SHA1: 4c4d068af8be9ed258c0db34abedbabe8deb98bc SHA256: 540d6f4bfcb7df4dd0b0dabc6329bba3885e377b1738790114434f3b83a678b8 |
|
|
| c:\users\dssdpmx042\desktop\pgm8zh2abxrdyc7agszx\k8vahpvastg\9wcvzyuqncphgsqczkn.png.wncry | 94.63 KB (96904 bytes) |
MD5:
e07ff506d192e05ac03f058f313ce6b8
SHA1: 4c4d068af8be9ed258c0db34abedbabe8deb98bc SHA256: 540d6f4bfcb7df4dd0b0dabc6329bba3885e377b1738790114434f3b83a678b8 |
|
|
| c:\users\dssdpmx042\desktop\pgm8zh2abxrdyc7agszx\k8vahpvastg\kpyogarb2ozckx549d.flv.wncryt | 46.76 KB (47880 bytes) |
MD5:
29c5beb13186c334ff549f14192eebbf
SHA1: 452a67dd80d75f5315e7250522d0adae475c673b SHA256: caab763449903cdfc503c74021f193addf894b9395af2886b71a578987cfa7ee |
|
|
| c:\users\dssdpmx042\desktop\pgm8zh2abxrdyc7agszx\k8vahpvastg\kpyogarb2ozckx549d.flv.wncry | 46.76 KB (47880 bytes) |
MD5:
29c5beb13186c334ff549f14192eebbf
SHA1: 452a67dd80d75f5315e7250522d0adae475c673b SHA256: caab763449903cdfc503c74021f193addf894b9395af2886b71a578987cfa7ee |
|
|
| c:\users\dssdpmx042\desktop\pgm8zh2abxrdyc7agszx\k8vahpvastg\z8mf4.avi.wncryt | 79.80 KB (81720 bytes) |
MD5:
13152349d47b9d2dcb17a2c102262bb4
SHA1: 7b0c676d9086fa8551534e19fe4e91b41b457bca SHA256: 547e61add2f2ba999ee1698022163b79083d9a64ad5f182771afca8aa910c8ec |
|
|
| c:\users\dssdpmx042\desktop\pgm8zh2abxrdyc7agszx\k8vahpvastg\z8mf4.avi.wncry | 79.80 KB (81720 bytes) |
MD5:
13152349d47b9d2dcb17a2c102262bb4
SHA1: 7b0c676d9086fa8551534e19fe4e91b41b457bca SHA256: 547e61add2f2ba999ee1698022163b79083d9a64ad5f182771afca8aa910c8ec |
|
|
| c:\users\dssdpmx042\desktop\pgm8zh2abxrdyc7agszx\lsxsfgzrgx3ysj1\tey_zyonktol5ojrt0io.mp4.wncryt | 20.26 KB (20744 bytes) |
MD5:
5190687a5afa9a78b1e497b7b4942161
SHA1: a5727619935a4bff4473f6b015c9137fc5f54b51 SHA256: acf1ac2194c046e02c9a1c70c91107703a30286bd59d7b42eac173d7511f1052 |
|
|
| c:\users\dssdpmx042\desktop\pgm8zh2abxrdyc7agszx\lsxsfgzrgx3ysj1\tey_zyonktol5ojrt0io.mp4.wncry | 20.26 KB (20744 bytes) |
MD5:
5190687a5afa9a78b1e497b7b4942161
SHA1: a5727619935a4bff4473f6b015c9137fc5f54b51 SHA256: acf1ac2194c046e02c9a1c70c91107703a30286bd59d7b42eac173d7511f1052 |
|
|
| c:\users\dssdpmx042\desktop\pgm8zh2abxrdyc7agszx\lsxsfgzrgx3ysj1\2tpofaj-rucn\46ix9df9_1lvnwsx.mp3.wncryt | 7.30 KB (7480 bytes) |
MD5:
7e36c746b4ab036102163998824cf58c
SHA1: bafaa829c24d9f71d89d6b9070fa804a5901f2c6 SHA256: b8a33643c2dcd517db7deff4a4a459acd6f630e12a484ab03c41328a6a7b526c |
|
|
| c:\users\dssdpmx042\desktop\pgm8zh2abxrdyc7agszx\lsxsfgzrgx3ysj1\2tpofaj-rucn\46ix9df9_1lvnwsx.mp3.wncry | 7.30 KB (7480 bytes) |
MD5:
7e36c746b4ab036102163998824cf58c
SHA1: bafaa829c24d9f71d89d6b9070fa804a5901f2c6 SHA256: b8a33643c2dcd517db7deff4a4a459acd6f630e12a484ab03c41328a6a7b526c |
|
|
| c:\programdata\qxtqusdnjzrizx418\f.wnry | 0.10 KB (106 bytes) |
MD5:
35127b2a5454914606b24bb01c185c86
SHA1: 88295b941fb048511649f5d07c33adeac14c7cb7 SHA256: ce0a30cb1eb0b57be12c006ef802133e146788b8140acc27348980e5ce21920d |
|
|
| c:\users\dssdpmx042\desktop\pgm8zh2abxrdyc7agszx\lsxsfgzrgx3ysj1\2tpofaj-rucn\93pm.gif.wncryt | 11.60 KB (11880 bytes) |
MD5:
918ea8d5d58af1eb46aff89900be220f
SHA1: da4ff7a82cd64133e4710f4f5f51f16749f673b9 SHA256: 7a47e96786ead3632934d2c334e7beb0833579d533260c0de9a077dd97a8d9a6 |
|
|
| c:\users\dssdpmx042\desktop\pgm8zh2abxrdyc7agszx\lsxsfgzrgx3ysj1\2tpofaj-rucn\93pm.gif.wncry | 11.60 KB (11880 bytes) |
MD5:
918ea8d5d58af1eb46aff89900be220f
SHA1: da4ff7a82cd64133e4710f4f5f51f16749f673b9 SHA256: 7a47e96786ead3632934d2c334e7beb0833579d533260c0de9a077dd97a8d9a6 |
|
|
| c:\users\dssdpmx042\desktop\pgm8zh2abxrdyc7agszx\lsxsfgzrgx3ysj1\2tpofaj-rucn\cxy8v.mp4.wncryt | 97.12 KB (99448 bytes) |
MD5:
ec43ed8ee82a2481f7733398185295cf
SHA1: 17336caa449328b825daa13317bf9c3257798713 SHA256: d2c2ff9520594a8824da8f1bbef5eeb921caec4bf5168eb132bf1bf2451a70b2 |
|
|
| c:\users\dssdpmx042\desktop\pgm8zh2abxrdyc7agszx\lsxsfgzrgx3ysj1\2tpofaj-rucn\cxy8v.mp4.wncry | 97.12 KB (99448 bytes) |
MD5:
ec43ed8ee82a2481f7733398185295cf
SHA1: 17336caa449328b825daa13317bf9c3257798713 SHA256: d2c2ff9520594a8824da8f1bbef5eeb921caec4bf5168eb132bf1bf2451a70b2 |
|
|
| c:\users\dssdpmx042\desktop\pgm8zh2abxrdyc7agszx\lsxsfgzrgx3ysj1\2tpofaj-rucn\xmeixq lmabg-zgr7mpc.bmp.wncryt | 3.80 KB (3896 bytes) |
MD5:
c6b7b8e77c2c59e9446c80ee9d8447ff
SHA1: 60694fbda21c8893eb4d0cfb589fc5f3d3793774 SHA256: a182b436cc0a8e27c4de43042584ca1dc29d7b2c705a835a390040b237f50bc8 |
|
|
| c:\users\dssdpmx042\desktop\pgm8zh2abxrdyc7agszx\lsxsfgzrgx3ysj1\2tpofaj-rucn\xmeixq lmabg-zgr7mpc.bmp.wncry | 3.80 KB (3896 bytes) |
MD5:
c6b7b8e77c2c59e9446c80ee9d8447ff
SHA1: 60694fbda21c8893eb4d0cfb589fc5f3d3793774 SHA256: a182b436cc0a8e27c4de43042584ca1dc29d7b2c705a835a390040b237f50bc8 |
|
|
| c:\users\dssdpmx042\desktop\pgm8zh2abxrdyc7agszx\lsxsfgzrgx3ysj1\2tpofaj-rucn\yg84pi.avi.wncryt | 36.10 KB (36968 bytes) |
MD5:
598e15dd285eb3d66c64df6121976f04
SHA1: c63a4da15b365e72f1f96993d90e09b70faa618a SHA256: 9bfd53f84cfa5bb82829642ca4ac695f5d5e5efdde976ef397ab4cc698f2a045 |
|
|
| c:\users\dssdpmx042\desktop\pgm8zh2abxrdyc7agszx\lsxsfgzrgx3ysj1\2tpofaj-rucn\yg84pi.avi.wncry | 36.10 KB (36968 bytes) |
MD5:
598e15dd285eb3d66c64df6121976f04
SHA1: c63a4da15b365e72f1f96993d90e09b70faa618a SHA256: 9bfd53f84cfa5bb82829642ca4ac695f5d5e5efdde976ef397ab4cc698f2a045 |
|
|
| c:\users\dssdpmx042\desktop\pgm8zh2abxrdyc7agszx\lsxsfgzrgx3ysj1\2tpofaj-rucn\yoo37jp7q.wav.wncryt | 69.70 KB (71368 bytes) |
MD5:
011b98edcebdd2b93780d56f40dea4a7
SHA1: d557ec9ae22d5531fe454900d681e593fff065d3 SHA256: 234f29a516234fbf16422026e4e1443f6b6422f0c4125c0fd501a82c4eeb85ab |
|
|
| c:\users\dssdpmx042\desktop\pgm8zh2abxrdyc7agszx\lsxsfgzrgx3ysj1\2tpofaj-rucn\yoo37jp7q.wav.wncry | 69.70 KB (71368 bytes) |
MD5:
011b98edcebdd2b93780d56f40dea4a7
SHA1: d557ec9ae22d5531fe454900d681e593fff065d3 SHA256: 234f29a516234fbf16422026e4e1443f6b6422f0c4125c0fd501a82c4eeb85ab |
|
|
| c:\users\dssdpmx042\documents\5dwumhpov0ond.doc.wncryt | 88.74 KB (90872 bytes) |
MD5:
5cd1ca8dfb2aa81a21266f546f9552a7
SHA1: 7c55a6644b51feecf1fd63bd57859b85d4a88cff SHA256: 46d4de7f6004cb170e102a5df911a25e1983561d1f0a54846eb05e03557eab11 |
|
|
| c:\users\dssdpmx042\documents\5dwumhpov0ond.doc.wncry | 88.74 KB (90872 bytes) |
MD5:
5cd1ca8dfb2aa81a21266f546f9552a7
SHA1: 7c55a6644b51feecf1fd63bd57859b85d4a88cff SHA256: 46d4de7f6004cb170e102a5df911a25e1983561d1f0a54846eb05e03557eab11 |
|
|
| c:\users\dssdpmx042\documents\5pfcgtj7-40fzu.docx.wncryt | 86.54 KB (88616 bytes) |
MD5:
4961339ad55c3f7284c8d5c3cfb1c588
SHA1: 9f24ea8c8c9d397802e4d701903778a8a4151e01 SHA256: e395ffb96f203ef7fe098ef30fadb17ad4325583dbd5e59c4d23bb7364c615a3 |
|
|
| c:\users\dssdpmx042\documents\5pfcgtj7-40fzu.docx.wncry | 86.54 KB (88616 bytes) |
MD5:
4961339ad55c3f7284c8d5c3cfb1c588
SHA1: 9f24ea8c8c9d397802e4d701903778a8a4151e01 SHA256: e395ffb96f203ef7fe098ef30fadb17ad4325583dbd5e59c4d23bb7364c615a3 |
|
|
| c:\users\dssdpmx042\documents\9c54.docx.wncryt | 81.54 KB (83496 bytes) |
MD5:
5e8095a6c45f39308e7ec68c75f9c898
SHA1: 3f23141da091e760669a1fadad04a0b6128682c2 SHA256: bfd2703601807a8932434ee73734546ffe29daa748136f0a22446382c459fbb2 |
|
|
| c:\users\dssdpmx042\documents\9c54.docx.wncry | 81.54 KB (83496 bytes) |
MD5:
5e8095a6c45f39308e7ec68c75f9c898
SHA1: 3f23141da091e760669a1fadad04a0b6128682c2 SHA256: bfd2703601807a8932434ee73734546ffe29daa748136f0a22446382c459fbb2 |
|
|
| c:\users\dssdpmx042\documents\axmcb.docx.wncryt | 78.85 KB (80744 bytes) |
MD5:
61a26f28ac8d733442ea25b98f413412
SHA1: aeaa07f50147c27635028b24ee8904cbcbed7d18 SHA256: 478d64feeee94df5f82a63e4d92934807a048c1ae0c3037f87074f16c84daf91 |
|
|
| c:\users\dssdpmx042\documents\axmcb.docx.wncry | 78.85 KB (80744 bytes) |
MD5:
61a26f28ac8d733442ea25b98f413412
SHA1: aeaa07f50147c27635028b24ee8904cbcbed7d18 SHA256: 478d64feeee94df5f82a63e4d92934807a048c1ae0c3037f87074f16c84daf91 |
|
|
| c:\users\dssdpmx042\documents\f8t0d1hl8mulgw0ye.pptx.wncryt | 8.87 KB (9080 bytes) |
MD5:
40bb90d66c5f11d1244e8868f0df7a8d
SHA1: 888f790ee9908192c343432f404b100df1d595f2 SHA256: 3a7b2025f679c4a2d047a1f0b7528630cbbe33583298da2b6963958c59daa961 |
|
|
| c:\users\dssdpmx042\documents\f8t0d1hl8mulgw0ye.pptx.wncry | 8.87 KB (9080 bytes) |
MD5:
40bb90d66c5f11d1244e8868f0df7a8d
SHA1: 888f790ee9908192c343432f404b100df1d595f2 SHA256: 3a7b2025f679c4a2d047a1f0b7528630cbbe33583298da2b6963958c59daa961 |
|
|
| c:\users\dssdpmx042\documents\g9fp hftlrgz5w.xls.wncryt | 75.55 KB (77368 bytes) |
MD5:
ea1ea3478f0d315ff1b9ff0921da93ca
SHA1: b1913745660ddb9cff1ef35e368c8d65b23c85d5 SHA256: 9b403af845f575b7896fdeb815f2f2b6e7f05ec16cad9d9be89ce81c5588edc3 |
|
|
| c:\users\dssdpmx042\documents\g9fp hftlrgz5w.xls.wncry | 75.55 KB (77368 bytes) |
MD5:
ea1ea3478f0d315ff1b9ff0921da93ca
SHA1: b1913745660ddb9cff1ef35e368c8d65b23c85d5 SHA256: 9b403af845f575b7896fdeb815f2f2b6e7f05ec16cad9d9be89ce81c5588edc3 |
|
|
| c:\users\dssdpmx042\documents\gmphr0w6rrpdhpbef.csv.wncryt | 34.93 KB (35768 bytes) |
MD5:
a8e78ee640cd053edfe59be041b389fc
SHA1: fad09c2d3f9a1c5f29d4742c839fd6ac054a872b SHA256: 951bbb0c3c2add70210bc959caede15d839aac49cbdeb70fc768357da325a1e4 |
|
|
| c:\users\dssdpmx042\documents\gmphr0w6rrpdhpbef.csv.wncry | 34.93 KB (35768 bytes) |
MD5:
a8e78ee640cd053edfe59be041b389fc
SHA1: fad09c2d3f9a1c5f29d4742c839fd6ac054a872b SHA256: 951bbb0c3c2add70210bc959caede15d839aac49cbdeb70fc768357da325a1e4 |
|
|
| c:\users\dssdpmx042\documents\gpimnirm chkjuih.xlsx.wncryt | 56.26 KB (57608 bytes) |
MD5:
ebf823308be529d8144053f4872232c7
SHA1: 27791f691037e9bde53c2c60ee32e1f7ab4ae901 SHA256: ab23c144a94abd91a8bb582e9db178ac625e8b1165a9050469c2af396641bfe2 |
|
|
| c:\users\dssdpmx042\documents\gpimnirm chkjuih.xlsx.wncry | 56.26 KB (57608 bytes) |
MD5:
ebf823308be529d8144053f4872232c7
SHA1: 27791f691037e9bde53c2c60ee32e1f7ab4ae901 SHA256: ab23c144a94abd91a8bb582e9db178ac625e8b1165a9050469c2af396641bfe2 |
|
|
| c:\users\dssdpmx042\documents\hemk7ngcvjguirn6.xlsx.wncryt | 19.95 KB (20424 bytes) |
MD5:
2326ea3caf9d0d08cf140fb253ce0a42
SHA1: a224496e8b68731d2240d5d1afd2036f06a76456 SHA256: 7e7272378f15f012886c9ba081e604a0c7eeaaf4d0111768a397216233cd7007 |
|
|
| c:\users\dssdpmx042\documents\hemk7ngcvjguirn6.xlsx.wncry | 19.95 KB (20424 bytes) |
MD5:
2326ea3caf9d0d08cf140fb253ce0a42
SHA1: a224496e8b68731d2240d5d1afd2036f06a76456 SHA256: 7e7272378f15f012886c9ba081e604a0c7eeaaf4d0111768a397216233cd7007 |
|
|
| c:\users\dssdpmx042\documents\kqsfgiuuv7macle5kbe.pptx.wncryt | 45.99 KB (47096 bytes) |
MD5:
2a1643792f60e24d426a82d297818b09
SHA1: 3f863ea5bf7621532c88ca42ed6d8f84a91b2534 SHA256: 6893f70d1b0068fea1d15ef0b34f956f50b18bca3ac2b3fe7c8cf10fef8c70eb |
|
|
| c:\users\dssdpmx042\documents\kqsfgiuuv7macle5kbe.pptx.wncry | 45.99 KB (47096 bytes) |
MD5:
2a1643792f60e24d426a82d297818b09
SHA1: 3f863ea5bf7621532c88ca42ed6d8f84a91b2534 SHA256: 6893f70d1b0068fea1d15ef0b34f956f50b18bca3ac2b3fe7c8cf10fef8c70eb |
|
|
| c:\users\dssdpmx042\documents\lsifcdcb6tbfbadh2jc.pptx.wncryt | 1.99 KB (2040 bytes) |
MD5:
0dc53b0a39c20744cd3b5871a9a24d0e
SHA1: f9c911c7ba77fe6ef6c4cfd12ab7bb8869e3b03d SHA256: 47143141fb18d1eec4acec4618f6aa320342e3a0fe96fca1785218817297df8e |
|
|
| c:\users\dssdpmx042\documents\lsifcdcb6tbfbadh2jc.pptx.wncry | 1.99 KB (2040 bytes) |
MD5:
0dc53b0a39c20744cd3b5871a9a24d0e
SHA1: f9c911c7ba77fe6ef6c4cfd12ab7bb8869e3b03d SHA256: 47143141fb18d1eec4acec4618f6aa320342e3a0fe96fca1785218817297df8e |
|
|
| c:\users\dssdpmx042\documents\lu6w3pxpu3ca.xlsx.wncryt | 13.93 KB (14264 bytes) |
MD5:
e328c6b7d836a4e1f3fa5d3b2c21ab32
SHA1: cb1e1c52bf79ace030cde923f00fc04527d0c3c4 SHA256: ff3b0cfd0a4cf0fde14f0e0ce1adfbb22b348d9c7d5d3851415a011b9fcaf974 |
|
|
| c:\users\dssdpmx042\documents\lu6w3pxpu3ca.xlsx.wncry | 13.93 KB (14264 bytes) |
MD5:
e328c6b7d836a4e1f3fa5d3b2c21ab32
SHA1: cb1e1c52bf79ace030cde923f00fc04527d0c3c4 SHA256: ff3b0cfd0a4cf0fde14f0e0ce1adfbb22b348d9c7d5d3851415a011b9fcaf974 |
|
|
| c:\users\dssdpmx042\documents\ly7o.pptx.wncryt | 48.37 KB (49528 bytes) |
MD5:
6496a48f2742ff65421213bc1aa77f9e
SHA1: 1b2f5f80bc33ce2ff2671585710d0a7f43a95bdf SHA256: 65d1023e07683b3377d65d11228a038b7a7f832f33573638ed482f6b551f11d8 |
|
|
| c:\users\dssdpmx042\documents\ly7o.pptx.wncry | 48.37 KB (49528 bytes) |
MD5:
6496a48f2742ff65421213bc1aa77f9e
SHA1: 1b2f5f80bc33ce2ff2671585710d0a7f43a95bdf SHA256: 65d1023e07683b3377d65d11228a038b7a7f832f33573638ed482f6b551f11d8 |
|
|
| c:\users\dssdpmx042\documents\qocbs.docx.wncryt | 58.49 KB (59896 bytes) |
MD5:
8add904e6aa329dcb0948b1d35748c66
SHA1: c8444b6e3e6d19d88b36c5292a5a299f56d9584c SHA256: 132281cd205e70d06273b3dd4a6d983e85eaa6b66df62c30a5dd51b78d23badb |
|
|
| c:\users\dssdpmx042\documents\qocbs.docx.wncry | 58.49 KB (59896 bytes) |
MD5:
8add904e6aa329dcb0948b1d35748c66
SHA1: c8444b6e3e6d19d88b36c5292a5a299f56d9584c SHA256: 132281cd205e70d06273b3dd4a6d983e85eaa6b66df62c30a5dd51b78d23badb |
|
|
| c:\users\dssdpmx042\documents\tcrd9un1_myjq-.pptx.wncryt | 92.55 KB (94776 bytes) |
MD5:
dc4f5d38a9683680c51c6fc18240cff7
SHA1: 771c3327a78aa01838b4a0df113b08620f4389db SHA256: 8dd56bebd69b5267beed0366ffb62fe652b3b6af4adc5ea759542421a17bde37 |
|
|
| c:\users\dssdpmx042\documents\tcrd9un1_myjq-.pptx.wncry | 92.55 KB (94776 bytes) |
MD5:
dc4f5d38a9683680c51c6fc18240cff7
SHA1: 771c3327a78aa01838b4a0df113b08620f4389db SHA256: 8dd56bebd69b5267beed0366ffb62fe652b3b6af4adc5ea759542421a17bde37 |
|
|
| c:\users\dssdpmx042\documents\wv7vnssgbfodzvw.xlsx.wncryt | 84.26 KB (86280 bytes) |
MD5:
947d94a76f8119c48ad63eeb6e55a79b
SHA1: b4559d766f389f77b5bdd6cdfd692256c25b262d SHA256: f30e855210819eb39eb0804f5c3d0180d3914d94179bd7e4444ee3b4c20f759b |
|
|
| c:\users\dssdpmx042\documents\wv7vnssgbfodzvw.xlsx.wncry | 84.26 KB (86280 bytes) |
MD5:
947d94a76f8119c48ad63eeb6e55a79b
SHA1: b4559d766f389f77b5bdd6cdfd692256c25b262d SHA256: f30e855210819eb39eb0804f5c3d0180d3914d94179bd7e4444ee3b4c20f759b |
|
|
| c:\users\dssdpmx042\documents\yzoy0uk.pptx.wncryt | 57.09 KB (58456 bytes) |
MD5:
aead00b48de4e725c391784011584430
SHA1: 3b5d3c6d2f3e095b0b9ab5fabe838d5b8bce5f7e SHA256: fbefc80f7687f4b415f1aa8d153cd2d2b1396c68e749318c643f3ac44872aa67 |
|
|
| c:\users\dssdpmx042\documents\yzoy0uk.pptx.wncry | 57.09 KB (58456 bytes) |
MD5:
aead00b48de4e725c391784011584430
SHA1: 3b5d3c6d2f3e095b0b9ab5fabe838d5b8bce5f7e SHA256: fbefc80f7687f4b415f1aa8d153cd2d2b1396c68e749318c643f3ac44872aa67 |
|
|
| c:\users\dssdpmx042\documents\zwklqrq2nlske44p.xlsx.wncryt | 63.93 KB (65464 bytes) |
MD5:
10ee0e66780fdad772edc8d351d56c74
SHA1: bf377e04de7c64f673637d0c897241425ac7b5bf SHA256: bfb274059900a588b4320677c3d59086cbcfc1bdd61baaa7d08b2b3500b29210 |
|
|
| c:\users\dssdpmx042\documents\zwklqrq2nlske44p.xlsx.wncry | 63.93 KB (65464 bytes) |
MD5:
10ee0e66780fdad772edc8d351d56c74
SHA1: bf377e04de7c64f673637d0c897241425ac7b5bf SHA256: bfb274059900a588b4320677c3d59086cbcfc1bdd61baaa7d08b2b3500b29210 |
|
|
| c:\users\dssdpmx042\documents\_xgwdcsgf mjc6 j.docx.wncryt | 63.38 KB (64904 bytes) |
MD5:
0354e75732608572e36c251c08f7833e
SHA1: dde0aaf7db8f268c2925442474026b124c82fcc9 SHA256: beb67cc0f9c4a664efe97567048b932a9b8eae442e2c8c511fa8c88f167c938e |
|
|
| c:\users\dssdpmx042\documents\_xgwdcsgf mjc6 j.docx.wncry | 63.38 KB (64904 bytes) |
MD5:
0354e75732608572e36c251c08f7833e
SHA1: dde0aaf7db8f268c2925442474026b124c82fcc9 SHA256: beb67cc0f9c4a664efe97567048b932a9b8eae442e2c8c511fa8c88f167c938e |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\@wanadecryptor@.exe.lnk | 0.71 KB (722 bytes) |
MD5:
c69be77ccaca2ede8ebdefea19f6d6c3
SHA1: d1c170e7e309646976cd3658fe76c1e4ac3c25c4 SHA256: 44cdc3b10641bf50ff9a233db4280af408981de0c05e926fe7d05da67bcac00f |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\j9gd3zhd03fzbccc\@wanadecryptor@.exe.lnk | 0.71 KB (722 bytes) |
MD5:
c69be77ccaca2ede8ebdefea19f6d6c3
SHA1: d1c170e7e309646976cd3658fe76c1e4ac3c25c4 SHA256: 44cdc3b10641bf50ff9a233db4280af408981de0c05e926fe7d05da67bcac00f |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\kfd49gef82k2wc1srgu\@wanadecryptor@.exe.lnk | 0.71 KB (722 bytes) |
MD5:
c69be77ccaca2ede8ebdefea19f6d6c3
SHA1: d1c170e7e309646976cd3658fe76c1e4ac3c25c4 SHA256: 44cdc3b10641bf50ff9a233db4280af408981de0c05e926fe7d05da67bcac00f |
|
|
| c:\programdata\microsoft\user account pictures\@wanadecryptor@.exe.lnk | 0.71 KB (722 bytes) |
MD5:
c69be77ccaca2ede8ebdefea19f6d6c3
SHA1: d1c170e7e309646976cd3658fe76c1e4ac3c25c4 SHA256: 44cdc3b10641bf50ff9a233db4280af408981de0c05e926fe7d05da67bcac00f |
|
|
| c:\programdata\microsoft\user account pictures\default pictures\@wanadecryptor@.exe.lnk | 0.71 KB (722 bytes) |
MD5:
c69be77ccaca2ede8ebdefea19f6d6c3
SHA1: d1c170e7e309646976cd3658fe76c1e4ac3c25c4 SHA256: 44cdc3b10641bf50ff9a233db4280af408981de0c05e926fe7d05da67bcac00f |
|
|
| c:\programdata\microsoft\windows\caches\@wanadecryptor@.exe.lnk | 0.71 KB (722 bytes) |
MD5:
c69be77ccaca2ede8ebdefea19f6d6c3
SHA1: d1c170e7e309646976cd3658fe76c1e4ac3c25c4 SHA256: 44cdc3b10641bf50ff9a233db4280af408981de0c05e926fe7d05da67bcac00f |
|
|
| c:\programdata\microsoft\windows\ringtones\@wanadecryptor@.exe.lnk | 0.71 KB (722 bytes) |
MD5:
c69be77ccaca2ede8ebdefea19f6d6c3
SHA1: d1c170e7e309646976cd3658fe76c1e4ac3c25c4 SHA256: 44cdc3b10641bf50ff9a233db4280af408981de0c05e926fe7d05da67bcac00f |
|
|
| c:\programdata\microsoft\windows nt\msscan\@wanadecryptor@.exe.lnk | 0.71 KB (722 bytes) |
MD5:
c69be77ccaca2ede8ebdefea19f6d6c3
SHA1: d1c170e7e309646976cd3658fe76c1e4ac3c25c4 SHA256: 44cdc3b10641bf50ff9a233db4280af408981de0c05e926fe7d05da67bcac00f |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\-nap.rtf.wncryt | 21.30 KB (21816 bytes) |
MD5:
b36c35593d083ddf7547827347d39cc7
SHA1: 29e3b417a58ba7b7db80d7b84d40193556ee83a6 SHA256: 37ed672b145e1803050e200fbe860dd3d353b6d2f1dc2f65c1491fdc4229d89b |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\-nap.rtf.wncry | 21.30 KB (21816 bytes) |
MD5:
b36c35593d083ddf7547827347d39cc7
SHA1: 29e3b417a58ba7b7db80d7b84d40193556ee83a6 SHA256: 37ed672b145e1803050e200fbe860dd3d353b6d2f1dc2f65c1491fdc4229d89b |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\9o_u.pdf.wncryt | 75.29 KB (77096 bytes) |
MD5:
5d08529339630f24571c92fbd3992aae
SHA1: d63d5b57f7c272146f93235de01bbb9120cc5bcc SHA256: 56fa98d85ec8de11310ee0ac61f380d8e810b7efc97835fae225070bca64d64d |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\9o_u.pdf.wncry | 75.29 KB (77096 bytes) |
MD5:
5d08529339630f24571c92fbd3992aae
SHA1: d63d5b57f7c272146f93235de01bbb9120cc5bcc SHA256: 56fa98d85ec8de11310ee0ac61f380d8e810b7efc97835fae225070bca64d64d |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\k6fadynloup1zicvtg0o.xlsx.wncryt | 3.24 KB (3320 bytes) |
MD5:
4126eb86b4b4ab771e49dc39a1e52993
SHA1: e36773b39e10c135859ca68e7dbfece5ac69454d SHA256: 621d4801970f53e9cb9e3e6d3f724894cde1dc663a792dffd1f2ebba06592794 |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\k6fadynloup1zicvtg0o.xlsx.wncry | 3.24 KB (3320 bytes) |
MD5:
4126eb86b4b4ab771e49dc39a1e52993
SHA1: e36773b39e10c135859ca68e7dbfece5ac69454d SHA256: 621d4801970f53e9cb9e3e6d3f724894cde1dc663a792dffd1f2ebba06592794 |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\p3k5i8nny2aq5c.pptx.wncryt | 68.82 KB (70472 bytes) |
MD5:
a1ab2a95f917a27cc8b15db1df7a81e1
SHA1: 843f05b790d04d2879219809db68d36dcd7545d9 SHA256: c55253706205be062f3c730f7f01fbed2c93d798485aec9ac5a62bc95d5575d8 |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\p3k5i8nny2aq5c.pptx.wncry | 68.82 KB (70472 bytes) |
MD5:
a1ab2a95f917a27cc8b15db1df7a81e1
SHA1: 843f05b790d04d2879219809db68d36dcd7545d9 SHA256: c55253706205be062f3c730f7f01fbed2c93d798485aec9ac5a62bc95d5575d8 |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\j9gd3zhd03fzbccc\y5sy7wjt_a7krqnidgx.xlsx.wncryt | 28.84 KB (29528 bytes) |
MD5:
94454b1b7bf4c60372cc32e2d31c9f74
SHA1: 4c06ba9f38010bfe538638ffb273c4de81348bb2 SHA256: 5a6e4363ec57b42b176109945c1458717c8b488441678f05bd809369592346bb |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\j9gd3zhd03fzbccc\y5sy7wjt_a7krqnidgx.xlsx.wncry | 28.84 KB (29528 bytes) |
MD5:
94454b1b7bf4c60372cc32e2d31c9f74
SHA1: 4c06ba9f38010bfe538638ffb273c4de81348bb2 SHA256: 5a6e4363ec57b42b176109945c1458717c8b488441678f05bd809369592346bb |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\j9gd3zhd03fzbccc\3e4ho\sbxkqajovxqwlt.csv.wncryt | 82.04 KB (84008 bytes) |
MD5:
c9609ed1e598fb01eee1c160c9f10a65
SHA1: 2a88ef6e56f0c69bf8ae6c03a059bc87b9959d1d SHA256: 301b811e145e995bca74c7787b3a087d2d44af6d7da66b1e4f8ba3313ebda2fa |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\j9gd3zhd03fzbccc\3e4ho\sbxkqajovxqwlt.csv.wncry | 82.04 KB (84008 bytes) |
MD5:
c9609ed1e598fb01eee1c160c9f10a65
SHA1: 2a88ef6e56f0c69bf8ae6c03a059bc87b9959d1d SHA256: 301b811e145e995bca74c7787b3a087d2d44af6d7da66b1e4f8ba3313ebda2fa |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\kfd49gef82k2wc1srgu\fxxfw-17sc6wh.ppt.wncryt | 8.04 KB (8232 bytes) |
MD5:
cdf30bdf3217e0c9e605bd6483ff8902
SHA1: 2edecab56087c398016d317fe25ba84f5bfee01f SHA256: 5a481db85d82f41131c451e45efbf6dc5ff888a982064075c4f55d1006f9d9c4 |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\kfd49gef82k2wc1srgu\fxxfw-17sc6wh.ppt.wncry | 8.04 KB (8232 bytes) |
MD5:
cdf30bdf3217e0c9e605bd6483ff8902
SHA1: 2edecab56087c398016d317fe25ba84f5bfee01f SHA256: 5a481db85d82f41131c451e45efbf6dc5ff888a982064075c4f55d1006f9d9c4 |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\kfd49gef82k2wc1srgu\vshy_qomhsb5w.ppt.wncryt | 28.60 KB (29288 bytes) |
MD5:
e9b0677a2f33f32c854a4b364a06b18c
SHA1: 101b43668b4b11b2172bfa31ff935652dae67cbe SHA256: 8877211f9341dd57e75219e70fa2949e598c21d6316602650b176c99be4188a6 |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\kfd49gef82k2wc1srgu\vshy_qomhsb5w.ppt.wncry | 28.60 KB (29288 bytes) |
MD5:
e9b0677a2f33f32c854a4b364a06b18c
SHA1: 101b43668b4b11b2172bfa31ff935652dae67cbe SHA256: 8877211f9341dd57e75219e70fa2949e598c21d6316602650b176c99be4188a6 |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\kfd49gef82k2wc1srgu\tedc-nspy xfvlw3\coafenjkmrn.xlsx.wncryt | 26.27 KB (26904 bytes) |
MD5:
9013b1403893ea3c5b380dde675f37f6
SHA1: 7e016c8d3d4a1335b850b72910ede986c55007c5 SHA256: cda8e3f3a8996426e9a7bf66dd38ee59cc60ed04e9e2d94d668c5727d975c8fe |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\kfd49gef82k2wc1srgu\tedc-nspy xfvlw3\coafenjkmrn.xlsx.wncry | 26.27 KB (26904 bytes) |
MD5:
9013b1403893ea3c5b380dde675f37f6
SHA1: 7e016c8d3d4a1335b850b72910ede986c55007c5 SHA256: cda8e3f3a8996426e9a7bf66dd38ee59cc60ed04e9e2d94d668c5727d975c8fe |
|
|
| c:\users\dssdpmx042\documents\kqu8ojbhlzr.odp.wncryt | 16.16 KB (16552 bytes) |
MD5:
30cf15b4006c78b30cbf5efad0620c18
SHA1: 04a88810214d2654d082d9ce45bb1b1eb0dded88 SHA256: 5fd9de346045aa87e2e5ecce3ddf0cd4b06cf961023fba2e63a1ded5e2d69693 |
|
|
| c:\users\dssdpmx042\documents\kqu8ojbhlzr.odp.wncry | 16.16 KB (16552 bytes) |
MD5:
30cf15b4006c78b30cbf5efad0620c18
SHA1: 04a88810214d2654d082d9ce45bb1b1eb0dded88 SHA256: 5fd9de346045aa87e2e5ecce3ddf0cd4b06cf961023fba2e63a1ded5e2d69693 |
|
|
| c:\users\dssdpmx042\documents\qracrespejeu3.ods.wncryt | 19.09 KB (19544 bytes) |
MD5:
04849e7cbf3e28646a3a630ff20c19f5
SHA1: ed7b5f67c43c6b352a59210359467166fbeedced SHA256: 352f3efa0fab99d072e8ffe9c79d52ef704f06781f2cbbde2123f5dedc7c88f2 |
|
|
| c:\users\dssdpmx042\documents\qracrespejeu3.ods.wncry | 19.09 KB (19544 bytes) |
MD5:
04849e7cbf3e28646a3a630ff20c19f5
SHA1: ed7b5f67c43c6b352a59210359467166fbeedced SHA256: 352f3efa0fab99d072e8ffe9c79d52ef704f06781f2cbbde2123f5dedc7c88f2 |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\t9kbu.ots.wncryt | 49.66 KB (50856 bytes) |
MD5:
bd394aaf945fe731ad07fd006cd5a741
SHA1: eb3bfc42bc690626258d7c8e2b638e6b30c5ae0f SHA256: ba068020fc69c79f3881017f4a951e400d0ccbea40aa80843d1a08ea4d58229e |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\t9kbu.ots.wncry | 49.66 KB (50856 bytes) |
MD5:
bd394aaf945fe731ad07fd006cd5a741
SHA1: eb3bfc42bc690626258d7c8e2b638e6b30c5ae0f SHA256: ba068020fc69c79f3881017f4a951e400d0ccbea40aa80843d1a08ea4d58229e |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\uigp.odp.wncryt | 68.85 KB (70504 bytes) |
MD5:
49241a64f8a60ed924d204656bf30ab1
SHA1: a152d4485edbaa6dc11cd5cb4b3d8f045f8960c8 SHA256: 34506055fc6fa8aed355b2c74f315e1239d8eba922b17470d60e8d55baf87dab |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\uigp.odp.wncry | 68.85 KB (70504 bytes) |
MD5:
49241a64f8a60ed924d204656bf30ab1
SHA1: a152d4485edbaa6dc11cd5cb4b3d8f045f8960c8 SHA256: 34506055fc6fa8aed355b2c74f315e1239d8eba922b17470d60e8d55baf87dab |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\j9gd3zhd03fzbccc\v3b5lpgbpfe06xmrqjo.ots.wncryt | 58.38 KB (59784 bytes) |
MD5:
ef06df5561345f0bf62aeb829af0151e
SHA1: 154658f7d51c569379792a2cf56499ea95266564 SHA256: c11b6245b098ab35dd04ceabc1ce2ba226354b2fff36dbadc7a2dc930f5d5b14 |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\j9gd3zhd03fzbccc\v3b5lpgbpfe06xmrqjo.ots.wncry | 58.38 KB (59784 bytes) |
MD5:
ef06df5561345f0bf62aeb829af0151e
SHA1: 154658f7d51c569379792a2cf56499ea95266564 SHA256: c11b6245b098ab35dd04ceabc1ce2ba226354b2fff36dbadc7a2dc930f5d5b14 |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\j9gd3zhd03fzbccc\3e4ho\k_5vq4jhsw8guvo.odp.wncryt | 14.43 KB (14776 bytes) |
MD5:
1de2998c63db83fbafffb155b7d23c38
SHA1: 81c28a0a60a9b99b86d9efb8269f3722f712a9e6 SHA256: 8ee82eec2d098c4a95586e8d8dfcbcc8cff6fb30edbd822c9bf9b3e5ad4aa2c0 |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\j9gd3zhd03fzbccc\3e4ho\k_5vq4jhsw8guvo.odp.wncry | 14.43 KB (14776 bytes) |
MD5:
1de2998c63db83fbafffb155b7d23c38
SHA1: 81c28a0a60a9b99b86d9efb8269f3722f712a9e6 SHA256: 8ee82eec2d098c4a95586e8d8dfcbcc8cff6fb30edbd822c9bf9b3e5ad4aa2c0 |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\j9gd3zhd03fzbccc\3e4ho\qbqa9 xzsel7xnah8.pps.wncryt | 44.40 KB (45464 bytes) |
MD5:
4f9debf4893c31632e03fa7b8cd0ea9b
SHA1: 09d56184652495495d309e340fae21e7f7f4fc35 SHA256: d60adf9bab0a3cb97be9fca2691b5be44a3a42b9c71d64b799bfc5cdca821114 |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\j9gd3zhd03fzbccc\3e4ho\qbqa9 xzsel7xnah8.pps.wncry | 44.40 KB (45464 bytes) |
MD5:
4f9debf4893c31632e03fa7b8cd0ea9b
SHA1: 09d56184652495495d309e340fae21e7f7f4fc35 SHA256: d60adf9bab0a3cb97be9fca2691b5be44a3a42b9c71d64b799bfc5cdca821114 |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\kfd49gef82k2wc1srgu\bzrtj.pps.wncryt | 63.88 KB (65416 bytes) |
MD5:
b19c25689eb1cedf81066cb4e7ff2007
SHA1: 056ea99d697606dcf14271812ebdace73b802d86 SHA256: b964a3b7423a525c64a3313a0568c28c1e90d5c56b8450f752306965a5391dfe |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\kfd49gef82k2wc1srgu\bzrtj.pps.wncry | 63.88 KB (65416 bytes) |
MD5:
b19c25689eb1cedf81066cb4e7ff2007
SHA1: 056ea99d697606dcf14271812ebdace73b802d86 SHA256: b964a3b7423a525c64a3313a0568c28c1e90d5c56b8450f752306965a5391dfe |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\kfd49gef82k2wc1srgu\lo4nczsaz.ots.wncryt | 19.18 KB (19640 bytes) |
MD5:
c1ba7533e53884804b236c202a146889
SHA1: 784165e2e16a0a2ddb385f878bb912f37db4a14f SHA256: 45db25bc5dafe3dc5de708c40217703db4c17d113faf07b3e46fae3886ba4ab2 |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\kfd49gef82k2wc1srgu\lo4nczsaz.ots.wncry | 19.18 KB (19640 bytes) |
MD5:
c1ba7533e53884804b236c202a146889
SHA1: 784165e2e16a0a2ddb385f878bb912f37db4a14f SHA256: 45db25bc5dafe3dc5de708c40217703db4c17d113faf07b3e46fae3886ba4ab2 |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\kfd49gef82k2wc1srgu\nqa-xbh.odp.wncryt | 67.65 KB (69272 bytes) |
MD5:
b6a4c95cd407d2d7e1cdc5bf143431eb
SHA1: bdda284edfbf226720160b5d601858116772458f SHA256: bdd433d31a91ab13e3199f82d6236151581f79d149340b723291a79e7f68952f |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\kfd49gef82k2wc1srgu\nqa-xbh.odp.wncry | 67.65 KB (69272 bytes) |
MD5:
b6a4c95cd407d2d7e1cdc5bf143431eb
SHA1: bdda284edfbf226720160b5d601858116772458f SHA256: bdd433d31a91ab13e3199f82d6236151581f79d149340b723291a79e7f68952f |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\kfd49gef82k2wc1srgu\tedc-nspy xfvlw3\-nos.ods.wncryt | 12.15 KB (12440 bytes) |
MD5:
de1eebba6db517c8c2e00458bb70c6eb
SHA1: 4716e9040f2064cba9fab79df88bcadeef8d6dda SHA256: e87c3ebcbf000c18f3d70f87f386312bb1d359a313fff58fb35cede937300278 |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\kfd49gef82k2wc1srgu\tedc-nspy xfvlw3\-nos.ods.wncry | 12.15 KB (12440 bytes) |
MD5:
de1eebba6db517c8c2e00458bb70c6eb
SHA1: 4716e9040f2064cba9fab79df88bcadeef8d6dda SHA256: e87c3ebcbf000c18f3d70f87f386312bb1d359a313fff58fb35cede937300278 |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\kfd49gef82k2wc1srgu\tedc-nspy xfvlw3\axtg6ai5-.ods.wncryt | 54.90 KB (56216 bytes) |
MD5:
43b32d1c133dbed7d30683370d7dbc72
SHA1: d963114687605dc39b368ccc9ba206be8a1cfe40 SHA256: 586f79a94a707311bf9e14295a22633095442f2518809494d28759f68864357d |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\kfd49gef82k2wc1srgu\tedc-nspy xfvlw3\axtg6ai5-.ods.wncry | 54.90 KB (56216 bytes) |
MD5:
43b32d1c133dbed7d30683370d7dbc72
SHA1: d963114687605dc39b368ccc9ba206be8a1cfe40 SHA256: 586f79a94a707311bf9e14295a22633095442f2518809494d28759f68864357d |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\kfd49gef82k2wc1srgu\tedc-nspy xfvlw3\qz1senichq4fy3oijrd.ots.wncryt | 55.93 KB (57272 bytes) |
MD5:
384b745c7c6b8682e483461c44072c89
SHA1: a541e377fe124b9b349f63ac5fe9d16d3330331f SHA256: 4c10122b8e894bed70bc0a3c724ed05c15b1c7c37859115905a7f4dad6838cf2 |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\kfd49gef82k2wc1srgu\tedc-nspy xfvlw3\qz1senichq4fy3oijrd.ots.wncry | 55.93 KB (57272 bytes) |
MD5:
384b745c7c6b8682e483461c44072c89
SHA1: a541e377fe124b9b349f63ac5fe9d16d3330331f SHA256: 4c10122b8e894bed70bc0a3c724ed05c15b1c7c37859115905a7f4dad6838cf2 |
|
|
| c:\programdata\microsoft\windows nt\msscan\welcomescan.jpg.wncryt | 504.60 KB (516712 bytes) |
MD5:
c2f490b449bd9a8562ef6f1a838e19f7
SHA1: b855e709f6902ce77930f0be50c94bb9b4cc545e SHA256: 5a629693b7bb3548901e66c530011065488cf02c1afb3fc2cff88ef7eacf8056 |
|
|
| c:\users\all users\microsoft\windows nt\msscan\welcomescan.jpg.wncry | 504.60 KB (516712 bytes) |
MD5:
c2f490b449bd9a8562ef6f1a838e19f7
SHA1: b855e709f6902ce77930f0be50c94bb9b4cc545e SHA256: 5a629693b7bb3548901e66c530011065488cf02c1afb3fc2cff88ef7eacf8056 |
|
|
| c:\windows\temp\0.wncryt | 10.80 KB (11064 bytes) |
MD5:
3ee5779625d0b97294ef36b70e58d188
SHA1: 50b0e20b07ab0da1577e48e998371e065d3f4efe SHA256: 62ac5cf20020f5c7571e14951c094d8dbf38e3f38f88f5139dca393d465b66fc |
|
|
| c:\windows\temp\1.wncryt | 22.00 KB (22528 bytes) |
MD5:
fb02e68d70109055a2fdc2864a842ec1
SHA1: 255a1cb6178d17fe92698ecea790a7537c7dcab8 SHA256: 9624a1ba5c11e599567f65dacbdccb22e4c9291bb1d190728cfc1c9d6760d4db |
|
|
| c:\windows\temp\2.wncryt | 80.57 KB (82500 bytes) |
MD5:
2d4df96ed77e5804720bf44c5b83296f
SHA1: 893d2146aac383261db90d866285ba8000907782 SHA256: 7434969cbd8ecacb0a5d77b7b2485ec168d790b439436e37c1122e800acfa583 |
|
|
| c:\windows\temp\3.wncryt | 71.48 KB (73192 bytes) |
MD5:
65d1857a5e2111f2e45cd54e164d806c
SHA1: 94bb2391424b2293c924f5601e4d477e3ca1a791 SHA256: 8599b28b4b11bc360f3d933a16937ed3a0c52670ae64570a13a044445ab1c461 |
|
|
| c:\windows\temp\4.wncryt | 40.00 KB (40955 bytes) |
MD5:
56bb3ca495ede0e41b28ef34e5fa3541
SHA1: 9e6f4b185994384e27b9d14d2011c087650a844f SHA256: 455c1ebe8caee4307b455527c737491a95467d5a393171975ff48903b6a010e0 |
|
|
| c:\windows\temp\5.wncryt | 58.39 KB (59796 bytes) |
MD5:
168562728df92f9f114f162a2c2be5c1
SHA1: 88c110971e0ca431d3b6e391223de9557d3eeca2 SHA256: 814162cbe25d555db3be6fa5199c45850439b2ec94cdbf6787f8c3c2660a7451 |
|
|
| c:\windows\temp\6.wncryt | 35.90 KB (36763 bytes) |
MD5:
229cad9ef4f5c6747fd250b1458bd034
SHA1: dbc6dfbf0dd5e22097dffb203d2605db109fc1a1 SHA256: 4069ed0b714f2ea93239f927a47d95582907538579f882a7d90694d824127b36 |
|
|
| c:\windows\temp\7.wncryt | 97.60 KB (99945 bytes) |
MD5:
f3d712b3002d73584282c5fb6660ac20
SHA1: e455bc30d36a256c5fdb04edc5aba1bd173c3bab SHA256: c842f219a72c51f09873e80ebb0d00bf7cad30bc7bb544335cc4b5bf29197a24 |
|
|
| c:\windows\temp\8.wncryt | 80.25 KB (82176 bytes) |
MD5:
162c7b257c42dbc21a8bd44611b4f890
SHA1: 9f0230022addae5674f46bbac2de0c1329e775cc SHA256: 6105ab2cd2eecf2a3d5940659c1296cefa36a11613781649c884878e871e38d4 |
|
|
| c:\windows\temp\9.wncryt | 85.57 KB (87623 bytes) |
MD5:
2e232a2cb31f0ad346bace764a90f286
SHA1: 259d85cb72d1d55a94b9d73bf02808f9cc14433f SHA256: d0f454ea3954a6ac5f87f6fe880f52e18a1f4dce9a57837a73c371357c327b4e |
|
|
| c:\windows\temp\10.wncryt | 79.68 KB (81590 bytes) |
MD5:
9b7567a7b3a8aea1171c7936a14c9e0e
SHA1: 46b0d934f3ac100d3c863c3644f3c9e1ab0cfcf0 SHA256: 14dae8125fdb52e782b6c1661e183af78b4faa950dbcea08e118f60f74b93893 |
|
|
| c:\windows\temp\11.wncryt | 74.26 KB (76047 bytes) |
MD5:
56ea97594d6c2f6213b3e64ef0fa4cc2
SHA1: 54ee47521257ba2f32ee5d6eeccfa9843e66a165 SHA256: 79525a1cd343565a2f8ab33b23fb28639ce8ad17f2bc2c8cfb7ad5bbd608217e |
|
|
| c:\windows\temp\12.wncryt | 46.82 KB (47942 bytes) |
MD5:
bd4769ae3e4cb236a860e29f7836fb64
SHA1: 531c24517337a47a8da33a6d627b3c76398c05a6 SHA256: f0c5d1aa7cd41c15544b129cee6d3258eff376e76a801a9dd93bb2d8c9fad27d |
|
|
| c:\windows\temp\13.wncryt | 80.34 KB (82273 bytes) |
MD5:
bc7e247bfc57168fc6757cdc4938b441
SHA1: 3f39a1eca30cca1137515da61c6ae208e7b0a128 SHA256: 37504f9946f13630307035595dcfe41f15a815ed99bf0aae9709924fa999926a |
|
|
| c:\windows\temp\14.wncryt | 14.97 KB (15333 bytes) |
MD5:
6c6bb09c3adb2034ac6df04caa5df1f3
SHA1: 352737014f2e270bcbd94e2016a20eb04ab11cf5 SHA256: 72bcf456f67936bbcc54a981b8045ac0beaa3abf9e6cc523f2614dfa23a13b4f |
|
|
| c:\windows\temp\15.wncryt | 38.62 KB (39552 bytes) |
MD5:
a0caf035ed46a2cc5f999e464a5a6beb
SHA1: ffb5be3d7c726c035546dfce5dca7b9770571785 SHA256: e7b85f3eccd8dc0c4dfe744cbf977ac53ef97f066ee5206435d7113de5dc2f1e |
|
|
| c:\windows\temp\16.wncryt | 28.23 KB (28912 bytes) |
MD5:
c886644bd3d95ff22acfb989c2e810cb
SHA1: 7aa33e6c737c6e47530ac3582a212b9248fdf960 SHA256: 8afd27e83d5a24ce35f1b907b5ad22a366b9be9993d829a501ab613f6fa3278e |
|
|
| c:\windows\temp\17.wncryt | 44.55 KB (45622 bytes) |
MD5:
a7d4745347be265cf78ef70fe504544e
SHA1: 840c0b582f8dcb2585382d2c3db7875cea4ba209 SHA256: e11137d2e02ae3ac1eb8bc1c8f04d90bf1926701be353203c8124761570e91de |
|
|
| c:\windows\temp\18.wncryt | 73.07 KB (74827 bytes) |
MD5:
2ed621e825694e7fae484037d3906a7a
SHA1: 7cb4ab9038f33afb43d539581060109611c972ed SHA256: e347c17e6cd8d1c74b152f269faeae5cde11043a983f7af1aa262362fbd0dc2d |
|
|
| c:\windows\temp\19.wncryt | 73.75 KB (75516 bytes) |
MD5:
b15f1937d3f3b7bfbb98f62a9aa9a227
SHA1: e60a4e0068895825a336d2c3b6a67e6a0e52b462 SHA256: b186c070593638b7e24be4393869fd34b130db62d9aa72c11fc8b7291c0f771a |
|
|
| c:\windows\temp\20.wncryt | 40.86 KB (41838 bytes) |
MD5:
6219d95071c47356507fec4900ada63b
SHA1: 4b8f2eaf504546dcdcf147e68ea9693f92080f63 SHA256: 4b81c0bc78abc3883cf7ac44258c92c041a3afa222c2c2a2fd0ff18004fe5e06 |
|
|
| c:\windows\temp\21.wncryt | 90.29 KB (92452 bytes) |
MD5:
3d55650b7c88e9237be0028231198528
SHA1: 8f2bcbb02078e6231ce6c5bd0acc8435ccb868cd SHA256: 991caaef77f177562aeebbfddfdddedfea876aaafce018a5868b60b3ef88c496 |
|
|
| c:\windows\temp\22.wncryt | 31.21 KB (31958 bytes) |
MD5:
419aa3a972f61d528e84abcbcd4eda25
SHA1: e4ff43bee2e446063fea3ce65503a829d0efca45 SHA256: 12197824c11674a0f0d2a45eda1621e2b2e6b7086af5ce748b8abfb7b7e18041 |
|
|
| c:\windows\temp\23.wncryt | 42.22 KB (43232 bytes) |
MD5:
bcb24fa3468b5a25ac5343e4b4dd8b90
SHA1: 3685760f78c9c7e9b33a7686aa44d26d8cc931dc SHA256: 981a7a46c3ba0ce36dc4dae86320a1e1c568b97b5bd531a2290b5efb1d2e4cb9 |
|
|
| c:\windows\temp\24.wncryt | 86.83 KB (88916 bytes) |
MD5:
5665be3e3e07d146b1b7b8326b86eea2
SHA1: 89f04a11c3e37d2e6d595c626af242d884b8347c SHA256: ed7100d87d053455a4865fe714feb645fec30e7b07d6ebfa60eca60a2a279179 |
|
|
| c:\windows\temp\25.wncryt | 84.44 KB (86471 bytes) |
MD5:
5ec48b36d07b2f4115c31194dc8e3c2e
SHA1: d05c2990e1d6669bb234cb568052b1c095838c3e SHA256: f7bda5aef4f129662e91499f83f29dae79efcbc561c772a0b9874e77315e3d12 |
|
|
| c:\windows\temp\26.wncryt | 19.23 KB (19695 bytes) |
MD5:
366b04c7e65a5f7f6124a6d9b68a5216
SHA1: 809b5c92c2d8d28d2338117043165913b6e1d667 SHA256: b353ec02032117bc9ca3c334554b8036630b41a0d07a3d420c70d3422e095cfd |
|
|
| c:\windows\temp\27.wncryt | 69.46 KB (71127 bytes) |
MD5:
460630425c310ecc1c71dd5450cbef74
SHA1: b90d1dc1ce5af59889ae854f3137d8817a2d583a SHA256: 9d05d74c19861871f2f11c6b88fadaf8d8a755798451f6d9bed22a550a0164f4 |
|
|
| c:\windows\temp\28.wncryt | 83.93 KB (85942 bytes) |
MD5:
4e5315bee5f649da6b5aa832486258d7
SHA1: b03381316170ea073025806d183ba5e3968665e9 SHA256: 54d7c454ae19d4f95c807d1d79f735ce26e34dffe2ebf6540fff58c2ea6ce35a |
|
|
| c:\windows\temp\29.wncryt | 25.30 KB (25907 bytes) |
MD5:
844165575fa4df2cdd7f3441c3d0a4f2
SHA1: 56208cac2a0f8468421a6ebeb42d314ad37522c0 SHA256: f573e975438ad214fa16fe88c27ac4966921f7574962c1bf871c29f1b72ecf67 |
|
|
| c:\windows\temp\30.wncryt | 24.17 KB (24745 bytes) |
MD5:
9012bffc48a060afadbb185bd3c7692e
SHA1: 52f3f17a30fceb157c0ee0396f7bb27c079c280b SHA256: a0147eff3e72ce55ee1856e4a60be490df4d0db746312021f3a426b2d62c7036 |
|
|
| c:\windows\temp\31.wncryt | 94.35 KB (96618 bytes) |
MD5:
22c51aa402b5736b9a0c91dc2f3cf801
SHA1: 1afff4dacbbded60c13e1fe57cebed55356effc4 SHA256: 3917264d1cb61060ba8fed7316bdbfec1df23c13371da6f2e0339b1d34d20ba5 |
|
|
| c:\windows\temp\32.wncryt | 46.48 KB (47599 bytes) |
MD5:
a6ee3de5f5b1b5f1523aca98958f726b
SHA1: 1242c3ce03bc4126a3129e14a3f4f35ad610791e SHA256: 254e12e1115e48dc65ce16f7d3bcf3e0197f2883dcabe44be47b8d36d3cc55ea |
|
|
| c:\windows\temp\33.wncryt | 79.53 KB (81440 bytes) |
MD5:
5446bfc868c5c6a2b360da05859e4771
SHA1: 7acdcc1eff402c249b05a90d93260836ea3f14f1 SHA256: d5b59fc4ae1516e7d2c41780b2d3c50bdab573400664185d61cdff839184523f |
|
|
| c:\windows\temp\34.wncryt | 19.98 KB (20462 bytes) |
MD5:
1d36f7a0686f60622cbd1a9f0b3ae704
SHA1: 36eb1965bf99b9c96561ce3d282693f08698e5dc SHA256: d8dd633bac02699aca5dfc655bd79693f7c1d539eec1e45291177306d4dfd84b |
|
|
| c:\windows\temp\35.wncryt | 7.03 KB (7197 bytes) |
MD5:
9af03dd5021216dc163f64a5ba1ddbb3
SHA1: ef974ecebd6100f3d2a52fbb2eefdfd84e1e8fdd SHA256: b282bde4234e49ad5331d8af5bb0f444fb7087e5330adac4a319dab097169980 |
|
|
| c:\windows\temp\36.wncryt | 11.32 KB (11589 bytes) |
MD5:
30ecbe3e88053d2db59a2bdbfbfb02ea
SHA1: 36d6978f04ab4d5b28e1e565bbacca337d6ffd3e SHA256: 2e873efdb4a95bb9ff963dae428fd571b7a6793397ee78640ba556972f177d55 |
|
|
| c:\windows\temp\37.wncryt | 96.84 KB (99165 bytes) |
MD5:
28045a99aa39e866a7b8930e31fa160d
SHA1: 69ce406319f6181792c79242c699291e7cb2f0a2 SHA256: 3f09489599f796006488694cee2b1a0b03f8b4022f4011623273504b20617ac9 |
|
|
| c:\windows\temp\38.wncryt | 3.53 KB (3616 bytes) |
MD5:
0da0bc05834a09e9c9b5337d6d8cb5d6
SHA1: dba913b8f245d10d20f0be6aca84f02160a37ac3 SHA256: 2c458697e529346aa8f464a64407e2e2719b709f31b7dc7a5370a0364002dff2 |
|
|
| c:\windows\temp\39.wncryt | 35.83 KB (36687 bytes) |
MD5:
0d5ce33354ab5486ae5a5a4a2a892a4b
SHA1: ac85d86a7b274a5c1133e17afbc548a7b3f0f985 SHA256: 63e0af48e7d0fabd7e0b1f7c79f14f6282df4a48c67fe4155ac86d7b18f2c3ef |
|
|
| c:\windows\temp\40.wncryt | 69.42 KB (71084 bytes) |
MD5:
885026e6c8b6916cfbc21acd4fb382cd
SHA1: 0b65bbb4a1269bf0665e7f20dd5ccf8e2ee91199 SHA256: ef32e2d69dc403ffa40bfe3eea01046a4c19c6e91dc747c3ecc8e2356fbd68ee |
|
|
| c:\windows\temp\41.wncryt | 88.46 KB (90586 bytes) |
MD5:
7b4719663f563124060ac78818ce7dfa
SHA1: 8a0b937437f6e7eddf421f453581feced2b0df29 SHA256: b977874f39c95c1efa40690e8e9d03d3b19224d25cbdc1e5299d812d31a37eac |
|
|
| c:\windows\temp\42.wncryt | 86.26 KB (88331 bytes) |
MD5:
3adafc6adbf55d82780ba02cdfc4a9a6
SHA1: 038b306aa9adb6284801b705ea088d4bb016766e SHA256: d7f7ebff15f058ba19d13d412cb3ab48a3eee01e65e08ac842a08ea6c01d820f |
|
|
| c:\windows\temp\43.wncryt | 81.26 KB (83207 bytes) |
MD5:
ae461238070b6531fa0bb800809aab8e
SHA1: aa7e15a8348fada29f15677ad1dddb25707f4286 SHA256: 5ae50a494b4a51b6042aa6a1efa621043ad8be8bea155db4b6b9e67318e1b0f4 |
|
|
| c:\windows\temp\44.wncryt | 78.57 KB (80457 bytes) |
MD5:
bf758fbe1c9a31d27d536c27b930ec71
SHA1: 50c8f19a242c17806c77768d178222fb50766684 SHA256: 8096b205eb794f01aee52f0f8e6ab9aa5f66ac2962fa0d2cac566b59699d0b06 |
|
|
| c:\windows\temp\45.wncryt | 8.59 KB (8796 bytes) |
MD5:
4b693f09a32b1b71341ae634198c000c
SHA1: 330b95e1a69d187d245832ab5bd57d9b56503f04 SHA256: 9e269533e183cb97af9a93c0c0a591e818e7cf6a95a3762876e6d97f7450723e |
|
|
| c:\windows\temp\46.wncryt | 75.28 KB (77086 bytes) |
MD5:
6c5559445301f20828f842dd1ab86e9b
SHA1: 74b8f43cfa8591853c28b721ae5d59bb48de049e SHA256: 8f3bd67a9e935fadf801109dfba0e56c4581a013c07ba5bc39d291327201cde8 |
|
|
| c:\windows\temp\47.wncryt | 34.65 KB (35484 bytes) |
MD5:
120cb113696e0e266b6f9e7bfecdc43b
SHA1: 70948f4b3189dbb4bf3b19a2041d35d20d9f83e1 SHA256: da733081e50b262e9b1c3400acd721ad5486573e658744efd43077c21dbab505 |
|
|
| c:\windows\temp\48.wncryt | 55.98 KB (57320 bytes) |
MD5:
60d7298b497d526794097930c8df889b
SHA1: b555bb6676b76cad5b3018f8b42434ab7602dc9d SHA256: 9363dcf055703a520573c56108c882b785e4ab62e4d3b14d89fbf64bfe8a6b9f |
|
|
| c:\windows\temp\49.wncryt | 19.66 KB (20129 bytes) |
MD5:
b280956170742c7231aa1e0774077012
SHA1: 61b0e5dd9196bd48996a3cdcadb365b3479fbfdb SHA256: 6b541655e39506efacf5fd6f58a51f88be44e0e0559daa54c4c93d23ea332ded |
|
|
| c:\windows\temp\50.wncryt | 45.72 KB (46813 bytes) |
MD5:
a550f72aed62c6babcda15ddd662d1fe
SHA1: dcc2cd3885a5ba763d130f7aaa69299433a28585 SHA256: 1d507d8e1dfcf0ea5d1f20342ab2bc79043f1cff82906bbea250e5db028b73e4 |
|
|
| c:\windows\temp\51.wncryt | 1.72 KB (1757 bytes) |
MD5:
3fad5bfe2edc9098357b199206d6c5d3
SHA1: c7a51b071311100f639fa2af870bb02295e9254b SHA256: 3eab663a2ef52cb706825f5d246f9654ff0b6c2704f9807348c6eb6d142929d6 |
|
|
| c:\windows\temp\52.wncryt | 13.65 KB (13981 bytes) |
MD5:
cc50b26ec5e479497c4db36960c98a6b
SHA1: f707a427f79a5438939f1983100a034cd3f96976 SHA256: ea064a645e33601ed1b1c1872c4e6e7bc64e5b8ddc0a8b047af8b64592b5597d |
|
|
| c:\windows\temp\53.wncryt | 48.09 KB (49248 bytes) |
MD5:
1258f6d64cb376de70876485e928c7d4
SHA1: 8a755a579b451e87da048c9fcf8b7335b1df88e4 SHA256: 42bb3c968a6ef5896f8b1727a4feeeb12ff4eb941e51c3d76f527f286a9c3fe5 |
|
|
| c:\windows\temp\54.wncryt | 58.21 KB (59605 bytes) |
MD5:
3d4c21badfd24eeda7b6247907454171
SHA1: 536a3526e945e93572a227124ccc88a0c45c6e66 SHA256: ed01cfbcdbdb135fbd25188ea82429a93d49e0560ac51a9ae7987052d1e80bba |
|
|
| c:\windows\temp\55.wncryt | 92.28 KB (94495 bytes) |
MD5:
aeb5c98fc0bbb455cc54a5b142b0c4c8
SHA1: e914c842b2f4b04a1ab4fcea50b6fcfc9aad82af SHA256: 818eab6f3a058bdd4f00c59e409ee804aadaaa036979ff32501e3ecac614eca0 |
|
|
| c:\windows\temp\56.wncryt | 83.98 KB (85999 bytes) |
MD5:
931214ce153e5f8cfd7b90b90ac67c8d
SHA1: 79ff691683832148fb21e2cbcc63f13ac827066d SHA256: c4892939c832a3b7fcc13e43765e0a177604bfe7f7ab51e52df7135f675e5b7b |
|
|
| c:\windows\temp\57.wncryt | 56.81 KB (58175 bytes) |
MD5:
86930dbaa7b2aea29f7cf02911f92736
SHA1: c60291c5f2d992117b22512de6c5f5b12686dce7 SHA256: 54790de48597d703753a392c5fd9e6130b27e37b37d4a53adc0fcde15a12f514 |
|
|
| c:\windows\temp\58.wncryt | 63.65 KB (65176 bytes) |
MD5:
1ad282e3fd9eeeacdd2666cbda58294c
SHA1: 5948bc29d1a978890f11abd5ca47b00b642c0fe1 SHA256: 2a427d0f08b69a933cb7df0b5903dcdcaa612d105b5cc7ae9d69f4a8f9858077 |
|
|
| c:\windows\temp\59.wncryt | 63.11 KB (64620 bytes) |
MD5:
1961e28a4c32795a61d27fc07e37b5d8
SHA1: ba771e48ab8f292b056a72a8bbe3f2804937065a SHA256: dd52219c6850d462be8a9f1c61730f9fa69d21652d0a6379e955b20085bc524b |
|
|
| c:\windows\temp\60.wncryt | 21.03 KB (21536 bytes) |
MD5:
cecdad5abb1b75d5db65b7ef7cd542a4
SHA1: f20dabaff1e8340e2233217a25d2918fee421686 SHA256: 323ce77226780d0fdc1186c796be6281c78df407b2eab568d9845af395609c89 |
|
|
| c:\windows\temp\61.wncryt | 75.00 KB (76804 bytes) |
MD5:
21cafd01feabc0d58c709dfc6ef05d65
SHA1: b9e68d1187fb47a1d2f666c19394de4ab6f135ae SHA256: 00f219d2d9d0cbdcff5a7ae7c0780913045250978295c1abda42240092418d7b |
|
|
| c:\windows\temp\62.wncryt | 2.96 KB (3028 bytes) |
MD5:
4f104bbefefe0f7d0959c59860259086
SHA1: 79543c507b0539c690e8ac6586265b76dd5245bc SHA256: 22a3c0b1e5d9f502796d86b9318e251159810826bea717265fbbb76ff9bdc39d |
|
|
| c:\windows\temp\63.wncryt | 68.54 KB (70185 bytes) |
MD5:
02b5650258010bdd049469c2aec4c616
SHA1: a377ec184c0185337e67e8555d378f97a89b26b5 SHA256: e91adf45cba76dbc14b1c03b5e8569749f8eda778464f169b42a141d8d7b5255 |
|
|
| c:\windows\temp\64.wncryt | 28.56 KB (29241 bytes) |
MD5:
e31b79f1593b60a4c127504e81d18720
SHA1: e9151dd6ace36881599ff4c38f3c52f2384a9adb SHA256: 20d7f4312a6e0229b59b87002478ba748dbbbca610c443ea4f07fdb70d08d015 |
|
|
| c:\windows\temp\65.wncryt | 81.76 KB (83722 bytes) |
MD5:
88d8778d2d81709d95857cb684c4f30f
SHA1: 5be079e4770322d83a41b04421843d001586f795 SHA256: 692a493c5db7fb547428159737e4dbec507848f6b30365dc3e0420ea4e338852 |
|
|
| c:\windows\temp\66.wncryt | 7.76 KB (7949 bytes) |
MD5:
1634c2e3e1f0f12ba48862f15739c995
SHA1: 91d91a766456e80de1ba6d50cbc5ebd2fb29328d SHA256: 7fd0d4790d94bad15341c13d302b89d05648e09e6c6d7441e6c4a8263b2043fd |
|
|
| c:\windows\temp\67.wncryt | 28.33 KB (29005 bytes) |
MD5:
fed314c2b4198d796d7e2317404b29cb
SHA1: f5cc18350f508df5d2e1b8f5e7d12242b8c28415 SHA256: 146504c3064a5b012307ed3b8f901f8264d2a8c2f305558831e91719f7579faa |
|
|
| c:\windows\temp\68.wncryt | 25.99 KB (26614 bytes) |
MD5:
a608c07a59222083c157a27f0a962404
SHA1: 8bf9fcdbac34aa3ded5da9b38a0166781e795eb1 SHA256: 6de1709099be145b3487b2cdce7f9b36859348f254ae6e5472b3e025475ad99d |
|
|
| c:\windows\temp\69.wncryt | 15.88 KB (16263 bytes) |
MD5:
7429d8beea2e5bd4d92b5597a8c41ce5
SHA1: 1afe9f7ad4921912634d837e3b75988fa050c304 SHA256: bcf3983dd13c35cea09969e7a9124ee6e7d195c3b3ec7600802ae6328c8e2ba2 |
|
|
| c:\windows\temp\70.wncryt | 18.81 KB (19262 bytes) |
MD5:
547ca5530625363e26dc2bc8368d0d65
SHA1: 8a9b6982d29534390d6d96f123d4c35d2725e09b SHA256: 1a4886a69fd54f03d9e04118f38538601a1075af9b157dd484136024bafc110f |
|
|
| c:\windows\temp\71.wncryt | 49.38 KB (50566 bytes) |
MD5:
af990fe4ddbb05bc09624b79c6102d82
SHA1: 7cb82f56c09174bbb2c9c608298322d8cd12e2c9 SHA256: 641be26af74046d03c0bc8d48ccdb597b23ea409697decee0ad6a5e35d202acf |
|
|
| c:\windows\temp\72.wncryt | 68.57 KB (70220 bytes) |
MD5:
e5ed54fe320e9208759ce43a34d8e570
SHA1: 9905d5596890f1d8257adaba3024b44baf25a81c SHA256: d257efa99d365cb080f6da03317bbd223c39d748d25924aae2b54a8cb4cf2c8c |
|
|
| c:\windows\temp\73.wncryt | 58.10 KB (59495 bytes) |
MD5:
ee0748217bd36b04a2bea33417496fc6
SHA1: 032f6d62b70ac8d70b0b93efe3f483b93c974e11 SHA256: d0e36a44f9710425e4f8c1f457ff1a577de0579081574f2b3b2d96ecadb60516 |
|
|
| c:\windows\temp\74.wncryt | 14.14 KB (14482 bytes) |
MD5:
82b28f4e4779c69a55d964556a04f659
SHA1: e25366e2cbdd6840fe9e91587cefd94bc156f183 SHA256: 9e511846b0c4ce12e0e58b9d9c5358df964c11f55f276e90b2a022522111c480 |
|
|
| c:\windows\temp\75.wncryt | 44.11 KB (45172 bytes) |
MD5:
6fe5ed0d2262214db2479ddcec897911
SHA1: 042b3d9f3ec5d94f3bfcfd8a9e1699e0145da876 SHA256: cf88fbb309ccc71314120ac165cd4a4eea7749b42949fb21847fc2ee99339f9a |
|
|
| c:\windows\temp\76.wncryt | 63.60 KB (65126 bytes) |
MD5:
30ca436ffeff1050e7169a8fed2f8a5d
SHA1: abe460287c15eb7042cce9fc7a023d61c14b644a SHA256: 20262c1e380a9527dc25b9f5c9fc256fb8059259826602ea8378d1e6dcf56d7e |
|
|
| c:\windows\temp\77.wncryt | 18.91 KB (19360 bytes) |
MD5:
fb330699a54a91917e2607c3d6d528f7
SHA1: 8f225246ff8df1a05730936d106dd8ca603b588e SHA256: 80e222b0100c5167226c5a4b41be4893f1b8d403f85e447ea31600a164687165 |
|
|
| c:\windows\temp\78.wncryt | 67.37 KB (68985 bytes) |
MD5:
73d3e6b43301bdab25a6947987124022
SHA1: 7aa26643cd525e49b743ca61bbe224f36855c84f SHA256: da110343e6a29f34262f176a005349d5767a138f1dad4586bbf845b9e8f79762 |
|
|
| c:\windows\temp\79.wncryt | 11.87 KB (12159 bytes) |
MD5:
19022e66119ee78b42eeb70bb670d888
SHA1: 6bf892bff1a709cd87a92229b8f542898238575e SHA256: 67c35823a40183728fb4c205080319d35705595d1b89ba1901a77e0292d244fa |
|
|
| c:\windows\temp\80.wncryt | 54.61 KB (55924 bytes) |
MD5:
b990512eaa65462c84bed7c7ef35cf3b
SHA1: 16bbeb534f459418780da6b1dbac6484368d9296 SHA256: e9938830ef1de39f9b76f0e050f8bd3318750cd949113a96ca5755a27cff82e9 |
|
|
| c:\windows\temp\81.wncryt | 55.65 KB (56989 bytes) |
MD5:
1a0ab823d5d87c2e8c662f6aecab92f1
SHA1: 73a700721e289f6604081e4f6ada4570f8f380a4 SHA256: 5733b547d767c43ef6b0a3461c4ae6c70d83f010872a6b56af7423e9f7f26c19 |
|
|
| Filename | File Size | Hash Values | YARA Match | Actions |
|---|---|---|---|---|
| c:\users\dssdpmx042\desktop\bibagpmyuse2qjdfr.jpg | 10.80 KB (11064 bytes) |
MD5:
3ee5779625d0b97294ef36b70e58d188
SHA1: 50b0e20b07ab0da1577e48e998371e065d3f4efe SHA256: 62ac5cf20020f5c7571e14951c094d8dbf38e3f38f88f5139dca393d465b66fc |
|
|
| c:\users\dssdpmx042\desktop\h yrmf.docx | 22.00 KB (22528 bytes) |
MD5:
fb02e68d70109055a2fdc2864a842ec1
SHA1: 255a1cb6178d17fe92698ecea790a7537c7dcab8 SHA256: 9624a1ba5c11e599567f65dacbdccb22e4c9291bb1d190728cfc1c9d6760d4db |
|
|
| c:\users\dssdpmx042\desktop\hwef8jg56gk9dlonf.csv | 80.57 KB (82500 bytes) |
MD5:
2d4df96ed77e5804720bf44c5b83296f
SHA1: 893d2146aac383261db90d866285ba8000907782 SHA256: 7434969cbd8ecacb0a5d77b7b2485ec168d790b439436e37c1122e800acfa583 |
|
|
| c:\users\dssdpmx042\desktop\lt4b3l1iwxyf2bnrt.xlsx | 71.48 KB (73192 bytes) |
MD5:
65d1857a5e2111f2e45cd54e164d806c
SHA1: 94bb2391424b2293c924f5601e4d477e3ca1a791 SHA256: 8599b28b4b11bc360f3d933a16937ed3a0c52670ae64570a13a044445ab1c461 |
|
|
| c:\users\dssdpmx042\desktop\qb17mfblutnx_jw3.jpg | 40.00 KB (40955 bytes) |
MD5:
56bb3ca495ede0e41b28ef34e5fa3541
SHA1: 9e6f4b185994384e27b9d14d2011c087650a844f SHA256: 455c1ebe8caee4307b455527c737491a95467d5a393171975ff48903b6a010e0 |
|
|
| c:\users\dssdpmx042\desktop\xirvpsv.pptx | 58.39 KB (59796 bytes) |
MD5:
168562728df92f9f114f162a2c2be5c1
SHA1: 88c110971e0ca431d3b6e391223de9557d3eeca2 SHA256: 814162cbe25d555db3be6fa5199c45850439b2ec94cdbf6787f8c3c2660a7451 |
|
|
| c:\users\dssdpmx042\desktop\z89la7110x3isdf6.doc | 35.90 KB (36763 bytes) |
MD5:
229cad9ef4f5c6747fd250b1458bd034
SHA1: dbc6dfbf0dd5e22097dffb203d2605db109fc1a1 SHA256: 4069ed0b714f2ea93239f927a47d95582907538579f882a7d90694d824127b36 |
|
|
| c:\users\dssdpmx042\desktop\pgm8zh2abxrdyc7agszx\6pkpcf4uawtzg4xqlmdz.jpg | 97.60 KB (99945 bytes) |
MD5:
f3d712b3002d73584282c5fb6660ac20
SHA1: e455bc30d36a256c5fdb04edc5aba1bd173c3bab SHA256: c842f219a72c51f09873e80ebb0d00bf7cad30bc7bb544335cc4b5bf29197a24 |
|
|
| c:\users\dssdpmx042\desktop\pgm8zh2abxrdyc7agszx\lsxsfgzrgx3ysj1\2tpofaj-rucn\yluqbrq8d4aff5hp.jpg | 80.25 KB (82176 bytes) |
MD5:
162c7b257c42dbc21a8bd44611b4f890
SHA1: 9f0230022addae5674f46bbac2de0c1329e775cc SHA256: 6105ab2cd2eecf2a3d5940659c1296cefa36a11613781649c884878e871e38d4 |
|
|
| c:\users\dssdpmx042\desktop\3kmod_2d6ued.swf | 85.57 KB (87623 bytes) |
MD5:
2e232a2cb31f0ad346bace764a90f286
SHA1: 259d85cb72d1d55a94b9d73bf02808f9cc14433f SHA256: d0f454ea3954a6ac5f87f6fe880f52e18a1f4dce9a57837a73c371357c327b4e |
|
|
| c:\users\dssdpmx042\desktop\acndlsz4zhbdyziqkotj.mp3 | 79.68 KB (81590 bytes) |
MD5:
9b7567a7b3a8aea1171c7936a14c9e0e
SHA1: 46b0d934f3ac100d3c863c3644f3c9e1ab0cfcf0 SHA256: 14dae8125fdb52e782b6c1661e183af78b4faa950dbcea08e118f60f74b93893 |
|
|
| c:\users\dssdpmx042\desktop\ajkh5gnvfe8rqzavym.png | 74.26 KB (76047 bytes) |
MD5:
56ea97594d6c2f6213b3e64ef0fa4cc2
SHA1: 54ee47521257ba2f32ee5d6eeccfa9843e66a165 SHA256: 79525a1cd343565a2f8ab33b23fb28639ce8ad17f2bc2c8cfb7ad5bbd608217e |
|
|
| c:\users\dssdpmx042\desktop\blw7.png | 46.82 KB (47942 bytes) |
MD5:
bd4769ae3e4cb236a860e29f7836fb64
SHA1: 531c24517337a47a8da33a6d627b3c76398c05a6 SHA256: f0c5d1aa7cd41c15544b129cee6d3258eff376e76a801a9dd93bb2d8c9fad27d |
|
|
| c:\users\dssdpmx042\desktop\c9dt7ht6ochw_r.flv | 80.34 KB (82273 bytes) |
MD5:
bc7e247bfc57168fc6757cdc4938b441
SHA1: 3f39a1eca30cca1137515da61c6ae208e7b0a128 SHA256: 37504f9946f13630307035595dcfe41f15a815ed99bf0aae9709924fa999926a |
|
|
| c:\users\dssdpmx042\desktop\fycbs5cumf6dh_fs.ods | 14.97 KB (15333 bytes) |
MD5:
6c6bb09c3adb2034ac6df04caa5df1f3
SHA1: 352737014f2e270bcbd94e2016a20eb04ab11cf5 SHA256: 72bcf456f67936bbcc54a981b8045ac0beaa3abf9e6cc523f2614dfa23a13b4f |
|
|
| c:\users\dssdpmx042\desktop\gfs3quzvztmy-jq6xox.bmp | 38.62 KB (39552 bytes) |
MD5:
a0caf035ed46a2cc5f999e464a5a6beb
SHA1: ffb5be3d7c726c035546dfce5dca7b9770571785 SHA256: e7b85f3eccd8dc0c4dfe744cbf977ac53ef97f066ee5206435d7113de5dc2f1e |
|
|
| c:\users\dssdpmx042\desktop\h4mzf.bmp | 28.23 KB (28912 bytes) |
MD5:
c886644bd3d95ff22acfb989c2e810cb
SHA1: 7aa33e6c737c6e47530ac3582a212b9248fdf960 SHA256: 8afd27e83d5a24ce35f1b907b5ad22a366b9be9993d829a501ab613f6fa3278e |
|
|
| c:\users\dssdpmx042\desktop\hyxaas7ppqlngg5ir6.mp4 | 44.55 KB (45622 bytes) |
MD5:
a7d4745347be265cf78ef70fe504544e
SHA1: 840c0b582f8dcb2585382d2c3db7875cea4ba209 SHA256: e11137d2e02ae3ac1eb8bc1c8f04d90bf1926701be353203c8124761570e91de |
|
|
| c:\users\dssdpmx042\desktop\kit3qjluq u1ehoy.wav | 73.07 KB (74827 bytes) |
MD5:
2ed621e825694e7fae484037d3906a7a
SHA1: 7cb4ab9038f33afb43d539581060109611c972ed SHA256: e347c17e6cd8d1c74b152f269faeae5cde11043a983f7af1aa262362fbd0dc2d |
|
|
| c:\users\dssdpmx042\desktop\lkwb.wav | 73.75 KB (75516 bytes) |
MD5:
b15f1937d3f3b7bfbb98f62a9aa9a227
SHA1: e60a4e0068895825a336d2c3b6a67e6a0e52b462 SHA256: b186c070593638b7e24be4393869fd34b130db62d9aa72c11fc8b7291c0f771a |
|
|
| c:\users\dssdpmx042\desktop\m-flkfw.pps | 40.86 KB (41838 bytes) |
MD5:
6219d95071c47356507fec4900ada63b
SHA1: 4b8f2eaf504546dcdcf147e68ea9693f92080f63 SHA256: 4b81c0bc78abc3883cf7ac44258c92c041a3afa222c2c2a2fd0ff18004fe5e06 |
|
|
| c:\users\dssdpmx042\desktop\p6tg4g.bmp | 90.29 KB (92452 bytes) |
MD5:
3d55650b7c88e9237be0028231198528
SHA1: 8f2bcbb02078e6231ce6c5bd0acc8435ccb868cd SHA256: 991caaef77f177562aeebbfddfdddedfea876aaafce018a5868b60b3ef88c496 |
|
|
| c:\users\dssdpmx042\desktop\ytaj9x8n5wxojmujtmi.gif | 31.21 KB (31958 bytes) |
MD5:
419aa3a972f61d528e84abcbcd4eda25
SHA1: e4ff43bee2e446063fea3ce65503a829d0efca45 SHA256: 12197824c11674a0f0d2a45eda1621e2b2e6b7086af5ce748b8abfb7b7e18041 |
|
|
| c:\users\dssdpmx042\desktop\zb1nbq.mp4 | 42.22 KB (43232 bytes) |
MD5:
bcb24fa3468b5a25ac5343e4b4dd8b90
SHA1: 3685760f78c9c7e9b33a7686aa44d26d8cc931dc SHA256: 981a7a46c3ba0ce36dc4dae86320a1e1c568b97b5bd531a2290b5efb1d2e4cb9 |
|
|
| c:\users\dssdpmx042\desktop\zu3ocp3f88cn.flv | 86.83 KB (88916 bytes) |
MD5:
5665be3e3e07d146b1b7b8326b86eea2
SHA1: 89f04a11c3e37d2e6d595c626af242d884b8347c SHA256: ed7100d87d053455a4865fe714feb645fec30e7b07d6ebfa60eca60a2a279179 |
|
|
| c:\users\dssdpmx042\desktop\pgm8zh2abxrdyc7agszx\- jmajpm5_rro.bmp | 84.44 KB (86471 bytes) |
MD5:
5ec48b36d07b2f4115c31194dc8e3c2e
SHA1: d05c2990e1d6669bb234cb568052b1c095838c3e SHA256: f7bda5aef4f129662e91499f83f29dae79efcbc561c772a0b9874e77315e3d12 |
|
|
| c:\users\dssdpmx042\desktop\pgm8zh2abxrdyc7agszx\mf1nbo.swf | 19.23 KB (19695 bytes) |
MD5:
366b04c7e65a5f7f6124a6d9b68a5216
SHA1: 809b5c92c2d8d28d2338117043165913b6e1d667 SHA256: b353ec02032117bc9ca3c334554b8036630b41a0d07a3d420c70d3422e095cfd |
|
|
| c:\users\dssdpmx042\desktop\pgm8zh2abxrdyc7agszx\0qdvmg\kslni5puyuj.flv | 69.46 KB (71127 bytes) |
MD5:
460630425c310ecc1c71dd5450cbef74
SHA1: b90d1dc1ce5af59889ae854f3137d8817a2d583a SHA256: 9d05d74c19861871f2f11c6b88fadaf8d8a755798451f6d9bed22a550a0164f4 |
|
|
| c:\users\dssdpmx042\desktop\pgm8zh2abxrdyc7agszx\0qdvmg\ntjkr9csa.mp4 | 83.93 KB (85942 bytes) |
MD5:
4e5315bee5f649da6b5aa832486258d7
SHA1: b03381316170ea073025806d183ba5e3968665e9 SHA256: 54d7c454ae19d4f95c807d1d79f735ce26e34dffe2ebf6540fff58c2ea6ce35a |
|
|
| c:\users\dssdpmx042\desktop\pgm8zh2abxrdyc7agszx\0qdvmg\nxds miu.odp | 25.30 KB (25907 bytes) |
MD5:
844165575fa4df2cdd7f3441c3d0a4f2
SHA1: 56208cac2a0f8468421a6ebeb42d314ad37522c0 SHA256: f573e975438ad214fa16fe88c27ac4966921f7574962c1bf871c29f1b72ecf67 |
|
|
| c:\users\dssdpmx042\desktop\pgm8zh2abxrdyc7agszx\k8vahpvastg\2h9gjyzxutjtaj vlt76.ods | 24.17 KB (24745 bytes) |
MD5:
9012bffc48a060afadbb185bd3c7692e
SHA1: 52f3f17a30fceb157c0ee0396f7bb27c079c280b SHA256: a0147eff3e72ce55ee1856e4a60be490df4d0db746312021f3a426b2d62c7036 |
|
|
| c:\users\dssdpmx042\desktop\pgm8zh2abxrdyc7agszx\k8vahpvastg\9wcvzyuqncphgsqczkn.png | 94.35 KB (96618 bytes) |
MD5:
22c51aa402b5736b9a0c91dc2f3cf801
SHA1: 1afff4dacbbded60c13e1fe57cebed55356effc4 SHA256: 3917264d1cb61060ba8fed7316bdbfec1df23c13371da6f2e0339b1d34d20ba5 |
|
|
| c:\users\dssdpmx042\desktop\pgm8zh2abxrdyc7agszx\k8vahpvastg\kpyogarb2ozckx549d.flv | 46.48 KB (47599 bytes) |
MD5:
a6ee3de5f5b1b5f1523aca98958f726b
SHA1: 1242c3ce03bc4126a3129e14a3f4f35ad610791e SHA256: 254e12e1115e48dc65ce16f7d3bcf3e0197f2883dcabe44be47b8d36d3cc55ea |
|
|
| c:\users\dssdpmx042\desktop\pgm8zh2abxrdyc7agszx\k8vahpvastg\z8mf4.avi | 79.53 KB (81440 bytes) |
MD5:
5446bfc868c5c6a2b360da05859e4771
SHA1: 7acdcc1eff402c249b05a90d93260836ea3f14f1 SHA256: d5b59fc4ae1516e7d2c41780b2d3c50bdab573400664185d61cdff839184523f |
|
|
| c:\users\dssdpmx042\desktop\pgm8zh2abxrdyc7agszx\lsxsfgzrgx3ysj1\tey_zyonktol5ojrt0io.mp4 | 19.98 KB (20462 bytes) |
MD5:
1d36f7a0686f60622cbd1a9f0b3ae704
SHA1: 36eb1965bf99b9c96561ce3d282693f08698e5dc SHA256: d8dd633bac02699aca5dfc655bd79693f7c1d539eec1e45291177306d4dfd84b |
|
|
| c:\users\dssdpmx042\desktop\pgm8zh2abxrdyc7agszx\lsxsfgzrgx3ysj1\2tpofaj-rucn\46ix9df9_1lvnwsx.mp3 | 7.03 KB (7197 bytes) |
MD5:
9af03dd5021216dc163f64a5ba1ddbb3
SHA1: ef974ecebd6100f3d2a52fbb2eefdfd84e1e8fdd SHA256: b282bde4234e49ad5331d8af5bb0f444fb7087e5330adac4a319dab097169980 |
|
|
| c:\users\dssdpmx042\desktop\pgm8zh2abxrdyc7agszx\lsxsfgzrgx3ysj1\2tpofaj-rucn\93pm.gif | 11.32 KB (11589 bytes) |
MD5:
30ecbe3e88053d2db59a2bdbfbfb02ea
SHA1: 36d6978f04ab4d5b28e1e565bbacca337d6ffd3e SHA256: 2e873efdb4a95bb9ff963dae428fd571b7a6793397ee78640ba556972f177d55 |
|
|
| c:\users\dssdpmx042\desktop\pgm8zh2abxrdyc7agszx\lsxsfgzrgx3ysj1\2tpofaj-rucn\cxy8v.mp4 | 96.84 KB (99165 bytes) |
MD5:
28045a99aa39e866a7b8930e31fa160d
SHA1: 69ce406319f6181792c79242c699291e7cb2f0a2 SHA256: 3f09489599f796006488694cee2b1a0b03f8b4022f4011623273504b20617ac9 |
|
|
| c:\users\dssdpmx042\desktop\pgm8zh2abxrdyc7agszx\lsxsfgzrgx3ysj1\2tpofaj-rucn\xmeixq lmabg-zgr7mpc.bmp | 3.53 KB (3616 bytes) |
MD5:
0da0bc05834a09e9c9b5337d6d8cb5d6
SHA1: dba913b8f245d10d20f0be6aca84f02160a37ac3 SHA256: 2c458697e529346aa8f464a64407e2e2719b709f31b7dc7a5370a0364002dff2 |
|
|
| c:\users\dssdpmx042\desktop\pgm8zh2abxrdyc7agszx\lsxsfgzrgx3ysj1\2tpofaj-rucn\yg84pi.avi | 35.83 KB (36687 bytes) |
MD5:
0d5ce33354ab5486ae5a5a4a2a892a4b
SHA1: ac85d86a7b274a5c1133e17afbc548a7b3f0f985 SHA256: 63e0af48e7d0fabd7e0b1f7c79f14f6282df4a48c67fe4155ac86d7b18f2c3ef |
|
|
| c:\users\dssdpmx042\desktop\pgm8zh2abxrdyc7agszx\lsxsfgzrgx3ysj1\2tpofaj-rucn\yoo37jp7q.wav | 69.42 KB (71084 bytes) |
MD5:
885026e6c8b6916cfbc21acd4fb382cd
SHA1: 0b65bbb4a1269bf0665e7f20dd5ccf8e2ee91199 SHA256: ef32e2d69dc403ffa40bfe3eea01046a4c19c6e91dc747c3ecc8e2356fbd68ee |
|
|
| c:\users\dssdpmx042\documents\5dwumhpov0ond.doc | 88.46 KB (90586 bytes) |
MD5:
7b4719663f563124060ac78818ce7dfa
SHA1: 8a0b937437f6e7eddf421f453581feced2b0df29 SHA256: b977874f39c95c1efa40690e8e9d03d3b19224d25cbdc1e5299d812d31a37eac |
|
|
| c:\users\dssdpmx042\documents\5pfcgtj7-40fzu.docx | 86.26 KB (88331 bytes) |
MD5:
3adafc6adbf55d82780ba02cdfc4a9a6
SHA1: 038b306aa9adb6284801b705ea088d4bb016766e SHA256: d7f7ebff15f058ba19d13d412cb3ab48a3eee01e65e08ac842a08ea6c01d820f |
|
|
| c:\users\dssdpmx042\documents\9c54.docx | 81.26 KB (83207 bytes) |
MD5:
ae461238070b6531fa0bb800809aab8e
SHA1: aa7e15a8348fada29f15677ad1dddb25707f4286 SHA256: 5ae50a494b4a51b6042aa6a1efa621043ad8be8bea155db4b6b9e67318e1b0f4 |
|
|
| c:\users\dssdpmx042\documents\axmcb.docx | 78.57 KB (80457 bytes) |
MD5:
bf758fbe1c9a31d27d536c27b930ec71
SHA1: 50c8f19a242c17806c77768d178222fb50766684 SHA256: 8096b205eb794f01aee52f0f8e6ab9aa5f66ac2962fa0d2cac566b59699d0b06 |
|
|
| c:\users\dssdpmx042\documents\f8t0d1hl8mulgw0ye.pptx | 8.59 KB (8796 bytes) |
MD5:
4b693f09a32b1b71341ae634198c000c
SHA1: 330b95e1a69d187d245832ab5bd57d9b56503f04 SHA256: 9e269533e183cb97af9a93c0c0a591e818e7cf6a95a3762876e6d97f7450723e |
|
|
| c:\users\dssdpmx042\documents\g9fp hftlrgz5w.xls | 75.28 KB (77086 bytes) |
MD5:
6c5559445301f20828f842dd1ab86e9b
SHA1: 74b8f43cfa8591853c28b721ae5d59bb48de049e SHA256: 8f3bd67a9e935fadf801109dfba0e56c4581a013c07ba5bc39d291327201cde8 |
|
|
| c:\users\dssdpmx042\documents\gmphr0w6rrpdhpbef.csv | 34.65 KB (35484 bytes) |
MD5:
120cb113696e0e266b6f9e7bfecdc43b
SHA1: 70948f4b3189dbb4bf3b19a2041d35d20d9f83e1 SHA256: da733081e50b262e9b1c3400acd721ad5486573e658744efd43077c21dbab505 |
|
|
| c:\users\dssdpmx042\documents\gpimnirm chkjuih.xlsx | 55.98 KB (57320 bytes) |
MD5:
60d7298b497d526794097930c8df889b
SHA1: b555bb6676b76cad5b3018f8b42434ab7602dc9d SHA256: 9363dcf055703a520573c56108c882b785e4ab62e4d3b14d89fbf64bfe8a6b9f |
|
|
| c:\users\dssdpmx042\documents\hemk7ngcvjguirn6.xlsx | 19.66 KB (20129 bytes) |
MD5:
b280956170742c7231aa1e0774077012
SHA1: 61b0e5dd9196bd48996a3cdcadb365b3479fbfdb SHA256: 6b541655e39506efacf5fd6f58a51f88be44e0e0559daa54c4c93d23ea332ded |
|
|
| c:\users\dssdpmx042\documents\kqsfgiuuv7macle5kbe.pptx | 45.72 KB (46813 bytes) |
MD5:
a550f72aed62c6babcda15ddd662d1fe
SHA1: dcc2cd3885a5ba763d130f7aaa69299433a28585 SHA256: 1d507d8e1dfcf0ea5d1f20342ab2bc79043f1cff82906bbea250e5db028b73e4 |
|
|
| c:\users\dssdpmx042\documents\lsifcdcb6tbfbadh2jc.pptx | 1.72 KB (1757 bytes) |
MD5:
3fad5bfe2edc9098357b199206d6c5d3
SHA1: c7a51b071311100f639fa2af870bb02295e9254b SHA256: 3eab663a2ef52cb706825f5d246f9654ff0b6c2704f9807348c6eb6d142929d6 |
|
|
| c:\users\dssdpmx042\documents\lu6w3pxpu3ca.xlsx | 13.65 KB (13981 bytes) |
MD5:
cc50b26ec5e479497c4db36960c98a6b
SHA1: f707a427f79a5438939f1983100a034cd3f96976 SHA256: ea064a645e33601ed1b1c1872c4e6e7bc64e5b8ddc0a8b047af8b64592b5597d |
|
|
| c:\users\dssdpmx042\documents\ly7o.pptx | 48.09 KB (49248 bytes) |
MD5:
1258f6d64cb376de70876485e928c7d4
SHA1: 8a755a579b451e87da048c9fcf8b7335b1df88e4 SHA256: 42bb3c968a6ef5896f8b1727a4feeeb12ff4eb941e51c3d76f527f286a9c3fe5 |
|
|
| c:\users\dssdpmx042\documents\qocbs.docx | 58.21 KB (59605 bytes) |
MD5:
3d4c21badfd24eeda7b6247907454171
SHA1: 536a3526e945e93572a227124ccc88a0c45c6e66 SHA256: ed01cfbcdbdb135fbd25188ea82429a93d49e0560ac51a9ae7987052d1e80bba |
|
|
| c:\users\dssdpmx042\documents\tcrd9un1_myjq-.pptx | 92.28 KB (94495 bytes) |
MD5:
aeb5c98fc0bbb455cc54a5b142b0c4c8
SHA1: e914c842b2f4b04a1ab4fcea50b6fcfc9aad82af SHA256: 818eab6f3a058bdd4f00c59e409ee804aadaaa036979ff32501e3ecac614eca0 |
|
|
| c:\users\dssdpmx042\documents\wv7vnssgbfodzvw.xlsx | 83.98 KB (85999 bytes) |
MD5:
931214ce153e5f8cfd7b90b90ac67c8d
SHA1: 79ff691683832148fb21e2cbcc63f13ac827066d SHA256: c4892939c832a3b7fcc13e43765e0a177604bfe7f7ab51e52df7135f675e5b7b |
|
|
| c:\users\dssdpmx042\documents\yzoy0uk.pptx | 56.81 KB (58175 bytes) |
MD5:
86930dbaa7b2aea29f7cf02911f92736
SHA1: c60291c5f2d992117b22512de6c5f5b12686dce7 SHA256: 54790de48597d703753a392c5fd9e6130b27e37b37d4a53adc0fcde15a12f514 |
|
|
| c:\users\dssdpmx042\documents\zwklqrq2nlske44p.xlsx | 63.65 KB (65176 bytes) |
MD5:
1ad282e3fd9eeeacdd2666cbda58294c
SHA1: 5948bc29d1a978890f11abd5ca47b00b642c0fe1 SHA256: 2a427d0f08b69a933cb7df0b5903dcdcaa612d105b5cc7ae9d69f4a8f9858077 |
|
|
| c:\users\dssdpmx042\documents\_xgwdcsgf mjc6 j.docx | 63.11 KB (64620 bytes) |
MD5:
1961e28a4c32795a61d27fc07e37b5d8
SHA1: ba771e48ab8f292b056a72a8bbe3f2804937065a SHA256: dd52219c6850d462be8a9f1c61730f9fa69d21652d0a6379e955b20085bc524b |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\-nap.rtf | 21.03 KB (21536 bytes) |
MD5:
cecdad5abb1b75d5db65b7ef7cd542a4
SHA1: f20dabaff1e8340e2233217a25d2918fee421686 SHA256: 323ce77226780d0fdc1186c796be6281c78df407b2eab568d9845af395609c89 |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\9o_u.pdf | 75.00 KB (76804 bytes) |
MD5:
21cafd01feabc0d58c709dfc6ef05d65
SHA1: b9e68d1187fb47a1d2f666c19394de4ab6f135ae SHA256: 00f219d2d9d0cbdcff5a7ae7c0780913045250978295c1abda42240092418d7b |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\k6fadynloup1zicvtg0o.xlsx | 2.96 KB (3028 bytes) |
MD5:
4f104bbefefe0f7d0959c59860259086
SHA1: 79543c507b0539c690e8ac6586265b76dd5245bc SHA256: 22a3c0b1e5d9f502796d86b9318e251159810826bea717265fbbb76ff9bdc39d |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\p3k5i8nny2aq5c.pptx | 68.54 KB (70185 bytes) |
MD5:
02b5650258010bdd049469c2aec4c616
SHA1: a377ec184c0185337e67e8555d378f97a89b26b5 SHA256: e91adf45cba76dbc14b1c03b5e8569749f8eda778464f169b42a141d8d7b5255 |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\j9gd3zhd03fzbccc\y5sy7wjt_a7krqnidgx.xlsx | 28.56 KB (29241 bytes) |
MD5:
e31b79f1593b60a4c127504e81d18720
SHA1: e9151dd6ace36881599ff4c38f3c52f2384a9adb SHA256: 20d7f4312a6e0229b59b87002478ba748dbbbca610c443ea4f07fdb70d08d015 |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\j9gd3zhd03fzbccc\3e4ho\sbxkqajovxqwlt.csv | 81.76 KB (83722 bytes) |
MD5:
88d8778d2d81709d95857cb684c4f30f
SHA1: 5be079e4770322d83a41b04421843d001586f795 SHA256: 692a493c5db7fb547428159737e4dbec507848f6b30365dc3e0420ea4e338852 |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\kfd49gef82k2wc1srgu\fxxfw-17sc6wh.ppt | 7.76 KB (7949 bytes) |
MD5:
1634c2e3e1f0f12ba48862f15739c995
SHA1: 91d91a766456e80de1ba6d50cbc5ebd2fb29328d SHA256: 7fd0d4790d94bad15341c13d302b89d05648e09e6c6d7441e6c4a8263b2043fd |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\kfd49gef82k2wc1srgu\vshy_qomhsb5w.ppt | 28.33 KB (29005 bytes) |
MD5:
fed314c2b4198d796d7e2317404b29cb
SHA1: f5cc18350f508df5d2e1b8f5e7d12242b8c28415 SHA256: 146504c3064a5b012307ed3b8f901f8264d2a8c2f305558831e91719f7579faa |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\kfd49gef82k2wc1srgu\tedc-nspy xfvlw3\coafenjkmrn.xlsx | 25.99 KB (26614 bytes) |
MD5:
a608c07a59222083c157a27f0a962404
SHA1: 8bf9fcdbac34aa3ded5da9b38a0166781e795eb1 SHA256: 6de1709099be145b3487b2cdce7f9b36859348f254ae6e5472b3e025475ad99d |
|
|
| c:\users\dssdpmx042\documents\kqu8ojbhlzr.odp | 15.88 KB (16263 bytes) |
MD5:
7429d8beea2e5bd4d92b5597a8c41ce5
SHA1: 1afe9f7ad4921912634d837e3b75988fa050c304 SHA256: bcf3983dd13c35cea09969e7a9124ee6e7d195c3b3ec7600802ae6328c8e2ba2 |
|
|
| c:\users\dssdpmx042\documents\qracrespejeu3.ods | 18.81 KB (19262 bytes) |
MD5:
547ca5530625363e26dc2bc8368d0d65
SHA1: 8a9b6982d29534390d6d96f123d4c35d2725e09b SHA256: 1a4886a69fd54f03d9e04118f38538601a1075af9b157dd484136024bafc110f |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\t9kbu.ots | 49.38 KB (50566 bytes) |
MD5:
af990fe4ddbb05bc09624b79c6102d82
SHA1: 7cb82f56c09174bbb2c9c608298322d8cd12e2c9 SHA256: 641be26af74046d03c0bc8d48ccdb597b23ea409697decee0ad6a5e35d202acf |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\uigp.odp | 68.57 KB (70220 bytes) |
MD5:
e5ed54fe320e9208759ce43a34d8e570
SHA1: 9905d5596890f1d8257adaba3024b44baf25a81c SHA256: d257efa99d365cb080f6da03317bbd223c39d748d25924aae2b54a8cb4cf2c8c |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\j9gd3zhd03fzbccc\v3b5lpgbpfe06xmrqjo.ots | 58.10 KB (59495 bytes) |
MD5:
ee0748217bd36b04a2bea33417496fc6
SHA1: 032f6d62b70ac8d70b0b93efe3f483b93c974e11 SHA256: d0e36a44f9710425e4f8c1f457ff1a577de0579081574f2b3b2d96ecadb60516 |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\j9gd3zhd03fzbccc\3e4ho\k_5vq4jhsw8guvo.odp | 14.14 KB (14482 bytes) |
MD5:
82b28f4e4779c69a55d964556a04f659
SHA1: e25366e2cbdd6840fe9e91587cefd94bc156f183 SHA256: 9e511846b0c4ce12e0e58b9d9c5358df964c11f55f276e90b2a022522111c480 |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\j9gd3zhd03fzbccc\3e4ho\qbqa9 xzsel7xnah8.pps | 44.11 KB (45172 bytes) |
MD5:
6fe5ed0d2262214db2479ddcec897911
SHA1: 042b3d9f3ec5d94f3bfcfd8a9e1699e0145da876 SHA256: cf88fbb309ccc71314120ac165cd4a4eea7749b42949fb21847fc2ee99339f9a |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\kfd49gef82k2wc1srgu\bzrtj.pps | 63.60 KB (65126 bytes) |
MD5:
30ca436ffeff1050e7169a8fed2f8a5d
SHA1: abe460287c15eb7042cce9fc7a023d61c14b644a SHA256: 20262c1e380a9527dc25b9f5c9fc256fb8059259826602ea8378d1e6dcf56d7e |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\kfd49gef82k2wc1srgu\lo4nczsaz.ots | 18.91 KB (19360 bytes) |
MD5:
fb330699a54a91917e2607c3d6d528f7
SHA1: 8f225246ff8df1a05730936d106dd8ca603b588e SHA256: 80e222b0100c5167226c5a4b41be4893f1b8d403f85e447ea31600a164687165 |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\kfd49gef82k2wc1srgu\nqa-xbh.odp | 67.37 KB (68985 bytes) |
MD5:
73d3e6b43301bdab25a6947987124022
SHA1: 7aa26643cd525e49b743ca61bbe224f36855c84f SHA256: da110343e6a29f34262f176a005349d5767a138f1dad4586bbf845b9e8f79762 |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\kfd49gef82k2wc1srgu\tedc-nspy xfvlw3\-nos.ods | 11.87 KB (12159 bytes) |
MD5:
19022e66119ee78b42eeb70bb670d888
SHA1: 6bf892bff1a709cd87a92229b8f542898238575e SHA256: 67c35823a40183728fb4c205080319d35705595d1b89ba1901a77e0292d244fa |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\kfd49gef82k2wc1srgu\tedc-nspy xfvlw3\axtg6ai5-.ods | 54.61 KB (55924 bytes) |
MD5:
b990512eaa65462c84bed7c7ef35cf3b
SHA1: 16bbeb534f459418780da6b1dbac6484368d9296 SHA256: e9938830ef1de39f9b76f0e050f8bd3318750cd949113a96ca5755a27cff82e9 |
|
|
| c:\users\dssdpmx042\documents\z-zdwb\kfd49gef82k2wc1srgu\tedc-nspy xfvlw3\qz1senichq4fy3oijrd.ots | 55.65 KB (56989 bytes) |
MD5:
1a0ab823d5d87c2e8c662f6aecab92f1
SHA1: 73a700721e289f6604081e4f6ada4570f8f380a4 SHA256: 5733b547d767c43ef6b0a3461c4ae6c70d83f010872a6b56af7423e9f7f26c19 |
|
|
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| FIND | C:\ProgramData\qxtqusdnjzrizx418\ |
|
64 | ||
| FIND | c.wnry |
|
1 | ||
| FIND | C:\ProgramData\qxtqusdnjzrizx418\msg |
|
1 | ||
| FIND | C:\ProgramData\qxtqusdnjzrizx418\msg/ |
|
28 | ||
| FIND | C:\ProgramData\qxtqusdnjzrizx418\msg |
|
27 | ||
| FIND | 00000000.dky |
|
42 | ||
| FIND | f.wnry |
|
1 | ||
| FIND | @WanaDecryptor@.exe |
|
1 | ||
| FIND | @WanaDecryptor@.exe.lnk |
|
1 | ||
| FIND | @Please_Read_Me@.txt |
|
1 | ||
| FIND | C:\Users\*.* |
|
3 | ||
| FIND | C:\Users\All Users\Desktop\* |
|
2 | ||
| FIND | C:\Users\Default\Desktop\* |
|
2 | ||
| FIND | C:\Users\Default User\Desktop\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\* |
|
2 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\biBAGpmYUSe2QjdFR.jpg.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\biBAGpmYUSe2QjdFR.jpg |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\H yRMf.docx.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\H yRMf.docx |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\HwEf8JG56gK9dloNF.csv.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\HwEf8JG56gK9dloNF.csv |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\lt4B3l1IwxYf2BNRT.xlsx.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\lt4B3l1IwxYf2BNRT.xlsx |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\Qb17MfBluTNx_Jw3.jpg.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\Qb17MfBluTNx_Jw3.jpg |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\XIRvPSv.pptx.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\XIRvPSv.pptx |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\Z89la7110X3Isdf6.doc.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\Z89la7110X3Isdf6.doc |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\PGm8zH2aBxrDYC7AGszX\* |
|
2 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\PGm8zH2aBxrDYC7AGszX\6PkpCF4UAwtzG4XQLmdz.jpg.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\PGm8zH2aBxrDYC7AGszX\6PkpCF4UAwtzG4XQLmdz.jpg |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\PGm8zH2aBxrDYC7AGszX\0qdvmG\* |
|
2 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\PGm8zH2aBxrDYC7AGszX\k8vAhpvastg\* |
|
2 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\PGm8zH2aBxrDYC7AGszX\LsXSfGzRgx3ySj1\* |
|
2 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\PGm8zH2aBxrDYC7AGszX\LsXSfGzRgx3ySj1\2TpOfAj-RuCN\* |
|
2 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\PGm8zH2aBxrDYC7AGszX\LsXSfGzRgx3ySj1\2TpOfAj-RuCN\yLuqbRQ8d4Aff5hp.jpg.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\PGm8zH2aBxrDYC7AGszX\LsXSfGzRgx3ySj1\2TpOfAj-RuCN\yLuqbRQ8d4Aff5hp.jpg |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\3kMod_2d6ued.swf.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\3kMod_2d6ued.swf |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\acNDLSZ4zhBDYZiqkOtj.mp3.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\acNDLSZ4zhBDYZiqkOtj.mp3 |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\AjkH5GNvFE8RqZAvyM.png.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\AjkH5GNvFE8RqZAvyM.png |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\blW7.png.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\blW7.png |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\c9dt7hT6oCHW_R.flv.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\c9dt7hT6oCHW_R.flv |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\FYcBs5cumF6Dh_Fs.ods.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\FYcBs5cumF6Dh_Fs.ods |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\GFS3QuZvzTMy-jq6XOx.bmp.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\GFS3QuZvzTMy-jq6XOx.bmp |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\h4mzF.bmp.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\h4mzF.bmp |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\HYXAAS7ppqLnGG5iR6.mp4.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\HYXAAS7ppqLnGG5iR6.mp4 |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\KIT3qjLuQ U1ehoy.wav.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\KIT3qjLuQ U1ehoy.wav |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\LKwB.wav.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\LKwB.wav |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\m-flkfw.pps.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\m-flkfw.pps |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\p6tG4G.bmp.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\p6tG4G.bmp |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\YtAJ9X8N5WXOjmUJtmi.gif.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\YtAJ9X8N5WXOjmUJtmi.gif |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\ZB1NbQ.mp4.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\ZB1NbQ.mp4 |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\zU3OcP3f88CN.flv.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\zU3OcP3f88CN.flv |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\PGm8zH2aBxrDYC7AGszX\- JMAjpm5_RRO.bmp.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\PGm8zH2aBxrDYC7AGszX\- JMAjpm5_RRO.bmp |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\PGm8zH2aBxrDYC7AGszX\mf1nBO.swf.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\PGm8zH2aBxrDYC7AGszX\mf1nBO.swf |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\PGm8zH2aBxrDYC7AGszX\0qdvmG\KsLnI5PUYUJ.flv.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\PGm8zH2aBxrDYC7AGszX\0qdvmG\KsLnI5PUYUJ.flv |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\PGm8zH2aBxrDYC7AGszX\0qdvmG\NtjKr9CsA.mp4.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\PGm8zH2aBxrDYC7AGszX\0qdvmG\NtjKr9CsA.mp4 |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\PGm8zH2aBxrDYC7AGszX\0qdvmG\NXDS MIU.odp.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\PGm8zH2aBxrDYC7AGszX\0qdvmG\NXDS MIU.odp |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\PGm8zH2aBxrDYC7AGszX\k8vAhpvastg\2H9gjYZxUtjTaj VLt76.ods.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\PGm8zH2aBxrDYC7AGszX\k8vAhpvastg\2H9gjYZxUtjTaj VLt76.ods |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\PGm8zH2aBxrDYC7AGszX\k8vAhpvastg\9WcvzYUQNCPhGsQczKn.png.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\PGm8zH2aBxrDYC7AGszX\k8vAhpvastg\9WcvzYUQNCPhGsQczKn.png |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\PGm8zH2aBxrDYC7AGszX\k8vAhpvastg\kPyogARb2oZcKX549D.flv.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\PGm8zH2aBxrDYC7AGszX\k8vAhpvastg\kPyogARb2oZcKX549D.flv |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\PGm8zH2aBxrDYC7AGszX\k8vAhpvastg\z8MF4.avi.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\PGm8zH2aBxrDYC7AGszX\k8vAhpvastg\z8MF4.avi |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\PGm8zH2aBxrDYC7AGszX\LsXSfGzRgx3ySj1\TEY_zYONKTOL5Ojrt0io.mp4.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\PGm8zH2aBxrDYC7AGszX\LsXSfGzRgx3ySj1\TEY_zYONKTOL5Ojrt0io.mp4 |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\PGm8zH2aBxrDYC7AGszX\LsXSfGzRgx3ySj1\2TpOfAj-RuCN\46iX9DF9_1LvNwSx.mp3.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\PGm8zH2aBxrDYC7AGszX\LsXSfGzRgx3ySj1\2TpOfAj-RuCN\46iX9DF9_1LvNwSx.mp3 |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\PGm8zH2aBxrDYC7AGszX\LsXSfGzRgx3ySj1\2TpOfAj-RuCN\93PM.gif.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\PGm8zH2aBxrDYC7AGszX\LsXSfGzRgx3ySj1\2TpOfAj-RuCN\93PM.gif |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\PGm8zH2aBxrDYC7AGszX\LsXSfGzRgx3ySj1\2TpOfAj-RuCN\cxY8V.mp4.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\PGm8zH2aBxrDYC7AGszX\LsXSfGzRgx3ySj1\2TpOfAj-RuCN\cxY8V.mp4 |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\PGm8zH2aBxrDYC7AGszX\LsXSfGzRgx3ySj1\2TpOfAj-RuCN\xmeIXQ lMabG-zGr7MPC.bmp.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\PGm8zH2aBxrDYC7AGszX\LsXSfGzRgx3ySj1\2TpOfAj-RuCN\xmeIXQ lMabG-zGr7MPC.bmp |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\PGm8zH2aBxrDYC7AGszX\LsXSfGzRgx3ySj1\2TpOfAj-RuCN\yg84PI.avi.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\PGm8zH2aBxrDYC7AGszX\LsXSfGzRgx3ySj1\2TpOfAj-RuCN\yg84PI.avi |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\PGm8zH2aBxrDYC7AGszX\LsXSfGzRgx3ySj1\2TpOfAj-RuCN\YOo37jP7q.wav.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\PGm8zH2aBxrDYC7AGszX\LsXSfGzRgx3ySj1\2TpOfAj-RuCN\YOo37jP7q.wav |
|
1 | ||
| FIND | C:\Users\Public\Desktop\* |
|
2 | ||
| FIND | C:\Users\All Users\Documents\* |
|
2 | ||
| FIND | C:\Users\Default\Documents\* |
|
2 | ||
| FIND | C:\Users\Default\Documents\My Music\* |
|
2 | ||
| FIND | C:\Users\Default\Documents\My Pictures\* |
|
2 | ||
| FIND | C:\Users\Default\Documents\My Videos\* |
|
2 | ||
| FIND | C:\Users\Default User\Documents\* |
|
1 | ||
| FIND | C:\Users\Default User\Documents\My Music\* |
|
1 | ||
| FIND | C:\Users\Default User\Documents\My Pictures\* |
|
1 | ||
| FIND | C:\Users\Default User\Documents\My Videos\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\* |
|
2 | ||
| FIND | C:\Users\DSsDPMx042\Documents\5DWumHpOv0oNd.doc.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\5DWumHpOv0oNd.doc |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\5PFCgtJ7-40fzU.docx.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\5PFCgtJ7-40fzU.docx |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\9c54.docx.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\9c54.docx |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\AxMCb.docx.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\AxMCb.docx |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\F8t0D1HL8MUlgw0YE.pptx.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\F8t0D1HL8MUlgw0YE.pptx |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\g9fP HfTLRGz5w.xls.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\g9fP HfTLRGz5w.xls |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\GMpHR0w6RrPdHpbef.csv.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\GMpHR0w6RrPdHpbef.csv |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\GpImNirm CHKjuIh.xlsx.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\GpImNirm CHKjuIh.xlsx |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\hEMK7NGCVJGUirn6.xlsx.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\hEMK7NGCVJGUirn6.xlsx |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\kqsfgiuUv7macLE5Kbe.pptx.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\kqsfgiuUv7macLE5Kbe.pptx |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\lSiFcdCb6tbfbadh2jc.pptx.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\lSiFcdCb6tbfbadh2jc.pptx |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\lU6w3Pxpu3cA.xlsx.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\lU6w3Pxpu3cA.xlsx |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\ly7o.pptx.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\ly7o.pptx |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\qOcBS.docx.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\qOcBS.docx |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\tcrD9un1_MYjQ-.pptx.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\tcrD9un1_MYjQ-.pptx |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\Wv7VNssgBfodzvW.xlsx.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\Wv7VNssgBfodzvW.xlsx |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\YzOY0Uk.pptx.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\YzOY0Uk.pptx |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\ZwKLqrQ2NlsKe44p.xlsx.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\ZwKLqrQ2NlsKe44p.xlsx |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\_xGWDCsGf MjC6 J.docx.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\_xGWDCsGf MjC6 J.docx |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\My Music\* |
|
2 | ||
| FIND | C:\Users\DSsDPMx042\Documents\My Pictures\* |
|
2 | ||
| FIND | C:\Users\DSsDPMx042\Documents\My Videos\* |
|
2 | ||
| FIND | C:\Users\DSsDPMx042\Documents\Z-ZDWB\* |
|
2 | ||
| FIND | C:\Users\DSsDPMx042\Documents\Z-ZDWB\-NaP.rtf.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\Z-ZDWB\-NaP.rtf |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\Z-ZDWB\9o_u.pdf.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\Z-ZDWB\9o_u.pdf |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\Z-ZDWB\k6FadYNLoUp1zicvTg0o.xlsx.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\Z-ZDWB\k6FadYNLoUp1zicvTg0o.xlsx |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\Z-ZDWB\p3K5I8nnY2aQ5c.pptx.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\Z-ZDWB\p3K5I8nnY2aQ5c.pptx |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\Z-ZDWB\J9gD3zhD03fZBccC\* |
|
2 | ||
| FIND | C:\Users\DSsDPMx042\Documents\Z-ZDWB\J9gD3zhD03fZBccC\Y5sY7WjT_A7KRqnIdGx.xlsx.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\Z-ZDWB\J9gD3zhD03fZBccC\Y5sY7WjT_A7KRqnIdGx.xlsx |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\Z-ZDWB\J9gD3zhD03fZBccC\3e4HO\* |
|
2 | ||
| FIND | C:\Users\DSsDPMx042\Documents\Z-ZDWB\J9gD3zhD03fZBccC\3e4HO\SBXkqAJOvXqwLt.csv.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\Z-ZDWB\J9gD3zhD03fZBccC\3e4HO\SBXkqAJOvXqwLt.csv |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\Z-ZDWB\Kfd49GEf82K2WC1SrgU\* |
|
2 | ||
| FIND | C:\Users\DSsDPMx042\Documents\Z-ZDWB\Kfd49GEf82K2WC1SrgU\fXxfW-17sC6wH.ppt.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\Z-ZDWB\Kfd49GEf82K2WC1SrgU\fXxfW-17sC6wH.ppt |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\Z-ZDWB\Kfd49GEf82K2WC1SrgU\VShY_qomhSb5w.ppt.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\Z-ZDWB\Kfd49GEf82K2WC1SrgU\VShY_qomhSb5w.ppt |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\Z-ZDWB\Kfd49GEf82K2WC1SrgU\TEDc-NsPy XFVlW3\* |
|
2 | ||
| FIND | C:\Users\DSsDPMx042\Documents\Z-ZDWB\Kfd49GEf82K2WC1SrgU\TEDc-NsPy XFVlW3\coAFENJkmrN.xlsx.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\Z-ZDWB\Kfd49GEf82K2WC1SrgU\TEDc-NsPy XFVlW3\coAFENJkmrN.xlsx |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\Kqu8OJBHlZr.odp.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\Kqu8OJBHlZr.odp |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\QRACRespeJeu3.ods.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\QRACRespeJeu3.ods |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\Z-ZDWB\T9kBu.ots.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\Z-ZDWB\T9kBu.ots |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\Z-ZDWB\uIgP.odp.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\Z-ZDWB\uIgP.odp |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\Z-ZDWB\J9gD3zhD03fZBccC\V3b5LpgbPFe06XMrQjO.ots.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\Z-ZDWB\J9gD3zhD03fZBccC\V3b5LpgbPFe06XMrQjO.ots |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\Z-ZDWB\J9gD3zhD03fZBccC\3e4HO\k_5Vq4jHSw8guVo.odp.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\Z-ZDWB\J9gD3zhD03fZBccC\3e4HO\k_5Vq4jHSw8guVo.odp |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\Z-ZDWB\J9gD3zhD03fZBccC\3e4HO\qBQA9 xzsEl7xNAh8.pps.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\Z-ZDWB\J9gD3zhD03fZBccC\3e4HO\qBQA9 xzsEl7xNAh8.pps |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\Z-ZDWB\Kfd49GEf82K2WC1SrgU\BzrTj.pps.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\Z-ZDWB\Kfd49GEf82K2WC1SrgU\BzrTj.pps |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\Z-ZDWB\Kfd49GEf82K2WC1SrgU\lo4nCZsaz.ots.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\Z-ZDWB\Kfd49GEf82K2WC1SrgU\lo4nCZsaz.ots |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\Z-ZDWB\Kfd49GEf82K2WC1SrgU\nqa-xbh.odp.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\Z-ZDWB\Kfd49GEf82K2WC1SrgU\nqa-xbh.odp |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\Z-ZDWB\Kfd49GEf82K2WC1SrgU\TEDc-NsPy XFVlW3\-nOs.ods.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\Z-ZDWB\Kfd49GEf82K2WC1SrgU\TEDc-NsPy XFVlW3\-nOs.ods |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\Z-ZDWB\Kfd49GEf82K2WC1SrgU\TEDc-NsPy XFVlW3\AxTg6ai5-.ods.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\Z-ZDWB\Kfd49GEf82K2WC1SrgU\TEDc-NsPy XFVlW3\AxTg6ai5-.ods |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\Z-ZDWB\Kfd49GEf82K2WC1SrgU\TEDc-NsPy XFVlW3\Qz1seNiCHq4fY3oIJRd.ots.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\Z-ZDWB\Kfd49GEf82K2WC1SrgU\TEDc-NsPy XFVlW3\Qz1seNiCHq4fY3oIJRd.ots |
|
1 | ||
| FIND | C:\Users\Public\Documents\* |
|
2 | ||
| FIND | C:\Users\Public\Documents\My Music\* |
|
2 | ||
| FIND | C:\Users\Public\Documents\My Pictures\* |
|
2 | ||
| FIND | C:\Users\Public\Documents\My Videos\* |
|
2 | ||
| FIND | C:\* |
|
1 | ||
| FIND | C:\$Recycle.Bin\* |
|
1 | ||
| FIND | C:\$Recycle.Bin\S-1-5-21-3385616887-338319549-3229196192-1000\* |
|
1 | ||
| FIND | C:\Boot\* |
|
1 | ||
| FIND | C:\Boot\cs-CZ\* |
|
1 | ||
| FIND | C:\Boot\da-DK\* |
|
1 | ||
| FIND | C:\Boot\de-DE\* |
|
1 | ||
| FIND | C:\Boot\el-GR\* |
|
1 | ||
| FIND | C:\Boot\en-US\* |
|
1 | ||
| FIND | C:\Boot\es-ES\* |
|
1 | ||
| FIND | C:\Boot\fi-FI\* |
|
1 | ||
| FIND | C:\Boot\Fonts\* |
|
1 | ||
| FIND | C:\Boot\fr-FR\* |
|
1 | ||
| FIND | C:\Boot\hu-HU\* |
|
1 | ||
| FIND | C:\Boot\it-IT\* |
|
1 | ||
| FIND | C:\Boot\ja-JP\* |
|
1 | ||
| FIND | C:\Boot\ko-KR\* |
|
1 | ||
| FIND | C:\Boot\nb-NO\* |
|
1 | ||
| FIND | C:\Boot\nl-NL\* |
|
1 | ||
| FIND | C:\Boot\pl-PL\* |
|
1 | ||
| FIND | C:\Boot\pt-BR\* |
|
1 | ||
| FIND | C:\Boot\pt-PT\* |
|
1 | ||
| FIND | C:\Boot\ru-RU\* |
|
1 | ||
| FIND | C:\Boot\sv-SE\* |
|
1 | ||
| FIND | C:\Boot\tr-TR\* |
|
1 | ||
| FIND | C:\Boot\zh-CN\* |
|
1 | ||
| FIND | C:\Boot\zh-HK\* |
|
1 | ||
| FIND | C:\Boot\zh-TW\* |
|
1 | ||
| FIND | C:\Documents and Settings\* |
|
1 | ||
| FIND | C:\PerfLogs\* |
|
1 | ||
| FIND | C:\PerfLogs\Admin\* |
|
1 | ||
| FIND | C:\Recovery\* |
|
1 | ||
| FIND | C:\Recovery\a8ef0822-7920-11e5-85b1-fee83b99d226\* |
|
1 | ||
| FIND | C:\System Volume Information\* |
|
1 | ||
| FIND | C:\System Volume Information\SPP\* |
|
1 | ||
| FIND | C:\System Volume Information\SPP\OnlineMetadataCache\* |
|
1 | ||
| FIND | C:\System Volume Information\SPP\SppCbsHiveStore\* |
|
1 | ||
| FIND | C:\System Volume Information\SPP\SppGroupCache\* |
|
1 | ||
| FIND | C:\Users\* |
|
1 | ||
| FIND | C:\Users\All Users\* |
|
1 | ||
| FIND | C:\Users\All Users\Application Data\* |
|
1 | ||
| FIND | C:\Users\All Users\Favorites\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Assistance\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Assistance\Client\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Assistance\Client\1.0\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Assistance\Client\1.0\en-US\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Crypto\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Crypto\DSS\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Crypto\DSS\MachineKeys\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Crypto\Keys\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Crypto\RSA\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Crypto\RSA\S-1-5-18\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Device Stage\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Device Stage\Device\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Device Stage\Task\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\DeviceSync\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\DRM\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\DRM\Server\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\eHome\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\eHome\logs\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Event Viewer\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Event Viewer\Views\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Event Viewer\Views\ApplicationViewsRootNode\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\IdentityCRL\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Media Player\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\MF\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Network\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Network\Connections\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Network\Downloader\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\RAC\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\RAC\Outbound\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\RAC\PublishedData\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\RAC\StateData\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\RAC\Temp\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Search\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Search\Data\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Search\Data\Applications\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Search\Data\Applications\Windows\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Search\Data\Applications\Windows\Config\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Search\Data\Applications\Windows\GatherLogs\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStore\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Search\Data\Temp\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\User Account Pictures\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Vault\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows\AIT\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows\Caches\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows\DeviceMetadataStore\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows\DeviceMetadataStore\en-US\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows\DRM\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows\DRM\Cache\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows\GameExplorer\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows\Power Efficiency Diagnostics\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows\Ringtones\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows\Sqm\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows\Sqm\Manifest\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows\Sqm\Sessions\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows\Sqm\Upload\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows\Start Menu\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Games\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Java\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Tablet PC\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows\Templates\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows\WER\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows\WER\ReportArchive\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows\WER\ReportArchive\NonCritical_x86_38e744f5ed92b6643d4610f93acebec71c7d44_03443294\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows\WER\ReportArchive\NonCritical_x86_5164e364f554d49c65173057b5da44f5956558a_03444874\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows\WER\ReportArchive\NonCritical_x86_7125ba86c55facb797ac343822852efc7fde5bb0_03681e87\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows\WER\ReportQueue\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows Defender\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows Defender\Definition Updates\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows Defender\Definition Updates\Backup\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows Defender\Definition Updates\Updates\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows Defender\Definition Updates\{21833C5A-BE0D-427D-B68E-EFA18747B9CF}\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows Defender\LocalCopy\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows Defender\Quarantine\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows Defender\Scans\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Entries\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows Defender\Scans\CleanStore\Resources\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows Defender\Scans\History\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows Defender\Scans\History\CacheManager\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows Defender\Scans\History\Results\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows Defender\Scans\History\Results\Resource\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows Defender\Scans\History\Service\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows Defender\Scans\History\Store\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows Defender\Support\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows NT\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows NT\MSFax\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows NT\MSFax\ActivityLog\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows NT\MSFax\Common Coverpages\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows NT\MSFax\Common Coverpages\en-US\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows NT\MSFax\Inbox\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows NT\MSFax\Queue\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows NT\MSFax\SentItems\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows NT\MSFax\VirtualInbox\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows NT\MSFax\VirtualInbox\en-US\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows NT\MSScan\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows NT\MSScan\WelcomeScan.jpg.WNCRY |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\WwanSvc\* |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\WwanSvc\Profiles\* |
|
1 | ||
| FIND | C:\Users\All Users\Mozilla\* |
|
1 | ||
| FIND | C:\Users\All Users\Mozilla\logs\* |
|
1 | ||
| FIND | C:\Users\All Users\Oracle\* |
|
1 | ||
| FIND | C:\Users\All Users\Oracle\Java\* |
|
1 | ||
| FIND | C:\Users\All Users\Oracle\Java\.oracle_jre_usage\* |
|
1 | ||
| FIND | C:\Users\All Users\Oracle\Java\installcache\* |
|
1 | ||
| FIND | C:\Users\All Users\Oracle\Java\javapath\* |
|
1 | ||
| FIND | C:\Users\All Users\Package Cache\* |
|
1 | ||
| FIND | C:\Users\All Users\Package Cache\D4036846864773E3D647F421DFE7F6CA536E307B\* |
|
1 | ||
| FIND | C:\Users\All Users\Package Cache\D4036846864773E3D647F421DFE7F6CA536E307B\packages\* |
|
1 | ||
| FIND | C:\Users\All Users\Package Cache\D4036846864773E3D647F421DFE7F6CA536E307B\packages\Patch\* |
|
1 | ||
| FIND | C:\Users\All Users\Package Cache\D4036846864773E3D647F421DFE7F6CA536E307B\packages\Patch\x86\* |
|
1 | ||
| FIND | C:\Users\All Users\Package Cache\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\* |
|
1 | ||
| FIND | C:\Users\All Users\Package Cache\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\packages\* |
|
1 | ||
| FIND | C:\Users\All Users\Package Cache\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\packages\vcRuntimeMinimum_x86\* |
|
1 | ||
| FIND | C:\Users\All Users\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\* |
|
1 | ||
| FIND | C:\Users\All Users\Package Cache\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\* |
|
1 | ||
| FIND | C:\Users\All Users\Package Cache\{A2563E55-3BEC-3828-8D67-E5E8B9E8B675}v14.0.23026\* |
|
1 | ||
| FIND | C:\Users\All Users\Package Cache\{A2563E55-3BEC-3828-8D67-E5E8B9E8B675}v14.0.23026\packages\* |
|
1 | ||
| FIND | C:\Users\All Users\Package Cache\{A2563E55-3BEC-3828-8D67-E5E8B9E8B675}v14.0.23026\packages\vcRuntimeMinimum_x86\* |
|
1 | ||
| FIND | C:\Users\All Users\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\* |
|
1 | ||
| FIND | C:\Users\All Users\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\packages\* |
|
1 | ||
| FIND | C:\Users\All Users\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\packages\vcRuntimeAdditional_x86\* |
|
1 | ||
| FIND | C:\Users\All Users\Package Cache\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\* |
|
1 | ||
| FIND | C:\Users\All Users\Package Cache\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\packages\* |
|
1 | ||
| FIND | C:\Users\All Users\Package Cache\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\packages\vcRuntimeMinimum_x86\* |
|
1 | ||
| FIND | C:\Users\All Users\Package Cache\{BE960C1C-7BAD-3DE6-8B1A-2616FE532845}v14.0.23026\* |
|
1 | ||
| FIND | C:\Users\All Users\Package Cache\{BE960C1C-7BAD-3DE6-8B1A-2616FE532845}v14.0.23026\packages\* |
|
1 | ||
| FIND | C:\Users\All Users\Package Cache\{BE960C1C-7BAD-3DE6-8B1A-2616FE532845}v14.0.23026\packages\vcRuntimeAdditional_x86\* |
|
1 | ||
| FIND | C:\Users\All Users\Package Cache\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\* |
|
1 | ||
| FIND | C:\Users\All Users\Package Cache\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\* |
|
1 | ||
| FIND | C:\Users\All Users\Package Cache\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\packages\* |
|
1 | ||
| FIND | C:\Users\All Users\Package Cache\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\packages\vcRuntimeAdditional_x86\* |
|
1 | ||
| FIND | C:\Users\All Users\qxtqusdnjzrizx418\* |
|
1 | ||
| FIND | C:\Users\All Users\qxtqusdnjzrizx418\msg\* |
|
1 | ||
| FIND | C:\Users\All Users\Start Menu\* |
|
1 | ||
| FIND | C:\Users\All Users\Templates\* |
|
1 | ||
| FIND | C:\Users\Default\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Local\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Local\Application Data\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Local\History\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Local\Microsoft\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Local\Microsoft\Credentials\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Local\Microsoft\Feeds\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Local\Microsoft\Feeds Cache\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Local\Microsoft\Feeds Cache\4CSSRV00\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Local\Microsoft\Feeds Cache\DT1GIE4D\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Local\Microsoft\Feeds Cache\F6GEI81Z\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Local\Microsoft\Feeds Cache\GXO2H2PJ\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Local\Microsoft\Internet Explorer\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Local\Microsoft\Internet Explorer\brndlog.txt.WNCRY |
|
1 | ||
| FIND | C:\Users\Default\AppData\Local\Microsoft\Media Player\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000FDBE\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Local\Microsoft\Windows\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Local\Microsoft\Windows\Burn\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Local\Microsoft\Windows\Burn\Burn\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Local\Microsoft\Windows\Caches\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Local\Microsoft\Windows\Explorer\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Local\Microsoft\Windows\GameExplorer\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Local\Microsoft\Windows\History\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Local\Microsoft\Windows\History\History.IE5\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Local\Microsoft\Windows\History\Low\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Local\Microsoft\Windows\Ringtones\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Local\Microsoft\Windows\WER\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Local\Microsoft\Windows\WER\ERC\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Local\Microsoft\Windows\WER\ReportArchive\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Local\Microsoft\Windows Mail\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Backup\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Backup\new\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\Bears.jpg.WNCRY |
|
1 | ||
| FIND | C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\Garden.jpg.WNCRY |
|
1 | ||
| FIND | C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\GreenBubbles.jpg.WNCRY |
|
1 | ||
| FIND | C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\HandPrints.jpg.WNCRY |
|
1 | ||
| FIND | C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\OrangeCircles.jpg.WNCRY |
|
1 | ||
| FIND | C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\Peacock.jpg.WNCRY |
|
1 | ||
| FIND | C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\Roses.jpg.WNCRY |
|
1 | ||
| FIND | C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\ShadesOfBlue.jpg.WNCRY |
|
1 | ||
| FIND | C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\SoftBlue.jpg.WNCRY |
|
1 | ||
| FIND | C:\Users\Default\AppData\Local\Microsoft\Windows Mail\Stationery\Stars.jpg.WNCRY |
|
1 | ||
| FIND | C:\Users\Default\AppData\Local\Microsoft\Windows Media\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Local\Microsoft\Windows Media\12.0\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Local\Microsoft\Windows Sidebar\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Local\Microsoft\Windows Sidebar\Gadgets\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\LocalLow\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Roaming\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Roaming\Identities\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Roaming\Identities\{B85DCA4A-5C21-4EC5-AF48-A2A88CD3D1D9}\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Roaming\Microsoft\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Roaming\Microsoft\Credentials\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Roaming\Microsoft\Crypto\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Roaming\Microsoft\Crypto\RSA\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Roaming\Microsoft\Protect\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Roaming\Microsoft\Protect\S-1-5-21-892523515-1518344882-2423736544-500\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Roaming\Microsoft\SystemCertificates\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Roaming\Microsoft\SystemCertificates\My\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Roaming\Microsoft\Windows\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Roaming\Microsoft\Windows\Cookies\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Roaming\Microsoft\Windows\IECompatCache\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Roaming\Microsoft\Windows\IECompatCache\Low\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Roaming\Microsoft\Windows\IETldCache\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Roaming\Microsoft\Windows\IETldCache\Low\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Roaming\Microsoft\Windows\Libraries\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Roaming\Microsoft\Windows\Network Shortcuts\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Roaming\Microsoft\Windows\PrivacIE\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Roaming\Microsoft\Windows\PrivacIE\Low\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Roaming\Microsoft\Windows\Templates\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Roaming\Microsoft\Windows\Themes\* |
|
1 | ||
| FIND | C:\Users\Default\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg.WNCRY |
|
1 | ||
| FIND | C:\Users\Default\Application Data\* |
|
1 | ||
| FIND | C:\Users\Default\Contacts\* |
|
1 | ||
| FIND | C:\Users\Default\Cookies\* |
|
1 | ||
| FIND | C:\Users\Default\Downloads\* |
|
1 | ||
| FIND | C:\Users\Default\Favorites\* |
|
1 | ||
| FIND | C:\Users\Default\Favorites\Links\* |
|
1 | ||
| FIND | C:\Users\Default\Favorites\Microsoft Websites\* |
|
1 | ||
| FIND | C:\Users\Default\Favorites\MSN Websites\* |
|
1 | ||
| FIND | C:\Users\Default\Favorites\Windows Live\* |
|
1 | ||
| FIND | C:\Users\Default\Links\* |
|
1 | ||
| FIND | C:\Users\Default\Local Settings\* |
|
1 | ||
| FIND | C:\Users\Default\Music\* |
|
1 | ||
| FIND | C:\Users\Default\My Documents\* |
|
1 | ||
| FIND | C:\Users\Default\NetHood\* |
|
1 | ||
| FIND | C:\Users\Default\Pictures\* |
|
1 | ||
| FIND | C:\Users\Default\PrintHood\* |
|
1 | ||
| FIND | C:\Users\Default\Recent\* |
|
1 | ||
| FIND | C:\Users\Default\Saved Games\* |
|
1 | ||
| FIND | C:\Users\Default\Searches\* |
|
1 | ||
| FIND | C:\Users\Default\SendTo\* |
|
1 | ||
| FIND | C:\Users\Default\Start Menu\* |
|
1 | ||
| FIND | C:\Users\Default\Templates\* |
|
1 | ||
| FIND | C:\Users\Default\Videos\* |
|
1 | ||
| FIND | C:\Users\Default User\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Application Data\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Google\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Google\CrashReports\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\History\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Microsoft\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Microsoft\Credentials\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Microsoft\Event Viewer\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Microsoft\Feeds\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Microsoft\Feeds Cache\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Microsoft\Feeds Cache\4CSSRV00\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Microsoft\Feeds Cache\DT1GIE4D\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Microsoft\Feeds Cache\F6GEI81Z\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Microsoft\Feeds Cache\GXO2H2PJ\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Microsoft\Internet Explorer\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Microsoft\Internet Explorer\brndlog.txt.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Microsoft\Internet Explorer\Recovery\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Microsoft\Internet Explorer\Recovery\Last Active\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Microsoft\Media Player\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Microsoft\Media Player\Sync Playlists\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000CD9A\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000FDBE\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Microsoft\TaskSchedulerConfig\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Microsoft\Windows\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Microsoft\Windows\1033\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Microsoft\Windows\Burn\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Microsoft\Windows\Burn\Burn\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Microsoft\Windows\Burn\Burn1\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Microsoft\Windows\Caches\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Microsoft\Windows\Explorer\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Microsoft\Windows\GameExplorer\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Microsoft\Windows\History\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Microsoft\Windows\History\History.IE5\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017051520170516\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Microsoft\Windows\History\Low\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Microsoft\Windows\History\Low\History.IE5\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Microsoft\Windows\History\Low\History.IE5\MSHist012016110220161103\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Microsoft\Windows\Ringtones\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Microsoft\Windows\Themes\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Microsoft\Windows\WER\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Microsoft\Windows\WER\ERC\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Microsoft\Windows\WER\ReportArchive\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Microsoft\Windows\WER\ReportQueue\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Microsoft\Windows Mail\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Microsoft\Windows Mail\Backup\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Microsoft\Windows Mail\Backup\new\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Microsoft\Windows Mail\Stationery\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Microsoft\Windows Mail\Stationery\Bears.jpg.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Microsoft\Windows Mail\Stationery\Garden.jpg.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Microsoft\Windows Mail\Stationery\GreenBubbles.jpg.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Microsoft\Windows Mail\Stationery\HandPrints.jpg.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Microsoft\Windows Mail\Stationery\OrangeCircles.jpg.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Microsoft\Windows Mail\Stationery\Peacock.jpg.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Microsoft\Windows Mail\Stationery\Roses.jpg.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Microsoft\Windows Mail\Stationery\ShadesOfBlue.jpg.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Microsoft\Windows Mail\Stationery\SoftBlue.jpg.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Microsoft\Windows Mail\Stationery\Stars.jpg.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Microsoft\Windows Media\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Microsoft\Windows Media\12.0\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Microsoft\Windows Sidebar\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Microsoft\Windows Sidebar\Gadgets\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\VirtualStore\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Microsoft\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Microsoft\CryptnetUrlCache\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Microsoft\Internet Explorer\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\1PPOL5ZC\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\68U8IHRK\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\B10W93ND\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\LS3151YD\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Microsoft\Internet Explorer\Services\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\0\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\1\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\10\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\11\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\12\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\13\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\14\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\19\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\2\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\20\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\21\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\22\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\23\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\24\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\25\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\26\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\27\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\28\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\29\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\30\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\32\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\33\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\35\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\36\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\37\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\38\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\39\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\4\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\40\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\41\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\42\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\44\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\45\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\46\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\47\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\48\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\5\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\50\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\51\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\52\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\57\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\58\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\59\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\6\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\60\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\61\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\7\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\8\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\muffin\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\tmp\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\cache\security\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\ext\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\log\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\security\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\tmp\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\LocalLow\Sun\Java\Deployment\tmp\si\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\D56IE.csv.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\dX-rNSK.jpg.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\ir5GayTBg.jpg.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\MPX3V.xlsx.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\o7p_l.xls.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\OZQ_qXmBlgN17N.pdf.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\Identities\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\Identities\{B85DCA4A-5C21-4EC5-AF48-A2A88CD3D1D9}\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\Microsoft\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\Microsoft\Credentials\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\Microsoft\Crypto\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\Microsoft\Crypto\RSA\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3385616887-338319549-3229196192-1000\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\Microsoft\Internet Explorer\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\Microsoft\MMC\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\Microsoft\Network\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\Microsoft\Network\Connections\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\Microsoft\Network\Connections\Pbk\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\Microsoft\Network\Connections\Pbk\_hiddenPbk\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\Microsoft\Protect\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\Microsoft\Protect\S-1-5-21-3385616887-338319549-3229196192-1000\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\Microsoft\Protect\S-1-5-21-892523515-1518344882-2423736544-500\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\Microsoft\SystemCertificates\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\Microsoft\SystemCertificates\My\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\Microsoft\Windows\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\Microsoft\Windows\Cookies\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\Microsoft\Windows\Cookies\Low\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\Microsoft\Windows\IECompatCache\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\Microsoft\Windows\IECompatCache\Low\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\Microsoft\Windows\IETldCache\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\Microsoft\Windows\IETldCache\Low\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\Microsoft\Windows\Libraries\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\Microsoft\Windows\Network Shortcuts\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\Microsoft\Windows\PrivacIE\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\Microsoft\Windows\PrivacIE\Low\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\Microsoft\Windows\Recent\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\Microsoft\Windows\SendTo\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\Microsoft\Windows\Start Menu\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\Microsoft\Windows\Templates\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\Microsoft\Windows\Themes\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\Sun\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\Sun\Java\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\Sun\Java\Deployment\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Application Data\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Contacts\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Cookies\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\biBAGpmYUSe2QjdFR.jpg.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\H yRMf.docx.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\HwEf8JG56gK9dloNF.csv.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\lt4B3l1IwxYf2BNRT.xlsx.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\Qb17MfBluTNx_Jw3.jpg.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\XIRvPSv.pptx.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\Z89la7110X3Isdf6.doc.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\PGm8zH2aBxrDYC7AGszX\6PkpCF4UAwtzG4XQLmdz.jpg.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\PGm8zH2aBxrDYC7AGszX\LsXSfGzRgx3ySj1\2TpOfAj-RuCN\yLuqbRQ8d4Aff5hp.jpg.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\5DWumHpOv0oNd.doc.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\5PFCgtJ7-40fzU.docx.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\9c54.docx.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\AxMCb.docx.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\F8t0D1HL8MUlgw0YE.pptx.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\g9fP HfTLRGz5w.xls.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\GMpHR0w6RrPdHpbef.csv.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\GpImNirm CHKjuIh.xlsx.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\hEMK7NGCVJGUirn6.xlsx.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\kqsfgiuUv7macLE5Kbe.pptx.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\lSiFcdCb6tbfbadh2jc.pptx.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\lU6w3Pxpu3cA.xlsx.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\ly7o.pptx.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\qOcBS.docx.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\tcrD9un1_MYjQ-.pptx.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\Wv7VNssgBfodzvW.xlsx.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\YzOY0Uk.pptx.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\ZwKLqrQ2NlsKe44p.xlsx.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\_xGWDCsGf MjC6 J.docx.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\Z-ZDWB\-NaP.rtf.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\Z-ZDWB\9o_u.pdf.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\Z-ZDWB\k6FadYNLoUp1zicvTg0o.xlsx.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\Z-ZDWB\p3K5I8nnY2aQ5c.pptx.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\Z-ZDWB\J9gD3zhD03fZBccC\Y5sY7WjT_A7KRqnIdGx.xlsx.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\Z-ZDWB\J9gD3zhD03fZBccC\3e4HO\SBXkqAJOvXqwLt.csv.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\Z-ZDWB\Kfd49GEf82K2WC1SrgU\fXxfW-17sC6wH.ppt.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\Z-ZDWB\Kfd49GEf82K2WC1SrgU\VShY_qomhSb5w.ppt.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\Z-ZDWB\Kfd49GEf82K2WC1SrgU\TEDc-NsPy XFVlW3\coAFENJkmrN.xlsx.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Downloads\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Favorites\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Favorites\Links\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Favorites\Microsoft Websites\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Favorites\MSN Websites\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Favorites\Windows Live\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Links\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Local Settings\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Music\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Music\IpzUl2xxs J\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Music\IpzUl2xxs J\fqNE\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Music\IpzUl2xxs J\gzfr8pq\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Music\IpzUl2xxs J\hiWj\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Music\IpzUl2xxs J\hiWj\0-sD9L8U\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Music\IpzUl2xxs J\hiWj\r4lSao\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Music\IpzUl2xxs J\hiWj\ZHuw0MA_qHQt\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\My Documents\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\NetHood\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Pictures\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Pictures\55WOZ240.jpg.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Pictures\J5LNdpj\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Pictures\J5LNdpj\RElY_w0.jpg.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Pictures\J5LNdpj\txoKdckRvk.jpg.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Pictures\Jd8VsRICzqxDx9VoB\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Pictures\Jd8VsRICzqxDx9VoB\u0Low_3k9h1Go PY7.jpg.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Pictures\QrgUfb3M\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Pictures\QrgUfb3M\3YHHEMA\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Pictures\QrgUfb3M\3YHHEMA\BhbsuWYvu\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Pictures\QrgUfb3M\3YHHEMA\g7VbdhsAvPJRP7\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Pictures\QrgUfb3M\3YHHEMA\g7VbdhsAvPJRP7\UvRcjVwuEV0RC6U9M.jpg.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Pictures\_2HZDo\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Pictures\_2HZDo\SoyIwozbTZRKlfZgMav.jpg.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\PrintHood\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Recent\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Saved Games\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Searches\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\SendTo\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Start Menu\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Templates\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Videos\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Videos\Fxinkj5Qtq47dCBmWz\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Videos\haKYSLTY-M-z9\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Videos\JYcSy200xq5SF\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Videos\JYcSy200xq5SF\gtgp\* |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Videos\JYcSy200xq5SF\gtgp\eWpNrtKDx2ttVnFQ8J\* |
|
1 | ||
| FIND | C:\Users\Public\* |
|
1 | ||
| FIND | C:\Users\Public\Downloads\* |
|
1 | ||
| FIND | C:\Users\Public\Favorites\* |
|
1 | ||
| FIND | C:\Users\Public\Libraries\* |
|
1 | ||
| FIND | C:\Users\Public\Music\* |
|
1 | ||
| FIND | C:\Users\Public\Music\Sample Music\* |
|
1 | ||
| FIND | C:\Users\Public\Pictures\* |
|
1 | ||
| FIND | C:\Users\Public\Pictures\Sample Pictures\* |
|
1 | ||
| FIND | C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg.WNCRY |
|
1 | ||
| FIND | C:\Users\Public\Pictures\Sample Pictures\Desert.jpg.WNCRY |
|
1 | ||
| FIND | C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg.WNCRY |
|
1 | ||
| FIND | C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg.WNCRY |
|
1 | ||
| FIND | C:\Users\Public\Pictures\Sample Pictures\Koala.jpg.WNCRY |
|
1 | ||
| FIND | C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg.WNCRY |
|
1 | ||
| FIND | C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg.WNCRY |
|
1 | ||
| FIND | C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg.WNCRY |
|
1 | ||
| FIND | C:\Users\Public\Recorded TV\* |
|
1 | ||
| FIND | C:\Users\Public\Recorded TV\Sample Media\* |
|
1 | ||
| FIND | C:\Users\Public\Videos\* |
|
1 | ||
| FIND | C:\Users\Public\Videos\Sample Videos\* |
|
1 | ||
| FIND | C:\BOOTSECT.BAK.WNCRY |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png.WNCRY |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png.WNCRY |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png.WNCRY |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png.WNCRY |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png.WNCRY |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png.WNCRY |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Search\Data\Applications\Windows\Windows.edb.WNCRY |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\User Account Pictures\guest.bmp.WNCRY |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\User Account Pictures\user.bmp.WNCRY |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile10.bmp.WNCRY |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile11.bmp.WNCRY |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile12.bmp.WNCRY |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile13.bmp.WNCRY |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile14.bmp.WNCRY |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile15.bmp.WNCRY |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile16.bmp.WNCRY |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile17.bmp.WNCRY |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile18.bmp.WNCRY |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile19.bmp.WNCRY |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile20.bmp.WNCRY |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile21.bmp.WNCRY |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile22.bmp.WNCRY |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile23.bmp.WNCRY |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile24.bmp.WNCRY |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile25.bmp.WNCRY |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile26.bmp.WNCRY |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile27.bmp.WNCRY |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile28.bmp.WNCRY |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile29.bmp.WNCRY |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile30.bmp.WNCRY |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile31.bmp.WNCRY |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile32.bmp.WNCRY |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile33.bmp.WNCRY |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile34.bmp.WNCRY |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile35.bmp.WNCRY |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile36.bmp.WNCRY |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile37.bmp.WNCRY |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile38.bmp.WNCRY |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile39.bmp.WNCRY |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile40.bmp.WNCRY |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile41.bmp.WNCRY |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile42.bmp.WNCRY |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile43.bmp.WNCRY |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile44.bmp.WNCRY |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows\Caches\cversions.2.db.WNCRY |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows\Caches\{67D69890-D853-4011-A87E-AA64FA83CE5A}.2.ver0x0000000000000002.db.WNCRY |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000004.db.WNCRY |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000005.db.WNCRY |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000006.db.WNCRY |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000007.db.WNCRY |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows\Caches\{7CD55808-3D38-4DD5-90C9-62F0E6EE60D4}.2.ver0x0000000000000001.db.WNCRY |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db.WNCRY |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows\Ringtones\Ringtone 01.wma.WNCRY |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows\Ringtones\Ringtone 02.wma.WNCRY |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows\Ringtones\Ringtone 03.wma.WNCRY |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows\Ringtones\Ringtone 04.wma.WNCRY |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows\Ringtones\Ringtone 05.wma.WNCRY |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows\Ringtones\Ringtone 06.wma.WNCRY |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows\Ringtones\Ringtone 07.wma.WNCRY |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows\Ringtones\Ringtone 08.wma.WNCRY |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows\Ringtones\Ringtone 09.wma.WNCRY |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows\Ringtones\Ringtone 10.wma.WNCRY |
|
1 | ||
| FIND | C:\Users\All Users\Microsoft\Windows NT\MSFax\VirtualInbox\en-US\WelcomeFax.tif.WNCRY |
|
1 | ||
| FIND | C:\Users\Default\AppData\Local\IconCache.db.WNCRY |
|
1 | ||
| FIND | C:\Users\Default\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db.WNCRY |
|
1 | ||
| FIND | C:\Users\Default\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\IconCache.db.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Microsoft\Internet Explorer\brndlog.bak.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Microsoft\Windows\Caches\cversions.1.db.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000f.db.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000010.db.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Microsoft\Windows\Explorer\thumbcache_96.db.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\BP7n0_qwTWKOrxG.mp3.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\bywI0QluWl3W9BuD5f3o.gif.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\daYIJ9-o1e8.bmp.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\dHLstwcTU20.swf.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\DjLKlpzvVty.swf.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\dz0vPTP5oWvHzt.bmp.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\G2kjJOGGR_cGbs8B.flv.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\g_IAP-Kg5-s.wav.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\JQZjF0K.bmp.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\mHjvG24DoFM.pps.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\Nrae.png.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\O8fcDDPBkgPE-.swf.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\ojEfR7Lfa6sgoK2mjmm.mp3.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\oRFN2VwItjwW5.bmp.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\pH1dzO_.png.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\QQ1a2p8pIiy_eDbCLi.mkv.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\Qwg2CVFqC9ez1jCA.mp3.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\RA-n6LUBAsx5.swf.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\rjweM.avi.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\sH5E3mmJVUx.mkv.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\sL9eRsroH9ZEq.png.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\uAEbZGeiEGNeOdNlxnCN.mkv.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\uLTbJg f.pps.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\UYwbA9Uh15VMu3eTzhh-.mkv.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\VSm1crHDJX95VtWS.flv.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\WGxrL2.odt.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\XdSQx_wXF9K9q.bmp.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\xF1J6kjKtJPO ac8GR6.ots.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\AppData\Roaming\zMeJ2xz6d3on_BH9Gk7G.wav.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\3kMod_2d6ued.swf.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\acNDLSZ4zhBDYZiqkOtj.mp3.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\AjkH5GNvFE8RqZAvyM.png.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\blW7.png.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\c9dt7hT6oCHW_R.flv.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\FYcBs5cumF6Dh_Fs.ods.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\GFS3QuZvzTMy-jq6XOx.bmp.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\h4mzF.bmp.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\HYXAAS7ppqLnGG5iR6.mp4.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\KIT3qjLuQ U1ehoy.wav.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\LKwB.wav.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\m-flkfw.pps.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\p6tG4G.bmp.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\YtAJ9X8N5WXOjmUJtmi.gif.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\ZB1NbQ.mp4.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\zU3OcP3f88CN.flv.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\PGm8zH2aBxrDYC7AGszX\- JMAjpm5_RRO.bmp.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\PGm8zH2aBxrDYC7AGszX\mf1nBO.swf.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\PGm8zH2aBxrDYC7AGszX\0qdvmG\KsLnI5PUYUJ.flv.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\PGm8zH2aBxrDYC7AGszX\0qdvmG\NtjKr9CsA.mp4.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\PGm8zH2aBxrDYC7AGszX\0qdvmG\NXDS MIU.odp.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\PGm8zH2aBxrDYC7AGszX\k8vAhpvastg\2H9gjYZxUtjTaj VLt76.ods.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\PGm8zH2aBxrDYC7AGszX\k8vAhpvastg\9WcvzYUQNCPhGsQczKn.png.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\PGm8zH2aBxrDYC7AGszX\k8vAhpvastg\kPyogARb2oZcKX549D.flv.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\PGm8zH2aBxrDYC7AGszX\k8vAhpvastg\z8MF4.avi.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\PGm8zH2aBxrDYC7AGszX\LsXSfGzRgx3ySj1\TEY_zYONKTOL5Ojrt0io.mp4.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\PGm8zH2aBxrDYC7AGszX\LsXSfGzRgx3ySj1\2TpOfAj-RuCN\46iX9DF9_1LvNwSx.mp3.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\PGm8zH2aBxrDYC7AGszX\LsXSfGzRgx3ySj1\2TpOfAj-RuCN\93PM.gif.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\PGm8zH2aBxrDYC7AGszX\LsXSfGzRgx3ySj1\2TpOfAj-RuCN\cxY8V.mp4.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\PGm8zH2aBxrDYC7AGszX\LsXSfGzRgx3ySj1\2TpOfAj-RuCN\xmeIXQ lMabG-zGr7MPC.bmp.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\PGm8zH2aBxrDYC7AGszX\LsXSfGzRgx3ySj1\2TpOfAj-RuCN\yg84PI.avi.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Desktop\PGm8zH2aBxrDYC7AGszX\LsXSfGzRgx3ySj1\2TpOfAj-RuCN\YOo37jP7q.wav.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\Kqu8OJBHlZr.odp.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\QRACRespeJeu3.ods.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\Z-ZDWB\T9kBu.ots.WNCRY |
|
1 | ||
| FIND | C:\Users\DSsDPMx042\Documents\Z-ZDWB\uIgP.odp.WNCRY |
|
1 | ||
|
For performance reasons, the remaining 7666 entries are omitted.
Click to download all 8666 entries as text file (4.41 MB). |
|||||
| Operation | Process Name | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| CREATE | attrib +h . | os_tid = 0xa60, os_pid = 0xa5c, creation_flags = CREATE_NO_WINDOW, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE |
|
1 | |
| CREATE | icacls . \grant Everyone:F \T \C \Q | os_tid = 0xa68, os_pid = 0xa64, creation_flags = CREATE_NO_WINDOW, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE |
|
1 | |
| CREATE | taskdl.exe | os_tid = 0xb98, os_pid = 0xb94, creation_flags = CREATE_NO_WINDOW, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE |
|
1 | |
| CREATE | @WanaDecryptor@.exe fi | os_tid = 0x0, os_pid = 0x0, creation_flags = CREATE_NO_WINDOW, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE |
|
1 | |
| CREATE | 29121494860050.bat | os_tid = 0xbb8, os_pid = 0xbb4, creation_flags = CREATE_NO_WINDOW, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE |
|
1 | |
| CREATE | taskdl.exe | os_tid = 0xdc0, os_pid = 0xdbc, creation_flags = CREATE_NO_WINDOW, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE |
|
1 | |
| CREATE | taskdl.exe | os_tid = 0xf78, os_pid = 0xf74, creation_flags = CREATE_NO_WINDOW, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE |
|
1 | |
| CREATE | taskdl.exe | os_tid = 0xfbc, os_pid = 0xfb8, creation_flags = CREATE_NO_WINDOW, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE |
|
1 | |
| CREATE | taskdl.exe | os_tid = 0x860, os_pid = 0x864, creation_flags = CREATE_NO_WINDOW, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE |
|
1 | |
| CREATE | @WanaDecryptor@.exe co | os_tid = 0x848, os_pid = 0x854, creation_flags = CREATE_NO_WINDOW, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE |
|
1 | |
| CREATE | cmd.exe \c start \b @WanaDecryptor@.exe vs | os_tid = 0x83c, os_pid = 0x840, creation_flags = CREATE_NO_WINDOW, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE |
|
1 | |
| CREATE | taskse.exe C:\ProgramData\qxtqusdnjzrizx418\@WanaDecryptor@.exe | os_tid = 0x120, os_pid = 0x784, creation_flags = CREATE_NO_WINDOW, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE |
|
1 | |
| CREATE | cmd.exe \c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run \v "qxtqusdnjzrizx418" \t REG_SZ \d "\"C:\ProgramData\qxtqusdnjzrizx418\tasksche.exe\"" \f | os_tid = 0x58c, os_pid = 0x128, creation_flags = CREATE_NO_WINDOW, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE |
|
1 | |
| CREATE | taskdl.exe | os_tid = 0x4e4, os_pid = 0x430, creation_flags = CREATE_NO_WINDOW, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE |
|
1 | |
| CREATE | taskdl.exe | os_tid = 0x47c, os_pid = 0x150, creation_flags = CREATE_NO_WINDOW, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE |
|
1 | |
| CREATE | taskse.exe C:\ProgramData\qxtqusdnjzrizx418\@WanaDecryptor@.exe | os_tid = 0x930, os_pid = 0x92c, creation_flags = CREATE_NO_WINDOW, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE |
|
1 | |
| CREATE | taskse.exe C:\ProgramData\qxtqusdnjzrizx418\@WanaDecryptor@.exe | os_tid = 0x6fc, os_pid = 0x704, creation_flags = CREATE_NO_WINDOW, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE |
|
1 | |
| CREATE | taskdl.exe | os_tid = 0x678, os_pid = 0x258, creation_flags = CREATE_NO_WINDOW, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE |
|
1 | |
| CREATE | taskse.exe C:\ProgramData\qxtqusdnjzrizx418\@WanaDecryptor@.exe | os_tid = 0xa44, os_pid = 0xa40, creation_flags = CREATE_NO_WINDOW, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE |
|
1 | |
| CREATE | taskdl.exe | os_tid = 0xa84, os_pid = 0xa5c, creation_flags = CREATE_NO_WINDOW, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE |
|
1 | |
| CREATE | taskse.exe C:\ProgramData\qxtqusdnjzrizx418\@WanaDecryptor@.exe | os_tid = 0xab8, os_pid = 0xab4, creation_flags = CREATE_NO_WINDOW, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE |
|
1 | |
| CREATE | taskse.exe C:\ProgramData\qxtqusdnjzrizx418\@WanaDecryptor@.exe | os_tid = 0xb20, os_pid = 0xb1c, creation_flags = CREATE_NO_WINDOW, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE |
|
1 | |
| CREATE | taskdl.exe | os_tid = 0xb50, os_pid = 0xb4c, creation_flags = CREATE_NO_WINDOW, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE |
|
1 | |
| CREATE | taskse.exe C:\ProgramData\qxtqusdnjzrizx418\@WanaDecryptor@.exe | os_tid = 0xbd8, os_pid = 0xbd4, creation_flags = CREATE_NO_WINDOW, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE |
|
1 | |
| CREATE | taskdl.exe | os_tid = 0xd44, os_pid = 0xc78, creation_flags = CREATE_NO_WINDOW, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE |
|
1 | |
| CREATE | taskse.exe C:\ProgramData\qxtqusdnjzrizx418\@WanaDecryptor@.exe | os_tid = 0xd5c, os_pid = 0xd58, creation_flags = CREATE_NO_WINDOW, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE |
|
1 | |
| CREATE | taskdl.exe | os_tid = 0xda8, os_pid = 0xda4, creation_flags = CREATE_NO_WINDOW, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE |
|
1 | |
| CREATE | taskse.exe C:\ProgramData\qxtqusdnjzrizx418\@WanaDecryptor@.exe | os_tid = 0x338, os_pid = 0xdd8, creation_flags = CREATE_NO_WINDOW, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE |
|
1 | |
| CREATE | taskdl.exe | os_tid = 0xe2c, os_pid = 0xe24, creation_flags = CREATE_NO_WINDOW, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE |
|
1 | |
| CREATE | taskse.exe C:\ProgramData\qxtqusdnjzrizx418\@WanaDecryptor@.exe | os_tid = 0xe30, os_pid = 0xdbc, creation_flags = CREATE_NO_WINDOW, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE |
|
1 | |
| CREATE | taskse.exe C:\ProgramData\qxtqusdnjzrizx418\@WanaDecryptor@.exe | os_tid = 0xea4, os_pid = 0xea0, creation_flags = CREATE_NO_WINDOW, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE |
|
1 | |
| CREATE | taskdl.exe | os_tid = 0xec4, os_pid = 0xec0, creation_flags = CREATE_NO_WINDOW, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE |
|
1 | |
| CREATE | taskse.exe C:\ProgramData\qxtqusdnjzrizx418\@WanaDecryptor@.exe | os_tid = 0xf24, os_pid = 0xf20, creation_flags = CREATE_NO_WINDOW, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE |
|
1 | |
| CREATE | taskdl.exe | os_tid = 0x9f0, os_pid = 0xf80, creation_flags = CREATE_NO_WINDOW, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE |
|
1 | |
| CREATE | taskse.exe C:\ProgramData\qxtqusdnjzrizx418\@WanaDecryptor@.exe | os_tid = 0xf8c, os_pid = 0xf88, creation_flags = CREATE_NO_WINDOW, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE |
|
1 | |
| CREATE | taskse.exe C:\ProgramData\qxtqusdnjzrizx418\@WanaDecryptor@.exe | os_tid = 0x7b4, os_pid = 0x180, creation_flags = CREATE_NO_WINDOW, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE |
|
1 | |
| CREATE | taskdl.exe | os_tid = 0xef0, os_pid = 0xc20, creation_flags = CREATE_NO_WINDOW, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE |
|
1 | |
| CREATE | taskse.exe C:\ProgramData\qxtqusdnjzrizx418\@WanaDecryptor@.exe | os_tid = 0x4f0, os_pid = 0xff0, creation_flags = CREATE_NO_WINDOW, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE |
|
1 | |
| CREATE | taskdl.exe | os_tid = 0x860, os_pid = 0x498, creation_flags = CREATE_NO_WINDOW, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE |
|
1 | |
| CREATE | taskse.exe C:\ProgramData\qxtqusdnjzrizx418\@WanaDecryptor@.exe | os_tid = 0x408, os_pid = 0x728, creation_flags = CREATE_NO_WINDOW, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE |
|
1 | |
| CREATE | taskdl.exe | os_tid = 0x784, os_pid = 0x430, creation_flags = CREATE_NO_WINDOW, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE |
|
1 | |
| OPEN_TOKEN | c:\programdata\qxtqusdnjzrizx418\tasksche.exe | os_pid = 0xa00, desired_access = PROCESS_VM_OPERATION, desired_access = PROCESS_VM_OPERATION |
|
1 | |
| SET_CURDIR | c:\programdata\qxtqusdnjzrizx418\tasksche.exe | os_pid = 0xa00, new_path_name = c:\programdata\qxtqusdnjzrizx418 |
|
2 |
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| LOAD | advapi32.dll | base_address = 0x77640000 |
|
3 | |
| LOAD | kernel32.dll | base_address = 0x75d30000 |
|
2 | |
| LOAD | KERNEL32.dll | base_address = 0x75d30000 |
|
1 | |
| LOAD | USER32.dll | base_address = 0x75f70000 |
|
1 | |
| LOAD | ADVAPI32.dll | base_address = 0x77640000 |
|
1 | |
| LOAD | SHELL32.dll | base_address = 0x76430000 |
|
1 | |
| LOAD | MSVCRT.dll | base_address = 0x77590000 |
|
1 | |
| LOAD | MSVCP60.dll | base_address = 0x70790000 |
|
1 | |
| GET_HANDLE | c:\programdata\qxtqusdnjzrizx418\tasksche.exe | base_address = 0x400000 |
|
1 | |
| GET_HANDLE | c:\windows\system32\kernel32.dll | base_address = 0x75d30000 |
|
1 | |
| GET_FILENAME | C:\ProgramData\qxtqusdnjzrizx418\tasksche.exe |
|
1 | ||
| GET_FILENAME | C:\ProgramData\qxtqusdnjzrizx418\tasksche.exe |
|
1 | ||
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = CryptAcquireContextA, address = 0x776491dd |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = CryptImportKey, address = 0x7764c532 |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = CryptDestroyKey, address = 0x7764c51a |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = CryptEncrypt, address = 0x7766779b |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = CryptDecrypt, address = 0x77683178 |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = CryptGenKey, address = 0x77648ee9 |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = CreateFileW, address = 0x75d7cc56 |
|
3 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = WriteFile, address = 0x75d81400 |
|
3 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = ReadFile, address = 0x75d796fb |
|
3 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = MoveFileW, address = 0x75d9548a |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = MoveFileExW, address = 0x75d74a91 |
|
3 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = DeleteFileW, address = 0x75d70f62 |
|
3 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = CloseHandle, address = 0x75d7ca7c |
|
3 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = GetNativeSystemInfo, address = 0x75d6be77 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = InitializeCriticalSection, address = 0x778fa149 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = SetFileAttributesW, address = 0x75d6ad1b |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = SetFileTime, address = 0x75d6be16 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = SetFilePointer, address = 0x75d7db36 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = GetFileTime, address = 0x75d70f6f |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = GetFileSizeEx, address = 0x75d759ef |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = MultiByteToWideChar, address = 0x75d8452b |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = GetFileAttributesW, address = 0x75d864ff |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = FindClose, address = 0x75d80e62 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = FindNextFileW, address = 0x75d7963a |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = FindFirstFileW, address = 0x75d853b2 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = ExitThread, address = 0x778cf611 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = LeaveCriticalSection, address = 0x778e7760 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = EnterCriticalSection, address = 0x778e77a0 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = Sleep, address = 0x75d7ba46 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = GetTempFileNameW, address = 0x75d66d1d |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = FlushFileBuffers, address = 0x75d67f81 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = CopyFileW, address = 0x75d667c3 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = CreateFileA, address = 0x75d7cee8 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = CreateThread, address = 0x75d8375d |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = GetFileAttributesA, address = 0x75d81de6 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = CreateMutexA, address = 0x75d83589 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = OpenMutexA, address = 0x75d6fe1a |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = GetFullPathNameA, address = 0x75d83735 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = CopyFileA, address = 0x75d9532c |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = CreateDirectoryW, address = 0x75d73925 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = GetTempPathW, address = 0x75d68b33 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = GetWindowsDirectoryW, address = 0x75d704b6 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = GetDiskFreeSpaceExW, address = 0x75d6de40 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = GetDriveTypeW, address = 0x75d83be6 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = WideCharToMultiByte, address = 0x75d8450e |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = InterlockedExchange, address = 0x75d7bf0a |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = InterlockedExchangeAdd, address = 0x75d7962a |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = GetLogicalDrives, address = 0x75d75986 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = DeleteFileA, address = 0x75d747cb |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = SetCurrentDirectoryW, address = 0x75d87663 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = GetModuleFileNameW, address = 0x75d83c26 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = DeleteCriticalSection, address = 0x778f9ac5 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = GetComputerNameW, address = 0x75d703ff |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = GetCurrentDirectoryA, address = 0x75d6733c |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = LocalFree, address = 0x75d7ca64 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = GetCurrentProcess, address = 0x75d7cdcf |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = GetLastError, address = 0x75d7bf00 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = GlobalAlloc, address = 0x75d79ce1 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = LoadLibraryA, address = 0x75d8395c |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = GetProcAddress, address = 0x75d833d3 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = GlobalFree, address = 0x75d79cf9 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = GetTickCount, address = 0x75d7ba60 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = CreateProcessA, address = 0x75d32082 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = WaitForSingleObject, address = 0x75d7ba90 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = TerminateProcess, address = 0x75d72331 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = GetExitCodeProcess, address = 0x75d81462 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = GetFileSize, address = 0x75d70273 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\user32.dll | function = SystemParametersInfoW, address = 0x75f7e09a |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = AllocateAndInitializeSid, address = 0x776540e6 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = CryptExportKey, address = 0x776491ea |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = CryptReleaseContext, address = 0x7764e124 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = GetSecurityInfo, address = 0x7764b3e4 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = SetEntriesInAclA, address = 0x776915e9 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = SetSecurityInfo, address = 0x77649edf |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = CheckTokenMembership, address = 0x7764df04 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = FreeSid, address = 0x7765412e |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = GetUserNameW, address = 0x7765157a |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = OpenProcessToken, address = 0x77654304 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = GetTokenInformation, address = 0x7765431c |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = CryptGenRandom, address = 0x7764dfc8 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = CryptGetKeyParam, address = 0x776677cb |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\shell32.dll | function = SHGetFolderPathW, address = 0x764b5708 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\msvcrt.dll | function = fopen, address = 0x775ab2c4 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\msvcrt.dll | function = fprintf, address = 0x775a3e00 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\msvcrt.dll | function = sprintf, address = 0x775ad354 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\msvcrt.dll | function = rand, address = 0x7759c070 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\msvcrt.dll | function = time, address = 0x7759f708 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\msvcrt.dll | function = srand, address = 0x7759f757 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\msvcrt.dll | function = wcscpy, address = 0x775ad4f8 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\msvcrt.dll | function = wcscat, address = 0x77610ea6 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\msvcrt.dll | function = wcslen, address = 0x775ad335 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\msvcrt.dll | function = ??2@YAPAXI@Z, address = 0x7759b0c9 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\msvcrt.dll | function = __CxxFrameHandler, address = 0x775b3495 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\msvcrt.dll | function = ??3@YAXPAX@Z, address = 0x7759b0b9 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\msvcrt.dll | function = swprintf, address = 0x775be87c |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\msvcrt.dll | function = _except_handler3, address = 0x775bd770 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\msvcrt.dll | function = fread, address = 0x775af3c8 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\msvcrt.dll | function = wcsrchr, address = 0x7759a73f |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\msvcrt.dll | function = wcsncpy, address = 0x775ad3f3 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\msvcrt.dll | function = wcscmp, address = 0x775ad3b7 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\msvcrt.dll | function = _wcsnicmp, address = 0x7759aae3 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\msvcrt.dll | function = strncmp, address = 0x7759b443 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\msvcrt.dll | function = wcschr, address = 0x7759aa61 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\msvcrt.dll | function = _wfopen, address = 0x775af3ac |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\msvcrt.dll | function = _ftol, address = 0x775a8e2f |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\msvcrt.dll | function = ??0exception@@QAE@ABV0@@Z, address = 0x775e56c5 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\msvcrt.dll | function = ??1exception@@UAE@XZ, address = 0x775a14e3 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\msvcrt.dll | function = ??0exception@@QAE@ABQBD@Z, address = 0x775b6afd |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\msvcrt.dll | function = _CxxThrowException, address = 0x775b3557 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\msvcrt.dll | function = ??1type_info@@UAE@XZ, address = 0x775e92b3 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\msvcrt.dll | function = free, address = 0x77599894 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\msvcrt.dll | function = _initterm, address = 0x7759c151 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\msvcrt.dll | function = malloc, address = 0x77599cee |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\msvcrt.dll | function = _adjust_fdiv, address = 0x776332ec |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\msvcrt.dll | function = fwrite, address = 0x775a76ac |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\msvcrt.dll | function = fclose, address = 0x775a3d79 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\msvcrt.dll | function = _wcsicmp, address = 0x7759a9e9 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\msvcrt.dll | function = _local_unwind2, address = 0x775bd8cf |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\msvcrt.dll | function = wcsstr, address = 0x7759bf71 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\msvcp60.dll | function = ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z, address = 0x707bf0c2 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\msvcp60.dll | function = ?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB, address = 0x70791440 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\msvcp60.dll | function = ?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB, address = 0x70791434 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\msvcp60.dll | function = ?_Xran@std@@YAXXZ, address = 0x707da62b |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\msvcp60.dll | function = ?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ, address = 0x707cc839 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\msvcp60.dll | function = ?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z, address = 0x707c3f35 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\msvcp60.dll | function = ??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ, address = 0x707bf29e |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\msvcp60.dll | function = ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z, address = 0x707bf070 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\msvcp60.dll | function = ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z, address = 0x707bf20b |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = ConvertSidToStringSidW, address = 0x77654344 |
|
1 |
| Operation | Key | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| CREATE_KEY | HKEY_LOCAL_MACHINE\Software\WanaCrypt0r |
|
1 | ||
| WRITE_VALUE | HKEY_LOCAL_MACHINE\Software\WanaCrypt0r | value_name = wd, type = REG_SZ, data = C:\ProgramData\qxtqusdnjzrizx418 |
|
1 |
| Operation | User/Group/Server | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| GET_CURRENT | SYSTEM |
|
15 |
| Operation | Information | Success | Count | Logfile |
|---|---|---|---|---|
| SLEEP | duration = 100 milliseconds (0.100 seconds) |
|
5 | |
| SLEEP | duration = 1000 milliseconds (1.000 seconds) |
|
239 | |
| SLEEP | duration = 5000 milliseconds (5.000 seconds) |
|
41 | |
| SLEEP | duration = 3000 milliseconds (3.000 seconds) |
|
67 | |
| SLEEP | duration = 30000 milliseconds (30.000 seconds) |
|
38 | |
| SLEEP | duration = 10 milliseconds (0.010 seconds) |
|
40 | |
| SLEEP | duration = 10000 milliseconds (10.000 seconds) |
|
2 |
| Operation | Name | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| CREATE | MsWinZonesCacheCounterMutexA | initial_owner = 1 |
|
1 | |
| CREATE | Global\MsWinZonesCacheCounterMutexA0 | initial_owner = 1 |
|
1 | |
| OPEN | Global\MsWinZonesCacheCounterMutexW | desired_access = SYNCHRONIZE |
|
1 |
| Information | Value |
|---|---|
| ID | #9 |
| File Name | c:\windows\system32\attrib.exe |
| Command Line | attrib +h . |
| Initial Working Directory | C:\ProgramData\qxtqusdnjzrizx418 |
| Monitor | Start Time: 00:01:06, Reason: Child Process |
| Unmonitor | End Time: 00:01:08, Reason: Terminated |
| Monitor Duration | 00:00:02 |
| Remarks | No high level activity detected in monitored regions |
| Information | Value |
|---|---|
| PID | 0xa5c |
| Parent PID | 0xa00 (c:\programdata\qxtqusdnjzrizx418\tasksche.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Groups |
|
| Enabled Privileges | SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege |
| Thread IDs |
0x
A60
|
| Name | Start VA | End VA | Type | Permissions | Monitored | Dump | YARA Match | Actions |
|---|---|---|---|---|---|---|---|---|
| private_0x0000000000010000 | 0x00010000 | 0x0002ffff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000010000 | 0x00010000 | 0x0001ffff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000020000 | 0x00020000 | 0x0002ffff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000030000 | 0x00030000 | 0x00033fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x0000000000040000 | 0x00040000 | 0x00040fff | Pagefile Backed Memory | Readable |
|
|
|
|
| locale.nls | 0x00050000 | 0x000b6fff | Memory Mapped File | Readable |
|
|
|
|
| private_0x00000000000e0000 | 0x000e0000 | 0x0011ffff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000120000 | 0x00120000 | 0x001e7fff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x0000000000250000 | 0x00250000 | 0x0025ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x00000000002c0000 | 0x002c0000 | 0x003bffff | Private Memory | Readable, Writable |
|
|
|
|
| attrib.exe | 0x00630000 | 0x00636fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| ulib.dll | 0x70770000 | 0x7078cfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| kernelbase.dll | 0x75c10000 | 0x75c59fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| kernel32.dll | 0x75d30000 | 0x75e03fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| imm32.dll | 0x75e10000 | 0x75e2efff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| user32.dll | 0x75f70000 | 0x76038fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| rpcrt4.dll | 0x76220000 | 0x762c0fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| usp10.dll | 0x771e0000 | 0x7727cfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| gdi32.dll | 0x77280000 | 0x772cdfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| msvcrt.dll | 0x77590000 | 0x7763bfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| advapi32.dll | 0x77640000 | 0x776dffff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| sechost.dll | 0x776e0000 | 0x776f8fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| ntdll.dll | 0x778a0000 | 0x779dbfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| lpk.dll | 0x779e0000 | 0x779e9fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| msctf.dll | 0x77a00000 | 0x77acbfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| apisetschema.dll | 0x77ae0000 | 0x77ae0fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| pagefile_0x000000007f6f0000 | 0x7f6f0000 | 0x7f7effff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x000000007ffb0000 | 0x7ffb0000 | 0x7ffd2fff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x000000007ffd8000 | 0x7ffd8000 | 0x7ffd8fff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffdf000 | 0x7ffdf000 | 0x7ffdffff | Private Memory | Readable, Writable |
|
|
|
|
| Information | Value |
|---|---|
| ID | #10 |
| File Name | c:\windows\system32\icacls.exe |
| Command Line | icacls . /grant Everyone:F /T /C /Q |
| Initial Working Directory | C:\ProgramData\qxtqusdnjzrizx418 |
| Monitor | Start Time: 00:01:06, Reason: Child Process |
| Unmonitor | End Time: 00:01:09, Reason: Terminated |
| Monitor Duration | 00:00:03 |
| Remarks | No high level activity detected in monitored regions |
| Information | Value |
|---|---|
| PID | 0xa64 |
| Parent PID | 0xa00 (c:\programdata\qxtqusdnjzrizx418\tasksche.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Groups |
|
| Enabled Privileges | SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege |
| Thread IDs |
0x
A68
0x
A90
|
| Name | Start VA | End VA | Type | Permissions | Monitored | Dump | YARA Match | Actions |
|---|---|---|---|---|---|---|---|---|
| private_0x0000000000010000 | 0x00010000 | 0x0002ffff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000010000 | 0x00010000 | 0x0001ffff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000020000 | 0x00020000 | 0x0002ffff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000030000 | 0x00030000 | 0x00033fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x0000000000040000 | 0x00040000 | 0x00040fff | Pagefile Backed Memory | Readable |
|
|
|
|
| locale.nls | 0x00050000 | 0x000b6fff | Memory Mapped File | Readable |
|
|
|
|
| private_0x00000000000d0000 | 0x000d0000 | 0x000dffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000110000 | 0x00110000 | 0x0014ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000180000 | 0x00180000 | 0x0027ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x00000000002d0000 | 0x002d0000 | 0x0030ffff | Private Memory | Readable, Writable |
|
|
|
|
| icacls.exe | 0x00b20000 | 0x00b29fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| ntmarta.dll | 0x74060000 | 0x74080fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| kernelbase.dll | 0x75c10000 | 0x75c59fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| kernel32.dll | 0x75d30000 | 0x75e03fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| wldap32.dll | 0x761d0000 | 0x76214fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| rpcrt4.dll | 0x76220000 | 0x762c0fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| msvcrt.dll | 0x77590000 | 0x7763bfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| advapi32.dll | 0x77640000 | 0x776dffff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| sechost.dll | 0x776e0000 | 0x776f8fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| ntdll.dll | 0x778a0000 | 0x779dbfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| apisetschema.dll | 0x77ae0000 | 0x77ae0fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| pagefile_0x000000007f6f0000 | 0x7f6f0000 | 0x7f7effff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x000000007ffb0000 | 0x7ffb0000 | 0x7ffd2fff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x000000007ffdd000 | 0x7ffdd000 | 0x7ffddfff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffde000 | 0x7ffde000 | 0x7ffdefff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffdf000 | 0x7ffdf000 | 0x7ffdffff | Private Memory | Readable, Writable |
|
|
|
|
| Information | Value |
|---|---|
| ID | #11 |
| File Name | c:\programdata\qxtqusdnjzrizx418\taskdl.exe |
| Command Line | taskdl.exe |
| Initial Working Directory | C:\ProgramData\qxtqusdnjzrizx418 |
| Monitor | Start Time: 00:01:12, Reason: Child Process |
| Unmonitor | End Time: 00:01:13, Reason: Terminated |
| Monitor Duration | 00:00:01 |
| Information | Value |
|---|---|
| PID | 0xb94 |
| Parent PID | 0xa00 (c:\programdata\qxtqusdnjzrizx418\tasksche.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Groups |
|
| Enabled Privileges | SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege |
| Thread IDs |
0x
B98
|
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| FIND | C:\Windows\TEMP\*.WNCRYT |
|
1 |
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| GET_HANDLE | c:\programdata\qxtqusdnjzrizx418\taskdl.exe | base_address = 0x400000 |
|
1 |
| Operation | Information | Success | Count | Logfile |
|---|---|---|---|---|
| SLEEP | duration = 10 milliseconds (0.010 seconds) |
|
1 |
| Information | Value |
|---|---|
| ID | #12 |
| File Name | c:\windows\system32\cmd.exe |
| Command Line | cmd /c 29121494860050.bat |
| Initial Working Directory | C:\ProgramData\qxtqusdnjzrizx418 |
| Monitor | Start Time: 00:01:13, Reason: Child Process |
| Unmonitor | End Time: 00:01:23, Reason: Terminated |
| Monitor Duration | 00:00:10 |
| Information | Value |
|---|---|
| PID | 0xbb4 |
| Parent PID | 0xa00 (c:\programdata\qxtqusdnjzrizx418\tasksche.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Groups |
|
| Enabled Privileges | SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege |
| Thread IDs |
0x
BB8
|
| Name | Start VA | End VA | Type | Permissions | Monitored | Dump | YARA Match | Actions |
|---|---|---|---|---|---|---|---|---|
| private_0x0000000000010000 | 0x00010000 | 0x0002ffff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000010000 | 0x00010000 | 0x0001ffff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000020000 | 0x00020000 | 0x0002ffff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000030000 | 0x00030000 | 0x00033fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x0000000000040000 | 0x00040000 | 0x00040fff | Pagefile Backed Memory | Readable |
|
|
|
|
| locale.nls | 0x00050000 | 0x000b6fff | Memory Mapped File | Readable |
|
|
|
|
| pagefile_0x00000000000c0000 | 0x000c0000 | 0x0013ffff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x0000000000140000 | 0x00140000 | 0x00146fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x0000000000150000 | 0x00150000 | 0x00151fff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000160000 | 0x00160000 | 0x0025ffff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000260000 | 0x00260000 | 0x00327fff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x0000000000330000 | 0x00330000 | 0x00330fff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000340000 | 0x00340000 | 0x00340fff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000350000 | 0x00350000 | 0x0035ffff | Private Memory | Readable, Writable |
|
|
|
|
| cscript.exe.mui | 0x00360000 | 0x00362fff | Memory Mapped File | Readable, Writable |
|
|
|
|
| private_0x00000000003c0000 | 0x003c0000 | 0x003cffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x00000000003d0000 | 0x003d0000 | 0x004cffff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x00000000004d0000 | 0x004d0000 | 0x005d0fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x00000000005e0000 | 0x005e0000 | 0x0086afff | Pagefile Backed Memory | Readable |
|
|
|
|
| sortdefault.nls | 0x00870000 | 0x00b3efff | Memory Mapped File | Readable |
|
|
|
|
| cscript.exe | 0x00d50000 | 0x00d71fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| cmd.exe | 0x4aa20000 | 0x4aa6bfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| winbrand.dll | 0x70830000 | 0x70836fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| kernelbase.dll | 0x75c10000 | 0x75c59fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| kernel32.dll | 0x75d30000 | 0x75e03fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| imm32.dll | 0x75e10000 | 0x75e2efff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| user32.dll | 0x75f70000 | 0x76038fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| rpcrt4.dll | 0x76220000 | 0x762c0fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| usp10.dll | 0x771e0000 | 0x7727cfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| gdi32.dll | 0x77280000 | 0x772cdfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| msvcrt.dll | 0x77590000 | 0x7763bfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| advapi32.dll | 0x77640000 | 0x776dffff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| sechost.dll | 0x776e0000 | 0x776f8fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| ntdll.dll | 0x778a0000 | 0x779dbfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| lpk.dll | 0x779e0000 | 0x779e9fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| msctf.dll | 0x77a00000 | 0x77acbfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| apisetschema.dll | 0x77ae0000 | 0x77ae0fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| pagefile_0x000000007f6f0000 | 0x7f6f0000 | 0x7f7effff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x000000007ffb0000 | 0x7ffb0000 | 0x7ffd2fff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x000000007ffd4000 | 0x7ffd4000 | 0x7ffd4fff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffdf000 | 0x7ffdf000 | 0x7ffdffff | Private Memory | Readable, Writable |
|
|
|
|
| Filename | File Size | Hash Values | YARA Match | Actions |
|---|---|---|---|---|
| c:\programdata\qxtqusdnjzrizx418\m.vbs | 0.05 KB (48 bytes) |
MD5:
c493292036ec198d49523464555aedde
SHA1: 25d640988d41fc2d046f9722ed79fde7a54575fd SHA256: 02befd86643a4f4a40116c2ad0dce064a070e17512f989c3b88b0df0fc3a905f |
|
|
| c:\programdata\qxtqusdnjzrizx418\m.vbs | 0.13 KB (136 bytes) |
MD5:
37e02a954d2b611c297682d51ffbcb52
SHA1: 2d2e31672be300dff53face6ef8bcc8ad327f426 SHA256: 16fa7eb4e3d014c2173b044ca8c32226aaa1bb1090749061ed68a5f1abd38c87 |
|
|
| c:\programdata\qxtqusdnjzrizx418\m.vbs | 0.20 KB (208 bytes) |
MD5:
620d64377f6ff4419bea5ff1d9dd94f3
SHA1: 0a38dfef93d6e73014a518e140f44065bb27d8c7 SHA256: 4c8698e64e19c1cc1bcbc19541175bda82ccd56585147d63e9a850b559d2107c |
|
|
| c:\programdata\qxtqusdnjzrizx418\m.vbs | 0.21 KB (217 bytes) |
MD5:
842b0b90740485898b4d9e4509c1b94c
SHA1: ed4387eeb836e971faa7ea06f0cdcde532f97ff2 SHA256: 1e68e9bda8ff0de0308ec19ec061fabc13b6571c57c9001718871a5a98cbb734 |
|
|
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| CREATE | c:\programdata\qxtqusdnjzrizx418\29121494860050.bat | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, create_disposition = OPEN_EXISTING, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
9 | |
| CREATE | c:\programdata\qxtqusdnjzrizx418\m.vbs | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ, create_disposition = CREATE_ALWAYS, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| CREATE | c:\programdata\qxtqusdnjzrizx418\m.vbs | desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, create_disposition = OPEN_EXISTING, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
3 | |
| CREATE | c:\programdata\qxtqusdnjzrizx418\29121494860050.bat | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, create_disposition = OPEN_EXISTING, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| OPEN | STD_OUTPUT_HANDLE |
|
12 | ||
| OPEN | STD_INPUT_HANDLE |
|
11 | ||
| OPEN | c:\programdata\qxtqusdnjzrizx418\29121494860050.bat |
|
45 | ||
| OPEN | c:\programdata\qxtqusdnjzrizx418\m.vbs |
|
40 | ||
| OPEN | STD_ERROR_HANDLE |
|
3 | ||
| READ | c:\programdata\qxtqusdnjzrizx418\29121494860050.bat | size = 8191 |
|
1 | |
| READ | c:\programdata\qxtqusdnjzrizx418\29121494860050.bat | size = 8191 |
|
1 | |
| READ | c:\programdata\qxtqusdnjzrizx418\29121494860050.bat | size = 8191 |
|
1 | |
| READ | c:\programdata\qxtqusdnjzrizx418\m.vbs | size = 1 |
|
3 | |
| READ | c:\programdata\qxtqusdnjzrizx418\29121494860050.bat | size = 8191 |
|
1 | |
| READ | c:\programdata\qxtqusdnjzrizx418\29121494860050.bat | size = 8191 |
|
1 | |
| READ | c:\programdata\qxtqusdnjzrizx418\29121494860050.bat | size = 8191 |
|
1 | |
| READ | c:\programdata\qxtqusdnjzrizx418\29121494860050.bat | size = 8191 |
|
1 | |
| READ | c:\programdata\qxtqusdnjzrizx418\29121494860050.bat | size = 8191 |
|
1 | |
| READ | c:\programdata\qxtqusdnjzrizx418\29121494860050.bat | size = 8191 |
|
1 | |
| WRITE | c:\programdata\qxtqusdnjzrizx418\m.vbs | size = 48 |
|
1 | |
| WRITE | c:\programdata\qxtqusdnjzrizx418\m.vbs | size = 88 |
|
1 | |
| WRITE | c:\programdata\qxtqusdnjzrizx418\m.vbs | size = 72 |
|
1 | |
| WRITE | c:\programdata\qxtqusdnjzrizx418\m.vbs | size = 9 |
|
1 | |
| WRITE | STD_ERROR_HANDLE | size = 33 |
|
1 | |
| FIND | C:\ProgramData\qxtqusdnjzrizx418 |
|
3 | ||
| FIND | C:\ProgramData |
|
1 | ||
| FIND | 29121494860050.bat |
|
3 | ||
| FIND | cscript.exe |
|
1 | ||
| FIND | m.vbs |
|
2 | ||
| DELETE | c:\programdata\qxtqusdnjzrizx418\m.vbs |
|
1 | ||
| DELETE | c:\programdata\qxtqusdnjzrizx418\29121494860050.bat |
|
1 |
| Operation | Process Name | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| CREATE | C:\Windows\system32\cscript.exe | os_tid = 0xbf0, os_pid = 0xbec, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, current_directory = C:\ProgramData\qxtqusdnjzrizx418, show_window = SW_SHOWNORMAL |
|
1 | |
| SET_CURDIR | c:\windows\system32\cmd.exe | os_pid = 0xbb4, new_path_name = c:\programdata\qxtqusdnjzrizx418 |
|
1 |
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| LOAD | ADVAPI32.dll | base_address = 0x77640000 |
|
1 | |
| GET_HANDLE | c:\windows\system32\cmd.exe | base_address = 0x4aa20000 |
|
1 | |
| GET_HANDLE | c:\windows\system32\kernel32.dll | base_address = 0x75d30000 |
|
2 | |
| GET_FILENAME | C:\Windows\system32\cmd.exe |
|
1 | ||
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = SetThreadUILanguage, address = 0x75d824c2 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = CopyFileExW, address = 0x75d6ac6c |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = IsDebuggerPresent, address = 0x75d73ea8 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = SetConsoleInputExeNameW, address = 0x75d82732 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = SaferIdentifyLevel, address = 0x77662102 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = SaferComputeTokenFromLevel, address = 0x77663352 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = SaferCloseLevel, address = 0x77663825 |
|
1 |
| Operation | Key | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| OPEN_KEY | HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System |
|
1 | ||
| OPEN_KEY | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor |
|
1 | ||
| OPEN_KEY | HKEY_CURRENT_USER\Software\Microsoft\Command Processor |
|
1 | ||
| READ_VALUE | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = DisableUNCCheck, data_ident_out = 152 |
|
1 | |
| READ_VALUE | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = EnableExtensions, data_ident_out = 1 |
|
1 | |
| READ_VALUE | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = DelayedExpansion, data_ident_out = 1 |
|
1 | |
| READ_VALUE | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = DefaultColor, data_ident_out = 0 |
|
1 | |
| READ_VALUE | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = CompletionChar, data_ident_out = 64 |
|
1 | |
| READ_VALUE | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = PathCompletionChar, data_ident_out = 64 |
|
1 | |
| READ_VALUE | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = AutoRun, data_ident_out = 64 |
|
1 | |
| READ_VALUE | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = DisableUNCCheck, data_ident_out = 64 |
|
1 | |
| READ_VALUE | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = EnableExtensions, data_ident_out = 1 |
|
1 | |
| READ_VALUE | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = DelayedExpansion, data_ident_out = 1 |
|
1 | |
| READ_VALUE | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = DefaultColor, data_ident_out = 0 |
|
1 | |
| READ_VALUE | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = CompletionChar, data_ident_out = 9 |
|
1 | |
| READ_VALUE | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = PathCompletionChar, data_ident_out = 9 |
|
1 | |
| READ_VALUE | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = AutoRun, data_ident_out = 9 |
|
1 |
| Information | Value |
|---|---|
| ID | #13 |
| File Name | c:\windows\system32\cscript.exe |
| Command Line | cscript.exe //nologo m.vbs |
| Initial Working Directory | C:\ProgramData\qxtqusdnjzrizx418 |
| Monitor | Start Time: 00:01:14, Reason: Child Process |
| Unmonitor | End Time: 00:01:23, Reason: Terminated |
| Monitor Duration | 00:00:09 |
| Information | Value |
|---|---|
| PID | 0xbec |
| Parent PID | 0xbb4 (c:\windows\system32\cmd.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Groups |
|
| Enabled Privileges | SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege |
| Thread IDs |
0x
BF0
0x
C08
0x
C14
0x
C4C
0x
C64
0x
C78
0x
D30
0x
D44
0x
D4C
|
| Filename | File Size | Hash Values | YARA Match | Actions |
|---|---|---|---|---|
| c:\programdata\qxtqusdnjzrizx418\@wanadecryptor@.exe.lnk | 0.71 KB (722 bytes) |
MD5:
c69be77ccaca2ede8ebdefea19f6d6c3
SHA1: d1c170e7e309646976cd3658fe76c1e4ac3c25c4 SHA256: 44cdc3b10641bf50ff9a233db4280af408981de0c05e926fe7d05da67bcac00f |
|
|
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| CREATE | c:\programdata\qxtqusdnjzrizx418\m.vbs | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, create_disposition = OPEN_EXISTING, file_attributes = FILE_FLAG_SEQUENTIAL_SCAN |
|
1 | |
| CREATE_SHORTCUT | C:\ProgramData\qxtqusdnjzrizx418\@WanaDecryptor@.exe.lnk | file_target = C:\ProgramData\qxtqusdnjzrizx418\@WanaDecryptor@.exe |
|
1 | |
| READ | c:\programdata\qxtqusdnjzrizx418\m.vbs | module_name = Nameless FileMapping, size = 217 |
|
1 |
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| LOAD | kernel32.dll | base_address = 0x75d30000 |
|
2 | |
| LOAD | ole32.dll | base_address = 0x762d0000 |
|
1 | |
| LOAD | C:\Windows\system32\advapi32.dll | base_address = 0x77640000 |
|
1 | |
| GET_HANDLE | c:\windows\system32\cscript.exe | base_address = 0xd50000 |
|
2 | |
| CREATE_MAPPING | c:\programdata\qxtqusdnjzrizx418\m.vbs | module_name = Nameless FileMapping, maximum_size = 217, protection = PAGE_READONLY |
|
1 | |
| MAP | c:\programdata\qxtqusdnjzrizx418\m.vbs | process_name = c:\windows\system32\cscript.exe, os_pid = 0xbec, module_name = Nameless FileMapping, desired_access = FILE_MAP_READ, file_offset = 0, address = 0x2b0000 |
|
1 | |
| UNMAP | c:\windows\system32\cscript.exe | os_pid = 0xbec, base_address = 0x2b0000 |
|
1 | |
| GET_FILENAME | c:\windows\system32\cscript.exe | file_name = C:\Windows\system32\cscript.exe |
|
1 | |
| GET_FILENAME | C:\Windows\system32\cscript.exe |
|
1 | ||
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = SetThreadUILanguage, address = 0x75d824c2 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = HeapSetInformation, address = 0x75d84157 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\ole32.dll | function = CoCreateInstance, address = 0x76319d0b |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = SaferIdentifyLevel, address = 0x77662102 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = SaferComputeTokenFromLevel, address = 0x77663352 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = SaferCloseLevel, address = 0x77663825 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\cscript.exe | function = 1, address = 0xd52d89 |
|
1 |
| Operation | Class | Interface | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|---|
| CREATE | VBScriptEngine5 | IUnknown | cls_context = CLSCTX_INPROC_SERVER, CLSCTX_INPROC_HANDLER, CLSCTX_LOCAL_SERVER, CLSCTX_REMOTE_SERVER |
|
1 | |
| CREATE | VBScriptEngine5 | IClassFactory |
|
1 | ||
| CREATE | {6C736DB1-BD94-11D0-8A23-00AA00B58E10} | ISystemDebugEventFire | cls_context = CLSCTX_INPROC_SERVER |
|
1 | |
| CREATE | {06290BD1-48AA-11D2-8432-006008C3FBFC} | {E4D1C9B0-46E8-11D4-A2A6-00104BD35090} | cls_context = CLSCTX_INPROC_SERVER |
|
1 | |
| CREATE | {06290BD1-48AA-11D2-8432-006008C3FBFC} | IClassFactory |
|
1 | ||
| CREATE | WshShell | IUnknown | cls_context = CLSCTX_INPROC_SERVER, CLSCTX_LOCAL_SERVER, CLSCTX_REMOTE_SERVER |
|
1 | |
| CREATE | WshShell | IClassFactory |
|
1 | ||
| CREATE | ShellLink | IShellLinkA | cls_context = CLSCTX_INPROC_SERVER |
|
1 | |
| QUERY | VBScriptEngine5 | IClassFactory | new_interface = IUnknown, |
|
1 | |
| QUERY | VBScriptEngine5 | IUnknown | new_interface = IUnknown |
|
1 | |
| QUERY | IClassFactory | new_interface = {E4D1C9B0-46E8-11D4-A2A6-00104BD35090}, |
|
1 | ||
| QUERY | new_interface = {E4D1C9B0-46E8-11D4-A2A6-00104BD35090} |
|
1 | |||
| QUERY | WshShell | IClassFactory | new_interface = IUnknown, |
|
1 | |
| QUERY | WshShell | IUnknown | new_interface = IUnknown |
|
1 | |
| QUERY | ShellLink | IShellLinkA | new_interface = IPersistFile, |
|
1 | |
| METHOD | IMessageFilter | method = AddRef |
|
2 | ||
| METHOD | ITypeLib | new_interface = ITypeInfo, method = GetTypeInfoOfGuid |
|
6 | ||
| METHOD | ITypeInfo | method = GetRefTypeOfImplType |
|
6 | ||
| METHOD | ITypeInfo | new_interface = ITypeInfo, method = GetRefTypeInfo |
|
6 | ||
| METHOD | VBScriptEngine5 | IClassFactory | new_interface = IUnknown, method = CreateInstance |
|
1 | |
| METHOD | VBScriptEngine5 | IUnknown | method = AddRef |
|
1 | |
| METHOD | ISystemDebugEventFire | method = BeginSession |
|
1 | ||
| METHOD | IClassFactory | method = CreateInstance |
|
1 | ||
| METHOD | method = AddRef |
|
1 | |||
| METHOD | ISystemDebugEventFire | method = IsActive |
|
2 | ||
| METHOD | ITypeInfo | method = AddRef |
|
8 | ||
| METHOD | ITypeInfo | method = LocalGetIDsOfNames |
|
4 | ||
| METHOD | ITypeInfo | method = LocalInvoke |
|
4 | ||
| METHOD | WshShell | IClassFactory | new_interface = IUnknown, method = CreateInstance |
|
1 | |
| METHOD | WshShell | IUnknown | method = AddRef |
|
1 | |
| METHOD | ShellLink | IPersistFile | method = Load |
|
1 | |
| METHOD | ShellLink | IShellLinkA | method = SetPath |
|
1 | |
| METHOD | ShellLink | IPersistFile | method = Save |
|
1 | |
| METHOD | ISystemDebugEventFire | method = EndSession |
|
1 |
| Operation | Key | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| CREATE_KEY | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Script Host\Settings |
|
1 | ||
| CREATE_KEY | HKEY_CURRENT_USER\Software\Microsoft\Windows Script Host\Settings |
|
1 | ||
| OPEN_KEY | HKEY_CURRENT_USER\Software\Microsoft\Windows Script Host\Settings |
|
3 | ||
| OPEN_KEY | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Script Host\Settings |
|
3 | ||
| OPEN_KEY | HKEY_CLASSES_ROOT\.vbs |
|
1 | ||
| OPEN_KEY | HKEY_CLASSES_ROOT\VBSFile\ScriptEngine |
|
1 | ||
| READ_VALUE | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Script Host\Settings | value_name = Enabled, data_ident_out = 69 |
|
1 | |
| READ_VALUE | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Script Host\Settings | value_name = LogSecuritySuccesses, data_ident_out = 0 |
|
1 | |
| READ_VALUE | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Script Host\Settings | value_name = IgnoreUserSettings, data_ident_out = 237 |
|
1 | |
| READ_VALUE | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Script Host\Settings | value_name = TrustPolicy, data_ident_out = 165 |
|
1 | |
| READ_VALUE | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Script Host\Settings | value_name = UseWINSAFER, data_ident_out = 1 |
|
1 | |
| READ_VALUE | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Script Host\Settings | value_name = Timeout, data_ident_out = 32 |
|
1 | |
| READ_VALUE | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Script Host\Settings | value_name = DisplayLogo, data_ident_out = 1 |
|
1 | |
| READ_VALUE | HKEY_CURRENT_USER\Software\Microsoft\Windows Script Host\Settings | value_name = Timeout, data_ident_out = 32 |
|
1 | |
| READ_VALUE | HKEY_CURRENT_USER\Software\Microsoft\Windows Script Host\Settings | value_name = DisplayLogo, data_ident_out = 49 |
|
1 | |
| READ_VALUE | HKEY_CLASSES_ROOT\.vbs | data_ident_out = VBSFile |
|
1 | |
| READ_VALUE | HKEY_CLASSES_ROOT\VBSFile\ScriptEngine | data_ident_out = VBScript |
|
1 |
| Operation | Window Name | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| CREATE | class_name = WSH-Timer, x_coordinate = 0, y_coordinate = 0, width = 1, height = 1, window_parameter = 4792952 |
|
1 | ||
| SET_ATTRIBUTE | class_name = WSH-Timer, x_coordinate = 0, y_coordinate = 0, width = 1, height = 1 |
|
1 |
| Operation | Information | Success | Count | Logfile |
|---|---|---|---|---|
| SLEEP | duration = -1 (infinite) |
|
2 | |
| GET_INFO | type = Hardware Information |
|
1 |
| Information | Value |
|---|---|
| ID | #14 |
| File Name | c:\programdata\qxtqusdnjzrizx418\taskdl.exe |
| Command Line | taskdl.exe |
| Initial Working Directory | C:\ProgramData\qxtqusdnjzrizx418 |
| Monitor | Start Time: 00:01:23, Reason: Child Process |
| Unmonitor | End Time: 00:01:25, Reason: Terminated |
| Monitor Duration | 00:00:02 |
| Information | Value |
|---|---|
| PID | 0xdbc |
| Parent PID | 0xa00 (c:\programdata\qxtqusdnjzrizx418\tasksche.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Groups |
|
| Enabled Privileges | SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege |
| Thread IDs |
0x
DC0
|
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| FIND | C:\Windows\TEMP\*.WNCRYT |
|
1 |
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| GET_HANDLE | c:\programdata\qxtqusdnjzrizx418\taskdl.exe | base_address = 0x400000 |
|
1 |
| Operation | Information | Success | Count | Logfile |
|---|---|---|---|---|
| SLEEP | duration = 10 milliseconds (0.010 seconds) |
|
1 |
| Information | Value |
|---|---|
| ID | #15 |
| File Name | c:\programdata\qxtqusdnjzrizx418\taskdl.exe |
| Command Line | taskdl.exe |
| Initial Working Directory | C:\ProgramData\qxtqusdnjzrizx418 |
| Monitor | Start Time: 00:01:34, Reason: Child Process |
| Unmonitor | End Time: 00:01:35, Reason: Terminated |
| Monitor Duration | 00:00:01 |
| Information | Value |
|---|---|
| PID | 0xf74 |
| Parent PID | 0xa00 (c:\programdata\qxtqusdnjzrizx418\tasksche.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Groups |
|
| Enabled Privileges | SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege |
| Thread IDs |
0x
F78
|
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| FIND | C:\Windows\TEMP\*.WNCRYT |
|
1 |
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| GET_HANDLE | c:\programdata\qxtqusdnjzrizx418\taskdl.exe | base_address = 0x400000 |
|
1 |
| Operation | Information | Success | Count | Logfile |
|---|---|---|---|---|
| SLEEP | duration = 10 milliseconds (0.010 seconds) |
|
1 |
| Information | Value |
|---|---|
| ID | #16 |
| File Name | c:\programdata\qxtqusdnjzrizx418\taskdl.exe |
| Command Line | taskdl.exe |
| Initial Working Directory | C:\ProgramData\qxtqusdnjzrizx418 |
| Monitor | Start Time: 00:01:44, Reason: Child Process |
| Unmonitor | End Time: 00:01:45, Reason: Terminated |
| Monitor Duration | 00:00:01 |
| Information | Value |
|---|---|
| PID | 0xfb8 |
| Parent PID | 0xa00 (c:\programdata\qxtqusdnjzrizx418\tasksche.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Groups |
|
| Enabled Privileges | SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege |
| Thread IDs |
0x
FBC
|
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| FIND | C:\Windows\TEMP\*.WNCRYT |
|
1 |
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| GET_HANDLE | c:\programdata\qxtqusdnjzrizx418\taskdl.exe | base_address = 0x400000 |
|
1 |
| Operation | Information | Success | Count | Logfile |
|---|---|---|---|---|
| SLEEP | duration = 10 milliseconds (0.010 seconds) |
|
1 |
| Information | Value |
|---|---|
| ID | #17 |
| File Name | c:\programdata\qxtqusdnjzrizx418\taskdl.exe |
| Command Line | taskdl.exe |
| Initial Working Directory | C:\ProgramData\qxtqusdnjzrizx418 |
| Monitor | Start Time: 00:01:55, Reason: Child Process |
| Unmonitor | End Time: 00:01:57, Reason: Terminated |
| Monitor Duration | 00:00:02 |
| Information | Value |
|---|---|
| PID | 0x864 |
| Parent PID | 0xa00 (c:\programdata\qxtqusdnjzrizx418\tasksche.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Groups |
|
| Enabled Privileges | SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege |
| Thread IDs |
0x
860
|
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| FIND | C:\Windows\TEMP\*.WNCRYT |
|
1 |
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| GET_HANDLE | c:\programdata\qxtqusdnjzrizx418\taskdl.exe | base_address = 0x400000 |
|
1 |
| Operation | Information | Success | Count | Logfile |
|---|---|---|---|---|
| SLEEP | duration = 10 milliseconds (0.010 seconds) |
|
1 |
| Information | Value |
|---|---|
| ID | #18 |
| File Name | c:\windows\system32\cmd.exe |
| Command Line | cmd.exe /c start /b @WanaDecryptor@.exe vs |
| Initial Working Directory | C:\ProgramData\qxtqusdnjzrizx418 |
| Monitor | Start Time: 00:01:56, Reason: Child Process |
| Unmonitor | End Time: 00:01:58, Reason: Terminated |
| Monitor Duration | 00:00:02 |
| Information | Value |
|---|---|
| PID | 0x840 |
| Parent PID | 0xa00 (c:\programdata\qxtqusdnjzrizx418\tasksche.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Groups |
|
| Enabled Privileges | SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege |
| Thread IDs |
0x
83C
|
| Name | Start VA | End VA | Type | Permissions | Monitored | Dump | YARA Match | Actions |
|---|---|---|---|---|---|---|---|---|
| private_0x0000000000010000 | 0x00010000 | 0x0002ffff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000010000 | 0x00010000 | 0x0001ffff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000020000 | 0x00020000 | 0x0002ffff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000030000 | 0x00030000 | 0x00033fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x0000000000040000 | 0x00040000 | 0x00040fff | Pagefile Backed Memory | Readable |
|
|
|
|
| locale.nls | 0x00050000 | 0x000b6fff | Memory Mapped File | Readable |
|
|
|
|
| private_0x00000000000c0000 | 0x000c0000 | 0x001bffff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x00000000001c0000 | 0x001c0000 | 0x00287fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x0000000000290000 | 0x00290000 | 0x0030ffff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x0000000000310000 | 0x00310000 | 0x00316fff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x0000000000320000 | 0x00320000 | 0x0032ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000330000 | 0x00330000 | 0x0042ffff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000430000 | 0x00430000 | 0x00530fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x0000000000540000 | 0x00540000 | 0x00541fff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000550000 | 0x00550000 | 0x007dafff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x00000000007e0000 | 0x007e0000 | 0x007e0fff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x00000000007f0000 | 0x007f0000 | 0x007f0fff | Private Memory | Readable, Writable |
|
|
|
|
| cmd.exe | 0x4a9f0000 | 0x4aa3bfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| winbrand.dll | 0x70770000 | 0x70776fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| kernelbase.dll | 0x75c10000 | 0x75c59fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| kernel32.dll | 0x75d30000 | 0x75e03fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| imm32.dll | 0x75e10000 | 0x75e2efff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| user32.dll | 0x75f70000 | 0x76038fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| usp10.dll | 0x771e0000 | 0x7727cfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| gdi32.dll | 0x77280000 | 0x772cdfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| msvcrt.dll | 0x77590000 | 0x7763bfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| ntdll.dll | 0x778a0000 | 0x779dbfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| lpk.dll | 0x779e0000 | 0x779e9fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| msctf.dll | 0x77a00000 | 0x77acbfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| apisetschema.dll | 0x77ae0000 | 0x77ae0fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| pagefile_0x000000007f6f0000 | 0x7f6f0000 | 0x7f7effff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x000000007ffb0000 | 0x7ffb0000 | 0x7ffd2fff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x000000007ffde000 | 0x7ffde000 | 0x7ffdefff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffdf000 | 0x7ffdf000 | 0x7ffdffff | Private Memory | Readable, Writable |
|
|
|
|
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| OPEN | c:\programdata\qxtqusdnjzrizx418\m.vbs |
|
5 | ||
| OPEN | STD_INPUT_HANDLE |
|
4 | ||
| OPEN | STD_OUTPUT_HANDLE |
|
1 | ||
| OPEN | STD_ERROR_HANDLE |
|
1 | ||
| FIND | C:\ProgramData\qxtqusdnjzrizx418 |
|
3 | ||
| FIND | C:\ProgramData |
|
1 |
| Operation | Process Name | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| CREATE | C:\ProgramData\qxtqusdnjzrizx418\@WanaDecryptor@.exe | os_tid = 0x310, os_pid = 0x810, creation_flags = CREATE_NEW_PROCESS_GROUP, CREATE_UNICODE_ENVIRONMENT, CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL |
|
1 | |
| SET_CURDIR | c:\windows\system32\cmd.exe | os_pid = 0x840, new_path_name = c:\programdata\qxtqusdnjzrizx418 |
|
1 |
| Operation | Process Name | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| RESUME | 0x310 |
|
1 |
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| GET_HANDLE | c:\windows\system32\cmd.exe | base_address = 0x4a9f0000 |
|
1 | |
| GET_HANDLE | c:\windows\system32\kernel32.dll | base_address = 0x75d30000 |
|
2 | |
| GET_FILENAME | C:\Windows\system32\cmd.exe |
|
1 | ||
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = SetThreadUILanguage, address = 0x75d824c2 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = CopyFileExW, address = 0x75d6ac6c |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = IsDebuggerPresent, address = 0x75d73ea8 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = SetConsoleInputExeNameW, address = 0x75d82732 |
|
1 |
| Operation | Key | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| OPEN_KEY | HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System |
|
1 | ||
| OPEN_KEY | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor |
|
1 | ||
| OPEN_KEY | HKEY_CURRENT_USER\Software\Microsoft\Command Processor |
|
1 | ||
| READ_VALUE | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = DisableUNCCheck, data_ident_out = 144 |
|
1 | |
| READ_VALUE | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = EnableExtensions, data_ident_out = 1 |
|
1 | |
| READ_VALUE | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = DelayedExpansion, data_ident_out = 1 |
|
1 | |
| READ_VALUE | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = DefaultColor, data_ident_out = 0 |
|
1 | |
| READ_VALUE | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = CompletionChar, data_ident_out = 64 |
|
1 | |
| READ_VALUE | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = PathCompletionChar, data_ident_out = 64 |
|
1 | |
| READ_VALUE | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = AutoRun, data_ident_out = 64 |
|
1 | |
| READ_VALUE | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = DisableUNCCheck, data_ident_out = 64 |
|
1 | |
| READ_VALUE | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = EnableExtensions, data_ident_out = 1 |
|
1 | |
| READ_VALUE | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = DelayedExpansion, data_ident_out = 1 |
|
1 | |
| READ_VALUE | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = DefaultColor, data_ident_out = 0 |
|
1 | |
| READ_VALUE | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = CompletionChar, data_ident_out = 9 |
|
1 | |
| READ_VALUE | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = PathCompletionChar, data_ident_out = 9 |
|
1 | |
| READ_VALUE | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = AutoRun, data_ident_out = 9 |
|
1 |
| Information | Value |
|---|---|
| ID | #19 |
| File Name | c:\programdata\qxtqusdnjzrizx418\@wanadecryptor@.exe |
| Command Line | @WanaDecryptor@.exe co |
| Initial Working Directory | C:\ProgramData\qxtqusdnjzrizx418 |
| Monitor | Start Time: 00:01:56, Reason: Child Process |
| Unmonitor | End Time: 00:04:59, Reason: Terminated by Timeout |
| Monitor Duration | 00:03:03 |
| Information | Value |
|---|---|
| PID | 0x854 |
| Parent PID | 0xa00 (c:\programdata\qxtqusdnjzrizx418\tasksche.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Groups |
|
| Enabled Privileges | SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege |
| Thread IDs |
0x
848
0x
5B0
|
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| CREATE | c:\programdata\qxtqusdnjzrizx418\c.wnry | file_attributes = _O_RDONLY | _O_BINARY |
|
1 | |
| CREATE | c:\programdata\qxtqusdnjzrizx418\00000000.res | file_attributes = _O_RDONLY | _O_BINARY |
|
2 | |
| CREATE | c:\programdata\qxtqusdnjzrizx418\s.wnry | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, create_disposition = OPEN_EXISTING, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| CREATE | c:\programdata\qxtqusdnjzrizx418\taskdata\tor\libeay32.dll | desired_access = GENERIC_WRITE, create_disposition = CREATE_ALWAYS, file_attributes = FILE_ATTRIBUTE_ARCHIVE |
|
1 | |
| CREATE | c:\programdata\qxtqusdnjzrizx418\taskdata\tor\libevent-2-0-5.dll | desired_access = GENERIC_WRITE, create_disposition = CREATE_ALWAYS, file_attributes = FILE_ATTRIBUTE_ARCHIVE |
|
1 | |
| CREATE | c:\programdata\qxtqusdnjzrizx418\taskdata\tor\libevent_core-2-0-5.dll | desired_access = GENERIC_WRITE, create_disposition = CREATE_ALWAYS, file_attributes = FILE_ATTRIBUTE_ARCHIVE |
|
1 | |
| CREATE | c:\programdata\qxtqusdnjzrizx418\taskdata\tor\libevent_extra-2-0-5.dll | desired_access = GENERIC_WRITE, create_disposition = CREATE_ALWAYS, file_attributes = FILE_ATTRIBUTE_ARCHIVE |
|
1 | |
| CREATE | c:\programdata\qxtqusdnjzrizx418\taskdata\tor\libgcc_s_sjlj-1.dll | desired_access = GENERIC_WRITE, create_disposition = CREATE_ALWAYS, file_attributes = FILE_ATTRIBUTE_ARCHIVE |
|
1 | |
| CREATE | c:\programdata\qxtqusdnjzrizx418\taskdata\tor\libssp-0.dll | desired_access = GENERIC_WRITE, create_disposition = CREATE_ALWAYS, file_attributes = FILE_ATTRIBUTE_ARCHIVE |
|
1 | |
| CREATE | c:\programdata\qxtqusdnjzrizx418\taskdata\tor\ssleay32.dll | desired_access = GENERIC_WRITE, create_disposition = CREATE_ALWAYS, file_attributes = FILE_ATTRIBUTE_ARCHIVE |
|
1 | |
| CREATE | c:\programdata\qxtqusdnjzrizx418\taskdata\tor\tor.exe | desired_access = GENERIC_WRITE, create_disposition = CREATE_ALWAYS, file_attributes = FILE_ATTRIBUTE_ARCHIVE |
|
1 | |
| CREATE | c:\programdata\qxtqusdnjzrizx418\taskdata\tor\zlib1.dll | desired_access = GENERIC_WRITE, create_disposition = CREATE_ALWAYS, file_attributes = FILE_ATTRIBUTE_ARCHIVE |
|
1 | |
| CREATE_DIR | c:\programdata\qxtqusdnjzrizx418\taskdata |
|
1 | ||
| CREATE_DIR | c:\programdata\qxtqusdnjzrizx418\taskdata\data |
|
1 | ||
| CREATE_DIR | c:\programdata\qxtqusdnjzrizx418\taskdata\data\tor |
|
1 | ||
| CREATE_DIR | c:\programdata\qxtqusdnjzrizx418\taskdata\tor |
|
1 | ||
| COPY | c:\programdata\qxtqusdnjzrizx418\taskdata\tor\taskhsvc.exe | source_file_name = c:\programdata\qxtqusdnjzrizx418\taskdata\tor\tor.exe, fail_if_exists = 0 |
|
1 | |
| READ | c:\programdata\qxtqusdnjzrizx418\c.wnry | size = 780 |
|
1 | |
| READ | c:\programdata\qxtqusdnjzrizx418\00000000.res | size = 136 |
|
2 | |
| READ | c:\programdata\qxtqusdnjzrizx418\s.wnry | size = 1028 |
|
1 | |
| READ | c:\programdata\qxtqusdnjzrizx418\s.wnry | size = 1 |
|
1756 | |
| READ | c:\programdata\qxtqusdnjzrizx418\s.wnry | size = 5 |
|
1 | |
| READ | c:\programdata\qxtqusdnjzrizx418\s.wnry | size = 0 |
|
12 | |
| READ | c:\programdata\qxtqusdnjzrizx418\s.wnry | size = 9 |
|
1 | |
| READ | c:\programdata\qxtqusdnjzrizx418\s.wnry | size = 4 |
|
1 | |
| READ | c:\programdata\qxtqusdnjzrizx418\s.wnry | size = 16 |
|
3 | |
| READ | c:\programdata\qxtqusdnjzrizx418\s.wnry | size = 16384 |
|
179 | |
| READ | c:\programdata\qxtqusdnjzrizx418\s.wnry | size = 7930 |
|
1 | |
| READ | c:\programdata\qxtqusdnjzrizx418\s.wnry | size = 22 |
|
1 | |
| READ | c:\programdata\qxtqusdnjzrizx418\s.wnry | size = 15479 |
|
1 | |
| READ | c:\programdata\qxtqusdnjzrizx418\s.wnry | size = 27 |
|
1 | |
| READ | c:\programdata\qxtqusdnjzrizx418\s.wnry | size = 11906 |
|
1 | |
| READ | c:\programdata\qxtqusdnjzrizx418\s.wnry | size = 28 |
|
1 | |
| READ | c:\programdata\qxtqusdnjzrizx418\s.wnry | size = 5655 |
|
1 | |
| READ | c:\programdata\qxtqusdnjzrizx418\s.wnry | size = 23 |
|
1 | |
| READ | c:\programdata\qxtqusdnjzrizx418\s.wnry | size = 13502 |
|
1 | |
| READ | c:\programdata\qxtqusdnjzrizx418\s.wnry | size = 13780 |
|
1 | |
| READ | c:\programdata\qxtqusdnjzrizx418\s.wnry | size = 14513 |
|
1 | |
| READ | c:\programdata\qxtqusdnjzrizx418\s.wnry | size = 11 |
|
1 | |
| READ | c:\programdata\qxtqusdnjzrizx418\s.wnry | size = 14890 |
|
1 | |
| READ | c:\programdata\qxtqusdnjzrizx418\s.wnry | size = 13 |
|
1 | |
| READ | c:\programdata\qxtqusdnjzrizx418\s.wnry | size = 6149 |
|
1 | |
| WRITE | c:\programdata\qxtqusdnjzrizx418\taskdata\tor\libeay32.dll | size = 16384 |
|
195 | |
| WRITE | c:\programdata\qxtqusdnjzrizx418\taskdata\tor\libeay32.dll | size = 2226 |
|
1 | |
| WRITE | c:\programdata\qxtqusdnjzrizx418\taskdata\tor\libevent-2-0-5.dll | size = 16384 |
|
43 | |
| WRITE | c:\programdata\qxtqusdnjzrizx418\taskdata\tor\libevent-2-0-5.dll | size = 14705 |
|
1 | |
| WRITE | c:\programdata\qxtqusdnjzrizx418\taskdata\tor\libevent_core-2-0-5.dll | size = 16384 |
|
25 | |
| WRITE | c:\programdata\qxtqusdnjzrizx418\taskdata\tor\libevent_core-2-0-5.dll | size = 8159 |
|
1 | |
| WRITE | c:\programdata\qxtqusdnjzrizx418\taskdata\tor\libevent_extra-2-0-5.dll | size = 16384 |
|
25 | |
| WRITE | c:\programdata\qxtqusdnjzrizx418\taskdata\tor\libevent_extra-2-0-5.dll | size = 1769 |
|
1 | |
| WRITE | c:\programdata\qxtqusdnjzrizx418\taskdata\tor\libgcc_s_sjlj-1.dll | size = 16384 |
|
31 | |
| WRITE | c:\programdata\qxtqusdnjzrizx418\taskdata\tor\libgcc_s_sjlj-1.dll | size = 15358 |
|
1 | |
| WRITE | c:\programdata\qxtqusdnjzrizx418\taskdata\tor\libssp-0.dll | size = 16384 |
|
5 | |
| WRITE | c:\programdata\qxtqusdnjzrizx418\taskdata\tor\libssp-0.dll | size = 10679 |
|
1 | |
| WRITE | c:\programdata\qxtqusdnjzrizx418\taskdata\tor\ssleay32.dll | size = 16384 |
|
43 | |
| WRITE | c:\programdata\qxtqusdnjzrizx418\taskdata\tor\ssleay32.dll | size = 6947 |
|
1 | |
| WRITE | c:\programdata\qxtqusdnjzrizx418\taskdata\tor\tor.exe | size = 16384 |
|
189 | |
| WRITE | c:\programdata\qxtqusdnjzrizx418\taskdata\tor\tor.exe | size = 2048 |
|
1 | |
| WRITE | c:\programdata\qxtqusdnjzrizx418\taskdata\tor\zlib1.dll | size = 16384 |
|
6 | |
| WRITE | c:\programdata\qxtqusdnjzrizx418\taskdata\tor\zlib1.dll | size = 9216 |
|
1 | |
| FIND | *.res |
|
1 | ||
| FIND | TaskData\Tor\taskhsvc.exe |
|
1 | ||
| FIND | C:\ProgramData\qxtqusdnjzrizx418\ |
|
37 | ||
| FIND | C:\ProgramData\qxtqusdnjzrizx418\TaskData |
|
12 | ||
| FIND | C:\ProgramData\qxtqusdnjzrizx418\TaskData\Data |
|
1 | ||
| FIND | C:\ProgramData\qxtqusdnjzrizx418\TaskData\Data/ |
|
1 | ||
| FIND | C:\ProgramData\qxtqusdnjzrizx418\TaskData\Data |
|
1 | ||
| FIND | C:\ProgramData\qxtqusdnjzrizx418\TaskData\Data/Tor |
|
1 | ||
| FIND | C:\ProgramData\qxtqusdnjzrizx418\TaskData\Data/Tor/ |
|
1 | ||
| FIND | C:\ProgramData\qxtqusdnjzrizx418\TaskData\Tor |
|
1 | ||
| FIND | C:\ProgramData\qxtqusdnjzrizx418\TaskData\Tor/ |
|
10 | ||
| FIND | C:\ProgramData\qxtqusdnjzrizx418\TaskData\Tor |
|
9 | ||
| FIND | TaskData\Tor\tor.exe |
|
1 |
| Operation | Process Name | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| CREATE | TaskData\Tor\taskhsvc.exe | os_tid = 0x85c, os_pid = 0x814, creation_flags = CREATE_NO_WINDOW, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE |
|
1 | |
| SET_CURDIR | c:\programdata\qxtqusdnjzrizx418\@wanadecryptor@.exe | os_pid = 0x854, new_path_name = c:\programdata\qxtqusdnjzrizx418 |
|
1 |
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| LOAD | advapi32.dll | base_address = 0x77640000 |
|
1 | |
| LOAD | kernel32.dll | base_address = 0x75d30000 |
|
1 | |
| GET_HANDLE | c:\programdata\qxtqusdnjzrizx418\@wanadecryptor@.exe | base_address = 0x400000 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = CryptAcquireContextA, address = 0x776491dd |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = CryptImportKey, address = 0x7764c532 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = CryptDestroyKey, address = 0x7764c51a |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = CryptEncrypt, address = 0x7766779b |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = CryptDecrypt, address = 0x77683178 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = CryptGenKey, address = 0x77648ee9 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = CreateFileW, address = 0x75d7cc56 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = WriteFile, address = 0x75d81400 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = ReadFile, address = 0x75d796fb |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = MoveFileW, address = 0x75d9548a |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = MoveFileExW, address = 0x75d74a91 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = DeleteFileW, address = 0x75d70f62 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = CloseHandle, address = 0x75d7ca7c |
|
1 |
| Operation | Key | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| CREATE_KEY | HKEY_LOCAL_MACHINE\Software\WanaCrypt0r |
|
1 | ||
| READ_VALUE | HKEY_LOCAL_MACHINE\Software\WanaCrypt0r | value_name = wd, data_ident_out = 67 |
|
1 |
| Operation | Window Name | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| FIND | Wana Decrypt0r 2.0 |
|
1 |
| Remote Address | Remote Port | L7Protocol | Success | Count |
|---|---|---|---|---|
| 127.0.0.1 | 9050 |
|
4 |
| Information | Value |
|---|---|
| ID | #20 |
| File Name | c:\programdata\qxtqusdnjzrizx418\@wanadecryptor@.exe |
| Command Line | @WanaDecryptor@.exe vs |
| Initial Working Directory | C:\ProgramData\qxtqusdnjzrizx418 |
| Monitor | Start Time: 00:01:57, Reason: Child Process |
| Unmonitor | End Time: 00:02:12, Reason: Terminated |
| Monitor Duration | 00:00:15 |
| Information | Value |
|---|---|
| PID | 0x810 |
| Parent PID | 0x840 (c:\windows\system32\cmd.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Groups |
|
| Enabled Privileges | SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege |
| Thread IDs |
0x
310
|
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| CREATE | c:\programdata\qxtqusdnjzrizx418\c.wnry | file_attributes = _O_RDONLY | _O_BINARY |
|
1 | |
| READ | c:\programdata\qxtqusdnjzrizx418\c.wnry | size = 780 |
|
1 |
| Operation | Process Name | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| CREATE | cmd.exe \c vssadmin delete shadows \all \quiet & wmic shadowcopy delete & bcdedit \set {default} bootstatuspolicy ignoreallfailures & bcdedit \set {default} recoveryenabled no & wbadmin delete catalog -quiet | os_tid = 0x8b8, os_pid = 0x36c, creation_flags = CREATE_NO_WINDOW, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE |
|
1 | |
| SET_CURDIR | c:\programdata\qxtqusdnjzrizx418\@wanadecryptor@.exe | os_pid = 0x810, new_path_name = c:\programdata\qxtqusdnjzrizx418 |
|
1 |
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| LOAD | advapi32.dll | base_address = 0x77640000 |
|
1 | |
| LOAD | kernel32.dll | base_address = 0x75d30000 |
|
1 | |
| GET_HANDLE | c:\programdata\qxtqusdnjzrizx418\@wanadecryptor@.exe | base_address = 0x400000 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = CryptAcquireContextA, address = 0x776491dd |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = CryptImportKey, address = 0x7764c532 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = CryptDestroyKey, address = 0x7764c51a |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = CryptEncrypt, address = 0x7766779b |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = CryptDecrypt, address = 0x77683178 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = CryptGenKey, address = 0x77648ee9 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = CreateFileW, address = 0x75d7cc56 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = WriteFile, address = 0x75d81400 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = ReadFile, address = 0x75d796fb |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = MoveFileW, address = 0x75d9548a |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = MoveFileExW, address = 0x75d74a91 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = DeleteFileW, address = 0x75d70f62 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = CloseHandle, address = 0x75d7ca7c |
|
1 |
| Operation | Key | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| CREATE_KEY | HKEY_LOCAL_MACHINE\Software\WanaCrypt0r |
|
1 | ||
| READ_VALUE | HKEY_LOCAL_MACHINE\Software\WanaCrypt0r | value_name = wd, data_ident_out = 67 |
|
1 |
| Operation | Window Name | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| FIND | Wana Decrypt0r 2.0 |
|
1 |
| Operation | Information | Success | Count | Logfile |
|---|---|---|---|---|
| SLEEP | duration = 10000 milliseconds (10.000 seconds) |
|
1 |
| Information | Value |
|---|---|
| ID | #21 |
| File Name | c:\programdata\qxtqusdnjzrizx418\taskse.exe |
| Command Line | taskse.exe C:\ProgramData\qxtqusdnjzrizx418\@WanaDecryptor@.exe |
| Initial Working Directory | C:\ProgramData\qxtqusdnjzrizx418 |
| Monitor | Start Time: 00:02:05, Reason: Child Process |
| Unmonitor | End Time: 00:02:08, Reason: Terminated |
| Monitor Duration | 00:00:03 |
| Information | Value |
|---|---|
| PID | 0x784 |
| Parent PID | 0xa00 (c:\programdata\qxtqusdnjzrizx418\tasksche.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Groups |
|
| Enabled Privileges | SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege |
| Thread IDs |
0x
120
0x
6DC
|
| Operation | Process Name | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| CREATE | C:\ProgramData\qxtqusdnjzrizx418\@WanaDecryptor@.exe | os_tid = 0x604, os_pid = 0x31c, creation_flags = CREATE_UNICODE_ENVIRONMENT, show_window = SW_SHOW |
|
1 | |
| OPEN_TOKEN | c:\programdata\qxtqusdnjzrizx418\tasksche.exe | os_pid = 0xa00, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITE, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITE |
|
2 |
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| LOAD | Wtsapi32.dll | base_address = 0x743d0000 |
|
1 | |
| LOAD | userenv.dll | base_address = 0x750a0000 |
|
1 | |
| GET_HANDLE | c:\programdata\qxtqusdnjzrizx418\taskse.exe | base_address = 0x400000 |
|
1 | |
| GET_HANDLE | c:\windows\system32\advapi32.dll | base_address = 0x77640000 |
|
2 | |
| GET_HANDLE | c:\windows\system32\kernel32.dll | base_address = 0x75d30000 |
|
2 | |
| GET_HANDLE | userenv.dll | base_address = 0x0 |
|
1 | |
| GET_HANDLE | c:\windows\system32\wtsapi32.dll | base_address = 0x743d0000 |
|
2 | |
| GET_HANDLE | c:\windows\system32\userenv.dll | base_address = 0x750a0000 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\wtsapi32.dll | function = WTSEnumerateSessionsA, address = 0x743d4023 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\wtsapi32.dll | function = WTSFreeMemory, address = 0x743d1b65 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = OpenProcessToken, address = 0x77654304 |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = LookupPrivilegeValueA, address = 0x7765404a |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = AdjustTokenPrivileges, address = 0x7765418e |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = DuplicateTokenEx, address = 0x7764ca24 |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = CreateProcessAsUserA, address = 0x77682538 |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = WTSGetActiveConsoleSessionId, address = 0x75d6480b |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = GetCurrentProcess, address = 0x75d7cdcf |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = CloseHandle, address = 0x75d7ca7c |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\userenv.dll | function = CreateEnvironmentBlock, address = 0x750a1a7a |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\userenv.dll | function = DestroyEnvironmentBlock, address = 0x750a1a4e |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\wtsapi32.dll | function = WTSQueryUserToken, address = 0x743d1f81 |
|
2 |
| Operation | User/Group/Server | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| LOOKUP_PRIVILEGE | Localhost | privilege = SeTcbPrivilege |
|
2 | |
| SET_PRIVILEGE | Localhost | c:\programdata\qxtqusdnjzrizx418\tasksche.exe, os_pid = 0xa00, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITE, disable_all_privileges = 0, privilege = SeTcbPrivilege |
|
2 | |
| SET_PRIVILEGE | Localhost | c:\programdata\qxtqusdnjzrizx418\tasksche.exe, os_pid = 0xa00, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITE, disable_all_privileges = 0, privilege = |
|
2 |
| Operation | Information | Success | Count | Logfile |
|---|---|---|---|---|
| SLEEP | duration = 100 milliseconds (0.100 seconds) |
|
2 |
| Information | Value |
|---|---|
| ID | #22 |
| File Name | c:\windows\system32\cmd.exe |
| Command Line | cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "qxtqusdnjzrizx418" /t REG_SZ /d "\"C:\ProgramData\qxtqusdnjzrizx418\tasksche.exe\"" /f |
| Initial Working Directory | C:\ProgramData\qxtqusdnjzrizx418 |
| Monitor | Start Time: 00:02:05, Reason: Child Process |
| Unmonitor | End Time: 00:02:09, Reason: Terminated |
| Monitor Duration | 00:00:04 |
| Information | Value |
|---|---|
| PID | 0x128 |
| Parent PID | 0xa00 (c:\programdata\qxtqusdnjzrizx418\tasksche.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Groups |
|
| Enabled Privileges | SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege |
| Thread IDs |
0x
58C
|
| Name | Start VA | End VA | Type | Permissions | Monitored | Dump | YARA Match | Actions |
|---|---|---|---|---|---|---|---|---|
| private_0x0000000000010000 | 0x00010000 | 0x0002ffff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000010000 | 0x00010000 | 0x0001ffff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000020000 | 0x00020000 | 0x0002ffff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000030000 | 0x00030000 | 0x00033fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x0000000000040000 | 0x00040000 | 0x00040fff | Pagefile Backed Memory | Readable |
|
|
|
|
| locale.nls | 0x00050000 | 0x000b6fff | Memory Mapped File | Readable |
|
|
|
|
| pagefile_0x00000000000c0000 | 0x000c0000 | 0x000c6fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x00000000000d0000 | 0x000d0000 | 0x000d1fff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| private_0x00000000000e0000 | 0x000e0000 | 0x000e0fff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x00000000000f0000 | 0x000f0000 | 0x001effff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x00000000001f0000 | 0x001f0000 | 0x002b7fff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x00000000002c0000 | 0x002c0000 | 0x002c0fff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000320000 | 0x00320000 | 0x0032ffff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000330000 | 0x00330000 | 0x003affff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x00000000003e0000 | 0x003e0000 | 0x004dffff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x00000000004e0000 | 0x004e0000 | 0x005e0fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x00000000005f0000 | 0x005f0000 | 0x0087afff | Pagefile Backed Memory | Readable |
|
|
|
|
| sortdefault.nls | 0x00880000 | 0x00b4efff | Memory Mapped File | Readable |
|
|
|
|
| cmd.exe | 0x4aa70000 | 0x4aabbfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| winbrand.dll | 0x705f0000 | 0x705f6fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| kernelbase.dll | 0x75c10000 | 0x75c59fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| kernel32.dll | 0x75d30000 | 0x75e03fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| imm32.dll | 0x75e10000 | 0x75e2efff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| user32.dll | 0x75f70000 | 0x76038fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| usp10.dll | 0x771e0000 | 0x7727cfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| gdi32.dll | 0x77280000 | 0x772cdfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| msvcrt.dll | 0x77590000 | 0x7763bfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| ntdll.dll | 0x778a0000 | 0x779dbfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| lpk.dll | 0x779e0000 | 0x779e9fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| msctf.dll | 0x77a00000 | 0x77acbfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| apisetschema.dll | 0x77ae0000 | 0x77ae0fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| pagefile_0x000000007f6f0000 | 0x7f6f0000 | 0x7f7effff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x000000007ffb0000 | 0x7ffb0000 | 0x7ffd2fff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x000000007ffd4000 | 0x7ffd4000 | 0x7ffd4fff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffdf000 | 0x7ffdf000 | 0x7ffdffff | Private Memory | Readable, Writable |
|
|
|
|
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| OPEN | c:\programdata\qxtqusdnjzrizx418\m.vbs |
|
5 | ||
| OPEN | STD_INPUT_HANDLE |
|
3 | ||
| FIND | C:\ProgramData\qxtqusdnjzrizx418 |
|
3 | ||
| FIND | C:\ProgramData |
|
1 |
| Operation | Process Name | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| CREATE | C:\Windows\system32\reg.exe | os_tid = 0x14c, os_pid = 0x878, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, current_directory = C:\ProgramData\qxtqusdnjzrizx418, show_window = SW_SHOWNORMAL |
|
1 | |
| SET_CURDIR | c:\windows\system32\cmd.exe | os_pid = 0x128, new_path_name = c:\programdata\qxtqusdnjzrizx418 |
|
1 |
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| GET_HANDLE | c:\windows\system32\cmd.exe | base_address = 0x4aa70000 |
|
1 | |
| GET_HANDLE | c:\windows\system32\kernel32.dll | base_address = 0x75d30000 |
|
2 | |
| GET_FILENAME | C:\Windows\system32\cmd.exe |
|
1 | ||
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = SetThreadUILanguage, address = 0x75d824c2 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = CopyFileExW, address = 0x75d6ac6c |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = IsDebuggerPresent, address = 0x75d73ea8 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = SetConsoleInputExeNameW, address = 0x75d82732 |
|
1 |
| Operation | Key | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| OPEN_KEY | HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System |
|
1 | ||
| OPEN_KEY | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor |
|
1 | ||
| OPEN_KEY | HKEY_CURRENT_USER\Software\Microsoft\Command Processor |
|
1 | ||
| READ_VALUE | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = DisableUNCCheck, data_ident_out = 56 |
|
1 | |
| READ_VALUE | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = EnableExtensions, data_ident_out = 1 |
|
1 | |
| READ_VALUE | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = DelayedExpansion, data_ident_out = 1 |
|
1 | |
| READ_VALUE | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = DefaultColor, data_ident_out = 0 |
|
1 | |
| READ_VALUE | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = CompletionChar, data_ident_out = 64 |
|
1 | |
| READ_VALUE | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = PathCompletionChar, data_ident_out = 64 |
|
1 | |
| READ_VALUE | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = AutoRun, data_ident_out = 64 |
|
1 | |
| READ_VALUE | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = DisableUNCCheck, data_ident_out = 64 |
|
1 | |
| READ_VALUE | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = EnableExtensions, data_ident_out = 1 |
|
1 | |
| READ_VALUE | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = DelayedExpansion, data_ident_out = 1 |
|
1 | |
| READ_VALUE | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = DefaultColor, data_ident_out = 0 |
|
1 | |
| READ_VALUE | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = CompletionChar, data_ident_out = 9 |
|
1 | |
| READ_VALUE | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = PathCompletionChar, data_ident_out = 9 |
|
1 | |
| READ_VALUE | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = AutoRun, data_ident_out = 9 |
|
1 |
| Information | Value |
|---|---|
| ID | #23 |
| File Name | c:\programdata\qxtqusdnjzrizx418\taskdl.exe |
| Command Line | taskdl.exe |
| Initial Working Directory | C:\ProgramData\qxtqusdnjzrizx418 |
| Monitor | Start Time: 00:02:06, Reason: Child Process |
| Unmonitor | End Time: 00:02:08, Reason: Terminated |
| Monitor Duration | 00:00:02 |
| Information | Value |
|---|---|
| PID | 0x430 |
| Parent PID | 0xa00 (c:\programdata\qxtqusdnjzrizx418\tasksche.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Groups |
|
| Enabled Privileges | SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege |
| Thread IDs |
0x
4E4
|
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| FIND | C:\Windows\TEMP\*.WNCRYT |
|
1 | ||
| DELETE | c:\windows\temp\hibsys.wncryt |
|
1 |
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| GET_HANDLE | c:\programdata\qxtqusdnjzrizx418\taskdl.exe | base_address = 0x400000 |
|
1 |
| Operation | Information | Success | Count | Logfile |
|---|---|---|---|---|
| SLEEP | duration = 10 milliseconds (0.010 seconds) |
|
1 |
| Information | Value |
|---|---|
| ID | #24 |
| File Name | c:\windows\system32\reg.exe |
| Command Line | reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "qxtqusdnjzrizx418" /t REG_SZ /d "\"C:\ProgramData\qxtqusdnjzrizx418\tasksche.exe\"" /f |
| Initial Working Directory | C:\ProgramData\qxtqusdnjzrizx418 |
| Monitor | Start Time: 00:02:07, Reason: Child Process |
| Unmonitor | End Time: 00:02:08, Reason: Terminated |
| Monitor Duration | 00:00:01 |
| Information | Value |
|---|---|
| PID | 0x878 |
| Parent PID | 0x128 (c:\windows\system32\cmd.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Groups |
|
| Enabled Privileges | SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege |
| Thread IDs |
0x
14C
|
| Name | Start VA | End VA | Type | Permissions | Monitored | Dump | YARA Match | Actions |
|---|---|---|---|---|---|---|---|---|
| private_0x0000000000010000 | 0x00010000 | 0x0002ffff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000010000 | 0x00010000 | 0x0001ffff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000020000 | 0x00020000 | 0x0002ffff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000030000 | 0x00030000 | 0x00033fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x0000000000040000 | 0x00040000 | 0x00040fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x0000000000050000 | 0x00050000 | 0x00056fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x0000000000060000 | 0x00060000 | 0x00061fff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| reg.exe.mui | 0x00070000 | 0x00078fff | Memory Mapped File | Readable, Writable |
|
|
|
|
| private_0x0000000000080000 | 0x00080000 | 0x00080fff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000090000 | 0x00090000 | 0x00090fff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x00000000000a0000 | 0x000a0000 | 0x000dffff | Private Memory | Readable, Writable |
|
|
|
|
| locale.nls | 0x000e0000 | 0x00146fff | Memory Mapped File | Readable |
|
|
|
|
| pagefile_0x0000000000150000 | 0x00150000 | 0x001cffff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x00000000001f0000 | 0x001f0000 | 0x002effff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000390000 | 0x00390000 | 0x0039ffff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x00000000003a0000 | 0x003a0000 | 0x00467fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x0000000000470000 | 0x00470000 | 0x00570fff | Pagefile Backed Memory | Readable |
|
|
|
|
| sortdefault.nls | 0x00580000 | 0x0084efff | Memory Mapped File | Readable |
|
|
|
|
| kernelbase.dll.mui | 0x00850000 | 0x0090ffff | Memory Mapped File | Readable, Writable |
|
|
|
|
| reg.exe | 0x00d40000 | 0x00d91fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| kernelbase.dll | 0x75c10000 | 0x75c59fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| kernel32.dll | 0x75d30000 | 0x75e03fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| imm32.dll | 0x75e10000 | 0x75e2efff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| user32.dll | 0x75f70000 | 0x76038fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| rpcrt4.dll | 0x76220000 | 0x762c0fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| ws2_32.dll | 0x77080000 | 0x770b4fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| usp10.dll | 0x771e0000 | 0x7727cfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| gdi32.dll | 0x77280000 | 0x772cdfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| shlwapi.dll | 0x77530000 | 0x77586fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| msvcrt.dll | 0x77590000 | 0x7763bfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| advapi32.dll | 0x77640000 | 0x776dffff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| sechost.dll | 0x776e0000 | 0x776f8fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| ntdll.dll | 0x778a0000 | 0x779dbfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| lpk.dll | 0x779e0000 | 0x779e9fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| nsi.dll | 0x779f0000 | 0x779f5fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| msctf.dll | 0x77a00000 | 0x77acbfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| apisetschema.dll | 0x77ae0000 | 0x77ae0fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| pagefile_0x000000007f6f0000 | 0x7f6f0000 | 0x7f7effff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x000000007ffb0000 | 0x7ffb0000 | 0x7ffd2fff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x000000007ffde000 | 0x7ffde000 | 0x7ffdefff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffdf000 | 0x7ffdf000 | 0x7ffdffff | Private Memory | Readable, Writable |
|
|
|
|
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| OPEN | c:\programdata\qxtqusdnjzrizx418\m.vbs |
|
1 | ||
| OPEN | STD_OUTPUT_HANDLE |
|
2 | ||
| WRITE | STD_OUTPUT_HANDLE | size = 39 |
|
1 |
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| GET_HANDLE | c:\windows\system32\reg.exe | base_address = 0xd40000 |
|
1 |
| Operation | Key | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| CREATE_KEY | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run |
|
1 | ||
| OPEN_KEY | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System |
|
1 | ||
| READ_VALUE | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run | value_name = qxtqusdnjzrizx418 |
|
1 | |
| WRITE_VALUE | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run | value_name = qxtqusdnjzrizx418, type = REG_SZ, data = "C:\ProgramData\qxtqusdnjzrizx418\tasksche.exe" |
|
1 |
| Information | Value |
|---|---|
| ID | #25 |
| File Name | c:\programdata\qxtqusdnjzrizx418\@wanadecryptor@.exe |
| Command Line | "C:\ProgramData\qxtqusdnjzrizx418\@WanaDecryptor@.exe" |
| Initial Working Directory | C:\ProgramData\qxtqusdnjzrizx418 |
| Monitor | Start Time: 00:02:07, Reason: Child Process |
| Unmonitor | End Time: 00:04:59, Reason: Terminated by Timeout |
| Monitor Duration | 00:02:52 |
| Information | Value |
|---|---|
| PID | 0x31c |
| Parent PID | 0x784 (c:\programdata\qxtqusdnjzrizx418\taskse.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | Medium |
| Username | N3EERVTWSM\DSsDPMx042 |
| Groups |
|
| Enabled Privileges | SeChangeNotifyPrivilege |
| Thread IDs |
0x
604
0x
178
0x
788
|
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| CREATE | c:\programdata\qxtqusdnjzrizx418\c.wnry | file_attributes = _O_RDONLY | _O_BINARY |
|
1 | |
| CREATE | c:\programdata\qxtqusdnjzrizx418\00000000.res | file_attributes = _O_RDONLY | _O_BINARY |
|
2 | |
| CREATE | c:\programdata\qxtqusdnjzrizx418\00000000.eky | file_attributes = _O_RDONLY | _O_BINARY |
|
1 | |
| COPY | c:\users\dssdpmx042\desktop\@wanadecryptor@.bmp | source_file_name = c:\programdata\qxtqusdnjzrizx418\b.wnry, fail_if_exists = 0 |
|
1 | |
| READ | c:\programdata\qxtqusdnjzrizx418\c.wnry | size = 780 |
|
1 | |
| READ | c:\programdata\qxtqusdnjzrizx418\00000000.res | size = 136 |
|
2 | |
| READ | c:\programdata\qxtqusdnjzrizx418\00000000.eky | size = 2048 |
|
1 | |
| FIND | msg\m_English.wnry |
|
1 | ||
| FIND | 00000000.dky |
|
1 |
| Operation | Process Name | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| SET_CURDIR | c:\programdata\qxtqusdnjzrizx418\@wanadecryptor@.exe | os_pid = 0x31c, new_path_name = c:\programdata\qxtqusdnjzrizx418 |
|
1 |
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| LOAD | advapi32.dll | base_address = 0x77640000 |
|
1 | |
| LOAD | kernel32.dll | base_address = 0x75d30000 |
|
1 | |
| GET_HANDLE | c:\programdata\qxtqusdnjzrizx418\@wanadecryptor@.exe | base_address = 0x400000 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = CryptAcquireContextA, address = 0x776491dd |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = CryptImportKey, address = 0x7764c532 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = CryptDestroyKey, address = 0x7764c51a |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = CryptEncrypt, address = 0x7766779b |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = CryptDecrypt, address = 0x77683178 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = CryptGenKey, address = 0x77648ee9 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = CreateFileW, address = 0x75d7cc56 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = WriteFile, address = 0x75d81400 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = ReadFile, address = 0x75d796fb |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = MoveFileW, address = 0x75d9548a |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = MoveFileExW, address = 0x75d74a91 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = DeleteFileW, address = 0x75d70f62 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = CloseHandle, address = 0x75d7ca7c |
|
1 |
| Operation | Key | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| CREATE_KEY | HKEY_LOCAL_MACHINE\Software\WanaCrypt0r |
|
1 | ||
| READ_VALUE | HKEY_LOCAL_MACHINE\Software\WanaCrypt0r | value_name = wd, data_ident_out = 67 |
|
1 |
| Operation | Window Name | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| FIND | Wana Decrypt0r 2.0 |
|
1 | ||
| FIND | Wana Decrypt0r 2.0 |
|
14 |
| Operation | Information | Success | Count | Logfile |
|---|---|---|---|---|
| SLEEP | duration = 1000 milliseconds (1.000 seconds) |
|
2 | |
| SLEEP | duration = 30000 milliseconds (30.000 seconds) |
|
1 | |
| SLEEP | duration = 3000 milliseconds (3.000 seconds) |
|
1 |
| Remote Address | Remote Port | L7Protocol | Success | Count |
|---|---|---|---|---|
| 127.0.0.1 | 9050 |
|
3 |
| Information | Value |
|---|---|
| ID | #26 |
| File Name | c:\programdata\qxtqusdnjzrizx418\taskdata\tor\taskhsvc.exe |
| Command Line | TaskData\Tor\taskhsvc.exe |
| Initial Working Directory | C:\ProgramData\qxtqusdnjzrizx418 |
| Monitor | Start Time: 00:02:08, Reason: Child Process |
| Unmonitor | End Time: 00:04:59, Reason: Terminated by Timeout |
| Monitor Duration | 00:02:51 |
| Information | Value |
|---|---|
| PID | 0x814 |
| Parent PID | 0x854 (c:\programdata\qxtqusdnjzrizx418\@wanadecryptor@.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Groups |
|
| Enabled Privileges | SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege |
| Thread IDs |
0x
85C
0x
8DC
0x
3C8
0x
320
0x
640
0x
AA4
|
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| CREATE | C:\Windows\System32\config\systemprofile\AppData\Roaming\tor\lock | file_attributes = _O_RDWR, _O_CREAT, _O_TRUNC |
|
1 | |
| CREATE | C:\Windows\System32\config\systemprofile\AppData\Roaming\tor\state.tmp | file_attributes = _O_WRONLY, _O_CREAT, _O_TRUNC, _O_EXCL |
|
1 | |
| CREATE | C:\Windows\System32\config\systemprofile\AppData\Roaming\tor\router-stability | file_attributes = _O_EXCL |
|
1 | |
| CREATE | c:\windows\system32\config\systemprofile\appdata\roaming\tor\geoip | file_attributes = _O_RDONLY |
|
1 | |
| CREATE | c:\windows\system32\config\systemprofile\appdata\roaming\tor\geoip6 | file_attributes = _O_RDONLY |
|
1 | |
| CREATE | C:\Windows\System32\config\systemprofile\AppData\Roaming\tor\cached-certs | file_attributes = _O_EXCL |
|
1 | |
| CREATE | C:\Windows\System32\config\systemprofile\AppData\Roaming\tor\cached-consensus | file_attributes = _O_EXCL |
|
1 | |
| CREATE | C:\Windows\System32\config\systemprofile\AppData\Roaming\tor\unverified-consensus | file_attributes = _O_EXCL |
|
1 | |
| CREATE | C:\Windows\System32\config\systemprofile\AppData\Roaming\tor\cached-microdesc-consensus | file_attributes = _O_EXCL |
|
1 | |
| CREATE | C:\Windows\System32\config\systemprofile\AppData\Roaming\tor\unverified-microdesc-consensus | file_attributes = _O_EXCL |
|
1 | |
| CREATE | C:\Windows\System32\config\systemprofile\AppData\Roaming\tor\cached-microdescs.new | file_attributes = _O_EXCL |
|
1 | |
| WRITE | c:\programdata\qxtqusdnjzrizx418\m.vbs | size = 146 |
|
2 | |
| WRITE | c:\programdata\qxtqusdnjzrizx418\m.vbs | size = 157 |
|
1 | |
| WRITE | c:\programdata\qxtqusdnjzrizx418\m.vbs | size = 70 |
|
1 | |
| WRITE | C:\Windows\System32\config\systemprofile\AppData\Roaming\tor\state.tmp | size = 216 |
|
1 | |
| WRITE | c:\programdata\qxtqusdnjzrizx418\m.vbs | size = 55 |
|
1 | |
| WRITE | c:\programdata\qxtqusdnjzrizx418\m.vbs | size = 77 |
|
1 | |
| WRITE | c:\programdata\qxtqusdnjzrizx418\m.vbs | size = 100 |
|
9 | |
| WRITE | c:\programdata\qxtqusdnjzrizx418\m.vbs | size = 246 |
|
1 | |
| WRITE | c:\programdata\qxtqusdnjzrizx418\m.vbs | size = 54 |
|
1 |
| Operation | Process Name | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| ENUMERATE |
|
3 |
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| LOAD | ADVAPI32.DLL | base_address = 0x77640000 |
|
2 | |
| LOAD | KERNEL32.DLL | base_address = 0x75d30000 |
|
2 | |
| LOAD | NETAPI32.DLL | base_address = 0x742d0000 |
|
2 | |
| LOAD | C:\Windows\system32\kernel32.dll | base_address = 0x75d30000 |
|
1 | |
| GET_HANDLE | c:\windows\system32\kernel32.dll | base_address = 0x75d30000 |
|
1 | |
| GET_HANDLE | c:\programdata\qxtqusdnjzrizx418\taskdata\tor\taskhsvc.exe | base_address = 0xe40000 |
|
1 | |
| ENUMERATE |
|
3 | |||
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = SetProcessDEPPolicy, address = 0x75d6602f |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\netapi32.dll | function = NetStatisticsGet, address = 0x742d644f |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\netapi32.dll | function = NetApiBufferFree, address = 0x742c13d2 |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = CryptAcquireContextW, address = 0x7764df14 |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = CryptGenRandom, address = 0x7764dfc8 |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = CryptReleaseContext, address = 0x7764e124 |
|
2 | |
| GET_PROC_ADDRESS | c:\programdata\qxtqusdnjzrizx418\taskdata\tor\taskhsvc.exe | function = _OPENSSL_isservice, address = 0x0 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = CreateToolhelp32Snapshot, address = 0x75d6f731 |
|
3 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = CloseToolhelp32Snapshot, address = 0x0 |
|
3 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = Heap32First, address = 0x75dc0429 |
|
3 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = Heap32Next, address = 0x75dc0614 |
|
3 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = Heap32ListFirst, address = 0x75dc02e7 |
|
3 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = Heap32ListNext, address = 0x75dc0391 |
|
3 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = Process32First, address = 0x75d9443d |
|
3 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = Process32Next, address = 0x75d94505 |
|
3 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = Thread32First, address = 0x75d97e4c |
|
3 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = Thread32Next, address = 0x75d97edc |
|
3 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = Module32First, address = 0x75dc0859 |
|
3 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = Module32Next, address = 0x75dc0942 |
|
3 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = GetTickCount64, address = 0x75d6eb4e |
|
1 |
| Operation | Class | Interface | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|---|
| METHOD | IMalloc | method = Free |
|
1 | ||
| METHOD | IMalloc | method = AddRef |
|
1 |
| Remote Address | Remote Port | L7Protocol | Success | Count |
|---|---|---|---|---|
| 127.0.0.1 | 50909 |
|
10 |
| Local Address | Local Port | Remote Address | Remote Port | Server Port | L7Protocol | Success | Count |
|---|---|---|---|---|---|---|---|
| 127.0.0.1 | 127.0.0.1 | 0 | 0 |
|
7 |
| Local Port | Success | Count |
|---|---|---|
| 0 |
|
2 |
| Information | Value |
|---|---|
| ID | #27 |
| File Name | c:\windows\system32\cmd.exe |
| Command Line | cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet |
| Initial Working Directory | C:\ProgramData\qxtqusdnjzrizx418 |
| Monitor | Start Time: 00:02:10, Reason: Child Process |
| Unmonitor | End Time: 00:03:24, Reason: Terminated |
| Monitor Duration | 00:01:14 |
| Information | Value |
|---|---|
| PID | 0x36c |
| Parent PID | 0x810 (c:\programdata\qxtqusdnjzrizx418\@wanadecryptor@.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Groups |
|
| Enabled Privileges | SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege |
| Thread IDs |
0x
8B8
|
| Name | Start VA | End VA | Type | Permissions | Monitored | Dump | YARA Match | Actions |
|---|---|---|---|---|---|---|---|---|
| private_0x0000000000010000 | 0x00010000 | 0x0002ffff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000010000 | 0x00010000 | 0x0001ffff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000020000 | 0x00020000 | 0x0002ffff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000030000 | 0x00030000 | 0x00033fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x0000000000040000 | 0x00040000 | 0x00040fff | Pagefile Backed Memory | Readable |
|
|
|
|
| locale.nls | 0x00050000 | 0x000b6fff | Memory Mapped File | Readable |
|
|
|
|
| pagefile_0x00000000000c0000 | 0x000c0000 | 0x000c6fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x00000000000d0000 | 0x000d0000 | 0x000d1fff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| private_0x00000000000e0000 | 0x000e0000 | 0x000e0fff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x00000000000f0000 | 0x000f0000 | 0x000f0fff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000120000 | 0x00120000 | 0x0021ffff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000220000 | 0x00220000 | 0x0029ffff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x00000000002a0000 | 0x002a0000 | 0x002affff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x00000000002b0000 | 0x002b0000 | 0x00377fff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x00000000003d0000 | 0x003d0000 | 0x004cffff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x00000000004d0000 | 0x004d0000 | 0x005d0fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x00000000005e0000 | 0x005e0000 | 0x0086afff | Pagefile Backed Memory | Readable |
|
|
|
|
| sortdefault.nls | 0x00870000 | 0x00b3efff | Memory Mapped File | Readable |
|
|
|
|
| cmd.exe | 0x4a090000 | 0x4a0dbfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| winbrand.dll | 0x705f0000 | 0x705f6fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| kernelbase.dll | 0x75c10000 | 0x75c59fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| kernel32.dll | 0x75d30000 | 0x75e03fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| imm32.dll | 0x75e10000 | 0x75e2efff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| user32.dll | 0x75f70000 | 0x76038fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| usp10.dll | 0x771e0000 | 0x7727cfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| gdi32.dll | 0x77280000 | 0x772cdfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| msvcrt.dll | 0x77590000 | 0x7763bfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| ntdll.dll | 0x778a0000 | 0x779dbfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| lpk.dll | 0x779e0000 | 0x779e9fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| msctf.dll | 0x77a00000 | 0x77acbfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| apisetschema.dll | 0x77ae0000 | 0x77ae0fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| pagefile_0x000000007f6f0000 | 0x7f6f0000 | 0x7f7effff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x000000007ffb0000 | 0x7ffb0000 | 0x7ffd2fff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x000000007ffd6000 | 0x7ffd6000 | 0x7ffd6fff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffdf000 | 0x7ffdf000 | 0x7ffdffff | Private Memory | Readable, Writable |
|
|
|
|
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| OPEN | c:\programdata\qxtqusdnjzrizx418\m.vbs |
|
5 | ||
| OPEN | STD_INPUT_HANDLE |
|
3 | ||
| FIND | C:\ProgramData\qxtqusdnjzrizx418 |
|
3 | ||
| FIND | C:\ProgramData |
|
1 |
| Operation | Process Name | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| CREATE | C:\Windows\system32\vssadmin.exe | os_tid = 0x89c, os_pid = 0x8fc, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, current_directory = C:\ProgramData\qxtqusdnjzrizx418, show_window = SW_SHOWNORMAL |
|
1 | |
| CREATE | C:\Windows\System32\Wbem\WMIC.exe | os_tid = 0xb3c, os_pid = 0xb34, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, current_directory = C:\ProgramData\qxtqusdnjzrizx418, show_window = SW_SHOWNORMAL |
|
1 | |
| CREATE | C:\Windows\system32\bcdedit.exe | os_tid = 0xbbc, os_pid = 0xbb0, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, current_directory = C:\ProgramData\qxtqusdnjzrizx418, show_window = SW_SHOWNORMAL |
|
1 | |
| CREATE | C:\Windows\system32\bcdedit.exe | os_tid = 0xbcc, os_pid = 0xb94, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, current_directory = C:\ProgramData\qxtqusdnjzrizx418, show_window = SW_SHOWNORMAL |
|
1 | |
| CREATE | C:\Windows\system32\wbadmin.exe | os_tid = 0xbe4, os_pid = 0xbe0, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, current_directory = C:\ProgramData\qxtqusdnjzrizx418, show_window = SW_SHOWNORMAL |
|
1 | |
| SET_CURDIR | c:\windows\system32\cmd.exe | os_pid = 0x36c, new_path_name = c:\programdata\qxtqusdnjzrizx418 |
|
1 |
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| GET_HANDLE | c:\windows\system32\cmd.exe | base_address = 0x4a090000 |
|
1 | |
| GET_HANDLE | c:\windows\system32\kernel32.dll | base_address = 0x75d30000 |
|
2 | |
| GET_FILENAME | C:\Windows\system32\cmd.exe |
|
1 | ||
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = SetThreadUILanguage, address = 0x75d824c2 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = CopyFileExW, address = 0x75d6ac6c |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = IsDebuggerPresent, address = 0x75d73ea8 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = SetConsoleInputExeNameW, address = 0x75d82732 |
|
1 |
| Operation | Key | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| OPEN_KEY | HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System |
|
1 | ||
| OPEN_KEY | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor |
|
1 | ||
| OPEN_KEY | HKEY_CURRENT_USER\Software\Microsoft\Command Processor |
|
1 | ||
| READ_VALUE | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = DisableUNCCheck, data_ident_out = 216 |
|
1 | |
| READ_VALUE | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = EnableExtensions, data_ident_out = 1 |
|
1 | |
| READ_VALUE | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = DelayedExpansion, data_ident_out = 1 |
|
1 | |
| READ_VALUE | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = DefaultColor, data_ident_out = 0 |
|
1 | |
| READ_VALUE | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = CompletionChar, data_ident_out = 64 |
|
1 | |
| READ_VALUE | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = PathCompletionChar, data_ident_out = 64 |
|
1 | |
| READ_VALUE | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = AutoRun, data_ident_out = 64 |
|
1 | |
| READ_VALUE | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = DisableUNCCheck, data_ident_out = 64 |
|
1 | |
| READ_VALUE | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = EnableExtensions, data_ident_out = 1 |
|
1 | |
| READ_VALUE | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = DelayedExpansion, data_ident_out = 1 |
|
1 | |
| READ_VALUE | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = DefaultColor, data_ident_out = 0 |
|
1 | |
| READ_VALUE | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = CompletionChar, data_ident_out = 9 |
|
1 | |
| READ_VALUE | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = PathCompletionChar, data_ident_out = 9 |
|
1 | |
| READ_VALUE | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = AutoRun, data_ident_out = 9 |
|
1 |
| Information | Value |
|---|---|
| ID | #28 |
| File Name | c:\windows\system32\vssadmin.exe |
| Command Line | vssadmin delete shadows /all /quiet |
| Initial Working Directory | C:\ProgramData\qxtqusdnjzrizx418 |
| Monitor | Start Time: 00:02:13, Reason: Child Process |
| Unmonitor | End Time: 00:03:03, Reason: Terminated |
| Monitor Duration | 00:00:50 |
| Remarks | No high level activity detected in monitored regions |
| Information | Value |
|---|---|
| PID | 0x8fc |
| Parent PID | 0x36c (c:\windows\system32\cmd.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Groups |
|
| Enabled Privileges | SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege |
| Thread IDs |
0x
89C
0x
88C
0x
8F4
0x
8AC
0x
8BC
|
| Name | Start VA | End VA | Type | Permissions | Monitored | Dump | YARA Match | Actions |
|---|---|---|---|---|---|---|---|---|
| private_0x0000000000010000 | 0x00010000 | 0x0002ffff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000010000 | 0x00010000 | 0x0001ffff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000020000 | 0x00020000 | 0x0002ffff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000030000 | 0x00030000 | 0x00033fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x0000000000040000 | 0x00040000 | 0x00040fff | Pagefile Backed Memory | Readable |
|
|
|
|
| locale.nls | 0x00050000 | 0x000b6fff | Memory Mapped File | Readable |
|
|
|
|
| pagefile_0x00000000000c0000 | 0x000c0000 | 0x0013ffff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x0000000000140000 | 0x00140000 | 0x0017ffff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000180000 | 0x00180000 | 0x00247fff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x0000000000250000 | 0x00250000 | 0x0025ffff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000260000 | 0x00260000 | 0x00266fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x0000000000270000 | 0x00270000 | 0x00271fff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| vssadmin.exe.mui | 0x00280000 | 0x0028cfff | Memory Mapped File | Readable, Writable |
|
|
|
|
| private_0x0000000000290000 | 0x00290000 | 0x00290fff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x00000000002a0000 | 0x002a0000 | 0x002a0fff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x00000000002b0000 | 0x002b0000 | 0x002b0fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x00000000002c0000 | 0x002c0000 | 0x002c0fff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x0000000000310000 | 0x00310000 | 0x0040ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000420000 | 0x00420000 | 0x0045ffff | Private Memory | Readable, Writable |
|
|
|
|
| vssadmin.exe | 0x004e0000 | 0x004fefff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| pagefile_0x0000000000500000 | 0x00500000 | 0x00600fff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x0000000000680000 | 0x00680000 | 0x006bffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000720000 | 0x00720000 | 0x0075ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000790000 | 0x00790000 | 0x007cffff | Private Memory | Readable, Writable |
|
|
|
|
| sortdefault.nls | 0x007d0000 | 0x00a9efff | Memory Mapped File | Readable |
|
|
|
|
| vss_ps.dll | 0x6f890000 | 0x6f899fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| vssapi.dll | 0x71200000 | 0x71315fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| vsstrace.dll | 0x717f0000 | 0x717fffff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| atl.dll | 0x73de0000 | 0x73df3fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| rsaenh.dll | 0x75260000 | 0x7529afff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| cryptsp.dll | 0x754c0000 | 0x754d5fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| cryptbase.dll | 0x75940000 | 0x7594bfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| rpcrtremote.dll | 0x759e0000 | 0x759edfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| kernelbase.dll | 0x75c10000 | 0x75c59fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| kernel32.dll | 0x75d30000 | 0x75e03fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| imm32.dll | 0x75e10000 | 0x75e2efff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| user32.dll | 0x75f70000 | 0x76038fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| rpcrt4.dll | 0x76220000 | 0x762c0fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| ole32.dll | 0x762d0000 | 0x7642bfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| clbcatq.dll | 0x770c0000 | 0x77142fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| oleaut32.dll | 0x77150000 | 0x771defff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| usp10.dll | 0x771e0000 | 0x7727cfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| gdi32.dll | 0x77280000 | 0x772cdfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| msvcrt.dll | 0x77590000 | 0x7763bfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| advapi32.dll | 0x77640000 | 0x776dffff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| sechost.dll | 0x776e0000 | 0x776f8fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| ntdll.dll | 0x778a0000 | 0x779dbfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| lpk.dll | 0x779e0000 | 0x779e9fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| msctf.dll | 0x77a00000 | 0x77acbfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| apisetschema.dll | 0x77ae0000 | 0x77ae0fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| pagefile_0x000000007f6f0000 | 0x7f6f0000 | 0x7f7effff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x000000007ffb0000 | 0x7ffb0000 | 0x7ffd2fff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x000000007ffda000 | 0x7ffda000 | 0x7ffdafff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffdb000 | 0x7ffdb000 | 0x7ffdbfff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffdc000 | 0x7ffdc000 | 0x7ffdcfff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffdd000 | 0x7ffdd000 | 0x7ffddfff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffde000 | 0x7ffde000 | 0x7ffdefff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffdf000 | 0x7ffdf000 | 0x7ffdffff | Private Memory | Readable, Writable |
|
|
|
|
| Information | Value |
|---|---|
| ID | #29 |
| File Name | c:\programdata\qxtqusdnjzrizx418\taskdl.exe |
| Command Line | taskdl.exe |
| Initial Working Directory | C:\ProgramData\qxtqusdnjzrizx418 |
| Monitor | Start Time: 00:02:18, Reason: Child Process |
| Unmonitor | End Time: 00:02:20, Reason: Terminated |
| Monitor Duration | 00:00:02 |
| Information | Value |
|---|---|
| PID | 0x150 |
| Parent PID | 0xa00 (c:\programdata\qxtqusdnjzrizx418\tasksche.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Groups |
|
| Enabled Privileges | SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege |
| Thread IDs |
0x
47C
|
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| FIND | C:\Windows\TEMP\*.WNCRYT |
|
1 | ||
| DELETE | c:\windows\temp\hibsys.wncryt |
|
1 |
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| GET_HANDLE | c:\programdata\qxtqusdnjzrizx418\taskdl.exe | base_address = 0x400000 |
|
1 |
| Operation | Information | Success | Count | Logfile |
|---|---|---|---|---|
| SLEEP | duration = 10 milliseconds (0.010 seconds) |
|
1 |
| Information | Value |
|---|---|
| ID | #30 |
| File Name | c:\windows\system32\vssvc.exe |
| Command Line | C:\Windows\system32\vssvc.exe |
| Initial Working Directory | C:\Windows\system32 |
| Monitor | Start Time: 00:02:19, Reason: RPC Server |
| Unmonitor | End Time: 00:04:59, Reason: Terminated by Timeout |
| Monitor Duration | 00:02:40 |
| Remarks | No high level activity detected in monitored regions |
| Information | Value |
|---|---|
| PID | 0x880 |
| Parent PID | 0x1d4 (c:\windows\system32\services.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Groups |
|
| Enabled Privileges | SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeBackupPrivilege, SeRestorePrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege |
| Thread IDs |
0x
868
0x
920
0x
124
0x
660
0x
8D0
0x
214
0x
8E4
0x
964
0x
10C
0x
C60
0x
9B8
|
| Name | Start VA | End VA | Type | Permissions | Monitored | Dump | YARA Match | Actions |
|---|---|---|---|---|---|---|---|---|
| pagefile_0x0000000000010000 | 0x00010000 | 0x0001ffff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000020000 | 0x00020000 | 0x00026fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x0000000000030000 | 0x00030000 | 0x00033fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x0000000000040000 | 0x00040000 | 0x00040fff | Pagefile Backed Memory | Readable |
|
|
|
|
| locale.nls | 0x00050000 | 0x000b6fff | Memory Mapped File | Readable |
|
|
|
|
| pagefile_0x00000000000c0000 | 0x000c0000 | 0x000c1fff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| vssvc.exe.mui | 0x000d0000 | 0x000e0fff | Memory Mapped File | Readable, Writable |
|
|
|
|
| private_0x00000000000f0000 | 0x000f0000 | 0x000f0fff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000100000 | 0x00100000 | 0x00100fff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000110000 | 0x00110000 | 0x00110fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x0000000000120000 | 0x00120000 | 0x00120fff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x0000000000130000 | 0x00130000 | 0x0016ffff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000170000 | 0x00170000 | 0x00237fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x0000000000240000 | 0x00240000 | 0x002bffff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x0000000000340000 | 0x00340000 | 0x0043ffff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000440000 | 0x00440000 | 0x00540fff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x00000000005b0000 | 0x005b0000 | 0x005effff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000610000 | 0x00610000 | 0x0061ffff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000620000 | 0x00620000 | 0x00a12fff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x0000000000a20000 | 0x00a20000 | 0x00b1ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000b50000 | 0x00b50000 | 0x00b8ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000ba0000 | 0x00ba0000 | 0x00bdffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000c30000 | 0x00c30000 | 0x00c6ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000cc0000 | 0x00cc0000 | 0x00cfffff | Private Memory | Readable, Writable |
|
|
|
|
| vssvc.exe | 0x00d60000 | 0x00e5cfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| private_0x0000000000e80000 | 0x00e80000 | 0x00ebffff | Private Memory | Readable, Writable |
|
|
|
|
| sortdefault.nls | 0x00ec0000 | 0x0118efff | Memory Mapped File | Readable |
|
|
|
|
| private_0x00000000011f0000 | 0x011f0000 | 0x012effff | Private Memory | Readable, Writable |
|
|
|
|
| catsrvut.dll | 0x6e9d0000 | 0x6ea4afff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| mfcsubs.dll | 0x6f880000 | 0x6f889fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| vss_ps.dll | 0x6f890000 | 0x6f899fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| fltlib.dll | 0x6f8a0000 | 0x6f8a6fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| virtdisk.dll | 0x70470000 | 0x70477fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| xolehlp.dll | 0x70710000 | 0x7071ffff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| vssapi.dll | 0x71200000 | 0x71315fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| vsstrace.dll | 0x717f0000 | 0x717fffff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| resutils.dll | 0x73ac0000 | 0x73ad3fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| clusapi.dll | 0x73ae0000 | 0x73b1afff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| es.dll | 0x73d60000 | 0x73da6fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| atl.dll | 0x73de0000 | 0x73df3fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| samcli.dll | 0x742a0000 | 0x742aefff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| wkscli.dll | 0x742b0000 | 0x742befff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| netutils.dll | 0x742c0000 | 0x742c8fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| netapi32.dll | 0x742d0000 | 0x742e0fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| propsys.dll | 0x74890000 | 0x74984fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| samlib.dll | 0x74990000 | 0x749a1fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| version.dll | 0x74f40000 | 0x74f48fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| rsaenh.dll | 0x75260000 | 0x7529afff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| cryptsp.dll | 0x754c0000 | 0x754d5fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| authz.dll | 0x75650000 | 0x7566afff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| cryptdll.dll | 0x756d0000 | 0x756e0fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| srvcli.dll | 0x75890000 | 0x758a8fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| cryptbase.dll | 0x75940000 | 0x7594bfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| rpcrtremote.dll | 0x759e0000 | 0x759edfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| cfgmgr32.dll | 0x75b90000 | 0x75bb6fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| devobj.dll | 0x75bc0000 | 0x75bd1fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| kernelbase.dll | 0x75c10000 | 0x75c59fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| kernel32.dll | 0x75d30000 | 0x75e03fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| imm32.dll | 0x75e10000 | 0x75e2efff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| user32.dll | 0x75f70000 | 0x76038fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| rpcrt4.dll | 0x76220000 | 0x762c0fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| ole32.dll | 0x762d0000 | 0x7642bfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| clbcatq.dll | 0x770c0000 | 0x77142fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| oleaut32.dll | 0x77150000 | 0x771defff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| usp10.dll | 0x771e0000 | 0x7727cfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| gdi32.dll | 0x77280000 | 0x772cdfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| shlwapi.dll | 0x77530000 | 0x77586fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| msvcrt.dll | 0x77590000 | 0x7763bfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| advapi32.dll | 0x77640000 | 0x776dffff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| sechost.dll | 0x776e0000 | 0x776f8fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| setupapi.dll | 0x77700000 | 0x7789cfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| ntdll.dll | 0x778a0000 | 0x779dbfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| lpk.dll | 0x779e0000 | 0x779e9fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| msctf.dll | 0x77a00000 | 0x77acbfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| apisetschema.dll | 0x77ae0000 | 0x77ae0fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| pagefile_0x000000007f6f0000 | 0x7f6f0000 | 0x7f7effff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x000000007ffb0000 | 0x7ffb0000 | 0x7ffd2fff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x000000007ffd8000 | 0x7ffd8000 | 0x7ffd8fff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffd9000 | 0x7ffd9000 | 0x7ffd9fff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffda000 | 0x7ffda000 | 0x7ffdafff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffdb000 | 0x7ffdb000 | 0x7ffdbfff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffdc000 | 0x7ffdc000 | 0x7ffdcfff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffdd000 | 0x7ffdd000 | 0x7ffddfff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffde000 | 0x7ffde000 | 0x7ffdefff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffdf000 | 0x7ffdf000 | 0x7ffdffff | Private Memory | Readable, Writable |
|
|
|
|
| Information | Value |
|---|---|
| ID | #31 |
| File Name | c:\programdata\qxtqusdnjzrizx418\taskse.exe |
| Command Line | taskse.exe C:\ProgramData\qxtqusdnjzrizx418\@WanaDecryptor@.exe |
| Initial Working Directory | C:\ProgramData\qxtqusdnjzrizx418 |
| Monitor | Start Time: 00:02:20, Reason: Child Process |
| Unmonitor | End Time: 00:02:24, Reason: Terminated |
| Monitor Duration | 00:00:04 |
| Information | Value |
|---|---|
| PID | 0x92c |
| Parent PID | 0xa00 (c:\programdata\qxtqusdnjzrizx418\tasksche.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Groups |
|
| Enabled Privileges | SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege |
| Thread IDs |
0x
930
0x
8EC
|
| Operation | Process Name | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| CREATE | C:\ProgramData\qxtqusdnjzrizx418\@WanaDecryptor@.exe | os_tid = 0x8c8, os_pid = 0x8cc, creation_flags = CREATE_UNICODE_ENVIRONMENT, show_window = SW_SHOW |
|
1 | |
| OPEN_TOKEN | c:\programdata\qxtqusdnjzrizx418\tasksche.exe | os_pid = 0xa00, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITE, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITE |
|
2 |
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| LOAD | Wtsapi32.dll | base_address = 0x743d0000 |
|
1 | |
| LOAD | userenv.dll | base_address = 0x750a0000 |
|
1 | |
| GET_HANDLE | c:\programdata\qxtqusdnjzrizx418\taskse.exe | base_address = 0x400000 |
|
1 | |
| GET_HANDLE | c:\windows\system32\advapi32.dll | base_address = 0x77640000 |
|
2 | |
| GET_HANDLE | c:\windows\system32\kernel32.dll | base_address = 0x75d30000 |
|
2 | |
| GET_HANDLE | userenv.dll | base_address = 0x0 |
|
1 | |
| GET_HANDLE | c:\windows\system32\wtsapi32.dll | base_address = 0x743d0000 |
|
2 | |
| GET_HANDLE | c:\windows\system32\userenv.dll | base_address = 0x750a0000 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\wtsapi32.dll | function = WTSEnumerateSessionsA, address = 0x743d4023 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\wtsapi32.dll | function = WTSFreeMemory, address = 0x743d1b65 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = OpenProcessToken, address = 0x77654304 |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = LookupPrivilegeValueA, address = 0x7765404a |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = AdjustTokenPrivileges, address = 0x7765418e |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = DuplicateTokenEx, address = 0x7764ca24 |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = CreateProcessAsUserA, address = 0x77682538 |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = WTSGetActiveConsoleSessionId, address = 0x75d6480b |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = GetCurrentProcess, address = 0x75d7cdcf |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = CloseHandle, address = 0x75d7ca7c |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\userenv.dll | function = CreateEnvironmentBlock, address = 0x750a1a7a |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\userenv.dll | function = DestroyEnvironmentBlock, address = 0x750a1a4e |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\wtsapi32.dll | function = WTSQueryUserToken, address = 0x743d1f81 |
|
2 |
| Operation | User/Group/Server | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| LOOKUP_PRIVILEGE | Localhost | privilege = SeTcbPrivilege |
|
2 | |
| SET_PRIVILEGE | Localhost | c:\programdata\qxtqusdnjzrizx418\tasksche.exe, os_pid = 0xa00, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITE, disable_all_privileges = 0, privilege = SeTcbPrivilege |
|
2 | |
| SET_PRIVILEGE | Localhost | c:\programdata\qxtqusdnjzrizx418\tasksche.exe, os_pid = 0xa00, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITE, disable_all_privileges = 0, privilege = |
|
2 |
| Operation | Information | Success | Count | Logfile |
|---|---|---|---|---|
| SLEEP | duration = 100 milliseconds (0.100 seconds) |
|
2 |
| Information | Value |
|---|---|
| ID | #32 |
| File Name | c:\programdata\qxtqusdnjzrizx418\@wanadecryptor@.exe |
| Command Line | "C:\ProgramData\qxtqusdnjzrizx418\@WanaDecryptor@.exe" |
| Initial Working Directory | C:\ProgramData\qxtqusdnjzrizx418 |
| Monitor | Start Time: 00:02:22, Reason: Child Process |
| Unmonitor | End Time: 00:02:26, Reason: Terminated |
| Monitor Duration | 00:00:04 |
| Information | Value |
|---|---|
| PID | 0x8cc |
| Parent PID | 0x92c (c:\programdata\qxtqusdnjzrizx418\taskse.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | Medium |
| Username | N3EERVTWSM\DSsDPMx042 |
| Groups |
|
| Enabled Privileges | SeChangeNotifyPrivilege |
| Thread IDs |
0x
8C8
|
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| GET_HANDLE | c:\programdata\qxtqusdnjzrizx418\@wanadecryptor@.exe | base_address = 0x400000 |
|
1 |
| Operation | Window Name | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| FIND | Wana Decrypt0r 2.0 |
|
1 |
| Information | Value |
|---|---|
| ID | #33 |
| File Name | c:\windows\system32\svchost.exe |
| Command Line | C:\Windows\System32\svchost.exe -k swprv |
| Initial Working Directory | C:\Windows\system32 |
| Monitor | Start Time: 00:02:26, Reason: RPC Server |
| Unmonitor | End Time: 00:04:59, Reason: Terminated by Timeout |
| Monitor Duration | 00:02:33 |
| Remarks | No high level activity detected in monitored regions |
| Information | Value |
|---|---|
| PID | 0x8c |
| Parent PID | 0x1d4 (c:\windows\system32\services.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Groups |
|
| Enabled Privileges | SeTcbPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePermanentPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege |
| Thread IDs |
0x
1C0
0x
2C8
0x
2A4
0x
240
0x
23C
0x
8F0
0x
9B4
0x
C0C
0x
280
|
| Name | Start VA | End VA | Type | Permissions | Monitored | Dump | YARA Match | Actions |
|---|---|---|---|---|---|---|---|---|
| pagefile_0x0000000000010000 | 0x00010000 | 0x0001ffff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000020000 | 0x00020000 | 0x00026fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x0000000000030000 | 0x00030000 | 0x00033fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x0000000000040000 | 0x00040000 | 0x00040fff | Pagefile Backed Memory | Readable |
|
|
|
|
| locale.nls | 0x00050000 | 0x000b6fff | Memory Mapped File | Readable |
|
|
|
|
| pagefile_0x00000000000c0000 | 0x000c0000 | 0x0013ffff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x0000000000140000 | 0x00140000 | 0x00141fff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| svchost.exe | 0x00150000 | 0x00157fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| private_0x0000000000160000 | 0x00160000 | 0x00160fff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000170000 | 0x00170000 | 0x00170fff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000180000 | 0x00180000 | 0x00180fff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x0000000000190000 | 0x00190000 | 0x001cffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x00000000001d0000 | 0x001d0000 | 0x0020ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000260000 | 0x00260000 | 0x0026ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x00000000002e0000 | 0x002e0000 | 0x003dffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000400000 | 0x00400000 | 0x0043ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000440000 | 0x00440000 | 0x0047ffff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000480000 | 0x00480000 | 0x00547fff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x0000000000580000 | 0x00580000 | 0x005bffff | Private Memory | Readable, Writable |
|
|
|
|
| sortdefault.nls | 0x005c0000 | 0x0088efff | Memory Mapped File | Readable |
|
|
|
|
| pagefile_0x0000000000890000 | 0x00890000 | 0x00990fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x00000000009a0000 | 0x009a0000 | 0x00d92fff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x0000000000da0000 | 0x00da0000 | 0x00e9ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000f00000 | 0x00f00000 | 0x00f3ffff | Private Memory | Readable, Writable |
|
|
|
|
| swprv.dll | 0x6e980000 | 0x6e9cefff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| vss_ps.dll | 0x6f890000 | 0x6f899fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| fltlib.dll | 0x6f8a0000 | 0x6f8a6fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| virtdisk.dll | 0x70470000 | 0x70477fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| vssapi.dll | 0x71200000 | 0x71315fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| vsstrace.dll | 0x717f0000 | 0x717fffff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| atl.dll | 0x73de0000 | 0x73df3fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| rsaenh.dll | 0x75260000 | 0x7529afff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| cryptsp.dll | 0x754c0000 | 0x754d5fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| cryptbase.dll | 0x75940000 | 0x7594bfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| rpcrtremote.dll | 0x759e0000 | 0x759edfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| kernelbase.dll | 0x75c10000 | 0x75c59fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| kernel32.dll | 0x75d30000 | 0x75e03fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| imm32.dll | 0x75e10000 | 0x75e2efff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| user32.dll | 0x75f70000 | 0x76038fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| rpcrt4.dll | 0x76220000 | 0x762c0fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| ole32.dll | 0x762d0000 | 0x7642bfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| clbcatq.dll | 0x770c0000 | 0x77142fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| oleaut32.dll | 0x77150000 | 0x771defff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| usp10.dll | 0x771e0000 | 0x7727cfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| gdi32.dll | 0x77280000 | 0x772cdfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| msvcrt.dll | 0x77590000 | 0x7763bfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| advapi32.dll | 0x77640000 | 0x776dffff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| sechost.dll | 0x776e0000 | 0x776f8fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| ntdll.dll | 0x778a0000 | 0x779dbfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| lpk.dll | 0x779e0000 | 0x779e9fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| msctf.dll | 0x77a00000 | 0x77acbfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| apisetschema.dll | 0x77ae0000 | 0x77ae0fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| pagefile_0x000000007f6f0000 | 0x7f6f0000 | 0x7f7effff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x000000007ffb0000 | 0x7ffb0000 | 0x7ffd2fff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x000000007ffd4000 | 0x7ffd4000 | 0x7ffd4fff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffda000 | 0x7ffda000 | 0x7ffdafff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffdb000 | 0x7ffdb000 | 0x7ffdbfff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffdc000 | 0x7ffdc000 | 0x7ffdcfff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffdd000 | 0x7ffdd000 | 0x7ffddfff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffde000 | 0x7ffde000 | 0x7ffdefff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffdf000 | 0x7ffdf000 | 0x7ffdffff | Private Memory | Readable, Writable |
|
|
|
|
| Information | Value |
|---|---|
| ID | #34 |
| File Name | c:\programdata\qxtqusdnjzrizx418\taskse.exe |
| Command Line | taskse.exe C:\ProgramData\qxtqusdnjzrizx418\@WanaDecryptor@.exe |
| Initial Working Directory | C:\ProgramData\qxtqusdnjzrizx418 |
| Monitor | Start Time: 00:02:30, Reason: Child Process |
| Unmonitor | End Time: 00:02:34, Reason: Terminated |
| Monitor Duration | 00:00:04 |
| Information | Value |
|---|---|
| PID | 0x704 |
| Parent PID | 0xa00 (c:\programdata\qxtqusdnjzrizx418\tasksche.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Groups |
|
| Enabled Privileges | SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege |
| Thread IDs |
0x
6FC
0x
410
|
| Operation | Process Name | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| CREATE | C:\ProgramData\qxtqusdnjzrizx418\@WanaDecryptor@.exe | os_tid = 0x948, os_pid = 0x9c0, creation_flags = CREATE_UNICODE_ENVIRONMENT, show_window = SW_SHOW |
|
1 | |
| OPEN_TOKEN | c:\programdata\qxtqusdnjzrizx418\tasksche.exe | os_pid = 0xa00, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITE, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITE |
|
2 |
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| LOAD | Wtsapi32.dll | base_address = 0x743d0000 |
|
1 | |
| LOAD | userenv.dll | base_address = 0x750a0000 |
|
1 | |
| GET_HANDLE | c:\programdata\qxtqusdnjzrizx418\taskse.exe | base_address = 0x400000 |
|
1 | |
| GET_HANDLE | c:\windows\system32\advapi32.dll | base_address = 0x77640000 |
|
2 | |
| GET_HANDLE | c:\windows\system32\kernel32.dll | base_address = 0x75d30000 |
|
2 | |
| GET_HANDLE | userenv.dll | base_address = 0x0 |
|
1 | |
| GET_HANDLE | c:\windows\system32\wtsapi32.dll | base_address = 0x743d0000 |
|
2 | |
| GET_HANDLE | c:\windows\system32\userenv.dll | base_address = 0x750a0000 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\wtsapi32.dll | function = WTSEnumerateSessionsA, address = 0x743d4023 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\wtsapi32.dll | function = WTSFreeMemory, address = 0x743d1b65 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = OpenProcessToken, address = 0x77654304 |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = LookupPrivilegeValueA, address = 0x7765404a |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = AdjustTokenPrivileges, address = 0x7765418e |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = DuplicateTokenEx, address = 0x7764ca24 |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = CreateProcessAsUserA, address = 0x77682538 |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = WTSGetActiveConsoleSessionId, address = 0x75d6480b |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = GetCurrentProcess, address = 0x75d7cdcf |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = CloseHandle, address = 0x75d7ca7c |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\userenv.dll | function = CreateEnvironmentBlock, address = 0x750a1a7a |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\userenv.dll | function = DestroyEnvironmentBlock, address = 0x750a1a4e |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\wtsapi32.dll | function = WTSQueryUserToken, address = 0x743d1f81 |
|
2 |
| Operation | User/Group/Server | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| LOOKUP_PRIVILEGE | Localhost | privilege = SeTcbPrivilege |
|
2 | |
| SET_PRIVILEGE | Localhost | c:\programdata\qxtqusdnjzrizx418\tasksche.exe, os_pid = 0xa00, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITE, disable_all_privileges = 0, privilege = SeTcbPrivilege |
|
2 | |
| SET_PRIVILEGE | Localhost | c:\programdata\qxtqusdnjzrizx418\tasksche.exe, os_pid = 0xa00, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITE, disable_all_privileges = 0, privilege = |
|
2 |
| Operation | Information | Success | Count | Logfile |
|---|---|---|---|---|
| SLEEP | duration = 100 milliseconds (0.100 seconds) |
|
2 |
| Information | Value |
|---|---|
| ID | #35 |
| File Name | c:\programdata\qxtqusdnjzrizx418\taskdl.exe |
| Command Line | taskdl.exe |
| Initial Working Directory | C:\ProgramData\qxtqusdnjzrizx418 |
| Monitor | Start Time: 00:02:30, Reason: Child Process |
| Unmonitor | End Time: 00:02:34, Reason: Terminated |
| Monitor Duration | 00:00:04 |
| Information | Value |
|---|---|
| PID | 0x258 |
| Parent PID | 0xa00 (c:\programdata\qxtqusdnjzrizx418\tasksche.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Groups |
|
| Enabled Privileges | SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege |
| Thread IDs |
0x
678
|
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| FIND | C:\Windows\TEMP\*.WNCRYT |
|
1 | ||
| DELETE | c:\windows\temp\0.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\1.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\10.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\11.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\12.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\13.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\14.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\15.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\16.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\17.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\18.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\19.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\2.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\20.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\21.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\22.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\23.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\24.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\25.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\26.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\27.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\28.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\29.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\3.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\30.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\31.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\32.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\33.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\34.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\35.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\36.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\37.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\38.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\39.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\4.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\40.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\41.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\42.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\43.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\44.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\45.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\46.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\47.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\48.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\49.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\5.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\50.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\51.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\52.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\53.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\54.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\55.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\56.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\57.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\58.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\59.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\6.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\60.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\61.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\62.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\63.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\64.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\65.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\7.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\8.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\9.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\hibsys.wncryt |
|
1 |
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| GET_HANDLE | c:\programdata\qxtqusdnjzrizx418\taskdl.exe | base_address = 0x400000 |
|
1 |
| Operation | Information | Success | Count | Logfile |
|---|---|---|---|---|
| SLEEP | duration = 10 milliseconds (0.010 seconds) |
|
1 |
| Information | Value |
|---|---|
| ID | #36 |
| File Name | c:\programdata\qxtqusdnjzrizx418\@wanadecryptor@.exe |
| Command Line | "C:\ProgramData\qxtqusdnjzrizx418\@WanaDecryptor@.exe" |
| Initial Working Directory | C:\ProgramData\qxtqusdnjzrizx418 |
| Monitor | Start Time: 00:02:33, Reason: Child Process |
| Unmonitor | End Time: 00:02:40, Reason: Terminated |
| Monitor Duration | 00:00:07 |
| Information | Value |
|---|---|
| PID | 0x9c0 |
| Parent PID | 0x704 (c:\programdata\qxtqusdnjzrizx418\taskse.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | Medium |
| Username | N3EERVTWSM\DSsDPMx042 |
| Groups |
|
| Enabled Privileges | SeChangeNotifyPrivilege |
| Thread IDs |
0x
948
|
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| GET_HANDLE | c:\programdata\qxtqusdnjzrizx418\@wanadecryptor@.exe | base_address = 0x400000 |
|
1 |
| Operation | Window Name | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| FIND | Wana Decrypt0r 2.0 |
|
1 |
| Information | Value |
|---|---|
| ID | #37 |
| File Name | c:\programdata\qxtqusdnjzrizx418\taskse.exe |
| Command Line | taskse.exe C:\ProgramData\qxtqusdnjzrizx418\@WanaDecryptor@.exe |
| Initial Working Directory | C:\ProgramData\qxtqusdnjzrizx418 |
| Monitor | Start Time: 00:02:40, Reason: Child Process |
| Unmonitor | End Time: 00:02:45, Reason: Terminated |
| Monitor Duration | 00:00:05 |
| Information | Value |
|---|---|
| PID | 0xa40 |
| Parent PID | 0xa00 (c:\programdata\qxtqusdnjzrizx418\tasksche.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Groups |
|
| Enabled Privileges | SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege |
| Thread IDs |
0x
A44
0x
A50
|
| Operation | Process Name | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| CREATE | C:\ProgramData\qxtqusdnjzrizx418\@WanaDecryptor@.exe | os_tid = 0xa7c, os_pid = 0xa68, creation_flags = CREATE_UNICODE_ENVIRONMENT, show_window = SW_SHOW |
|
1 | |
| OPEN_TOKEN | c:\programdata\qxtqusdnjzrizx418\tasksche.exe | os_pid = 0xa00, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITE, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITE |
|
2 |
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| LOAD | Wtsapi32.dll | base_address = 0x743d0000 |
|
1 | |
| LOAD | userenv.dll | base_address = 0x750a0000 |
|
1 | |
| GET_HANDLE | c:\programdata\qxtqusdnjzrizx418\taskse.exe | base_address = 0x400000 |
|
1 | |
| GET_HANDLE | c:\windows\system32\advapi32.dll | base_address = 0x77640000 |
|
2 | |
| GET_HANDLE | c:\windows\system32\kernel32.dll | base_address = 0x75d30000 |
|
2 | |
| GET_HANDLE | userenv.dll | base_address = 0x0 |
|
1 | |
| GET_HANDLE | c:\windows\system32\wtsapi32.dll | base_address = 0x743d0000 |
|
2 | |
| GET_HANDLE | c:\windows\system32\userenv.dll | base_address = 0x750a0000 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\wtsapi32.dll | function = WTSEnumerateSessionsA, address = 0x743d4023 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\wtsapi32.dll | function = WTSFreeMemory, address = 0x743d1b65 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = OpenProcessToken, address = 0x77654304 |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = LookupPrivilegeValueA, address = 0x7765404a |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = AdjustTokenPrivileges, address = 0x7765418e |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = DuplicateTokenEx, address = 0x7764ca24 |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = CreateProcessAsUserA, address = 0x77682538 |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = WTSGetActiveConsoleSessionId, address = 0x75d6480b |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = GetCurrentProcess, address = 0x75d7cdcf |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = CloseHandle, address = 0x75d7ca7c |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\userenv.dll | function = CreateEnvironmentBlock, address = 0x750a1a7a |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\userenv.dll | function = DestroyEnvironmentBlock, address = 0x750a1a4e |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\wtsapi32.dll | function = WTSQueryUserToken, address = 0x743d1f81 |
|
2 |
| Operation | User/Group/Server | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| LOOKUP_PRIVILEGE | Localhost | privilege = SeTcbPrivilege |
|
2 | |
| SET_PRIVILEGE | Localhost | c:\programdata\qxtqusdnjzrizx418\tasksche.exe, os_pid = 0xa00, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITE, disable_all_privileges = 0, privilege = SeTcbPrivilege |
|
2 | |
| SET_PRIVILEGE | Localhost | c:\programdata\qxtqusdnjzrizx418\tasksche.exe, os_pid = 0xa00, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITE, disable_all_privileges = 0, privilege = |
|
2 |
| Operation | Information | Success | Count | Logfile |
|---|---|---|---|---|
| SLEEP | duration = 100 milliseconds (0.100 seconds) |
|
2 |
| Information | Value |
|---|---|
| ID | #38 |
| File Name | c:\programdata\qxtqusdnjzrizx418\taskdl.exe |
| Command Line | taskdl.exe |
| Initial Working Directory | C:\ProgramData\qxtqusdnjzrizx418 |
| Monitor | Start Time: 00:02:44, Reason: Child Process |
| Unmonitor | End Time: 00:02:57, Reason: Terminated |
| Monitor Duration | 00:00:13 |
| Information | Value |
|---|---|
| PID | 0xa5c |
| Parent PID | 0xa00 (c:\programdata\qxtqusdnjzrizx418\tasksche.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Groups |
|
| Enabled Privileges | SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege |
| Thread IDs |
0x
A84
|
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| FIND | C:\Windows\TEMP\*.WNCRYT |
|
1 | ||
| DELETE | c:\windows\temp\100.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\101.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\102.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\103.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\104.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\105.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\106.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\107.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\108.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\109.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\110.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\111.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\112.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\150.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\151.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\152.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\153.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\154.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\155.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\156.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\157.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\158.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\159.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\160.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\161.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\162.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\163.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\164.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\171.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\172.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\173.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\209.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\210.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\211.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\212.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\213.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\214.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\215.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\216.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\217.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\218.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\219.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\220.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\221.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\222.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\223.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\224.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\225.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\226.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\228.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\229.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\230.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\231.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\232.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\233.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\234.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\235.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\236.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\237.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\238.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\239.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\240.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\241.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\242.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\243.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\244.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\245.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\246.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\247.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\248.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\249.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\250.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\251.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\252.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\253.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\254.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\255.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\256.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\257.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\258.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\259.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\260.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\261.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\262.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\263.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\264.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\265.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\266.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\267.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\268.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\314.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\315.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\316.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\317.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\318.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\319.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\320.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\321.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\322.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\323.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\324.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\325.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\326.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\327.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\328.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\329.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\330.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\331.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\332.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\333.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\334.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\335.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\336.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\337.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\338.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\339.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\340.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\341.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\342.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\343.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\344.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\345.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\346.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\347.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\348.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\349.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\350.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\351.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\352.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\353.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\354.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\355.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\356.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\357.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\358.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\359.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\360.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\361.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\362.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\363.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\364.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\365.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\366.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\367.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\368.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\66.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\67.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\68.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\69.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\70.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\71.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\72.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\73.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\74.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\75.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\76.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\77.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\78.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\79.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\80.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\81.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\83.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\84.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\85.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\86.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\87.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\88.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\89.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\90.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\91.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\92.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\93.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\94.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\95.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\96.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\97.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\98.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\99.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\hibsys.wncryt |
|
1 |
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| GET_HANDLE | c:\programdata\qxtqusdnjzrizx418\taskdl.exe | base_address = 0x400000 |
|
1 |
| Operation | Information | Success | Count | Logfile |
|---|---|---|---|---|
| SLEEP | duration = 10 milliseconds (0.010 seconds) |
|
1 |
| Information | Value |
|---|---|
| ID | #39 |
| File Name | c:\programdata\qxtqusdnjzrizx418\@wanadecryptor@.exe |
| Command Line | "C:\ProgramData\qxtqusdnjzrizx418\@WanaDecryptor@.exe" |
| Initial Working Directory | C:\ProgramData\qxtqusdnjzrizx418 |
| Monitor | Start Time: 00:02:45, Reason: Child Process |
| Unmonitor | End Time: 00:02:53, Reason: Terminated |
| Monitor Duration | 00:00:08 |
| Information | Value |
|---|---|
| PID | 0xa68 |
| Parent PID | 0xa40 (c:\programdata\qxtqusdnjzrizx418\taskse.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | Medium |
| Username | N3EERVTWSM\DSsDPMx042 |
| Groups |
|
| Enabled Privileges | SeChangeNotifyPrivilege |
| Thread IDs |
0x
A7C
|
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| GET_HANDLE | c:\programdata\qxtqusdnjzrizx418\@wanadecryptor@.exe | base_address = 0x400000 |
|
1 |
| Operation | Window Name | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| FIND | Wana Decrypt0r 2.0 |
|
1 |
| Information | Value |
|---|---|
| ID | #40 |
| File Name | c:\programdata\qxtqusdnjzrizx418\taskse.exe |
| Command Line | taskse.exe C:\ProgramData\qxtqusdnjzrizx418\@WanaDecryptor@.exe |
| Initial Working Directory | C:\ProgramData\qxtqusdnjzrizx418 |
| Monitor | Start Time: 00:02:51, Reason: Child Process |
| Unmonitor | End Time: 00:02:54, Reason: Terminated |
| Monitor Duration | 00:00:03 |
| Information | Value |
|---|---|
| PID | 0xab4 |
| Parent PID | 0xa00 (c:\programdata\qxtqusdnjzrizx418\tasksche.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Groups |
|
| Enabled Privileges | SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege |
| Thread IDs |
0x
AB8
0x
AC0
|
| Operation | Process Name | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| CREATE | C:\ProgramData\qxtqusdnjzrizx418\@WanaDecryptor@.exe | os_tid = 0xacc, os_pid = 0xac8, creation_flags = CREATE_UNICODE_ENVIRONMENT, show_window = SW_SHOW |
|
1 | |
| OPEN_TOKEN | c:\programdata\qxtqusdnjzrizx418\tasksche.exe | os_pid = 0xa00, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITE, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITE |
|
2 |
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| LOAD | Wtsapi32.dll | base_address = 0x743d0000 |
|
1 | |
| LOAD | userenv.dll | base_address = 0x750a0000 |
|
1 | |
| GET_HANDLE | c:\programdata\qxtqusdnjzrizx418\taskse.exe | base_address = 0x400000 |
|
1 | |
| GET_HANDLE | c:\windows\system32\advapi32.dll | base_address = 0x77640000 |
|
2 | |
| GET_HANDLE | c:\windows\system32\kernel32.dll | base_address = 0x75d30000 |
|
2 | |
| GET_HANDLE | userenv.dll | base_address = 0x0 |
|
1 | |
| GET_HANDLE | c:\windows\system32\wtsapi32.dll | base_address = 0x743d0000 |
|
2 | |
| GET_HANDLE | c:\windows\system32\userenv.dll | base_address = 0x750a0000 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\wtsapi32.dll | function = WTSEnumerateSessionsA, address = 0x743d4023 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\wtsapi32.dll | function = WTSFreeMemory, address = 0x743d1b65 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = OpenProcessToken, address = 0x77654304 |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = LookupPrivilegeValueA, address = 0x7765404a |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = AdjustTokenPrivileges, address = 0x7765418e |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = DuplicateTokenEx, address = 0x7764ca24 |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = CreateProcessAsUserA, address = 0x77682538 |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = WTSGetActiveConsoleSessionId, address = 0x75d6480b |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = GetCurrentProcess, address = 0x75d7cdcf |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = CloseHandle, address = 0x75d7ca7c |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\userenv.dll | function = CreateEnvironmentBlock, address = 0x750a1a7a |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\userenv.dll | function = DestroyEnvironmentBlock, address = 0x750a1a4e |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\wtsapi32.dll | function = WTSQueryUserToken, address = 0x743d1f81 |
|
2 |
| Operation | User/Group/Server | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| LOOKUP_PRIVILEGE | Localhost | privilege = SeTcbPrivilege |
|
2 | |
| SET_PRIVILEGE | Localhost | c:\programdata\qxtqusdnjzrizx418\tasksche.exe, os_pid = 0xa00, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITE, disable_all_privileges = 0, privilege = SeTcbPrivilege |
|
2 | |
| SET_PRIVILEGE | Localhost | c:\programdata\qxtqusdnjzrizx418\tasksche.exe, os_pid = 0xa00, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITE, disable_all_privileges = 0, privilege = |
|
2 |
| Operation | Information | Success | Count | Logfile |
|---|---|---|---|---|
| SLEEP | duration = 100 milliseconds (0.100 seconds) |
|
2 |
| Information | Value |
|---|---|
| ID | #41 |
| File Name | c:\programdata\qxtqusdnjzrizx418\@wanadecryptor@.exe |
| Command Line | "C:\ProgramData\qxtqusdnjzrizx418\@WanaDecryptor@.exe" |
| Initial Working Directory | C:\ProgramData\qxtqusdnjzrizx418 |
| Monitor | Start Time: 00:02:53, Reason: Child Process |
| Unmonitor | End Time: 00:03:00, Reason: Terminated |
| Monitor Duration | 00:00:07 |
| Information | Value |
|---|---|
| PID | 0xac8 |
| Parent PID | 0xab4 (c:\programdata\qxtqusdnjzrizx418\taskse.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | Medium |
| Username | N3EERVTWSM\DSsDPMx042 |
| Groups |
|
| Enabled Privileges | SeChangeNotifyPrivilege |
| Thread IDs |
0x
ACC
|
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| GET_HANDLE | c:\programdata\qxtqusdnjzrizx418\@wanadecryptor@.exe | base_address = 0x400000 |
|
1 |
| Operation | Window Name | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| FIND | Wana Decrypt0r 2.0 |
|
1 |
| Information | Value |
|---|---|
| ID | #42 |
| File Name | c:\programdata\qxtqusdnjzrizx418\taskse.exe |
| Command Line | taskse.exe C:\ProgramData\qxtqusdnjzrizx418\@WanaDecryptor@.exe |
| Initial Working Directory | C:\ProgramData\qxtqusdnjzrizx418 |
| Monitor | Start Time: 00:03:01, Reason: Child Process |
| Unmonitor | End Time: 00:03:04, Reason: Terminated |
| Monitor Duration | 00:00:03 |
| Information | Value |
|---|---|
| PID | 0xb1c |
| Parent PID | 0xa00 (c:\programdata\qxtqusdnjzrizx418\tasksche.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Groups |
|
| Enabled Privileges | SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege |
| Thread IDs |
0x
B20
0x
B24
|
| Operation | Process Name | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| CREATE | C:\ProgramData\qxtqusdnjzrizx418\@WanaDecryptor@.exe | os_tid = 0xb30, os_pid = 0xb2c, creation_flags = CREATE_UNICODE_ENVIRONMENT, show_window = SW_SHOW |
|
1 | |
| OPEN_TOKEN | c:\programdata\qxtqusdnjzrizx418\tasksche.exe | os_pid = 0xa00, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITE, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITE |
|
2 |
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| LOAD | Wtsapi32.dll | base_address = 0x743d0000 |
|
1 | |
| LOAD | userenv.dll | base_address = 0x750a0000 |
|
1 | |
| GET_HANDLE | c:\programdata\qxtqusdnjzrizx418\taskse.exe | base_address = 0x400000 |
|
1 | |
| GET_HANDLE | c:\windows\system32\advapi32.dll | base_address = 0x77640000 |
|
2 | |
| GET_HANDLE | c:\windows\system32\kernel32.dll | base_address = 0x75d30000 |
|
2 | |
| GET_HANDLE | userenv.dll | base_address = 0x0 |
|
1 | |
| GET_HANDLE | c:\windows\system32\wtsapi32.dll | base_address = 0x743d0000 |
|
2 | |
| GET_HANDLE | c:\windows\system32\userenv.dll | base_address = 0x750a0000 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\wtsapi32.dll | function = WTSEnumerateSessionsA, address = 0x743d4023 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\wtsapi32.dll | function = WTSFreeMemory, address = 0x743d1b65 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = OpenProcessToken, address = 0x77654304 |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = LookupPrivilegeValueA, address = 0x7765404a |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = AdjustTokenPrivileges, address = 0x7765418e |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = DuplicateTokenEx, address = 0x7764ca24 |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = CreateProcessAsUserA, address = 0x77682538 |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = WTSGetActiveConsoleSessionId, address = 0x75d6480b |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = GetCurrentProcess, address = 0x75d7cdcf |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = CloseHandle, address = 0x75d7ca7c |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\userenv.dll | function = CreateEnvironmentBlock, address = 0x750a1a7a |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\userenv.dll | function = DestroyEnvironmentBlock, address = 0x750a1a4e |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\wtsapi32.dll | function = WTSQueryUserToken, address = 0x743d1f81 |
|
2 |
| Operation | User/Group/Server | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| LOOKUP_PRIVILEGE | Localhost | privilege = SeTcbPrivilege |
|
2 | |
| SET_PRIVILEGE | Localhost | c:\programdata\qxtqusdnjzrizx418\tasksche.exe, os_pid = 0xa00, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITE, disable_all_privileges = 0, privilege = SeTcbPrivilege |
|
2 | |
| SET_PRIVILEGE | Localhost | c:\programdata\qxtqusdnjzrizx418\tasksche.exe, os_pid = 0xa00, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITE, disable_all_privileges = 0, privilege = |
|
2 |
| Operation | Information | Success | Count | Logfile |
|---|---|---|---|---|
| SLEEP | duration = 100 milliseconds (0.100 seconds) |
|
2 |
| Information | Value |
|---|---|
| ID | #43 |
| File Name | c:\programdata\qxtqusdnjzrizx418\@wanadecryptor@.exe |
| Command Line | "C:\ProgramData\qxtqusdnjzrizx418\@WanaDecryptor@.exe" |
| Initial Working Directory | C:\ProgramData\qxtqusdnjzrizx418 |
| Monitor | Start Time: 00:03:02, Reason: Child Process |
| Unmonitor | End Time: 00:03:05, Reason: Terminated |
| Monitor Duration | 00:00:03 |
| Information | Value |
|---|---|
| PID | 0xb2c |
| Parent PID | 0xb1c (c:\programdata\qxtqusdnjzrizx418\taskse.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | Medium |
| Username | N3EERVTWSM\DSsDPMx042 |
| Groups |
|
| Enabled Privileges | SeChangeNotifyPrivilege |
| Thread IDs |
0x
B30
|
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| GET_HANDLE | c:\programdata\qxtqusdnjzrizx418\@wanadecryptor@.exe | base_address = 0x400000 |
|
1 |
| Operation | Window Name | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| FIND | Wana Decrypt0r 2.0 |
|
1 |
| Information | Value |
|---|---|
| ID | #44 |
| File Name | c:\windows\system32\wbem\wmic.exe |
| Command Line | wmic shadowcopy delete |
| Initial Working Directory | C:\ProgramData\qxtqusdnjzrizx418 |
| Monitor | Start Time: 00:03:02, Reason: Child Process |
| Unmonitor | End Time: 00:03:16, Reason: Terminated |
| Monitor Duration | 00:00:14 |
| Remarks | No high level activity detected in monitored regions |
| Information | Value |
|---|---|
| PID | 0xb34 |
| Parent PID | 0x36c (c:\windows\system32\cmd.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Groups |
|
| Enabled Privileges | SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege |
| Thread IDs |
0x
B3C
0x
B44
0x
B54
0x
B58
0x
B98
|
| Information | Value |
|---|---|
| ID | #45 |
| File Name | c:\programdata\qxtqusdnjzrizx418\taskdl.exe |
| Command Line | taskdl.exe |
| Initial Working Directory | C:\ProgramData\qxtqusdnjzrizx418 |
| Monitor | Start Time: 00:03:06, Reason: Child Process |
| Unmonitor | End Time: 00:03:08, Reason: Terminated |
| Monitor Duration | 00:00:02 |
| Information | Value |
|---|---|
| PID | 0xb4c |
| Parent PID | 0xa00 (c:\programdata\qxtqusdnjzrizx418\tasksche.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Groups |
|
| Enabled Privileges | SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege |
| Thread IDs |
0x
B50
|
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| FIND | C:\Windows\TEMP\*.WNCRYT |
|
1 | ||
| DELETE | c:\windows\temp\164.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\209.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\214.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\215.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\216.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\235.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\369.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\370.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\371.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\372.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\373.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\374.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\375.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\376.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\377.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\378.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\379.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\380.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\381.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\382.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\383.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\384.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\385.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\386.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\387.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\388.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\389.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\390.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\391.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\392.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\393.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\394.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\395.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\396.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\397.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\398.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\399.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\400.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\401.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\402.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\403.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\404.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\405.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\406.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\407.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\408.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\409.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\410.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\411.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\412.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\413.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\414.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\415.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\416.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\417.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\hibsys.wncryt |
|
1 |
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| GET_HANDLE | c:\programdata\qxtqusdnjzrizx418\taskdl.exe | base_address = 0x400000 |
|
1 |
| Operation | Information | Success | Count | Logfile |
|---|---|---|---|---|
| SLEEP | duration = 10 milliseconds (0.010 seconds) |
|
1 |
| Information | Value |
|---|---|
| ID | #46 |
| File Name | c:\windows\system32\svchost.exe |
| Command Line | C:\Windows\system32\svchost.exe -k netsvcs |
| Initial Working Directory | C:\Windows\system32 |
| Monitor | Start Time: 00:03:09, Reason: RPC Server |
| Unmonitor | End Time: 00:04:59, Reason: Terminated by Timeout |
| Monitor Duration | 00:01:50 |
| Remarks | No high level activity detected in monitored regions |
| Information | Value |
|---|---|
| PID | 0x364 |
| Parent PID | 0x1d4 (c:\windows\system32\services.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Groups |
|
| Enabled Privileges | SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege |
| Thread IDs |
0x
B60
0x
AD8
0x
AFC
0x
AF8
0x
AF4
0x
AF0
0x
AE4
0x
AE0
0x
A6C
0x
A54
0x
9CC
0x
9C4
0x
244
0x
3A8
0x
8B0
0x
7FC
0x
960
0x
698
0x
148
0x
4A0
0x
914
0x
91C
0x
F38
0x
F34
0x
F30
0x
F18
0x
4B4
0x
454
0x
75C
0x
720
0x
71C
0x
6F4
0x
6F0
0x
6E4
0x
6D0
0x
550
0x
524
0x
51C
0x
508
0x
4F4
0x
4C4
0x
3E8
0x
3DC
0x
390
0x
384
0x
380
0x
37C
0x
370
0x
368
0x
E08
0x
BB4
0x
E7C
0x
ED0
0x
C38
0x
FD0
0x
FD8
0x
4C8
0x
E08
|
| Name | Start VA | End VA | Type | Permissions | Monitored | Dump | YARA Match | Actions |
|---|---|---|---|---|---|---|---|---|
| pagefile_0x0000000000010000 | 0x00010000 | 0x0001ffff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000020000 | 0x00020000 | 0x00026fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x0000000000030000 | 0x00030000 | 0x00033fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x0000000000040000 | 0x00040000 | 0x00040fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x0000000000050000 | 0x00050000 | 0x00051fff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000060000 | 0x00060000 | 0x0009ffff | Private Memory | Readable, Writable |
|
|
|
|
| locale.nls | 0x000a0000 | 0x00106fff | Memory Mapped File | Readable |
|
|
|
|
| private_0x0000000000110000 | 0x00110000 | 0x00110fff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000120000 | 0x00120000 | 0x00120fff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000130000 | 0x00130000 | 0x00130fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x0000000000140000 | 0x00140000 | 0x00140fff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| svchost.exe | 0x00150000 | 0x00157fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| pagefile_0x0000000000160000 | 0x00160000 | 0x00227fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x0000000000230000 | 0x00230000 | 0x00230fff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x0000000000240000 | 0x00240000 | 0x00240fff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000250000 | 0x00250000 | 0x00251fff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x0000000000260000 | 0x00260000 | 0x0035ffff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000360000 | 0x00360000 | 0x00460fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x0000000000470000 | 0x00470000 | 0x004effff | Pagefile Backed Memory | Readable |
|
|
|
|
| cversions.2.db | 0x004f0000 | 0x004f3fff | Memory Mapped File | Readable |
|
|
|
|
| pagefile_0x0000000000500000 | 0x00500000 | 0x00501fff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x0000000000510000 | 0x00510000 | 0x0051ffff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000520000 | 0x00520000 | 0x00912fff | Pagefile Backed Memory | Readable |
|
|
|
|
| cversions.2.db | 0x00920000 | 0x00923fff | Memory Mapped File | Readable |
|
|
|
|
| private_0x0000000000930000 | 0x00930000 | 0x0096ffff | Private Memory | Readable, Writable |
|
|
|
|
| {6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000007.db | 0x00970000 | 0x0099ffff | Memory Mapped File | Readable |
|
|
|
|
| pagefile_0x00000000009a0000 | 0x009a0000 | 0x009a0fff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| nci.dll.mui | 0x009b0000 | 0x009b0fff | Memory Mapped File | Readable, Writable |
|
|
|
|
| pagefile_0x00000000009c0000 | 0x009c0000 | 0x009c0fff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x00000000009d0000 | 0x009d0000 | 0x00a0ffff | Private Memory | Readable, Writable |
|
|
|
|
| firewallapi.dll.mui | 0x00a10000 | 0x00a2bfff | Memory Mapped File | Readable, Writable |
|
|
|
|
| private_0x0000000000a30000 | 0x00a30000 | 0x00a6ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000a70000 | 0x00a70000 | 0x00a70fff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000ac0000 | 0x00ac0000 | 0x00acffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000ad0000 | 0x00ad0000 | 0x00b0ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000b20000 | 0x00b20000 | 0x00b5ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000b90000 | 0x00b90000 | 0x00bcffff | Private Memory | Readable, Writable |
|
|
|
|
| sortdefault.nls | 0x00bd0000 | 0x00e9efff | Memory Mapped File | Readable |
|
|
|
|
| private_0x0000000000ed0000 | 0x00ed0000 | 0x00f0ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000f20000 | 0x00f20000 | 0x00f5ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000f60000 | 0x00f60000 | 0x0105ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000001060000 | 0x01060000 | 0x0109ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x00000000010b0000 | 0x010b0000 | 0x010effff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000001100000 | 0x01100000 | 0x0110ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000001120000 | 0x01120000 | 0x0115ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x00000000011b0000 | 0x011b0000 | 0x011effff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000001210000 | 0x01210000 | 0x0124ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000001250000 | 0x01250000 | 0x0128ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x00000000012c0000 | 0x012c0000 | 0x012fffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000001320000 | 0x01320000 | 0x0135ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000001370000 | 0x01370000 | 0x013affff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x00000000013e0000 | 0x013e0000 | 0x0141ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000001420000 | 0x01420000 | 0x0145ffff | Private Memory | Readable, Writable |
|
|
|
|
| {ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db | 0x01460000 | 0x014c5fff | Memory Mapped File | Readable |
|
|
|
|
| private_0x00000000014d0000 | 0x014d0000 | 0x0150ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000001530000 | 0x01530000 | 0x0156ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000001580000 | 0x01580000 | 0x015bffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x00000000015c0000 | 0x015c0000 | 0x0163ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000001660000 | 0x01660000 | 0x0169ffff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x00000000016a0000 | 0x016a0000 | 0x0192afff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x0000000001930000 | 0x01930000 | 0x01a2ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000001a50000 | 0x01a50000 | 0x01a8ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000001ac0000 | 0x01ac0000 | 0x01afffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000001b00000 | 0x01b00000 | 0x01b3ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000001b60000 | 0x01b60000 | 0x01b9ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000001bd0000 | 0x01bd0000 | 0x01bdffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000001be0000 | 0x01be0000 | 0x01c1ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000001c20000 | 0x01c20000 | 0x01c5ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000001c70000 | 0x01c70000 | 0x01caffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000001ce0000 | 0x01ce0000 | 0x01d1ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000001d30000 | 0x01d30000 | 0x01d6ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000001d90000 | 0x01d90000 | 0x01dcffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000001dd0000 | 0x01dd0000 | 0x01e0ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000001e10000 | 0x01e10000 | 0x01e4ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000001e60000 | 0x01e60000 | 0x01e9ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000001eb0000 | 0x01eb0000 | 0x01eeffff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000001ef0000 | 0x01ef0000 | 0x01feffff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| private_0x0000000001ff0000 | 0x01ff0000 | 0x0202ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000002060000 | 0x02060000 | 0x0206ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000002070000 | 0x02070000 | 0x020affff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x00000000020c0000 | 0x020c0000 | 0x020fffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000002120000 | 0x02120000 | 0x0215ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000002180000 | 0x02180000 | 0x021bffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x00000000021c0000 | 0x021c0000 | 0x021fffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000002200000 | 0x02200000 | 0x0223ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000002270000 | 0x02270000 | 0x022affff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000002320000 | 0x02320000 | 0x0232ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000002330000 | 0x02330000 | 0x0242ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000002450000 | 0x02450000 | 0x0248ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x00000000024a0000 | 0x024a0000 | 0x024dffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x00000000024f0000 | 0x024f0000 | 0x0252ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000002530000 | 0x02530000 | 0x0256ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000002570000 | 0x02570000 | 0x025affff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x00000000025d0000 | 0x025d0000 | 0x0260ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000002640000 | 0x02640000 | 0x0267ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x00000000026a0000 | 0x026a0000 | 0x026dffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x00000000026e0000 | 0x026e0000 | 0x027dffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x00000000027e0000 | 0x027e0000 | 0x0281ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000002830000 | 0x02830000 | 0x0286ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000002890000 | 0x02890000 | 0x028cffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000002930000 | 0x02930000 | 0x0296ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000002970000 | 0x02970000 | 0x02a2ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000002a60000 | 0x02a60000 | 0x02b5ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000002b60000 | 0x02b60000 | 0x02d5ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000002dd0000 | 0x02dd0000 | 0x02e0ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000002e70000 | 0x02e70000 | 0x02eaffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000002ec0000 | 0x02ec0000 | 0x030bffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000003140000 | 0x03140000 | 0x0317ffff | Private Memory | Readable, Writable |
|
|
|
|
| wuaueng.dll | 0x6e460000 | 0x6e635fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| esent.dll | 0x6f4b0000 | 0x6f652fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| mspatcha.dll | 0x6f6b0000 | 0x6f6bbfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| ncprov.dll | 0x70840000 | 0x7084ffff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| wbemcomn.dll | 0x70ed0000 | 0x70f2bfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| wmisvc.dll | 0x70f30000 | 0x70f5afff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| webio.dll | 0x710d0000 | 0x7111efff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| winhttp.dll | 0x71120000 | 0x71177fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| vssapi.dll | 0x71200000 | 0x71315fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| cabinet.dll | 0x717d0000 | 0x717e4fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| vsstrace.dll | 0x717f0000 | 0x717fffff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| tschannel.dll | 0x71800000 | 0x71807fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| actxprxy.dll | 0x71f20000 | 0x71f6dfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| taskcomp.dll | 0x71ff0000 | 0x7203cfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| ktmw32.dll | 0x72350000 | 0x72358fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| schedsvc.dll | 0x72360000 | 0x72419fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| wiarpc.dll | 0x726a0000 | 0x726aafff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| fvecerts.dll | 0x726b0000 | 0x726b7fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| tbs.dll | 0x726c0000 | 0x726c6fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| fveapi.dll | 0x726d0000 | 0x72712fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| shsvcs.dll | 0x72720000 | 0x72771fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| dhcpcsvc.dll | 0x727a0000 | 0x727b1fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| dhcpcsvc6.dll | 0x727c0000 | 0x727ccfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| fwpuclnt.dll | 0x727f0000 | 0x72827fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| spfileq.dll | 0x730a0000 | 0x730b5fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| tcpipcfg.dll | 0x73160000 | 0x7318ffff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| mprapi.dll | 0x73190000 | 0x731b8fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| winspool.drv | 0x731c0000 | 0x73210fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| appinfo.dll | 0x73420000 | 0x7342efff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| npmproxy.dll | 0x73660000 | 0x73667fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| rasadhlp.dll | 0x73750000 | 0x73755fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| wbemess.dll | 0x73770000 | 0x737c5fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| ncobjapi.dll | 0x737d0000 | 0x737defff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| wmiprvsd.dll | 0x737e0000 | 0x73860fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| repdrvfs.dll | 0x73870000 | 0x738bbfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| wmiutils.dll | 0x738c0000 | 0x738d6fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| netprofm.dll | 0x738e0000 | 0x73939fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| hnetcfg.dll | 0x73940000 | 0x73989fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| wbemsvc.dll | 0x73990000 | 0x7399efff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| esscli.dll | 0x739a0000 | 0x739e3fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| wbemcore.dll | 0x739f0000 | 0x73ab1fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| resutils.dll | 0x73ac0000 | 0x73ad3fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
|
For performance reasons, the remaining 161 entries are omitted.
The remaining entries can be found in flog.txt. |
||||||||
| Information | Value |
|---|---|
| ID | #47 |
| File Name | c:\windows\system32\wbem\wmiprvse.exe |
| Command Line | C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding |
| Initial Working Directory | C:\Windows\system32 |
| Monitor | Start Time: 00:03:15, Reason: RPC Server |
| Unmonitor | End Time: 00:04:23, Reason: Terminated |
| Monitor Duration | 00:01:08 |
| Remarks | No high level activity detected in monitored regions |
| Information | Value |
|---|---|
| PID | 0xbc4 |
| Parent PID | 0x24c (c:\windows\system32\svchost.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\Network Service |
| Groups |
|
| Enabled Privileges | SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege |
| Thread IDs |
0x
BA0
0x
B8C
0x
B88
0x
B80
0x
B78
0x
B70
0x
B6C
0x
C04
|
| Name | Start VA | End VA | Type | Permissions | Monitored | Dump | YARA Match | Actions |
|---|---|---|---|---|---|---|---|---|
| pagefile_0x0000000000010000 | 0x00010000 | 0x0001ffff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000020000 | 0x00020000 | 0x00020fff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000030000 | 0x00030000 | 0x00033fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x0000000000040000 | 0x00040000 | 0x00040fff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x0000000000050000 | 0x00050000 | 0x00050fff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000060000 | 0x00060000 | 0x00066fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x0000000000070000 | 0x00070000 | 0x00071fff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000080000 | 0x00080000 | 0x000bffff | Private Memory | Readable, Writable |
|
|
|
|
| locale.nls | 0x000c0000 | 0x00126fff | Memory Mapped File | Readable |
|
|
|
|
| pagefile_0x0000000000130000 | 0x00130000 | 0x00130fff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000140000 | 0x00140000 | 0x00140fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x0000000000150000 | 0x00150000 | 0x00150fff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x0000000000160000 | 0x00160000 | 0x0016ffff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000170000 | 0x00170000 | 0x00237fff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x0000000000270000 | 0x00270000 | 0x0036ffff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000370000 | 0x00370000 | 0x00470fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x0000000000480000 | 0x00480000 | 0x004fffff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x0000000000500000 | 0x00500000 | 0x0057ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x00000000005e0000 | 0x005e0000 | 0x0061ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000640000 | 0x00640000 | 0x0067ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x00000000006c0000 | 0x006c0000 | 0x006fffff | Private Memory | Readable, Writable |
|
|
|
|
| sortdefault.nls | 0x00700000 | 0x009cefff | Memory Mapped File | Readable |
|
|
|
|
| private_0x0000000000a40000 | 0x00a40000 | 0x00a7ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000ab0000 | 0x00ab0000 | 0x00aeffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000b10000 | 0x00b10000 | 0x00b4ffff | Private Memory | Readable, Writable |
|
|
|
|
| wmiprvse.exe | 0x00b60000 | 0x00ba0fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| pagefile_0x0000000000bb0000 | 0x00bb0000 | 0x00fa2fff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x0000000000fb0000 | 0x00fb0000 | 0x010affff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x00000000010c0000 | 0x010c0000 | 0x010fffff | Private Memory | Readable, Writable |
|
|
|
|
| vsswmi.dll | 0x6ead0000 | 0x6eaeffff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| framedynos.dll | 0x70600000 | 0x70634fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| wbemcomn.dll | 0x70ed0000 | 0x70f2bfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| vssapi.dll | 0x71200000 | 0x71315fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| vsstrace.dll | 0x717f0000 | 0x717fffff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| ncobjapi.dll | 0x737d0000 | 0x737defff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| wmiutils.dll | 0x738c0000 | 0x738d6fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| wbemsvc.dll | 0x73990000 | 0x7399efff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| atl.dll | 0x73de0000 | 0x73df3fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| ntmarta.dll | 0x74060000 | 0x74080fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| wbemprox.dll | 0x74180000 | 0x74189fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| fastprox.dll | 0x74190000 | 0x74225fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| ntdsapi.dll | 0x742f0000 | 0x74307fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| wtsapi32.dll | 0x743d0000 | 0x743dcfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| rsaenh.dll | 0x75260000 | 0x7529afff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| cryptsp.dll | 0x754c0000 | 0x754d5fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| sspicli.dll | 0x75920000 | 0x7593afff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| cryptbase.dll | 0x75940000 | 0x7594bfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| rpcrtremote.dll | 0x759e0000 | 0x759edfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| kernelbase.dll | 0x75c10000 | 0x75c59fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| kernel32.dll | 0x75d30000 | 0x75e03fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| imm32.dll | 0x75e10000 | 0x75e2efff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| user32.dll | 0x75f70000 | 0x76038fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| wldap32.dll | 0x761d0000 | 0x76214fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| rpcrt4.dll | 0x76220000 | 0x762c0fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| ole32.dll | 0x762d0000 | 0x7642bfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| ws2_32.dll | 0x77080000 | 0x770b4fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| clbcatq.dll | 0x770c0000 | 0x77142fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| oleaut32.dll | 0x77150000 | 0x771defff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| usp10.dll | 0x771e0000 | 0x7727cfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| gdi32.dll | 0x77280000 | 0x772cdfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| msvcrt.dll | 0x77590000 | 0x7763bfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| advapi32.dll | 0x77640000 | 0x776dffff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| sechost.dll | 0x776e0000 | 0x776f8fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| ntdll.dll | 0x778a0000 | 0x779dbfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| lpk.dll | 0x779e0000 | 0x779e9fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| nsi.dll | 0x779f0000 | 0x779f5fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| msctf.dll | 0x77a00000 | 0x77acbfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| apisetschema.dll | 0x77ae0000 | 0x77ae0fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| pagefile_0x000000007f6f0000 | 0x7f6f0000 | 0x7f7effff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x000000007ffb0000 | 0x7ffb0000 | 0x7ffd2fff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x000000007ffd6000 | 0x7ffd6000 | 0x7ffd6fff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffd9000 | 0x7ffd9000 | 0x7ffd9fff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffda000 | 0x7ffda000 | 0x7ffdafff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffdb000 | 0x7ffdb000 | 0x7ffdbfff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffdc000 | 0x7ffdc000 | 0x7ffdcfff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffdd000 | 0x7ffdd000 | 0x7ffddfff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffde000 | 0x7ffde000 | 0x7ffdefff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffdf000 | 0x7ffdf000 | 0x7ffdffff | Private Memory | Readable, Writable |
|
|
|
|
| Information | Value |
|---|---|
| ID | #48 |
| File Name | c:\windows\system32\bcdedit.exe |
| Command Line | bcdedit /set {default} bootstatuspolicy ignoreallfailures |
| Initial Working Directory | C:\ProgramData\qxtqusdnjzrizx418 |
| Monitor | Start Time: 00:03:16, Reason: Child Process |
| Unmonitor | End Time: 00:03:16, Reason: Terminated |
| Monitor Duration | 00:00:00 |
| Remarks | No high level activity detected in monitored regions |
| Information | Value |
|---|---|
| PID | 0xbb0 |
| Parent PID | 0x36c (c:\windows\system32\cmd.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Groups |
|
| Enabled Privileges | SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege |
| Thread IDs |
0x
BBC
|
| Name | Start VA | End VA | Type | Permissions | Monitored | Dump | YARA Match | Actions |
|---|---|---|---|---|---|---|---|---|
| private_0x0000000000010000 | 0x00010000 | 0x0002ffff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000010000 | 0x00010000 | 0x0001ffff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000020000 | 0x00020000 | 0x0002ffff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000030000 | 0x00030000 | 0x00033fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x0000000000040000 | 0x00040000 | 0x00040fff | Pagefile Backed Memory | Readable |
|
|
|
|
| locale.nls | 0x00050000 | 0x000b6fff | Memory Mapped File | Readable |
|
|
|
|
| private_0x0000000000160000 | 0x00160000 | 0x0016ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x00000000001e0000 | 0x001e0000 | 0x0021ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x00000000002e0000 | 0x002e0000 | 0x003dffff | Private Memory | Readable, Writable |
|
|
|
|
| bcdedit.exe | 0x00e80000 | 0x00ec9fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| kernelbase.dll | 0x75c10000 | 0x75c59fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| kernel32.dll | 0x75d30000 | 0x75e03fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| rpcrt4.dll | 0x76220000 | 0x762c0fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| msvcrt.dll | 0x77590000 | 0x7763bfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| advapi32.dll | 0x77640000 | 0x776dffff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| sechost.dll | 0x776e0000 | 0x776f8fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| ntdll.dll | 0x778a0000 | 0x779dbfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| apisetschema.dll | 0x77ae0000 | 0x77ae0fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| pagefile_0x000000007f6f0000 | 0x7f6f0000 | 0x7f7effff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x000000007ffb0000 | 0x7ffb0000 | 0x7ffd2fff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x000000007ffd7000 | 0x7ffd7000 | 0x7ffd7fff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffdf000 | 0x7ffdf000 | 0x7ffdffff | Private Memory | Readable, Writable |
|
|
|
|
| Information | Value |
|---|---|
| ID | #49 |
| File Name | c:\windows\system32\bcdedit.exe |
| Command Line | bcdedit /set {default} recoveryenabled no |
| Initial Working Directory | C:\ProgramData\qxtqusdnjzrizx418 |
| Monitor | Start Time: 00:03:16, Reason: Child Process |
| Unmonitor | End Time: 00:03:17, Reason: Terminated |
| Monitor Duration | 00:00:01 |
| Remarks | No high level activity detected in monitored regions |
| Information | Value |
|---|---|
| PID | 0xb94 |
| Parent PID | 0x36c (c:\windows\system32\cmd.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Groups |
|
| Enabled Privileges | SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege |
| Thread IDs |
0x
BCC
|
| Name | Start VA | End VA | Type | Permissions | Monitored | Dump | YARA Match | Actions |
|---|---|---|---|---|---|---|---|---|
| private_0x0000000000010000 | 0x00010000 | 0x0002ffff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000010000 | 0x00010000 | 0x0001ffff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000020000 | 0x00020000 | 0x0002ffff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000030000 | 0x00030000 | 0x00033fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x0000000000040000 | 0x00040000 | 0x00040fff | Pagefile Backed Memory | Readable |
|
|
|
|
| locale.nls | 0x00050000 | 0x000b6fff | Memory Mapped File | Readable |
|
|
|
|
| private_0x00000000000c0000 | 0x000c0000 | 0x001bffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x00000000001d0000 | 0x001d0000 | 0x001dffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x00000000001e0000 | 0x001e0000 | 0x0021ffff | Private Memory | Readable, Writable |
|
|
|
|
| bcdedit.exe | 0x00f40000 | 0x00f89fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| kernelbase.dll | 0x75c10000 | 0x75c59fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| kernel32.dll | 0x75d30000 | 0x75e03fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| rpcrt4.dll | 0x76220000 | 0x762c0fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| msvcrt.dll | 0x77590000 | 0x7763bfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| advapi32.dll | 0x77640000 | 0x776dffff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| sechost.dll | 0x776e0000 | 0x776f8fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| ntdll.dll | 0x778a0000 | 0x779dbfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| apisetschema.dll | 0x77ae0000 | 0x77ae0fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| pagefile_0x000000007f6f0000 | 0x7f6f0000 | 0x7f7effff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x000000007ffb0000 | 0x7ffb0000 | 0x7ffd2fff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x000000007ffd7000 | 0x7ffd7000 | 0x7ffd7fff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffdf000 | 0x7ffdf000 | 0x7ffdffff | Private Memory | Readable, Writable |
|
|
|
|
| Information | Value |
|---|---|
| ID | #50 |
| File Name | c:\programdata\qxtqusdnjzrizx418\taskse.exe |
| Command Line | taskse.exe C:\ProgramData\qxtqusdnjzrizx418\@WanaDecryptor@.exe |
| Initial Working Directory | C:\ProgramData\qxtqusdnjzrizx418 |
| Monitor | Start Time: 00:03:16, Reason: Child Process |
| Unmonitor | End Time: 00:03:18, Reason: Terminated |
| Monitor Duration | 00:00:02 |
| Information | Value |
|---|---|
| PID | 0xbd4 |
| Parent PID | 0xa00 (c:\programdata\qxtqusdnjzrizx418\tasksche.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Groups |
|
| Enabled Privileges | SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege |
| Thread IDs |
0x
BD8
0x
BDC
|
| Operation | Process Name | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| CREATE | C:\ProgramData\qxtqusdnjzrizx418\@WanaDecryptor@.exe | os_tid = 0xbf4, os_pid = 0xbe8, creation_flags = CREATE_UNICODE_ENVIRONMENT, show_window = SW_SHOW |
|
1 | |
| OPEN_TOKEN | c:\programdata\qxtqusdnjzrizx418\tasksche.exe | os_pid = 0xa00, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITE, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITE |
|
2 |
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| LOAD | Wtsapi32.dll | base_address = 0x743d0000 |
|
1 | |
| LOAD | userenv.dll | base_address = 0x750a0000 |
|
1 | |
| GET_HANDLE | c:\programdata\qxtqusdnjzrizx418\taskse.exe | base_address = 0x400000 |
|
1 | |
| GET_HANDLE | c:\windows\system32\advapi32.dll | base_address = 0x77640000 |
|
2 | |
| GET_HANDLE | c:\windows\system32\kernel32.dll | base_address = 0x75d30000 |
|
2 | |
| GET_HANDLE | userenv.dll | base_address = 0x0 |
|
1 | |
| GET_HANDLE | c:\windows\system32\wtsapi32.dll | base_address = 0x743d0000 |
|
2 | |
| GET_HANDLE | c:\windows\system32\userenv.dll | base_address = 0x750a0000 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\wtsapi32.dll | function = WTSEnumerateSessionsA, address = 0x743d4023 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\wtsapi32.dll | function = WTSFreeMemory, address = 0x743d1b65 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = OpenProcessToken, address = 0x77654304 |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = LookupPrivilegeValueA, address = 0x7765404a |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = AdjustTokenPrivileges, address = 0x7765418e |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = DuplicateTokenEx, address = 0x7764ca24 |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = CreateProcessAsUserA, address = 0x77682538 |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = WTSGetActiveConsoleSessionId, address = 0x75d6480b |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = GetCurrentProcess, address = 0x75d7cdcf |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = CloseHandle, address = 0x75d7ca7c |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\userenv.dll | function = CreateEnvironmentBlock, address = 0x750a1a7a |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\userenv.dll | function = DestroyEnvironmentBlock, address = 0x750a1a4e |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\wtsapi32.dll | function = WTSQueryUserToken, address = 0x743d1f81 |
|
2 |
| Operation | User/Group/Server | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| LOOKUP_PRIVILEGE | Localhost | privilege = SeTcbPrivilege |
|
2 | |
| SET_PRIVILEGE | Localhost | c:\programdata\qxtqusdnjzrizx418\tasksche.exe, os_pid = 0xa00, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITE, disable_all_privileges = 0, privilege = SeTcbPrivilege |
|
2 | |
| SET_PRIVILEGE | Localhost | c:\programdata\qxtqusdnjzrizx418\tasksche.exe, os_pid = 0xa00, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITE, disable_all_privileges = 0, privilege = |
|
2 |
| Operation | Information | Success | Count | Logfile |
|---|---|---|---|---|
| SLEEP | duration = 100 milliseconds (0.100 seconds) |
|
2 |
| Information | Value |
|---|---|
| ID | #51 |
| File Name | c:\windows\system32\wbadmin.exe |
| Command Line | wbadmin delete catalog -quiet |
| Initial Working Directory | C:\ProgramData\qxtqusdnjzrizx418 |
| Monitor | Start Time: 00:03:16, Reason: Child Process |
| Unmonitor | End Time: 00:03:23, Reason: Terminated |
| Monitor Duration | 00:00:07 |
| Remarks | No high level activity detected in monitored regions |
| Information | Value |
|---|---|
| PID | 0xbe0 |
| Parent PID | 0x36c (c:\windows\system32\cmd.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Groups |
|
| Enabled Privileges | SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege |
| Thread IDs |
0x
BE4
0x
BF8
0x
C00
0x
C10
0x
C18
0x
C28
|
| Name | Start VA | End VA | Type | Permissions | Monitored | Dump | YARA Match | Actions |
|---|---|---|---|---|---|---|---|---|
| private_0x0000000000010000 | 0x00010000 | 0x0002ffff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000010000 | 0x00010000 | 0x0001ffff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000020000 | 0x00020000 | 0x0002ffff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000030000 | 0x00030000 | 0x00033fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x0000000000040000 | 0x00040000 | 0x00040fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x0000000000050000 | 0x00050000 | 0x00056fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x0000000000060000 | 0x00060000 | 0x00061fff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000070000 | 0x00070000 | 0x00070fff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000080000 | 0x00080000 | 0x00080fff | Private Memory | Readable, Writable |
|
|
|
|
| wbadmin.exe | 0x00090000 | 0x000c9fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| locale.nls | 0x000d0000 | 0x00136fff | Memory Mapped File | Readable |
|
|
|
|
| wbadmin.exe.mui | 0x00140000 | 0x0016afff | Memory Mapped File | Readable, Writable |
|
|
|
|
| private_0x0000000000170000 | 0x00170000 | 0x001affff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x00000000001b0000 | 0x001b0000 | 0x001b1fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x00000000001c0000 | 0x001c0000 | 0x001c0fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x00000000001d0000 | 0x001d0000 | 0x001d1fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x00000000001e0000 | 0x001e0000 | 0x001e0fff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x00000000001f0000 | 0x001f0000 | 0x002effff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000350000 | 0x00350000 | 0x0035ffff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000360000 | 0x00360000 | 0x00427fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x0000000000430000 | 0x00430000 | 0x00530fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x0000000000540000 | 0x00540000 | 0x005bffff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x00000000005c0000 | 0x005c0000 | 0x009b2fff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x00000000009c0000 | 0x009c0000 | 0x009fffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000a70000 | 0x00a70000 | 0x00aaffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000ae0000 | 0x00ae0000 | 0x00b1ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000b50000 | 0x00b50000 | 0x00b8ffff | Private Memory | Readable, Writable |
|
|
|
|
| sortdefault.nls | 0x00b90000 | 0x00e5efff | Memory Mapped File | Readable |
|
|
|
|
| private_0x0000000000f00000 | 0x00f00000 | 0x00f3ffff | Private Memory | Readable, Writable |
|
|
|
|
| credui.dll | 0x6e950000 | 0x6e97afff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| blb_ps.dll | 0x6eac0000 | 0x6eac9fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| slc.dll | 0x73db0000 | 0x73db9fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| comctl32.dll | 0x749d0000 | 0x74b6dfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| rsaenh.dll | 0x75260000 | 0x7529afff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| cryptsp.dll | 0x754c0000 | 0x754d5fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| cryptbase.dll | 0x75940000 | 0x7594bfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| rpcrtremote.dll | 0x759e0000 | 0x759edfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| cfgmgr32.dll | 0x75b90000 | 0x75bb6fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| devobj.dll | 0x75bc0000 | 0x75bd1fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| kernelbase.dll | 0x75c10000 | 0x75c59fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| kernel32.dll | 0x75d30000 | 0x75e03fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| imm32.dll | 0x75e10000 | 0x75e2efff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| user32.dll | 0x75f70000 | 0x76038fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| rpcrt4.dll | 0x76220000 | 0x762c0fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| ole32.dll | 0x762d0000 | 0x7642bfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| clbcatq.dll | 0x770c0000 | 0x77142fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| oleaut32.dll | 0x77150000 | 0x771defff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| usp10.dll | 0x771e0000 | 0x7727cfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| gdi32.dll | 0x77280000 | 0x772cdfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| shlwapi.dll | 0x77530000 | 0x77586fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| msvcrt.dll | 0x77590000 | 0x7763bfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| advapi32.dll | 0x77640000 | 0x776dffff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| sechost.dll | 0x776e0000 | 0x776f8fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| setupapi.dll | 0x77700000 | 0x7789cfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| ntdll.dll | 0x778a0000 | 0x779dbfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| lpk.dll | 0x779e0000 | 0x779e9fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| msctf.dll | 0x77a00000 | 0x77acbfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| apisetschema.dll | 0x77ae0000 | 0x77ae0fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| pagefile_0x000000007f6f0000 | 0x7f6f0000 | 0x7f7effff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x000000007ffb0000 | 0x7ffb0000 | 0x7ffd2fff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x000000007ffd9000 | 0x7ffd9000 | 0x7ffd9fff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffda000 | 0x7ffda000 | 0x7ffdafff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffdb000 | 0x7ffdb000 | 0x7ffdbfff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffdc000 | 0x7ffdc000 | 0x7ffdcfff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffdd000 | 0x7ffdd000 | 0x7ffddfff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffde000 | 0x7ffde000 | 0x7ffdefff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffdf000 | 0x7ffdf000 | 0x7ffdffff | Private Memory | Readable, Writable |
|
|
|
|
| Information | Value |
|---|---|
| ID | #52 |
| File Name | c:\programdata\qxtqusdnjzrizx418\@wanadecryptor@.exe |
| Command Line | "C:\ProgramData\qxtqusdnjzrizx418\@WanaDecryptor@.exe" |
| Initial Working Directory | C:\ProgramData\qxtqusdnjzrizx418 |
| Monitor | Start Time: 00:03:17, Reason: Child Process |
| Unmonitor | End Time: 00:03:18, Reason: Terminated |
| Monitor Duration | 00:00:01 |
| Information | Value |
|---|---|
| PID | 0xbe8 |
| Parent PID | 0xbd4 (c:\programdata\qxtqusdnjzrizx418\taskse.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | Medium |
| Username | N3EERVTWSM\DSsDPMx042 |
| Groups |
|
| Enabled Privileges | SeChangeNotifyPrivilege |
| Thread IDs |
0x
BF4
|
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| GET_HANDLE | c:\programdata\qxtqusdnjzrizx418\@wanadecryptor@.exe | base_address = 0x400000 |
|
1 |
| Operation | Window Name | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| FIND | Wana Decrypt0r 2.0 |
|
1 |
| Information | Value |
|---|---|
| ID | #53 |
| File Name | c:\windows\system32\wbengine.exe |
| Command Line | "C:\Windows\system32\wbengine.exe" |
| Initial Working Directory | C:\Windows\system32 |
| Monitor | Start Time: 00:03:19, Reason: RPC Server |
| Unmonitor | End Time: 00:04:59, Reason: Terminated by Timeout |
| Monitor Duration | 00:01:40 |
| Remarks | No high level activity detected in monitored regions |
| Information | Value |
|---|---|
| PID | 0xc2c |
| Parent PID | 0x1d4 (c:\windows\system32\services.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Groups |
|
| Enabled Privileges | SeSecurityPrivilege, SeBackupPrivilege, SeRestorePrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege |
| Thread IDs |
0x
C68
0x
A8
0x
C5C
0x
C48
0x
C40
0x
C3C
0x
C30
0x
C14
|
| Name | Start VA | End VA | Type | Permissions | Monitored | Dump | YARA Match | Actions |
|---|---|---|---|---|---|---|---|---|
| pagefile_0x0000000000010000 | 0x00010000 | 0x0001ffff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000020000 | 0x00020000 | 0x00026fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x0000000000030000 | 0x00030000 | 0x00033fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x0000000000040000 | 0x00040000 | 0x00040fff | Pagefile Backed Memory | Readable |
|
|
|
|
| locale.nls | 0x00050000 | 0x000b6fff | Memory Mapped File | Readable |
|
|
|
|
| pagefile_0x00000000000c0000 | 0x000c0000 | 0x000c1fff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| wbengine.exe.mui | 0x000d0000 | 0x000d0fff | Memory Mapped File | Readable, Writable |
|
|
|
|
| wbengine.exe | 0x000e0000 | 0x00209fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| pagefile_0x0000000000210000 | 0x00210000 | 0x0028ffff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x0000000000290000 | 0x00290000 | 0x00290fff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x00000000002a0000 | 0x002a0000 | 0x002dffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x00000000002e0000 | 0x002e0000 | 0x002e0fff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x00000000002f0000 | 0x002f0000 | 0x002f0fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x0000000000300000 | 0x00300000 | 0x00300fff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x0000000000310000 | 0x00310000 | 0x0040ffff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000410000 | 0x00410000 | 0x004d7fff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x0000000000530000 | 0x00530000 | 0x0056ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000590000 | 0x00590000 | 0x0059ffff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x00000000005a0000 | 0x005a0000 | 0x006a0fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x00000000006b0000 | 0x006b0000 | 0x00aa2fff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x0000000000ab0000 | 0x00ab0000 | 0x00baffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000c30000 | 0x00c30000 | 0x00c6ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000c70000 | 0x00c70000 | 0x00caffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000cf0000 | 0x00cf0000 | 0x00d2ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000d40000 | 0x00d40000 | 0x00d7ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000dd0000 | 0x00dd0000 | 0x00e0ffff | Private Memory | Readable, Writable |
|
|
|
|
| sortdefault.nls | 0x00e10000 | 0x010defff | Memory Mapped File | Readable |
|
|
|
|
| vds_ps.dll | 0x6e8e0000 | 0x6e8eefff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| blb_ps.dll | 0x6eac0000 | 0x6eac9fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| fltlib.dll | 0x6f8a0000 | 0x6f8a6fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| virtdisk.dll | 0x70470000 | 0x70477fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| vssapi.dll | 0x71200000 | 0x71315fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| vsstrace.dll | 0x717f0000 | 0x717fffff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| cscapi.dll | 0x720c0000 | 0x720cafff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| fvecerts.dll | 0x726b0000 | 0x726b7fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| tbs.dll | 0x726c0000 | 0x726c6fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| fveapi.dll | 0x726d0000 | 0x72712fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| clusapi.dll | 0x73ae0000 | 0x73b1afff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| atl.dll | 0x73de0000 | 0x73df3fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| taskschd.dll | 0x73f20000 | 0x73f9cfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| wkscli.dll | 0x742b0000 | 0x742befff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| netutils.dll | 0x742c0000 | 0x742c8fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| netapi32.dll | 0x742d0000 | 0x742e0fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| xmllite.dll | 0x744f0000 | 0x7451efff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| bcryptprimitives.dll | 0x751a0000 | 0x751dcfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| rsaenh.dll | 0x75260000 | 0x7529afff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| logoncli.dll | 0x75310000 | 0x75331fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| cryptsp.dll | 0x754c0000 | 0x754d5fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| bcrypt.dll | 0x755f0000 | 0x75606fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| cryptdll.dll | 0x756d0000 | 0x756e0fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| srvcli.dll | 0x75890000 | 0x758a8fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| sspicli.dll | 0x75920000 | 0x7593afff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| cryptbase.dll | 0x75940000 | 0x7594bfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| rpcrtremote.dll | 0x759e0000 | 0x759edfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| msasn1.dll | 0x75a60000 | 0x75a6bfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| crypt32.dll | 0x75a70000 | 0x75b8cfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| cfgmgr32.dll | 0x75b90000 | 0x75bb6fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| devobj.dll | 0x75bc0000 | 0x75bd1fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| kernelbase.dll | 0x75c10000 | 0x75c59fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| kernel32.dll | 0x75d30000 | 0x75e03fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| imm32.dll | 0x75e10000 | 0x75e2efff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| user32.dll | 0x75f70000 | 0x76038fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| rpcrt4.dll | 0x76220000 | 0x762c0fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| ole32.dll | 0x762d0000 | 0x7642bfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| clbcatq.dll | 0x770c0000 | 0x77142fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| oleaut32.dll | 0x77150000 | 0x771defff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| usp10.dll | 0x771e0000 | 0x7727cfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| gdi32.dll | 0x77280000 | 0x772cdfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| msvcrt.dll | 0x77590000 | 0x7763bfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| advapi32.dll | 0x77640000 | 0x776dffff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| sechost.dll | 0x776e0000 | 0x776f8fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| setupapi.dll | 0x77700000 | 0x7789cfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| ntdll.dll | 0x778a0000 | 0x779dbfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| lpk.dll | 0x779e0000 | 0x779e9fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| msctf.dll | 0x77a00000 | 0x77acbfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| apisetschema.dll | 0x77ae0000 | 0x77ae0fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| pagefile_0x000000007f6f0000 | 0x7f6f0000 | 0x7f7effff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x000000007ffb0000 | 0x7ffb0000 | 0x7ffd2fff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x000000007ffd8000 | 0x7ffd8000 | 0x7ffd8fff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffd9000 | 0x7ffd9000 | 0x7ffd9fff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffda000 | 0x7ffda000 | 0x7ffdafff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffdb000 | 0x7ffdb000 | 0x7ffdbfff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffdc000 | 0x7ffdc000 | 0x7ffdcfff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffdd000 | 0x7ffdd000 | 0x7ffddfff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffde000 | 0x7ffde000 | 0x7ffdefff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffdf000 | 0x7ffdf000 | 0x7ffdffff | Private Memory | Readable, Writable |
|
|
|
|
| Information | Value |
|---|---|
| ID | #54 |
| File Name | c:\windows\system32\vdsldr.exe |
| Command Line | C:\Windows\System32\vdsldr.exe -Embedding |
| Initial Working Directory | C:\Windows\system32 |
| Monitor | Start Time: 00:03:20, Reason: RPC Server |
| Unmonitor | End Time: 00:03:30, Reason: Terminated |
| Monitor Duration | 00:00:10 |
| Remarks | No high level activity detected in monitored regions |
| Information | Value |
|---|---|
| PID | 0xc6c |
| Parent PID | 0x24c (c:\windows\system32\svchost.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Groups |
|
| Enabled Privileges | SeSecurityPrivilege, SeBackupPrivilege, SeRestorePrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege |
| Thread IDs |
0x
D08
0x
D04
0x
D00
0x
CF8
0x
C74
0x
C70
|
| Name | Start VA | End VA | Type | Permissions | Monitored | Dump | YARA Match | Actions |
|---|---|---|---|---|---|---|---|---|
| pagefile_0x0000000000010000 | 0x00010000 | 0x0001ffff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000020000 | 0x00020000 | 0x00020fff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000030000 | 0x00030000 | 0x00033fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x0000000000040000 | 0x00040000 | 0x00040fff | Pagefile Backed Memory | Readable |
|
|
|
|
| locale.nls | 0x00050000 | 0x000b6fff | Memory Mapped File | Readable |
|
|
|
|
| private_0x00000000000c0000 | 0x000c0000 | 0x000c0fff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x00000000000d0000 | 0x000d0000 | 0x000d6fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x00000000000e0000 | 0x000e0000 | 0x000e1fff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| pagefile_0x00000000000f0000 | 0x000f0000 | 0x000f0fff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x0000000000130000 | 0x00130000 | 0x0013ffff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000140000 | 0x00140000 | 0x00207fff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x0000000000210000 | 0x00210000 | 0x0024ffff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000250000 | 0x00250000 | 0x00350fff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x00000000003c0000 | 0x003c0000 | 0x004bffff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x00000000004c0000 | 0x004c0000 | 0x0053ffff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x0000000000550000 | 0x00550000 | 0x0058ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000670000 | 0x00670000 | 0x006affff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000710000 | 0x00710000 | 0x0074ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x00000000007a0000 | 0x007a0000 | 0x007dffff | Private Memory | Readable, Writable |
|
|
|
|
| vdsldr.exe | 0x00800000 | 0x00807fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| pagefile_0x0000000000810000 | 0x00810000 | 0x00c02fff | Pagefile Backed Memory | Readable |
|
|
|
|
| sortdefault.nls | 0x00c10000 | 0x00edefff | Memory Mapped File | Readable |
|
|
|
|
| private_0x0000000000f20000 | 0x00f20000 | 0x00f5ffff | Private Memory | Readable, Writable |
|
|
|
|
| vds_ps.dll | 0x6e8e0000 | 0x6e8eefff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| vdsutil.dll | 0x6e8f0000 | 0x6e917fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| atl.dll | 0x73de0000 | 0x73df3fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| wkscli.dll | 0x742b0000 | 0x742befff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| netutils.dll | 0x742c0000 | 0x742c8fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| netapi32.dll | 0x742d0000 | 0x742e0fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| rsaenh.dll | 0x75260000 | 0x7529afff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| cryptsp.dll | 0x754c0000 | 0x754d5fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| srvcli.dll | 0x75890000 | 0x758a8fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| cryptbase.dll | 0x75940000 | 0x7594bfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| rpcrtremote.dll | 0x759e0000 | 0x759edfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| cfgmgr32.dll | 0x75b90000 | 0x75bb6fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| devobj.dll | 0x75bc0000 | 0x75bd1fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| kernelbase.dll | 0x75c10000 | 0x75c59fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| kernel32.dll | 0x75d30000 | 0x75e03fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| imm32.dll | 0x75e10000 | 0x75e2efff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| user32.dll | 0x75f70000 | 0x76038fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| rpcrt4.dll | 0x76220000 | 0x762c0fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| ole32.dll | 0x762d0000 | 0x7642bfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| ws2_32.dll | 0x77080000 | 0x770b4fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| clbcatq.dll | 0x770c0000 | 0x77142fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| oleaut32.dll | 0x77150000 | 0x771defff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| usp10.dll | 0x771e0000 | 0x7727cfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| gdi32.dll | 0x77280000 | 0x772cdfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| msvcrt.dll | 0x77590000 | 0x7763bfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| advapi32.dll | 0x77640000 | 0x776dffff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| sechost.dll | 0x776e0000 | 0x776f8fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| setupapi.dll | 0x77700000 | 0x7789cfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| ntdll.dll | 0x778a0000 | 0x779dbfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| lpk.dll | 0x779e0000 | 0x779e9fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| nsi.dll | 0x779f0000 | 0x779f5fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| msctf.dll | 0x77a00000 | 0x77acbfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| apisetschema.dll | 0x77ae0000 | 0x77ae0fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| pagefile_0x000000007f6f0000 | 0x7f6f0000 | 0x7f7effff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x000000007ffb0000 | 0x7ffb0000 | 0x7ffd2fff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x000000007ffd8000 | 0x7ffd8000 | 0x7ffd8fff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffda000 | 0x7ffda000 | 0x7ffdafff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffdb000 | 0x7ffdb000 | 0x7ffdbfff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffdc000 | 0x7ffdc000 | 0x7ffdcfff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffdd000 | 0x7ffdd000 | 0x7ffddfff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffde000 | 0x7ffde000 | 0x7ffdefff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffdf000 | 0x7ffdf000 | 0x7ffdffff | Private Memory | Readable, Writable |
|
|
|
|
| Information | Value |
|---|---|
| ID | #55 |
| File Name | c:\windows\system32\vds.exe |
| Command Line | C:\Windows\System32\vds.exe |
| Initial Working Directory | C:\Windows\system32 |
| Monitor | Start Time: 00:03:21, Reason: RPC Server |
| Unmonitor | End Time: 00:04:59, Reason: Terminated by Timeout |
| Monitor Duration | 00:01:38 |
| Remarks | No high level activity detected in monitored regions |
| Information | Value |
|---|---|
| PID | 0xd0c |
| Parent PID | 0x1d4 (c:\windows\system32\services.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Groups |
|
| Enabled Privileges | SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege |
| Thread IDs |
0x
D28
0x
D24
0x
D18
0x
D14
0x
5EC
0x
D10
0x
D2C
0x
D34
0x
D38
0x
D6C
0x
D40
0x
C08
0x
C64
0x
D30
0x
BF0
0x
BC8
0x
D54
0x
878
|
| Name | Start VA | End VA | Type | Permissions | Monitored | Dump | YARA Match | Actions |
|---|---|---|---|---|---|---|---|---|
| pagefile_0x0000000000010000 | 0x00010000 | 0x0001ffff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000020000 | 0x00020000 | 0x00026fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x0000000000030000 | 0x00030000 | 0x00033fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x0000000000040000 | 0x00040000 | 0x00040fff | Pagefile Backed Memory | Readable |
|
|
|
|
| locale.nls | 0x00050000 | 0x000b6fff | Memory Mapped File | Readable |
|
|
|
|
| pagefile_0x00000000000c0000 | 0x000c0000 | 0x0013ffff | Pagefile Backed Memory | Readable |
|
|
|
|
| vds.exe | 0x00140000 | 0x001b0fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| pagefile_0x00000000001c0000 | 0x001c0000 | 0x001c1fff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| vds.exe.mui | 0x001d0000 | 0x001d1fff | Memory Mapped File | Readable, Writable |
|
|
|
|
| private_0x00000000001e0000 | 0x001e0000 | 0x001e0fff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x00000000001f0000 | 0x001f0000 | 0x001f0fff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000200000 | 0x00200000 | 0x00200fff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x0000000000210000 | 0x00210000 | 0x0024ffff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000250000 | 0x00250000 | 0x00250fff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x0000000000280000 | 0x00280000 | 0x002bffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x00000000002d0000 | 0x002d0000 | 0x003cffff | Private Memory | Readable, Writable |
|
|
|
|
| ulib.dll.mui | 0x003d0000 | 0x00407fff | Memory Mapped File | Readable, Writable |
|
|
|
|
| private_0x0000000000410000 | 0x00410000 | 0x0044ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000460000 | 0x00460000 | 0x0046ffff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000470000 | 0x00470000 | 0x00537fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x0000000000540000 | 0x00540000 | 0x00640fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x0000000000650000 | 0x00650000 | 0x00a42fff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x0000000000a80000 | 0x00a80000 | 0x00abffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000ac0000 | 0x00ac0000 | 0x00afffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000b10000 | 0x00b10000 | 0x00b4ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000b60000 | 0x00b60000 | 0x00b9ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000ba0000 | 0x00ba0000 | 0x00c9ffff | Private Memory | Readable, Writable |
|
|
|
|
| sortdefault.nls | 0x00ca0000 | 0x00f6efff | Memory Mapped File | Readable |
|
|
|
|
| private_0x0000000000f70000 | 0x00f70000 | 0x00feffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000001050000 | 0x01050000 | 0x0108ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x00000000010e0000 | 0x010e0000 | 0x0111ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000001130000 | 0x01130000 | 0x0116ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x00000000011f0000 | 0x011f0000 | 0x0122ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000001260000 | 0x01260000 | 0x0129ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x00000000012a0000 | 0x012a0000 | 0x012dffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000001340000 | 0x01340000 | 0x0137ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000001390000 | 0x01390000 | 0x013cffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000001410000 | 0x01410000 | 0x0144ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000001470000 | 0x01470000 | 0x014affff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000001680000 | 0x01680000 | 0x016bffff | Private Memory | Readable, Writable |
|
|
|
|
| vdsdyn.dll | 0x6e190000 | 0x6e210fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| hbaapi.dll | 0x6e380000 | 0x6e392fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| untfs.dll | 0x6e3a0000 | 0x6e3f7fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| uudf.dll | 0x6e400000 | 0x6e423fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| ifsutil.dll | 0x6e430000 | 0x6e456fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| ufat.dll | 0x6e6d0000 | 0x6e6e9fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| ulib.dll | 0x6e6f0000 | 0x6e70cfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| uexfat.dll | 0x6e710000 | 0x6e723fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| fmifs.dll | 0x6e8c0000 | 0x6e8c8fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| osuninst.dll | 0x6e8d0000 | 0x6e8d4fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| vds_ps.dll | 0x6e8e0000 | 0x6e8eefff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| vdsutil.dll | 0x6e8f0000 | 0x6e917fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| vdsbas.dll | 0x6e950000 | 0x6e979fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| fltlib.dll | 0x6f8a0000 | 0x6f8a6fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| virtdisk.dll | 0x70470000 | 0x70477fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| vdsvd.dll | 0x705f0000 | 0x705fefff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| wbemcomn.dll | 0x70ed0000 | 0x70f2bfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| wbemsvc.dll | 0x73990000 | 0x7399efff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| atl.dll | 0x73de0000 | 0x73df3fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| wbemprox.dll | 0x74180000 | 0x74189fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| fastprox.dll | 0x74190000 | 0x74225fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| wkscli.dll | 0x742b0000 | 0x742befff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| netutils.dll | 0x742c0000 | 0x742c8fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| netapi32.dll | 0x742d0000 | 0x742e0fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| ntdsapi.dll | 0x742f0000 | 0x74307fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| rsaenh.dll | 0x75260000 | 0x7529afff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| cryptsp.dll | 0x754c0000 | 0x754d5fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| srvcli.dll | 0x75890000 | 0x758a8fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| cryptbase.dll | 0x75940000 | 0x7594bfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| rpcrtremote.dll | 0x759e0000 | 0x759edfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| msasn1.dll | 0x75a60000 | 0x75a6bfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| crypt32.dll | 0x75a70000 | 0x75b8cfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| cfgmgr32.dll | 0x75b90000 | 0x75bb6fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| devobj.dll | 0x75bc0000 | 0x75bd1fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| wintrust.dll | 0x75be0000 | 0x75c0cfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| kernelbase.dll | 0x75c10000 | 0x75c59fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| kernel32.dll | 0x75d30000 | 0x75e03fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| imm32.dll | 0x75e10000 | 0x75e2efff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| user32.dll | 0x75f70000 | 0x76038fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| rpcrt4.dll | 0x76220000 | 0x762c0fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| ole32.dll | 0x762d0000 | 0x7642bfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| ws2_32.dll | 0x77080000 | 0x770b4fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| clbcatq.dll | 0x770c0000 | 0x77142fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| oleaut32.dll | 0x77150000 | 0x771defff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| usp10.dll | 0x771e0000 | 0x7727cfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| gdi32.dll | 0x77280000 | 0x772cdfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| msvcrt.dll | 0x77590000 | 0x7763bfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| advapi32.dll | 0x77640000 | 0x776dffff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| sechost.dll | 0x776e0000 | 0x776f8fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| setupapi.dll | 0x77700000 | 0x7789cfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| ntdll.dll | 0x778a0000 | 0x779dbfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| lpk.dll | 0x779e0000 | 0x779e9fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| nsi.dll | 0x779f0000 | 0x779f5fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| msctf.dll | 0x77a00000 | 0x77acbfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| apisetschema.dll | 0x77ae0000 | 0x77ae0fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| pagefile_0x000000007f6f0000 | 0x7f6f0000 | 0x7f7effff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x000000007ffab000 | 0x7ffab000 | 0x7ffabfff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffac000 | 0x7ffac000 | 0x7ffacfff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffad000 | 0x7ffad000 | 0x7ffadfff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffae000 | 0x7ffae000 | 0x7ffaefff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffaf000 | 0x7ffaf000 | 0x7ffaffff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x000000007ffb0000 | 0x7ffb0000 | 0x7ffd2fff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x000000007ffd3000 | 0x7ffd3000 | 0x7ffd3fff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffd4000 | 0x7ffd4000 | 0x7ffd4fff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffd5000 | 0x7ffd5000 | 0x7ffd5fff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffd6000 | 0x7ffd6000 | 0x7ffd6fff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffd7000 | 0x7ffd7000 | 0x7ffd7fff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffd8000 | 0x7ffd8000 | 0x7ffd8fff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffd9000 | 0x7ffd9000 | 0x7ffd9fff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffda000 | 0x7ffda000 | 0x7ffdafff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffdb000 | 0x7ffdb000 | 0x7ffdbfff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffdc000 | 0x7ffdc000 | 0x7ffdcfff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffdd000 | 0x7ffdd000 | 0x7ffddfff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffde000 | 0x7ffde000 | 0x7ffdefff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffdf000 | 0x7ffdf000 | 0x7ffdffff | Private Memory | Readable, Writable |
|
|
|
|
| Information | Value |
|---|---|
| ID | #56 |
| File Name | c:\programdata\qxtqusdnjzrizx418\taskdl.exe |
| Command Line | taskdl.exe |
| Initial Working Directory | C:\ProgramData\qxtqusdnjzrizx418 |
| Monitor | Start Time: 00:03:24, Reason: Child Process |
| Unmonitor | End Time: 00:03:25, Reason: Terminated |
| Monitor Duration | 00:00:01 |
| Information | Value |
|---|---|
| PID | 0xc78 |
| Parent PID | 0xa00 (c:\programdata\qxtqusdnjzrizx418\tasksche.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Groups |
|
| Enabled Privileges | SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege |
| Thread IDs |
0x
D44
|
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| FIND | C:\Windows\TEMP\*.WNCRYT |
|
1 | ||
| DELETE | c:\windows\temp\164.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\209.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\214.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\215.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\216.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\235.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\hibsys.wncryt |
|
1 |
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| GET_HANDLE | c:\programdata\qxtqusdnjzrizx418\taskdl.exe | base_address = 0x400000 |
|
1 |
| Operation | Information | Success | Count | Logfile |
|---|---|---|---|---|
| SLEEP | duration = 10 milliseconds (0.010 seconds) |
|
1 |
| Information | Value |
|---|---|
| ID | #57 |
| File Name | c:\programdata\qxtqusdnjzrizx418\taskse.exe |
| Command Line | taskse.exe C:\ProgramData\qxtqusdnjzrizx418\@WanaDecryptor@.exe |
| Initial Working Directory | C:\ProgramData\qxtqusdnjzrizx418 |
| Monitor | Start Time: 00:03:28, Reason: Child Process |
| Unmonitor | End Time: 00:03:30, Reason: Terminated |
| Monitor Duration | 00:00:02 |
| Information | Value |
|---|---|
| PID | 0xd58 |
| Parent PID | 0xa00 (c:\programdata\qxtqusdnjzrizx418\tasksche.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Groups |
|
| Enabled Privileges | SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege |
| Thread IDs |
0x
D5C
0x
D64
|
| Operation | Process Name | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| CREATE | C:\ProgramData\qxtqusdnjzrizx418\@WanaDecryptor@.exe | os_tid = 0xd70, os_pid = 0xd68, creation_flags = CREATE_UNICODE_ENVIRONMENT, show_window = SW_SHOW |
|
1 | |
| OPEN_TOKEN | c:\programdata\qxtqusdnjzrizx418\tasksche.exe | os_pid = 0xa00, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITE, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITE |
|
2 |
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| LOAD | Wtsapi32.dll | base_address = 0x743d0000 |
|
1 | |
| LOAD | userenv.dll | base_address = 0x750a0000 |
|
1 | |
| GET_HANDLE | c:\programdata\qxtqusdnjzrizx418\taskse.exe | base_address = 0x400000 |
|
1 | |
| GET_HANDLE | c:\windows\system32\advapi32.dll | base_address = 0x77640000 |
|
2 | |
| GET_HANDLE | c:\windows\system32\kernel32.dll | base_address = 0x75d30000 |
|
2 | |
| GET_HANDLE | userenv.dll | base_address = 0x0 |
|
1 | |
| GET_HANDLE | c:\windows\system32\wtsapi32.dll | base_address = 0x743d0000 |
|
2 | |
| GET_HANDLE | c:\windows\system32\userenv.dll | base_address = 0x750a0000 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\wtsapi32.dll | function = WTSEnumerateSessionsA, address = 0x743d4023 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\wtsapi32.dll | function = WTSFreeMemory, address = 0x743d1b65 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = OpenProcessToken, address = 0x77654304 |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = LookupPrivilegeValueA, address = 0x7765404a |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = AdjustTokenPrivileges, address = 0x7765418e |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = DuplicateTokenEx, address = 0x7764ca24 |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = CreateProcessAsUserA, address = 0x77682538 |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = WTSGetActiveConsoleSessionId, address = 0x75d6480b |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = GetCurrentProcess, address = 0x75d7cdcf |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = CloseHandle, address = 0x75d7ca7c |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\userenv.dll | function = CreateEnvironmentBlock, address = 0x750a1a7a |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\userenv.dll | function = DestroyEnvironmentBlock, address = 0x750a1a4e |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\wtsapi32.dll | function = WTSQueryUserToken, address = 0x743d1f81 |
|
2 |
| Operation | User/Group/Server | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| LOOKUP_PRIVILEGE | Localhost | privilege = SeTcbPrivilege |
|
2 | |
| SET_PRIVILEGE | Localhost | c:\programdata\qxtqusdnjzrizx418\tasksche.exe, os_pid = 0xa00, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITE, disable_all_privileges = 0, privilege = SeTcbPrivilege |
|
2 | |
| SET_PRIVILEGE | Localhost | c:\programdata\qxtqusdnjzrizx418\tasksche.exe, os_pid = 0xa00, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITE, disable_all_privileges = 0, privilege = |
|
2 |
| Operation | Information | Success | Count | Logfile |
|---|---|---|---|---|
| SLEEP | duration = 100 milliseconds (0.100 seconds) |
|
2 |
| Information | Value |
|---|---|
| ID | #58 |
| File Name | c:\programdata\qxtqusdnjzrizx418\@wanadecryptor@.exe |
| Command Line | "C:\ProgramData\qxtqusdnjzrizx418\@WanaDecryptor@.exe" |
| Initial Working Directory | C:\ProgramData\qxtqusdnjzrizx418 |
| Monitor | Start Time: 00:03:29, Reason: Child Process |
| Unmonitor | End Time: 00:03:31, Reason: Terminated |
| Monitor Duration | 00:00:02 |
| Information | Value |
|---|---|
| PID | 0xd68 |
| Parent PID | 0xd58 (c:\programdata\qxtqusdnjzrizx418\taskse.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | Medium |
| Username | N3EERVTWSM\DSsDPMx042 |
| Groups |
|
| Enabled Privileges | SeChangeNotifyPrivilege |
| Thread IDs |
0x
D70
|
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| GET_HANDLE | c:\programdata\qxtqusdnjzrizx418\@wanadecryptor@.exe | base_address = 0x400000 |
|
1 |
| Operation | Window Name | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| FIND | Wana Decrypt0r 2.0 |
|
1 |
| Information | Value |
|---|---|
| ID | #59 |
| File Name | c:\windows\system32\wbem\wmiprvse.exe |
| Command Line | C:\Windows\system32\wbem\wmiprvse.exe -Embedding |
| Initial Working Directory | C:\Windows\system32 |
| Monitor | Start Time: 00:03:31, Reason: RPC Server |
| Unmonitor | End Time: 00:04:59, Reason: Terminated by Timeout |
| Monitor Duration | 00:01:28 |
| Remarks | No high level activity detected in monitored regions |
| Information | Value |
|---|---|
| PID | 0xd78 |
| Parent PID | 0x24c (c:\windows\system32\svchost.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Groups |
|
| Enabled Privileges | SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege |
| Thread IDs |
0x
DC0
0x
D98
0x
D94
0x
D90
0x
D88
0x
D80
0x
D7C
0x
D9C
0x
E18
|
| Name | Start VA | End VA | Type | Permissions | Monitored | Dump | YARA Match | Actions |
|---|---|---|---|---|---|---|---|---|
| pagefile_0x0000000000010000 | 0x00010000 | 0x0001ffff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000020000 | 0x00020000 | 0x00020fff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000030000 | 0x00030000 | 0x00033fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x0000000000040000 | 0x00040000 | 0x00040fff | Pagefile Backed Memory | Readable |
|
|
|
|
| locale.nls | 0x00050000 | 0x000b6fff | Memory Mapped File | Readable |
|
|
|
|
| private_0x00000000000c0000 | 0x000c0000 | 0x000c0fff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x00000000000d0000 | 0x000d0000 | 0x000dffff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x00000000000e0000 | 0x000e0000 | 0x001a7fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x00000000001b0000 | 0x001b0000 | 0x001b6fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x00000000001c0000 | 0x001c0000 | 0x001c1fff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| pagefile_0x00000000001d0000 | 0x001d0000 | 0x001d0fff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| pagefile_0x00000000001e0000 | 0x001e0000 | 0x001e0fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x00000000001f0000 | 0x001f0000 | 0x001f0fff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x0000000000200000 | 0x00200000 | 0x0023ffff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000240000 | 0x00240000 | 0x00340fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x0000000000350000 | 0x00350000 | 0x003cffff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x00000000003d0000 | 0x003d0000 | 0x004cffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x00000000004d0000 | 0x004d0000 | 0x0054ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000580000 | 0x00580000 | 0x005bffff | Private Memory | Readable, Writable |
|
|
|
|
| sortdefault.nls | 0x005c0000 | 0x0088efff | Memory Mapped File | Readable |
|
|
|
|
| private_0x00000000008c0000 | 0x008c0000 | 0x008fffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000920000 | 0x00920000 | 0x0095ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x00000000009a0000 | 0x009a0000 | 0x009dffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x00000000009e0000 | 0x009e0000 | 0x00adffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000ae0000 | 0x00ae0000 | 0x00b1ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000b20000 | 0x00b20000 | 0x00b5ffff | Private Memory | Readable, Writable |
|
|
|
|
| wmiprvse.exe | 0x00b60000 | 0x00ba0fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| pagefile_0x0000000000bb0000 | 0x00bb0000 | 0x00fa2fff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x0000000001070000 | 0x01070000 | 0x010affff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x00000000010b0000 | 0x010b0000 | 0x010effff | Private Memory | Readable, Writable |
|
|
|
|
| mofd.dll | 0x6d8b0000 | 0x6d8e0fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| wmiprov.dll | 0x6e350000 | 0x6e377fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| wbemcomn.dll | 0x70ed0000 | 0x70f2bfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| ncobjapi.dll | 0x737d0000 | 0x737defff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| wmiutils.dll | 0x738c0000 | 0x738d6fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| wbemsvc.dll | 0x73990000 | 0x7399efff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| ntmarta.dll | 0x74060000 | 0x74080fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| wbemprox.dll | 0x74180000 | 0x74189fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| fastprox.dll | 0x74190000 | 0x74225fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| ntdsapi.dll | 0x742f0000 | 0x74307fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| rsaenh.dll | 0x75260000 | 0x7529afff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| cryptsp.dll | 0x754c0000 | 0x754d5fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| cryptbase.dll | 0x75940000 | 0x7594bfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| rpcrtremote.dll | 0x759e0000 | 0x759edfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| kernelbase.dll | 0x75c10000 | 0x75c59fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| kernel32.dll | 0x75d30000 | 0x75e03fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| imm32.dll | 0x75e10000 | 0x75e2efff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| user32.dll | 0x75f70000 | 0x76038fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| wldap32.dll | 0x761d0000 | 0x76214fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| rpcrt4.dll | 0x76220000 | 0x762c0fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| ole32.dll | 0x762d0000 | 0x7642bfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| ws2_32.dll | 0x77080000 | 0x770b4fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| clbcatq.dll | 0x770c0000 | 0x77142fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| oleaut32.dll | 0x77150000 | 0x771defff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| usp10.dll | 0x771e0000 | 0x7727cfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| gdi32.dll | 0x77280000 | 0x772cdfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| msvcrt.dll | 0x77590000 | 0x7763bfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| advapi32.dll | 0x77640000 | 0x776dffff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| sechost.dll | 0x776e0000 | 0x776f8fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| ntdll.dll | 0x778a0000 | 0x779dbfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| lpk.dll | 0x779e0000 | 0x779e9fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| nsi.dll | 0x779f0000 | 0x779f5fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| msctf.dll | 0x77a00000 | 0x77acbfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| apisetschema.dll | 0x77ae0000 | 0x77ae0fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| pagefile_0x000000007f6f0000 | 0x7f6f0000 | 0x7f7effff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x000000007ffb0000 | 0x7ffb0000 | 0x7ffd2fff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x000000007ffd7000 | 0x7ffd7000 | 0x7ffd7fff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffd8000 | 0x7ffd8000 | 0x7ffd8fff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffd9000 | 0x7ffd9000 | 0x7ffd9fff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffda000 | 0x7ffda000 | 0x7ffdafff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffdb000 | 0x7ffdb000 | 0x7ffdbfff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffdc000 | 0x7ffdc000 | 0x7ffdcfff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffdd000 | 0x7ffdd000 | 0x7ffddfff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffde000 | 0x7ffde000 | 0x7ffdefff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffdf000 | 0x7ffdf000 | 0x7ffdffff | Private Memory | Readable, Writable |
|
|
|
|
| Information | Value |
|---|---|
| ID | #60 |
| File Name | c:\programdata\qxtqusdnjzrizx418\taskdl.exe |
| Command Line | taskdl.exe |
| Initial Working Directory | C:\ProgramData\qxtqusdnjzrizx418 |
| Monitor | Start Time: 00:03:34, Reason: Child Process |
| Unmonitor | End Time: 00:03:36, Reason: Terminated |
| Monitor Duration | 00:00:02 |
| Information | Value |
|---|---|
| PID | 0xda4 |
| Parent PID | 0xa00 (c:\programdata\qxtqusdnjzrizx418\tasksche.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Groups |
|
| Enabled Privileges | SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege |
| Thread IDs |
0x
DA8
|
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| FIND | C:\Windows\TEMP\*.WNCRYT |
|
1 | ||
| DELETE | c:\windows\temp\164.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\209.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\214.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\215.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\216.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\235.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\hibsys.wncryt |
|
1 |
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| GET_HANDLE | c:\programdata\qxtqusdnjzrizx418\taskdl.exe | base_address = 0x400000 |
|
1 |
| Operation | Information | Success | Count | Logfile |
|---|---|---|---|---|
| SLEEP | duration = 10 milliseconds (0.010 seconds) |
|
1 |
| Information | Value |
|---|---|
| ID | #61 |
| File Name | c:\programdata\qxtqusdnjzrizx418\taskse.exe |
| Command Line | taskse.exe C:\ProgramData\qxtqusdnjzrizx418\@WanaDecryptor@.exe |
| Initial Working Directory | C:\ProgramData\qxtqusdnjzrizx418 |
| Monitor | Start Time: 00:03:38, Reason: Child Process |
| Unmonitor | End Time: 00:03:55, Reason: Terminated |
| Monitor Duration | 00:00:17 |
| Information | Value |
|---|---|
| PID | 0xdd8 |
| Parent PID | 0xa00 (c:\programdata\qxtqusdnjzrizx418\tasksche.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Groups |
|
| Enabled Privileges | SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege |
| Thread IDs |
0x
338
0x
E54
|
| Operation | Process Name | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| CREATE | C:\ProgramData\qxtqusdnjzrizx418\@WanaDecryptor@.exe | os_tid = 0xe68, os_pid = 0x57c, creation_flags = CREATE_UNICODE_ENVIRONMENT, show_window = SW_SHOW |
|
1 | |
| OPEN_TOKEN | c:\programdata\qxtqusdnjzrizx418\tasksche.exe | os_pid = 0xa00, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITE, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITE |
|
2 |
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| LOAD | Wtsapi32.dll | base_address = 0x743d0000 |
|
1 | |
| LOAD | userenv.dll | base_address = 0x750a0000 |
|
1 | |
| GET_HANDLE | c:\programdata\qxtqusdnjzrizx418\taskse.exe | base_address = 0x400000 |
|
1 | |
| GET_HANDLE | c:\windows\system32\advapi32.dll | base_address = 0x77640000 |
|
2 | |
| GET_HANDLE | c:\windows\system32\kernel32.dll | base_address = 0x75d30000 |
|
2 | |
| GET_HANDLE | userenv.dll | base_address = 0x0 |
|
1 | |
| GET_HANDLE | c:\windows\system32\wtsapi32.dll | base_address = 0x743d0000 |
|
2 | |
| GET_HANDLE | c:\windows\system32\userenv.dll | base_address = 0x750a0000 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\wtsapi32.dll | function = WTSEnumerateSessionsA, address = 0x743d4023 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\wtsapi32.dll | function = WTSFreeMemory, address = 0x743d1b65 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = OpenProcessToken, address = 0x77654304 |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = LookupPrivilegeValueA, address = 0x7765404a |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = AdjustTokenPrivileges, address = 0x7765418e |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = DuplicateTokenEx, address = 0x7764ca24 |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = CreateProcessAsUserA, address = 0x77682538 |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = WTSGetActiveConsoleSessionId, address = 0x75d6480b |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = GetCurrentProcess, address = 0x75d7cdcf |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = CloseHandle, address = 0x75d7ca7c |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\userenv.dll | function = CreateEnvironmentBlock, address = 0x750a1a7a |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\userenv.dll | function = DestroyEnvironmentBlock, address = 0x750a1a4e |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\wtsapi32.dll | function = WTSQueryUserToken, address = 0x743d1f81 |
|
2 |
| Operation | User/Group/Server | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| LOOKUP_PRIVILEGE | Localhost | privilege = SeTcbPrivilege |
|
2 | |
| SET_PRIVILEGE | Localhost | c:\programdata\qxtqusdnjzrizx418\tasksche.exe, os_pid = 0xa00, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITE, disable_all_privileges = 0, privilege = SeTcbPrivilege |
|
2 | |
| SET_PRIVILEGE | Localhost | c:\programdata\qxtqusdnjzrizx418\tasksche.exe, os_pid = 0xa00, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITE, disable_all_privileges = 0, privilege = |
|
2 |
| Operation | Information | Success | Count | Logfile |
|---|---|---|---|---|
| SLEEP | duration = 100 milliseconds (0.100 seconds) |
|
2 |
| Information | Value |
|---|---|
| ID | #62 |
| File Name | c:\programdata\qxtqusdnjzrizx418\taskdl.exe |
| Command Line | taskdl.exe |
| Initial Working Directory | C:\ProgramData\qxtqusdnjzrizx418 |
| Monitor | Start Time: 00:03:46, Reason: Child Process |
| Unmonitor | End Time: 00:03:54, Reason: Terminated |
| Monitor Duration | 00:00:08 |
| Information | Value |
|---|---|
| PID | 0xe24 |
| Parent PID | 0xa00 (c:\programdata\qxtqusdnjzrizx418\tasksche.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Groups |
|
| Enabled Privileges | SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege |
| Thread IDs |
0x
E2C
|
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| FIND | C:\Windows\TEMP\*.WNCRYT |
|
1 | ||
| DELETE | c:\windows\temp\164.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\209.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\214.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\215.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\216.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\235.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\hibsys.wncryt |
|
1 |
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| GET_HANDLE | c:\programdata\qxtqusdnjzrizx418\taskdl.exe | base_address = 0x400000 |
|
1 |
| Operation | Information | Success | Count | Logfile |
|---|---|---|---|---|
| SLEEP | duration = 10 milliseconds (0.010 seconds) |
|
1 |
| Information | Value |
|---|---|
| ID | #63 |
| File Name | c:\programdata\qxtqusdnjzrizx418\taskse.exe |
| Command Line | taskse.exe C:\ProgramData\qxtqusdnjzrizx418\@WanaDecryptor@.exe |
| Initial Working Directory | C:\ProgramData\qxtqusdnjzrizx418 |
| Monitor | Start Time: 00:03:49, Reason: Child Process |
| Unmonitor | End Time: 00:03:50, Reason: Terminated |
| Monitor Duration | 00:00:01 |
| Information | Value |
|---|---|
| PID | 0xdbc |
| Parent PID | 0xa00 (c:\programdata\qxtqusdnjzrizx418\tasksche.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Groups |
|
| Enabled Privileges | SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege |
| Thread IDs |
0x
E30
0x
2A0
|
| Operation | Process Name | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| CREATE | C:\ProgramData\qxtqusdnjzrizx418\@WanaDecryptor@.exe | os_tid = 0xe44, os_pid = 0xe40, creation_flags = CREATE_UNICODE_ENVIRONMENT, show_window = SW_SHOW |
|
1 | |
| OPEN_TOKEN | c:\programdata\qxtqusdnjzrizx418\tasksche.exe | os_pid = 0xa00, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITE, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITE |
|
2 |
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| LOAD | Wtsapi32.dll | base_address = 0x743d0000 |
|
1 | |
| LOAD | userenv.dll | base_address = 0x750a0000 |
|
1 | |
| GET_HANDLE | c:\programdata\qxtqusdnjzrizx418\taskse.exe | base_address = 0x400000 |
|
1 | |
| GET_HANDLE | c:\windows\system32\advapi32.dll | base_address = 0x77640000 |
|
2 | |
| GET_HANDLE | c:\windows\system32\kernel32.dll | base_address = 0x75d30000 |
|
2 | |
| GET_HANDLE | userenv.dll | base_address = 0x0 |
|
1 | |
| GET_HANDLE | c:\windows\system32\wtsapi32.dll | base_address = 0x743d0000 |
|
2 | |
| GET_HANDLE | c:\windows\system32\userenv.dll | base_address = 0x750a0000 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\wtsapi32.dll | function = WTSEnumerateSessionsA, address = 0x743d4023 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\wtsapi32.dll | function = WTSFreeMemory, address = 0x743d1b65 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = OpenProcessToken, address = 0x77654304 |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = LookupPrivilegeValueA, address = 0x7765404a |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = AdjustTokenPrivileges, address = 0x7765418e |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = DuplicateTokenEx, address = 0x7764ca24 |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = CreateProcessAsUserA, address = 0x77682538 |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = WTSGetActiveConsoleSessionId, address = 0x75d6480b |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = GetCurrentProcess, address = 0x75d7cdcf |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = CloseHandle, address = 0x75d7ca7c |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\userenv.dll | function = CreateEnvironmentBlock, address = 0x750a1a7a |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\userenv.dll | function = DestroyEnvironmentBlock, address = 0x750a1a4e |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\wtsapi32.dll | function = WTSQueryUserToken, address = 0x743d1f81 |
|
2 |
| Operation | User/Group/Server | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| LOOKUP_PRIVILEGE | Localhost | privilege = SeTcbPrivilege |
|
2 | |
| SET_PRIVILEGE | Localhost | c:\programdata\qxtqusdnjzrizx418\tasksche.exe, os_pid = 0xa00, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITE, disable_all_privileges = 0, privilege = SeTcbPrivilege |
|
2 | |
| SET_PRIVILEGE | Localhost | c:\programdata\qxtqusdnjzrizx418\tasksche.exe, os_pid = 0xa00, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITE, disable_all_privileges = 0, privilege = |
|
2 |
| Operation | Information | Success | Count | Logfile |
|---|---|---|---|---|
| SLEEP | duration = 100 milliseconds (0.100 seconds) |
|
2 |
| Information | Value |
|---|---|
| ID | #64 |
| File Name | c:\programdata\qxtqusdnjzrizx418\@wanadecryptor@.exe |
| Command Line | "C:\ProgramData\qxtqusdnjzrizx418\@WanaDecryptor@.exe" |
| Initial Working Directory | C:\ProgramData\qxtqusdnjzrizx418 |
| Monitor | Start Time: 00:03:49, Reason: Child Process |
| Unmonitor | End Time: 00:03:55, Reason: Terminated |
| Monitor Duration | 00:00:06 |
| Information | Value |
|---|---|
| PID | 0xe40 |
| Parent PID | 0xdbc (c:\programdata\qxtqusdnjzrizx418\taskdl.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | Medium |
| Username | N3EERVTWSM\DSsDPMx042 |
| Groups |
|
| Enabled Privileges | SeChangeNotifyPrivilege |
| Thread IDs |
0x
E44
|
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| GET_HANDLE | c:\programdata\qxtqusdnjzrizx418\@wanadecryptor@.exe | base_address = 0x400000 |
|
1 |
| Operation | Window Name | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| FIND | Wana Decrypt0r 2.0 |
|
1 |
| Information | Value |
|---|---|
| ID | #65 |
| File Name | c:\programdata\qxtqusdnjzrizx418\@wanadecryptor@.exe |
| Command Line | "C:\ProgramData\qxtqusdnjzrizx418\@WanaDecryptor@.exe" |
| Initial Working Directory | C:\ProgramData\qxtqusdnjzrizx418 |
| Monitor | Start Time: 00:03:54, Reason: Child Process |
| Unmonitor | End Time: 00:03:57, Reason: Terminated |
| Monitor Duration | 00:00:03 |
| Information | Value |
|---|---|
| PID | 0x57c |
| Parent PID | 0xdd8 (c:\programdata\qxtqusdnjzrizx418\taskse.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | Medium |
| Username | N3EERVTWSM\DSsDPMx042 |
| Groups |
|
| Enabled Privileges | SeChangeNotifyPrivilege |
| Thread IDs |
0x
E68
|
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| GET_HANDLE | c:\programdata\qxtqusdnjzrizx418\@wanadecryptor@.exe | base_address = 0x400000 |
|
1 |
| Operation | Window Name | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| FIND | Wana Decrypt0r 2.0 |
|
1 |
| Information | Value |
|---|---|
| ID | #66 |
| File Name | c:\programdata\qxtqusdnjzrizx418\taskse.exe |
| Command Line | taskse.exe C:\ProgramData\qxtqusdnjzrizx418\@WanaDecryptor@.exe |
| Initial Working Directory | C:\ProgramData\qxtqusdnjzrizx418 |
| Monitor | Start Time: 00:03:59, Reason: Child Process |
| Unmonitor | End Time: 00:04:12, Reason: Terminated |
| Monitor Duration | 00:00:13 |
| Information | Value |
|---|---|
| PID | 0xea0 |
| Parent PID | 0xa00 (c:\programdata\qxtqusdnjzrizx418\tasksche.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Groups |
|
| Enabled Privileges | SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege |
| Thread IDs |
0x
EA4
0x
EDC
|
| Operation | Process Name | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| CREATE | C:\ProgramData\qxtqusdnjzrizx418\@WanaDecryptor@.exe | os_tid = 0xf1c, os_pid = 0xf14, creation_flags = CREATE_UNICODE_ENVIRONMENT, show_window = SW_SHOW |
|
1 | |
| OPEN_TOKEN | c:\programdata\qxtqusdnjzrizx418\tasksche.exe | os_pid = 0xa00, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITE, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITE |
|
2 |
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| LOAD | Wtsapi32.dll | base_address = 0x743d0000 |
|
1 | |
| LOAD | userenv.dll | base_address = 0x750a0000 |
|
1 | |
| GET_HANDLE | c:\programdata\qxtqusdnjzrizx418\taskse.exe | base_address = 0x400000 |
|
1 | |
| GET_HANDLE | c:\windows\system32\advapi32.dll | base_address = 0x77640000 |
|
2 | |
| GET_HANDLE | c:\windows\system32\kernel32.dll | base_address = 0x75d30000 |
|
2 | |
| GET_HANDLE | userenv.dll | base_address = 0x0 |
|
1 | |
| GET_HANDLE | c:\windows\system32\wtsapi32.dll | base_address = 0x743d0000 |
|
2 | |
| GET_HANDLE | c:\windows\system32\userenv.dll | base_address = 0x750a0000 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\wtsapi32.dll | function = WTSEnumerateSessionsA, address = 0x743d4023 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\wtsapi32.dll | function = WTSFreeMemory, address = 0x743d1b65 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = OpenProcessToken, address = 0x77654304 |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = LookupPrivilegeValueA, address = 0x7765404a |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = AdjustTokenPrivileges, address = 0x7765418e |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = DuplicateTokenEx, address = 0x7764ca24 |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = CreateProcessAsUserA, address = 0x77682538 |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = WTSGetActiveConsoleSessionId, address = 0x75d6480b |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = GetCurrentProcess, address = 0x75d7cdcf |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = CloseHandle, address = 0x75d7ca7c |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\userenv.dll | function = CreateEnvironmentBlock, address = 0x750a1a7a |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\userenv.dll | function = DestroyEnvironmentBlock, address = 0x750a1a4e |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\wtsapi32.dll | function = WTSQueryUserToken, address = 0x743d1f81 |
|
2 |
| Operation | User/Group/Server | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| LOOKUP_PRIVILEGE | Localhost | privilege = SeTcbPrivilege |
|
2 | |
| SET_PRIVILEGE | Localhost | c:\programdata\qxtqusdnjzrizx418\tasksche.exe, os_pid = 0xa00, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITE, disable_all_privileges = 0, privilege = SeTcbPrivilege |
|
2 | |
| SET_PRIVILEGE | Localhost | c:\programdata\qxtqusdnjzrizx418\tasksche.exe, os_pid = 0xa00, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITE, disable_all_privileges = 0, privilege = |
|
2 |
| Operation | Information | Success | Count | Logfile |
|---|---|---|---|---|
| SLEEP | duration = 100 milliseconds (0.100 seconds) |
|
2 |
| Information | Value |
|---|---|
| ID | #67 |
| File Name | c:\programdata\qxtqusdnjzrizx418\taskdl.exe |
| Command Line | taskdl.exe |
| Initial Working Directory | C:\ProgramData\qxtqusdnjzrizx418 |
| Monitor | Start Time: 00:04:04, Reason: Child Process |
| Unmonitor | End Time: 00:04:10, Reason: Terminated |
| Monitor Duration | 00:00:06 |
| Information | Value |
|---|---|
| PID | 0xec0 |
| Parent PID | 0xa00 (c:\programdata\qxtqusdnjzrizx418\tasksche.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Groups |
|
| Enabled Privileges | SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege |
| Thread IDs |
0x
EC4
|
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| FIND | C:\Windows\TEMP\*.WNCRYT |
|
1 | ||
| DELETE | c:\windows\temp\164.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\209.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\214.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\215.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\216.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\235.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\hibsys.wncryt |
|
1 |
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| GET_HANDLE | c:\programdata\qxtqusdnjzrizx418\taskdl.exe | base_address = 0x400000 |
|
1 |
| Operation | Information | Success | Count | Logfile |
|---|---|---|---|---|
| SLEEP | duration = 10 milliseconds (0.010 seconds) |
|
1 |
| Information | Value |
|---|---|
| ID | #68 |
| File Name | c:\windows\system32\svchost.exe |
| Command Line | C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted |
| Initial Working Directory | C:\Windows\system32 |
| Monitor | Start Time: 00:04:05, Reason: RPC Server |
| Unmonitor | End Time: 00:04:59, Reason: Terminated by Timeout |
| Monitor Duration | 00:00:54 |
| Remarks | No high level activity detected in monitored regions |
| Information | Value |
|---|---|
| PID | 0x2c0 |
| Parent PID | 0x1d4 (c:\windows\system32\services.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\Local Service |
| Groups |
|
| Enabled Privileges | SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege |
| Thread IDs |
0x
DEC
0x
BB8
0x
B14
0x
AD4
0x
9F4
0x
9D8
0x
FE0
0x
CEC
0x
64C
0x
648
0x
490
0x
484
0x
3B4
0x
3AC
0x
39C
0x
354
0x
350
0x
34C
0x
2F8
0x
2F4
0x
2D8
0x
2D0
0x
2C4
0x
2A8
0x
2E4
|
| Name | Start VA | End VA | Type | Permissions | Monitored | Dump | YARA Match | Actions |
|---|---|---|---|---|---|---|---|---|
| pagefile_0x0000000000010000 | 0x00010000 | 0x0001ffff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000020000 | 0x00020000 | 0x00026fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x0000000000030000 | 0x00030000 | 0x00033fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x0000000000040000 | 0x00040000 | 0x00040fff | Pagefile Backed Memory | Readable |
|
|
|
|
| locale.nls | 0x00050000 | 0x000b6fff | Memory Mapped File | Readable |
|
|
|
|
| pagefile_0x00000000000c0000 | 0x000c0000 | 0x0013ffff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x0000000000140000 | 0x00140000 | 0x00141fff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| svchost.exe | 0x00150000 | 0x00157fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| private_0x0000000000160000 | 0x00160000 | 0x00160fff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000170000 | 0x00170000 | 0x00170fff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000180000 | 0x00180000 | 0x0019ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x00000000001a0000 | 0x001a0000 | 0x001dffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x00000000001e0000 | 0x001e0000 | 0x001fffff | Private Memory | Readable, Writable |
|
|
|
|
| services.exe | 0x00200000 | 0x00240fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| private_0x0000000000250000 | 0x00250000 | 0x0026ffff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000270000 | 0x00270000 | 0x00270fff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x0000000000280000 | 0x00280000 | 0x0028ffff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000290000 | 0x00290000 | 0x00357fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x0000000000360000 | 0x00360000 | 0x00360fff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x0000000000370000 | 0x00370000 | 0x003affff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x00000000003b0000 | 0x003b0000 | 0x004affff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x00000000004b0000 | 0x004b0000 | 0x005b0fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x00000000005c0000 | 0x005c0000 | 0x009b2fff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x00000000009c0000 | 0x009c0000 | 0x009dffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x00000000009e0000 | 0x009e0000 | 0x009e0fff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x00000000009f0000 | 0x009f0000 | 0x009f0fff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000a00000 | 0x00a00000 | 0x00a3ffff | Private Memory | Readable, Writable |
|
|
|
|
| winmgmtr.dll | 0x00a40000 | 0x00a42fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| pagefile_0x0000000000a50000 | 0x00a50000 | 0x00a51fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x0000000000a60000 | 0x00a60000 | 0x00a60fff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000a70000 | 0x00a70000 | 0x00a70fff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000a80000 | 0x00a80000 | 0x00a80fff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| winlogon.exe | 0x00a90000 | 0x00ad7fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| private_0x0000000000ae0000 | 0x00ae0000 | 0x00ae1fff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000af0000 | 0x00af0000 | 0x00b2ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000b40000 | 0x00b40000 | 0x00b7ffff | Private Memory | Readable, Writable |
|
|
|
|
| winlogon.exe | 0x00b80000 | 0x00bc7fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| sortdefault.nls | 0x00be0000 | 0x00eaefff | Memory Mapped File | Readable |
|
|
|
|
| private_0x0000000000eb0000 | 0x00eb0000 | 0x00faffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000fb0000 | 0x00fb0000 | 0x00feffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000001000000 | 0x01000000 | 0x0103ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000001040000 | 0x01040000 | 0x01047fff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000001080000 | 0x01080000 | 0x010bffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x00000000010f0000 | 0x010f0000 | 0x0112ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000001150000 | 0x01150000 | 0x0118ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x00000000011a0000 | 0x011a0000 | 0x011dffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x00000000011e0000 | 0x011e0000 | 0x012dffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000001310000 | 0x01310000 | 0x0134ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x00000000013a0000 | 0x013a0000 | 0x013dffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000001430000 | 0x01430000 | 0x0146ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000001480000 | 0x01480000 | 0x014bffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x00000000014d0000 | 0x014d0000 | 0x0150ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000001510000 | 0x01510000 | 0x0154ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000001550000 | 0x01550000 | 0x0164ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000001650000 | 0x01650000 | 0x0168ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000001690000 | 0x01690000 | 0x0170ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000001770000 | 0x01770000 | 0x017affff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x00000000017b0000 | 0x017b0000 | 0x017effff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000001800000 | 0x01800000 | 0x0183ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000001840000 | 0x01840000 | 0x01a3ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000001a40000 | 0x01a40000 | 0x01e41fff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000001e50000 | 0x01e50000 | 0x0224ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x00000000022a0000 | 0x022a0000 | 0x022dffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x00000000023d0000 | 0x023d0000 | 0x0240ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000002420000 | 0x02420000 | 0x0245ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x00000000024c0000 | 0x024c0000 | 0x024fffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000002550000 | 0x02550000 | 0x0258ffff | Private Memory | Readable, Writable |
|
|
|
|
| wuapi.dll | 0x6e640000 | 0x6e6cbfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| dbghelp.dll | 0x6e7d0000 | 0x6e8bafff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| wscsvc.dll | 0x6eaf0000 | 0x6eb03fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| wbemcomn.dll | 0x70ed0000 | 0x70f2bfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| cabinet.dll | 0x717d0000 | 0x717e4fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| audioses.dll | 0x71910000 | 0x71945fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| dhcpcsvc.dll | 0x727a0000 | 0x727b1fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| dhcpcsvc6.dll | 0x727c0000 | 0x727ccfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| dhcpcore6.dll | 0x72860000 | 0x72890fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| winmgmtr.dll | 0x73760000 | 0x73762fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| wbemsvc.dll | 0x73990000 | 0x7399efff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| dhcpcore.dll | 0x73c10000 | 0x73c4ffff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| nrpsrv.dll | 0x73cf0000 | 0x73cf5fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| lmhsvc.dll | 0x73d00000 | 0x73d07fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| winnsi.dll | 0x73d20000 | 0x73d26fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| iphlpapi.dll | 0x73d30000 | 0x73d4bfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| avrt.dll | 0x740b0000 | 0x740b6fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| powrprof.dll | 0x740c0000 | 0x740e4fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| audiosrv.dll | 0x740f0000 | 0x74169fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| wbemprox.dll | 0x74180000 | 0x74189fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| fastprox.dll | 0x74190000 | 0x74225fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| ntdsapi.dll | 0x742f0000 | 0x74307fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| mmdevapi.dll | 0x74540000 | 0x74578fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| propsys.dll | 0x74890000 | 0x74984fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| wevtsvc.dll | 0x74e30000 | 0x74f3bfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| version.dll | 0x74f40000 | 0x74f48fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| firewallapi.dll | 0x74f50000 | 0x74fc5fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| wshtcpip.dll | 0x74fd0000 | 0x74fd4fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| gpapi.dll | 0x75080000 | 0x75095fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| userenv.dll | 0x750a0000 | 0x750b6fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| credssp.dll | 0x75190000 | 0x75197fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| rsaenh.dll | 0x75260000 | 0x7529afff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| dnsapi.dll | 0x75340000 | 0x75383fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| wship6.dll | 0x75470000 | 0x75475fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| mswsock.dll | 0x75480000 | 0x754bbfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| cryptsp.dll | 0x754c0000 | 0x754d5fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| wevtapi.dll | 0x75680000 | 0x756c1fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| secur32.dll | 0x75900000 | 0x75907fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| sspicli.dll | 0x75920000 | 0x7593afff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| cryptbase.dll | 0x75940000 | 0x7594bfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| winsta.dll | 0x759b0000 | 0x759d8fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| rpcrtremote.dll | 0x759e0000 | 0x759edfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| profapi.dll | 0x759f0000 | 0x759fafff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| msasn1.dll | 0x75a60000 | 0x75a6bfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| crypt32.dll | 0x75a70000 | 0x75b8cfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| cfgmgr32.dll | 0x75b90000 | 0x75bb6fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| devobj.dll | 0x75bc0000 | 0x75bd1fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| wintrust.dll | 0x75be0000 | 0x75c0cfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| kernelbase.dll | 0x75c10000 | 0x75c59fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| kernel32.dll | 0x75d30000 | 0x75e03fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| imm32.dll | 0x75e10000 | 0x75e2efff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| user32.dll | 0x75f70000 | 0x76038fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| rpcrt4.dll | 0x76220000 | 0x762c0fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| ole32.dll | 0x762d0000 | 0x7642bfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| ws2_32.dll | 0x77080000 | 0x770b4fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| clbcatq.dll | 0x770c0000 | 0x77142fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| oleaut32.dll | 0x77150000 | 0x771defff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| usp10.dll | 0x771e0000 | 0x7727cfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| gdi32.dll | 0x77280000 | 0x772cdfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| shlwapi.dll | 0x77530000 | 0x77586fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| msvcrt.dll | 0x77590000 | 0x7763bfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| advapi32.dll | 0x77640000 | 0x776dffff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| sechost.dll | 0x776e0000 | 0x776f8fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| setupapi.dll | 0x77700000 | 0x7789cfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| ntdll.dll | 0x778a0000 | 0x779dbfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| lpk.dll | 0x779e0000 | 0x779e9fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| nsi.dll | 0x779f0000 | 0x779f5fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| msctf.dll | 0x77a00000 | 0x77acbfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| apisetschema.dll | 0x77ae0000 | 0x77ae0fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| pagefile_0x000000007f6f0000 | 0x7f6f0000 | 0x7f7effff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x000000007ffa3000 | 0x7ffa3000 | 0x7ffa3fff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffa4000 | 0x7ffa4000 | 0x7ffa4fff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffa5000 | 0x7ffa5000 | 0x7ffa5fff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffa6000 | 0x7ffa6000 | 0x7ffa6fff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffa9000 | 0x7ffa9000 | 0x7ffa9fff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffaa000 | 0x7ffaa000 | 0x7ffaafff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffab000 | 0x7ffab000 | 0x7ffabfff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffac000 | 0x7ffac000 | 0x7ffacfff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffad000 | 0x7ffad000 | 0x7ffadfff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffae000 | 0x7ffae000 | 0x7ffaefff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffaf000 | 0x7ffaf000 | 0x7ffaffff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x000000007ffb0000 | 0x7ffb0000 | 0x7ffd2fff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x000000007ffd3000 | 0x7ffd3000 | 0x7ffd3fff | Private Memory | Readable, Writable |
|
|
|
|
|
For performance reasons, the remaining 12 entries are omitted.
The remaining entries can be found in flog.txt. |
||||||||
| Information | Value |
|---|---|
| ID | #69 |
| File Name | c:\windows\system32\wbem\wmiadap.exe |
| Command Line | wmiadap.exe /F /T /R |
| Initial Working Directory | C:\Windows\system32 |
| Monitor | Start Time: 00:04:10, Reason: Child Process |
| Unmonitor | End Time: 00:04:59, Reason: Terminated by Timeout |
| Monitor Duration | 00:00:49 |
| Remarks | No high level activity detected in monitored regions |
| Information | Value |
|---|---|
| PID | 0xef4 |
| Parent PID | 0x364 (c:\windows\system32\svchost.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Groups |
|
| Enabled Privileges | SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege |
| Thread IDs |
0x
F0C
0x
F3C
0x
F40
0x
F48
0x
F5C
0x
F60
|
| Name | Start VA | End VA | Type | Permissions | Monitored | Dump | YARA Match | Actions |
|---|---|---|---|---|---|---|---|---|
| private_0x0000000000010000 | 0x00010000 | 0x0002ffff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000010000 | 0x00010000 | 0x0001ffff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000020000 | 0x00020000 | 0x00026fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x0000000000030000 | 0x00030000 | 0x00033fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x0000000000040000 | 0x00040000 | 0x00040fff | Pagefile Backed Memory | Readable |
|
|
|
|
| locale.nls | 0x00050000 | 0x000b6fff | Memory Mapped File | Readable |
|
|
|
|
| pagefile_0x00000000000c0000 | 0x000c0000 | 0x0013ffff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x0000000000140000 | 0x00140000 | 0x0017ffff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000180000 | 0x00180000 | 0x00181fff | Pagefile Backed Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000190000 | 0x00190000 | 0x00190fff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x00000000001a0000 | 0x001a0000 | 0x001a0fff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x00000000001b0000 | 0x001b0000 | 0x001b0fff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x00000000001c0000 | 0x001c0000 | 0x001c0fff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x0000000000230000 | 0x00230000 | 0x0032ffff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000330000 | 0x00330000 | 0x003f7fff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x0000000000410000 | 0x00410000 | 0x0041ffff | Private Memory | Readable, Writable |
|
|
|
|
| pagefile_0x0000000000420000 | 0x00420000 | 0x00520fff | Pagefile Backed Memory | Readable |
|
|
|
|
| wmiadap.exe | 0x00600000 | 0x0061efff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| private_0x0000000000670000 | 0x00670000 | 0x006affff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000700000 | 0x00700000 | 0x0073ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000750000 | 0x00750000 | 0x0078ffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x00000000007a0000 | 0x007a0000 | 0x007dffff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x0000000000820000 | 0x00820000 | 0x0085ffff | Private Memory | Readable, Writable |
|
|
|
|
| sortdefault.nls | 0x00860000 | 0x00b2efff | Memory Mapped File | Readable |
|
|
|
|
| private_0x0000000000b40000 | 0x00b40000 | 0x00b7ffff | Private Memory | Readable, Writable |
|
|
|
|
| loadperf.dll | 0x6ddc0000 | 0x6dddefff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| wbemcomn.dll | 0x70ed0000 | 0x70f2bfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| wbemsvc.dll | 0x73990000 | 0x7399efff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| wbemprox.dll | 0x74180000 | 0x74189fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| fastprox.dll | 0x74190000 | 0x74225fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| ntdsapi.dll | 0x742f0000 | 0x74307fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| rsaenh.dll | 0x75260000 | 0x7529afff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| cryptsp.dll | 0x754c0000 | 0x754d5fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| cryptbase.dll | 0x75940000 | 0x7594bfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| rpcrtremote.dll | 0x759e0000 | 0x759edfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| kernelbase.dll | 0x75c10000 | 0x75c59fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| psapi.dll | 0x75cf0000 | 0x75cf4fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| kernel32.dll | 0x75d30000 | 0x75e03fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| imm32.dll | 0x75e10000 | 0x75e2efff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| user32.dll | 0x75f70000 | 0x76038fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| rpcrt4.dll | 0x76220000 | 0x762c0fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| ole32.dll | 0x762d0000 | 0x7642bfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| ws2_32.dll | 0x77080000 | 0x770b4fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| clbcatq.dll | 0x770c0000 | 0x77142fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| oleaut32.dll | 0x77150000 | 0x771defff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| usp10.dll | 0x771e0000 | 0x7727cfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| gdi32.dll | 0x77280000 | 0x772cdfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| msvcrt.dll | 0x77590000 | 0x7763bfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| advapi32.dll | 0x77640000 | 0x776dffff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| sechost.dll | 0x776e0000 | 0x776f8fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| ntdll.dll | 0x778a0000 | 0x779dbfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| lpk.dll | 0x779e0000 | 0x779e9fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| nsi.dll | 0x779f0000 | 0x779f5fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| msctf.dll | 0x77a00000 | 0x77acbfff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| apisetschema.dll | 0x77ae0000 | 0x77ae0fff | Memory Mapped File | Readable, Writable, Executable |
|
|
|
|
| pagefile_0x000000007f6f0000 | 0x7f6f0000 | 0x7f7effff | Pagefile Backed Memory | Readable |
|
|
|
|
| pagefile_0x000000007ffb0000 | 0x7ffb0000 | 0x7ffd2fff | Pagefile Backed Memory | Readable |
|
|
|
|
| private_0x000000007ffd7000 | 0x7ffd7000 | 0x7ffd7fff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffda000 | 0x7ffda000 | 0x7ffdafff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffdb000 | 0x7ffdb000 | 0x7ffdbfff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffdc000 | 0x7ffdc000 | 0x7ffdcfff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffdd000 | 0x7ffdd000 | 0x7ffddfff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffde000 | 0x7ffde000 | 0x7ffdefff | Private Memory | Readable, Writable |
|
|
|
|
| private_0x000000007ffdf000 | 0x7ffdf000 | 0x7ffdffff | Private Memory | Readable, Writable |
|
|
|
|
| Information | Value |
|---|---|
| ID | #70 |
| File Name | c:\programdata\qxtqusdnjzrizx418\@wanadecryptor@.exe |
| Command Line | "C:\ProgramData\qxtqusdnjzrizx418\@WanaDecryptor@.exe" |
| Initial Working Directory | C:\ProgramData\qxtqusdnjzrizx418 |
| Monitor | Start Time: 00:04:10, Reason: Child Process |
| Unmonitor | End Time: 00:04:15, Reason: Terminated |
| Monitor Duration | 00:00:05 |
| Information | Value |
|---|---|
| PID | 0xf14 |
| Parent PID | 0xea0 (c:\programdata\qxtqusdnjzrizx418\taskse.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | Medium |
| Username | N3EERVTWSM\DSsDPMx042 |
| Groups |
|
| Enabled Privileges | SeChangeNotifyPrivilege |
| Thread IDs |
0x
F1C
|
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| GET_HANDLE | c:\programdata\qxtqusdnjzrizx418\@wanadecryptor@.exe | base_address = 0x400000 |
|
1 |
| Operation | Window Name | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| FIND | Wana Decrypt0r 2.0 |
|
1 |
| Information | Value |
|---|---|
| ID | #71 |
| File Name | c:\programdata\qxtqusdnjzrizx418\taskse.exe |
| Command Line | taskse.exe C:\ProgramData\qxtqusdnjzrizx418\@WanaDecryptor@.exe |
| Initial Working Directory | C:\ProgramData\qxtqusdnjzrizx418 |
| Monitor | Start Time: 00:04:10, Reason: Child Process |
| Unmonitor | End Time: 00:04:16, Reason: Terminated |
| Monitor Duration | 00:00:06 |
| Information | Value |
|---|---|
| PID | 0xf20 |
| Parent PID | 0xa00 (c:\programdata\qxtqusdnjzrizx418\tasksche.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Groups |
|
| Enabled Privileges | SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege |
| Thread IDs |
0x
F24
0x
F2C
|
| Operation | Process Name | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| CREATE | C:\ProgramData\qxtqusdnjzrizx418\@WanaDecryptor@.exe | os_tid = 0xf78, os_pid = 0xf54, creation_flags = CREATE_UNICODE_ENVIRONMENT, show_window = SW_SHOW |
|
1 | |
| OPEN_TOKEN | c:\programdata\qxtqusdnjzrizx418\tasksche.exe | os_pid = 0xa00, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITE, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITE |
|
2 |
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| LOAD | Wtsapi32.dll | base_address = 0x743d0000 |
|
1 | |
| LOAD | userenv.dll | base_address = 0x750a0000 |
|
1 | |
| GET_HANDLE | c:\programdata\qxtqusdnjzrizx418\taskse.exe | base_address = 0x400000 |
|
1 | |
| GET_HANDLE | c:\windows\system32\advapi32.dll | base_address = 0x77640000 |
|
2 | |
| GET_HANDLE | c:\windows\system32\kernel32.dll | base_address = 0x75d30000 |
|
2 | |
| GET_HANDLE | userenv.dll | base_address = 0x0 |
|
1 | |
| GET_HANDLE | c:\windows\system32\wtsapi32.dll | base_address = 0x743d0000 |
|
2 | |
| GET_HANDLE | c:\windows\system32\userenv.dll | base_address = 0x750a0000 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\wtsapi32.dll | function = WTSEnumerateSessionsA, address = 0x743d4023 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\wtsapi32.dll | function = WTSFreeMemory, address = 0x743d1b65 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = OpenProcessToken, address = 0x77654304 |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = LookupPrivilegeValueA, address = 0x7765404a |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = AdjustTokenPrivileges, address = 0x7765418e |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = DuplicateTokenEx, address = 0x7764ca24 |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = CreateProcessAsUserA, address = 0x77682538 |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = WTSGetActiveConsoleSessionId, address = 0x75d6480b |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = GetCurrentProcess, address = 0x75d7cdcf |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = CloseHandle, address = 0x75d7ca7c |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\userenv.dll | function = CreateEnvironmentBlock, address = 0x750a1a7a |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\userenv.dll | function = DestroyEnvironmentBlock, address = 0x750a1a4e |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\wtsapi32.dll | function = WTSQueryUserToken, address = 0x743d1f81 |
|
2 |
| Operation | User/Group/Server | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| LOOKUP_PRIVILEGE | Localhost | privilege = SeTcbPrivilege |
|
2 | |
| SET_PRIVILEGE | Localhost | c:\programdata\qxtqusdnjzrizx418\tasksche.exe, os_pid = 0xa00, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITE, disable_all_privileges = 0, privilege = SeTcbPrivilege |
|
2 | |
| SET_PRIVILEGE | Localhost | c:\programdata\qxtqusdnjzrizx418\tasksche.exe, os_pid = 0xa00, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITE, disable_all_privileges = 0, privilege = |
|
2 |
| Operation | Information | Success | Count | Logfile |
|---|---|---|---|---|
| SLEEP | duration = 100 milliseconds (0.100 seconds) |
|
2 |
| Information | Value |
|---|---|
| ID | #72 |
| File Name | c:\programdata\qxtqusdnjzrizx418\@wanadecryptor@.exe |
| Command Line | "C:\ProgramData\qxtqusdnjzrizx418\@WanaDecryptor@.exe" |
| Initial Working Directory | C:\ProgramData\qxtqusdnjzrizx418 |
| Monitor | Start Time: 00:04:14, Reason: Child Process |
| Unmonitor | End Time: 00:04:19, Reason: Terminated |
| Monitor Duration | 00:00:05 |
| Information | Value |
|---|---|
| PID | 0xf54 |
| Parent PID | 0xf20 (c:\programdata\qxtqusdnjzrizx418\taskse.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | Medium |
| Username | N3EERVTWSM\DSsDPMx042 |
| Groups |
|
| Enabled Privileges | SeChangeNotifyPrivilege |
| Thread IDs |
0x
F78
|
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| GET_HANDLE | c:\programdata\qxtqusdnjzrizx418\@wanadecryptor@.exe | base_address = 0x400000 |
|
1 |
| Operation | Window Name | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| FIND | Wana Decrypt0r 2.0 |
|
1 |
| Information | Value |
|---|---|
| ID | #73 |
| File Name | c:\programdata\qxtqusdnjzrizx418\taskdl.exe |
| Command Line | taskdl.exe |
| Initial Working Directory | C:\ProgramData\qxtqusdnjzrizx418 |
| Monitor | Start Time: 00:04:20, Reason: Child Process |
| Unmonitor | End Time: 00:04:22, Reason: Terminated |
| Monitor Duration | 00:00:02 |
| Information | Value |
|---|---|
| PID | 0xf80 |
| Parent PID | 0xa00 (c:\programdata\qxtqusdnjzrizx418\tasksche.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Groups |
|
| Enabled Privileges | SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege |
| Thread IDs |
0x
9F0
|
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| FIND | C:\Windows\TEMP\*.WNCRYT |
|
1 | ||
| DELETE | c:\windows\temp\164.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\209.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\214.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\215.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\216.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\235.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\hibsys.wncryt |
|
1 |
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| GET_HANDLE | c:\programdata\qxtqusdnjzrizx418\taskdl.exe | base_address = 0x400000 |
|
1 |
| Operation | Information | Success | Count | Logfile |
|---|---|---|---|---|
| SLEEP | duration = 10 milliseconds (0.010 seconds) |
|
1 |
| Information | Value |
|---|---|
| ID | #74 |
| File Name | c:\programdata\qxtqusdnjzrizx418\taskse.exe |
| Command Line | taskse.exe C:\ProgramData\qxtqusdnjzrizx418\@WanaDecryptor@.exe |
| Initial Working Directory | C:\ProgramData\qxtqusdnjzrizx418 |
| Monitor | Start Time: 00:04:21, Reason: Child Process |
| Unmonitor | End Time: 00:04:25, Reason: Terminated |
| Monitor Duration | 00:00:04 |
| Information | Value |
|---|---|
| PID | 0xf88 |
| Parent PID | 0xa00 (c:\programdata\qxtqusdnjzrizx418\tasksche.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Groups |
|
| Enabled Privileges | SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege |
| Thread IDs |
0x
F8C
0x
F94
|
| Operation | Process Name | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| CREATE | C:\ProgramData\qxtqusdnjzrizx418\@WanaDecryptor@.exe | os_tid = 0xa10, os_pid = 0x664, creation_flags = CREATE_UNICODE_ENVIRONMENT, show_window = SW_SHOW |
|
1 | |
| OPEN_TOKEN | c:\programdata\qxtqusdnjzrizx418\tasksche.exe | os_pid = 0xa00, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITE, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITE |
|
2 |
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| LOAD | Wtsapi32.dll | base_address = 0x743d0000 |
|
1 | |
| LOAD | userenv.dll | base_address = 0x750a0000 |
|
1 | |
| GET_HANDLE | c:\programdata\qxtqusdnjzrizx418\taskse.exe | base_address = 0x400000 |
|
1 | |
| GET_HANDLE | c:\windows\system32\advapi32.dll | base_address = 0x77640000 |
|
2 | |
| GET_HANDLE | c:\windows\system32\kernel32.dll | base_address = 0x75d30000 |
|
2 | |
| GET_HANDLE | userenv.dll | base_address = 0x0 |
|
1 | |
| GET_HANDLE | c:\windows\system32\wtsapi32.dll | base_address = 0x743d0000 |
|
2 | |
| GET_HANDLE | c:\windows\system32\userenv.dll | base_address = 0x750a0000 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\wtsapi32.dll | function = WTSEnumerateSessionsA, address = 0x743d4023 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\wtsapi32.dll | function = WTSFreeMemory, address = 0x743d1b65 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = OpenProcessToken, address = 0x77654304 |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = LookupPrivilegeValueA, address = 0x7765404a |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = AdjustTokenPrivileges, address = 0x7765418e |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = DuplicateTokenEx, address = 0x7764ca24 |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = CreateProcessAsUserA, address = 0x77682538 |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = WTSGetActiveConsoleSessionId, address = 0x75d6480b |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = GetCurrentProcess, address = 0x75d7cdcf |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = CloseHandle, address = 0x75d7ca7c |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\userenv.dll | function = CreateEnvironmentBlock, address = 0x750a1a7a |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\userenv.dll | function = DestroyEnvironmentBlock, address = 0x750a1a4e |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\wtsapi32.dll | function = WTSQueryUserToken, address = 0x743d1f81 |
|
2 |
| Operation | User/Group/Server | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| LOOKUP_PRIVILEGE | Localhost | privilege = SeTcbPrivilege |
|
2 | |
| SET_PRIVILEGE | Localhost | c:\programdata\qxtqusdnjzrizx418\tasksche.exe, os_pid = 0xa00, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITE, disable_all_privileges = 0, privilege = SeTcbPrivilege |
|
2 | |
| SET_PRIVILEGE | Localhost | c:\programdata\qxtqusdnjzrizx418\tasksche.exe, os_pid = 0xa00, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITE, disable_all_privileges = 0, privilege = |
|
2 |
| Operation | Information | Success | Count | Logfile |
|---|---|---|---|---|
| SLEEP | duration = 100 milliseconds (0.100 seconds) |
|
2 |
| Information | Value |
|---|---|
| ID | #75 |
| File Name | c:\programdata\qxtqusdnjzrizx418\@wanadecryptor@.exe |
| Command Line | "C:\ProgramData\qxtqusdnjzrizx418\@WanaDecryptor@.exe" |
| Initial Working Directory | C:\ProgramData\qxtqusdnjzrizx418 |
| Monitor | Start Time: 00:04:23, Reason: Child Process |
| Unmonitor | End Time: 00:04:28, Reason: Terminated |
| Monitor Duration | 00:00:05 |
| Information | Value |
|---|---|
| PID | 0x664 |
| Parent PID | 0xf88 (c:\programdata\qxtqusdnjzrizx418\taskse.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | Medium |
| Username | N3EERVTWSM\DSsDPMx042 |
| Groups |
|
| Enabled Privileges | SeChangeNotifyPrivilege |
| Thread IDs |
0x
A10
|
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| GET_HANDLE | c:\programdata\qxtqusdnjzrizx418\@wanadecryptor@.exe | base_address = 0x400000 |
|
1 |
| Operation | Window Name | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| FIND | Wana Decrypt0r 2.0 |
|
1 |
| Information | Value |
|---|---|
| ID | #76 |
| File Name | c:\programdata\qxtqusdnjzrizx418\taskse.exe |
| Command Line | taskse.exe C:\ProgramData\qxtqusdnjzrizx418\@WanaDecryptor@.exe |
| Initial Working Directory | C:\ProgramData\qxtqusdnjzrizx418 |
| Monitor | Start Time: 00:04:32, Reason: Child Process |
| Unmonitor | End Time: 00:04:36, Reason: Terminated |
| Monitor Duration | 00:00:04 |
| Information | Value |
|---|---|
| PID | 0x180 |
| Parent PID | 0xa00 (c:\programdata\qxtqusdnjzrizx418\tasksche.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Groups |
|
| Enabled Privileges | SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege |
| Thread IDs |
0x
7B4
0x
EE8
|
| Operation | Process Name | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| CREATE | C:\ProgramData\qxtqusdnjzrizx418\@WanaDecryptor@.exe | os_tid = 0x598, os_pid = 0x7a0, creation_flags = CREATE_UNICODE_ENVIRONMENT, show_window = SW_SHOW |
|
1 | |
| OPEN_TOKEN | c:\programdata\qxtqusdnjzrizx418\tasksche.exe | os_pid = 0xa00, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITE, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITE |
|
2 |
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| LOAD | Wtsapi32.dll | base_address = 0x743d0000 |
|
1 | |
| LOAD | userenv.dll | base_address = 0x750a0000 |
|
1 | |
| GET_HANDLE | c:\programdata\qxtqusdnjzrizx418\taskse.exe | base_address = 0x400000 |
|
1 | |
| GET_HANDLE | c:\windows\system32\advapi32.dll | base_address = 0x77640000 |
|
2 | |
| GET_HANDLE | c:\windows\system32\kernel32.dll | base_address = 0x75d30000 |
|
2 | |
| GET_HANDLE | userenv.dll | base_address = 0x0 |
|
1 | |
| GET_HANDLE | c:\windows\system32\wtsapi32.dll | base_address = 0x743d0000 |
|
2 | |
| GET_HANDLE | c:\windows\system32\userenv.dll | base_address = 0x750a0000 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\wtsapi32.dll | function = WTSEnumerateSessionsA, address = 0x743d4023 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\wtsapi32.dll | function = WTSFreeMemory, address = 0x743d1b65 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = OpenProcessToken, address = 0x77654304 |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = LookupPrivilegeValueA, address = 0x7765404a |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = AdjustTokenPrivileges, address = 0x7765418e |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = DuplicateTokenEx, address = 0x7764ca24 |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = CreateProcessAsUserA, address = 0x77682538 |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = WTSGetActiveConsoleSessionId, address = 0x75d6480b |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = GetCurrentProcess, address = 0x75d7cdcf |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = CloseHandle, address = 0x75d7ca7c |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\userenv.dll | function = CreateEnvironmentBlock, address = 0x750a1a7a |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\userenv.dll | function = DestroyEnvironmentBlock, address = 0x750a1a4e |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\wtsapi32.dll | function = WTSQueryUserToken, address = 0x743d1f81 |
|
2 |
| Operation | User/Group/Server | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| LOOKUP_PRIVILEGE | Localhost | privilege = SeTcbPrivilege |
|
2 | |
| SET_PRIVILEGE | Localhost | c:\programdata\qxtqusdnjzrizx418\tasksche.exe, os_pid = 0xa00, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITE, disable_all_privileges = 0, privilege = SeTcbPrivilege |
|
2 | |
| SET_PRIVILEGE | Localhost | c:\programdata\qxtqusdnjzrizx418\tasksche.exe, os_pid = 0xa00, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITE, disable_all_privileges = 0, privilege = |
|
2 |
| Operation | Information | Success | Count | Logfile |
|---|---|---|---|---|
| SLEEP | duration = 100 milliseconds (0.100 seconds) |
|
2 |
| Information | Value |
|---|---|
| ID | #77 |
| File Name | c:\programdata\qxtqusdnjzrizx418\taskdl.exe |
| Command Line | taskdl.exe |
| Initial Working Directory | C:\ProgramData\qxtqusdnjzrizx418 |
| Monitor | Start Time: 00:04:32, Reason: Child Process |
| Unmonitor | End Time: 00:04:35, Reason: Terminated |
| Monitor Duration | 00:00:03 |
| Information | Value |
|---|---|
| PID | 0xc20 |
| Parent PID | 0xa00 (c:\programdata\qxtqusdnjzrizx418\tasksche.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Groups |
|
| Enabled Privileges | SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege |
| Thread IDs |
0x
EF0
|
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| FIND | C:\Windows\TEMP\*.WNCRYT |
|
1 | ||
| DELETE | c:\windows\temp\164.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\209.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\214.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\215.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\216.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\235.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\hibsys.wncryt |
|
1 |
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| GET_HANDLE | c:\programdata\qxtqusdnjzrizx418\taskdl.exe | base_address = 0x400000 |
|
1 |
| Operation | Information | Success | Count | Logfile |
|---|---|---|---|---|
| SLEEP | duration = 10 milliseconds (0.010 seconds) |
|
1 |
| Information | Value |
|---|---|
| ID | #78 |
| File Name | c:\programdata\qxtqusdnjzrizx418\@wanadecryptor@.exe |
| Command Line | "C:\ProgramData\qxtqusdnjzrizx418\@WanaDecryptor@.exe" |
| Initial Working Directory | C:\ProgramData\qxtqusdnjzrizx418 |
| Monitor | Start Time: 00:04:34, Reason: Child Process |
| Unmonitor | End Time: 00:04:37, Reason: Terminated |
| Monitor Duration | 00:00:03 |
| Information | Value |
|---|---|
| PID | 0x7a0 |
| Parent PID | 0x180 (c:\programdata\qxtqusdnjzrizx418\taskse.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | Medium |
| Username | N3EERVTWSM\DSsDPMx042 |
| Groups |
|
| Enabled Privileges | SeChangeNotifyPrivilege |
| Thread IDs |
0x
598
|
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| GET_HANDLE | c:\programdata\qxtqusdnjzrizx418\@wanadecryptor@.exe | base_address = 0x400000 |
|
1 |
| Operation | Window Name | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| FIND | Wana Decrypt0r 2.0 |
|
1 |
| Information | Value |
|---|---|
| ID | #79 |
| File Name | c:\programdata\qxtqusdnjzrizx418\taskse.exe |
| Command Line | taskse.exe C:\ProgramData\qxtqusdnjzrizx418\@WanaDecryptor@.exe |
| Initial Working Directory | C:\ProgramData\qxtqusdnjzrizx418 |
| Monitor | Start Time: 00:04:43, Reason: Child Process |
| Unmonitor | End Time: 00:04:47, Reason: Terminated |
| Monitor Duration | 00:00:04 |
| Information | Value |
|---|---|
| PID | 0xff0 |
| Parent PID | 0xa00 (c:\programdata\qxtqusdnjzrizx418\tasksche.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Groups |
|
| Enabled Privileges | SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege |
| Thread IDs |
0x
4F0
0x
874
|
| Operation | Process Name | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| CREATE | C:\ProgramData\qxtqusdnjzrizx418\@WanaDecryptor@.exe | os_tid = 0x83c, os_pid = 0x474, creation_flags = CREATE_UNICODE_ENVIRONMENT, show_window = SW_SHOW |
|
1 | |
| OPEN_TOKEN | c:\programdata\qxtqusdnjzrizx418\tasksche.exe | os_pid = 0xa00, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITE, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITE |
|
2 |
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| LOAD | Wtsapi32.dll | base_address = 0x743d0000 |
|
1 | |
| LOAD | userenv.dll | base_address = 0x750a0000 |
|
1 | |
| GET_HANDLE | c:\programdata\qxtqusdnjzrizx418\taskse.exe | base_address = 0x400000 |
|
1 | |
| GET_HANDLE | c:\windows\system32\advapi32.dll | base_address = 0x77640000 |
|
2 | |
| GET_HANDLE | c:\windows\system32\kernel32.dll | base_address = 0x75d30000 |
|
2 | |
| GET_HANDLE | userenv.dll | base_address = 0x0 |
|
1 | |
| GET_HANDLE | c:\windows\system32\wtsapi32.dll | base_address = 0x743d0000 |
|
2 | |
| GET_HANDLE | c:\windows\system32\userenv.dll | base_address = 0x750a0000 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\wtsapi32.dll | function = WTSEnumerateSessionsA, address = 0x743d4023 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\wtsapi32.dll | function = WTSFreeMemory, address = 0x743d1b65 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = OpenProcessToken, address = 0x77654304 |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = LookupPrivilegeValueA, address = 0x7765404a |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = AdjustTokenPrivileges, address = 0x7765418e |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = DuplicateTokenEx, address = 0x7764ca24 |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = CreateProcessAsUserA, address = 0x77682538 |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = WTSGetActiveConsoleSessionId, address = 0x75d6480b |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = GetCurrentProcess, address = 0x75d7cdcf |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = CloseHandle, address = 0x75d7ca7c |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\userenv.dll | function = CreateEnvironmentBlock, address = 0x750a1a7a |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\userenv.dll | function = DestroyEnvironmentBlock, address = 0x750a1a4e |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\wtsapi32.dll | function = WTSQueryUserToken, address = 0x743d1f81 |
|
2 |
| Operation | User/Group/Server | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| LOOKUP_PRIVILEGE | Localhost | privilege = SeTcbPrivilege |
|
2 | |
| SET_PRIVILEGE | Localhost | c:\programdata\qxtqusdnjzrizx418\tasksche.exe, os_pid = 0xa00, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITE, disable_all_privileges = 0, privilege = SeTcbPrivilege |
|
2 | |
| SET_PRIVILEGE | Localhost | c:\programdata\qxtqusdnjzrizx418\tasksche.exe, os_pid = 0xa00, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITE, disable_all_privileges = 0, privilege = |
|
2 |
| Operation | Information | Success | Count | Logfile |
|---|---|---|---|---|
| SLEEP | duration = 100 milliseconds (0.100 seconds) |
|
2 |
| Information | Value |
|---|---|
| ID | #80 |
| File Name | c:\programdata\qxtqusdnjzrizx418\taskdl.exe |
| Command Line | taskdl.exe |
| Initial Working Directory | C:\ProgramData\qxtqusdnjzrizx418 |
| Monitor | Start Time: 00:04:44, Reason: Child Process |
| Unmonitor | End Time: 00:04:45, Reason: Terminated |
| Monitor Duration | 00:00:01 |
| Information | Value |
|---|---|
| PID | 0x498 |
| Parent PID | 0xa00 (c:\programdata\qxtqusdnjzrizx418\tasksche.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Groups |
|
| Enabled Privileges | SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege |
| Thread IDs |
0x
860
|
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| FIND | C:\Windows\TEMP\*.WNCRYT |
|
1 | ||
| DELETE | c:\windows\temp\164.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\209.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\214.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\215.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\216.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\235.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\hibsys.wncryt |
|
1 |
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| GET_HANDLE | c:\programdata\qxtqusdnjzrizx418\taskdl.exe | base_address = 0x400000 |
|
1 |
| Operation | Information | Success | Count | Logfile |
|---|---|---|---|---|
| SLEEP | duration = 10 milliseconds (0.010 seconds) |
|
1 |
| Information | Value |
|---|---|
| ID | #81 |
| File Name | c:\programdata\qxtqusdnjzrizx418\@wanadecryptor@.exe |
| Command Line | "C:\ProgramData\qxtqusdnjzrizx418\@WanaDecryptor@.exe" |
| Initial Working Directory | C:\ProgramData\qxtqusdnjzrizx418 |
| Monitor | Start Time: 00:04:45, Reason: Child Process |
| Unmonitor | End Time: 00:04:48, Reason: Terminated |
| Monitor Duration | 00:00:03 |
| Information | Value |
|---|---|
| PID | 0x474 |
| Parent PID | 0xff0 (c:\programdata\qxtqusdnjzrizx418\taskse.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | Medium |
| Username | N3EERVTWSM\DSsDPMx042 |
| Groups |
|
| Enabled Privileges | SeChangeNotifyPrivilege |
| Thread IDs |
0x
83C
|
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| GET_HANDLE | c:\programdata\qxtqusdnjzrizx418\@wanadecryptor@.exe | base_address = 0x400000 |
|
1 |
| Operation | Window Name | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| FIND | Wana Decrypt0r 2.0 |
|
1 |
| Information | Value |
|---|---|
| ID | #82 |
| File Name | c:\programdata\qxtqusdnjzrizx418\taskse.exe |
| Command Line | taskse.exe C:\ProgramData\qxtqusdnjzrizx418\@WanaDecryptor@.exe |
| Initial Working Directory | C:\ProgramData\qxtqusdnjzrizx418 |
| Monitor | Start Time: 00:04:53, Reason: Child Process |
| Unmonitor | End Time: 00:04:59, Reason: Terminated by Timeout |
| Monitor Duration | 00:00:06 |
| Information | Value |
|---|---|
| PID | 0x728 |
| Parent PID | 0xa00 (c:\programdata\qxtqusdnjzrizx418\tasksche.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Groups |
|
| Enabled Privileges | SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege |
| Thread IDs |
0x
408
0x
694
|
| Operation | Process Name | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| CREATE | C:\ProgramData\qxtqusdnjzrizx418\@WanaDecryptor@.exe | os_tid = 0x120, os_pid = 0x6dc, creation_flags = CREATE_UNICODE_ENVIRONMENT, show_window = SW_SHOW |
|
1 | |
| OPEN_TOKEN | c:\programdata\qxtqusdnjzrizx418\tasksche.exe | os_pid = 0xa00, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITE, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITE |
|
2 |
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| LOAD | Wtsapi32.dll | base_address = 0x743d0000 |
|
1 | |
| LOAD | userenv.dll | base_address = 0x750a0000 |
|
1 | |
| GET_HANDLE | c:\programdata\qxtqusdnjzrizx418\taskse.exe | base_address = 0x400000 |
|
1 | |
| GET_HANDLE | c:\windows\system32\advapi32.dll | base_address = 0x77640000 |
|
2 | |
| GET_HANDLE | c:\windows\system32\kernel32.dll | base_address = 0x75d30000 |
|
2 | |
| GET_HANDLE | userenv.dll | base_address = 0x0 |
|
1 | |
| GET_HANDLE | c:\windows\system32\wtsapi32.dll | base_address = 0x743d0000 |
|
2 | |
| GET_HANDLE | c:\windows\system32\userenv.dll | base_address = 0x750a0000 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\wtsapi32.dll | function = WTSEnumerateSessionsA, address = 0x743d4023 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\wtsapi32.dll | function = WTSFreeMemory, address = 0x743d1b65 |
|
1 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = OpenProcessToken, address = 0x77654304 |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = LookupPrivilegeValueA, address = 0x7765404a |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = AdjustTokenPrivileges, address = 0x7765418e |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = DuplicateTokenEx, address = 0x7764ca24 |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\advapi32.dll | function = CreateProcessAsUserA, address = 0x77682538 |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = WTSGetActiveConsoleSessionId, address = 0x75d6480b |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = GetCurrentProcess, address = 0x75d7cdcf |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\kernel32.dll | function = CloseHandle, address = 0x75d7ca7c |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\userenv.dll | function = CreateEnvironmentBlock, address = 0x750a1a7a |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\userenv.dll | function = DestroyEnvironmentBlock, address = 0x750a1a4e |
|
2 | |
| GET_PROC_ADDRESS | c:\windows\system32\wtsapi32.dll | function = WTSQueryUserToken, address = 0x743d1f81 |
|
2 |
| Operation | User/Group/Server | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| LOOKUP_PRIVILEGE | Localhost | privilege = SeTcbPrivilege |
|
2 | |
| SET_PRIVILEGE | Localhost | c:\programdata\qxtqusdnjzrizx418\tasksche.exe, os_pid = 0xa00, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITE, disable_all_privileges = 0, privilege = SeTcbPrivilege |
|
2 | |
| SET_PRIVILEGE | Localhost | c:\programdata\qxtqusdnjzrizx418\tasksche.exe, os_pid = 0xa00, desired_access = PROCESS_VM_OPERATION, PROCESS_VM_WRITE, disable_all_privileges = 0, privilege = |
|
2 |
| Operation | Information | Success | Count | Logfile |
|---|---|---|---|---|
| SLEEP | duration = 100 milliseconds (0.100 seconds) |
|
2 |
| Information | Value |
|---|---|
| ID | #83 |
| File Name | c:\programdata\qxtqusdnjzrizx418\@wanadecryptor@.exe |
| Command Line | "C:\ProgramData\qxtqusdnjzrizx418\@WanaDecryptor@.exe" |
| Initial Working Directory | C:\ProgramData\qxtqusdnjzrizx418 |
| Monitor | Start Time: 00:04:55, Reason: Child Process |
| Unmonitor | End Time: 00:04:59, Reason: Terminated by Timeout |
| Monitor Duration | 00:00:04 |
| Information | Value |
|---|---|
| PID | 0x6dc |
| Parent PID | 0x728 (c:\programdata\qxtqusdnjzrizx418\taskse.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | Medium |
| Username | N3EERVTWSM\DSsDPMx042 |
| Groups |
|
| Enabled Privileges | SeChangeNotifyPrivilege |
| Thread IDs |
0x
120
|
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| GET_HANDLE | c:\programdata\qxtqusdnjzrizx418\@wanadecryptor@.exe | base_address = 0x400000 |
|
1 |
| Operation | Window Name | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| FIND | Wana Decrypt0r 2.0 |
|
1 |
| Information | Value |
|---|---|
| ID | #84 |
| File Name | c:\programdata\qxtqusdnjzrizx418\taskdl.exe |
| Command Line | taskdl.exe |
| Initial Working Directory | C:\ProgramData\qxtqusdnjzrizx418 |
| Monitor | Start Time: 00:04:55, Reason: Child Process |
| Unmonitor | End Time: 00:04:59, Reason: Terminated by Timeout |
| Monitor Duration | 00:00:04 |
| Information | Value |
|---|---|
| PID | 0x430 |
| Parent PID | 0xa00 (c:\programdata\qxtqusdnjzrizx418\tasksche.exe) |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Groups |
|
| Enabled Privileges | SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege |
| Thread IDs |
0x
784
|
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| FIND | C:\Windows\TEMP\*.WNCRYT |
|
1 | ||
| DELETE | c:\windows\temp\164.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\209.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\214.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\215.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\216.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\235.wncryt |
|
1 | ||
| DELETE | c:\windows\temp\hibsys.wncryt |
|
1 |
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| GET_HANDLE | c:\programdata\qxtqusdnjzrizx418\taskdl.exe | base_address = 0x400000 |
|
1 |
| Operation | Information | Success | Count | Logfile |
|---|---|---|---|---|
| SLEEP | duration = 10 milliseconds (0.010 seconds) |
|
1 |
