Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations

Domains/URLs

4.ddns.me

6.ddns.me

7.ddns.me

alashsec.hopto.me

asan.zapto.org

auth-update-check.myddns.me

blog-tecnet-microsoft.serveftp.com

blog-tecnet-microsoft.servegame.com

blog-tecnet-microsoft.servehttp.com

catalog-update-microsoft.serveftp.com

catalog-update-microsoft.servehttp.com

catalog-update-unix-systems.servehttp.com

catalog-update-update-microsoft.serveftp.com

cdn-redhatcom.serveftp.com

cdn-redhatupdate.serveftp.com

corehost.ddns.net

cs.access.ly

ctldl-windowsupdate.ddns.net

darkpc.zapto.org

daww3420.myddns.me

debian-update-system.servehttp.com

domain-server-ms.securitytactics.com

drivers-microsoft-catalog.serveirc.com

drivers-windows-update.serveirc.com

dtco.ddns.net

ekolabrecycling.ddns.net

english.read-books.org

esd.asan.gov.zapto.org

forti.access.ly

gov.zapto.org

gptbot.sytes.net

inform.zapto.org

it-support.workisboring.com

licensing-mp-microsoft.serveexchange.com

linux-update-system.serveftp.com

loading.hopto.me

mail-english.read-books.org

mail.english.read-books.org

mail.mobatex.ddns.net

maill.ddns.net

maill.loginto.me

main.servecounterstrike.com

microsoft-secure-login.servehttp.com

microsoft-service-manager.serveftp.com

microsoft-update-catalog.servehttp.com

microsoft-updates-check-windows.serveftp.com

microsoft-updates-windows.servehttp.com

microsoft-ws-updates.serveftp.com

mirror-centos-vault.serveftp.com

mobatex.ddns.net

msedge-api-cdp-microsoft.serveftp.com

msws-updates.ddns.me

n8nbot.sytes.net

networks.zapto.org

ntservicepack-update-microsoft.serveftp.com

q1q.ddns.net

repo-centos-webstatic-world.securitytactics.com

repo-centos-webtatic.serveftp.com

repo-ubuntu-webstatic-world.securitytactics.com

repo-webtatic-server.servehttp.com

security-updates-microsoft.servehttp.com

serviceupdate.dynns.com

srv.corehost.ddns.net

support-center-freeexchange.ddns.net

support-center.serveexchange.com

support-service-update.serveftp.com

systeminfo.dynns.com

sysupdate.serveftp.com

telecommand-telemetry-microsoft.servehttp.com

terea.serveexchange.com

toolbox.ddns.net

u.ddns.me

update-service-host.serveftp.com

updates-check-microsoft.ddns.net

upgrade.securitytactics.com

windows-config-update.myddns.me

windows-rms.servehttp.com

windows-update-catalog.serveftp.com

windows-update-server-microsoft.servehttp.com

windows-update-ws.servehttp.com

windows-update.damnserver.com

windows-updates-check.ddns.net

windowsupdate-microsoft-com.servehttp.com

www-mfa-gov-tm.dynns.com

yandex-cloud.ddns.me

https://raw.githubusercontent.com/GoBuster7777/asd/main/1.ps1

https://raw.githubusercontent.com/xzj4/1/refs/heads/main/1.exe

https://raw.githubusercontent.com/xzj4/1/refs/heads/main/324.ps1

https://raw.githubusercontent.com/xzj4/1/refs/heads/main/456.ps1

https://raw.githubusercontent.com/xzj4/1/refs/heads/main/569.ps1

https://raw.githubusercontent.com/xzj4/1/refs/heads/main/753.ps1

https://raw.githubusercontent.com/xzj4/1/refs/heads/main/789.ps1

https://raw.githubusercontent.com/xzj4/1/refs/heads/main/Rrnsvc.exe

https://raw.githubusercontent.com/xzj4/1/refs/heads/main/carnsvc.exe

https://raw.githubusercontent.com/xzj4/1/refs/heads/main/wcrnsvc.exe

http://6.ddns.me/789.ps1

http://updates-check-microsoft.ddns.net/1.pdf

http://updates-check-microsoft.ddns.net/MicrosoftOfficeUpdate.zip

http://62.113.66.137/WindowsUpdateService.vbs

http://62.113.66.137/WindowsUpdateService.ps1

http://62.113.66.137/comhost.exe

http://62.113.66.137/ssdpdrv.exe

http://62.113.66.137/libssl-3.dll

http://62.113.66.137/libcrypto-3.dll

http://104.248.17.222:443/9.exe

http://104.248.17.222:80/rev.elf

http://104.248.17.222:80/linux-update-repos.elf

http://104.248.17.222:8081/fish.exe

http://154.205.145.179:8000/agent.exe

http://154.205.145.179:8000/dwm.exe

http://154.205.145.179:8000/dwm.7z

http://154.205.145.179:8000/obsf.exe

http://154.205.145.179:8000/kworkerr

http://154.205.145.179:8000/fscan

http://154.205.145.179:8000/ligolo-mp_linux_amd64

http://178.128.40.89:8989/shell.exe

IP Address

37.18.27.27

37.18.88.6

37.18.88.25

38.60.209.55

45.130.146.197

46.17.42.29

46.17.46.156

46.101.148.177

46.101.172.27

62.113.66.7

62.113.66.17

62.113.66.137

64.227.130.177

68.183.68.108

89.22.168.20

89.22.169.22

89.22.173.5

89.22.173.39

89.22.173.54

89.110.93.25

91.149.240.142

91.245.60.45

94.139.242.46

104.248.17.222

104.248.242.121

138.68.93.248

138.68.226.28

138.197.123.236

139.59.106.112

143.244.129.125

148.135.59.32

154.18.187.239

154.18.239.238

154.205.145.20

154.205.145.179

166.1.22.248

167.17.183.223

167.99.248.28

173.249.13.174

176.32.38.168

176.109.87.14

176.109.87.28

176.109.87.29

178.128.40.89

178.170.220.14

178.236.22.27

178.236.22.28

178.236.22.54

185.125.203.150

185.158.153.13

188.72.76.36

188.72.77.166

188.227.16.2

188.227.16.6

188.227.74.19

192.3.229.231

194.87.82.8

195.133.55.31

195.133.55.162

206.189.11.142

206.189.104.65

206.189.216.89

207.154.223.11

Hash

dff3461b7b0b793c6dc62a63ffb6560c3babd7ca0b8d479ee2f7cbd4486c9d85

2deda9985c6e8cca888a58746c96ae686a1aaf5c0b7a236c7557d88b4050f1f9

80565a0855ed142decae819fbfa79a083b5cd90f5234106b0ae16b1d21affa3c

58bb311f564489ace95740498b8db7c039809e5b76747fd3ed67d27aa8ed1ce2

2915d5eb099a3673324148c1ca75311aebbe706fe706281310942d728127b504

b5a4f459bdff7947f27474840062cfce14ee2b1a0ef84da100679bc4aa2fcf77

bb269b19beed984f99fdbce745286ac75bb235f91f113d4dae0752cf2fbed6b5

a527a96b091730408c62fa1414052cf7c527724d93a537f821d18333cfb9dbcd

5c6b0f1ee2960a87e47ccf880c8780d4d7807eda5b33a02c262ecadf803de276

09cd1581f5f6a9db131e3c92c931f9c3b2f90b7a639d5cb85b29fb92ee937a4a

6e30a01b8175bac359bb85cf5ced9a1920aa6098a26affa4fc780323a549ce19

a38af45a67fc9070d46649feab0b347011585d1e547fe88185e70dea6e6582ea

d7e0d98b9e574f3c47880f3f021de9e455d0807f733acfe27142c4dffb8fc7bd

6806029ed72de2b592c18edb430ffabd56137a8428b7c23860ae4f000a02f0af

907ce23b85da7e72c29cf55505765987f32e867a3361a53e61a52034d0a70c85

237a971277e1f549b950999f0334aa23d6238edf3f3693b3c9acfd13c75798c0

a05ece531189c12581493a60c8016174af69aa7978ba72acadc2e921210dc838

2a3e8405523a3a911ecebc90b067c2c8ad0fe56a0a07fbc9c3f772e397492eba

de9d6d5cecf9c8ccb56b1c91ad4058e2f1def0c4b616b986055ff14242792229

1b6808161f1ee5c545895ad2f33daea483b5b85defab7c17995b7701fa3ef1cc

e9c2a219ee9b80cee8f39abd3562ac618aeacfa50c4bd0f1faa3bac6ada90964

392b70086f10c23ce7b4173d1f68d72727ea0146260fb773c78642f6eb641775

754311b2fe001ca1a60166bafe0c48d13c7277623f263861cfc743d0557e696d

27b6075cf2dc22a55afdf58548a90b6b983f396d901801bfc7a1a95ca1166a5f

be3124c0fd67dffc41c0c76c5e4e4dea23623417a6374dd6bb9583e0641bf3c6

44af608e1f151932fa098b8ac06a424b681b167133a0c750d836c94fb91f4077

803bd2bd9f93e6ab794dc7af1686b127c6fc2ddd5bf0e934cda0b582a879ba41

691c1d6c02c0153bdfaf6fb31506cd3aced24ed9902747c39fa6ac2094c202f1

b0b2d12a377f3d02cc49165d69a5839c06f11986716a04b3a068e8dac6de7194

f379351908ddde7b0ee44e71ee395f92339cb2d87a7fb470eda23895afeea938

31bbd8f26ea51ee99b8126ef8afd20a99756fd89140a26f9f16570d302aed64c

43dcb336876bd374a4125c4f6c2e1b6ce1b03297ab7692a8506fbe1c33be3582

97ef4aaa61beaff8f404187834ea3c5e628b41570ee1a5f23e7a43f84ee41ae6

974dc6f3172d51f39eaa4693aeaf9706bd8bf66a76439e01ddf29f6500e037fc

3590d897dd0c2350fe36460af85f7a76151c461380b146bc7edc9f01e276265e

97969978799100c7be211b9bf8a152bbd826ba6cb55377284537b381a4814216

909a7cb3cc5ec6722b03d3538780fbd096e639a8f2993f6ea4d81d8fdba8bdda

2c1764610a7f3113bb01fdaeede3b411acc99843bbb7d642c26024a601460efe

2a2166b1342fd83ea0fb3e81e2b424a7360716f9b43e7b7f3b6731e5a51c329a

0bce0e213690120afc94b53390d93a8874562de5ddcc5511c7b9b9d95cf8a15d

821f1ee371482bfa9b5ff1aff33705ed16e0147a9375d7a9969974c43b9e16e8

ae51aef21ea4b422ef0c7eb025356e45d1ce405d66afbb3f6479d10d0600bcfd

c663165e18319faf44a22e9286b53e1cfd974901a6b077aaf850a90e40d5ecc6

6dfa12fbf5543984b799d502f6c52d078e46294c665a1581c54ce19da2b6e33a

ce7886943034f9e3896d54d46b5e815c1eed39822e6238a6e8a81186828e1dfc

a7506a1d6818d69329d6d5e03f281337b74da045e818f81fbe6eced1b148df54

2f62bbf3430c464ccbf42f7e449ddd1d48f95125cf2f472dce2e3e6c19bd1d4a

c1bdcfd686d40cee8e58833b294ca478b0b843583bb8ece98022aa0c94e2f7cd

19082f36392e48f68d61889ebf408b767810db3cbe081e66466b3ee8d36c1231

67d918d70b6231b141433db238f19bec26fdf60c66841adf9179536eddcd0f5c

ae1511cf6f1f1f01e6508bf3ca798355bef3acfecf50ed5ff1513d9a44f0588a

3b99dddf185d17f397d81e7403993221d582a2df4938964254376cc70e1dc927

26aca51d555a0ea6d80715d8c6a9f49fea158dee11631735e16ea75c443a5802

a639a9043334dcd95e7cd239f8816851517ebb3850c6066a4f64ac39281242a3

32035c9d3b81ad72913f8db42038fcf6d95b51d4d84208067fe22cf6323f133c

b0ac155b99bc5cf17ecfd8d3c26037456bc59643344a3a30a92e2c71c4c6ce8d

1531f13142fc0ebfb7b406d99a02ec6441fc9e40725fe2d2ac11119780995cd3

67cf0e32ad30a594442be87a99882fa4ac86494994eee23bdd21337adb804d3f

036a60aa2c62c8a9be89a2060e4300476aef1af2fd4d3dd8cac1bb286c520959

303f03ae338fddfe77c6afab496ea5c3593d7831571ce697e2253d4b6ca8a69a

262f9c63c46a0c20d1feecbd0cad75dcb8f731aa5982fef47d2a87217ecda45b

384c5967dc5f929cd1a4e075a0a1b2a5bf76d8e2256c2fe0bdf0a8b80eb107da

463e407c362b87b572afe30bb576268e351402cd88e8708c2cb0e52844750898

40d4d7b0bc47b1d30167dd7fc9bd6bd34d99b8e0ae2c4537f94716e58e7a5aeb

681368d790607aba88b7e17a719e9d974ba84dc89c434a58dd648f1b33b7e2a7

1dcd7704273c22e14f08bd83b07da6133254f7b080e749e9cce9bd2feeb14957

b87712a6eea5310319043414eabe69462e12738d4f460e66a59c3acb5f30e32e

79e5808590f880383bcba871c02a013b66bb603b214e07ea601e5f525a564aea

71e9258247f89ba9f3ded3635a5bb6e55237fad127c95264aa600d386cb3358b

0e5423e9da92802f71171c07192410787092bd844d393d13d57018eb057f1aba

a2c5b66dd9168a89ff9d132bbbab87e1102746dbf2b8ed90b12ea1c91db74335

6129324ec0fd079d60ca428e33a45d22449f238290633b14261d5cfd14b60d5d

ec714810410a4c9f76d2bcdb5a17f0099b820e65cdd76875f2e0ba133b904d92

4627cc970b2af15a292e0286820ccec069507c827810b839e1c532a03206353c

d12eef4b4b57c0186a166afc6246bf7fb4f668d0a84348c076c4943af1c98838

5bae9c364ee4f89af83e1c7d3d6ee93e7f2ea7bd72f9da47d78a88ab5cfbd5d4

ef627bad812c25a665e886044217371f9e817770b892f65cff5877b02458374e

28a7ac0ee629cd3393509c3f633876ab1dfe1aa8e2628d04e6839b0315dfb787

5b58133de33e818e082a5661d151326bce5eeddea0ef4d860024c1dbb9f94639

39707a7c6e938dfd71e130097a51ba4ef38dfeef6a97320bc8eb09f26a7d013d

987a3573307671e6a67bb0fd3de9d4966759c89d05f20d3eb636ff20578aaecf

3940ab38d2661765f6a9fb37df1b1a7b783365ad974d63f930db12c6393c31f4

697be7589b428f483736486a560f29088e3f8fa03a512b6ca8b606ace0186765

afb8220743a8373b1a6038aacd3c90abb960a3558858cc454cb83a7f56dd6c59

e5c584172ec05f0db848f058390a62dcf51bd72f6f3f7b229010588f2b3c431a

884b0c24a421ec63cf7228f1de4cce7911730fbc2663422ca38fb840dd8003f7

b068fb284fdeaa1696aa24e0211793ef29e7439212a7f6dd77d09510e405b404

cedc4ec0c238b1fc7a71dfa54f7d2d407539d22b87fe1c73b96b7a0dc17d4e40

7a2ac57809c57b258713ced5b09c7d38cfc71d5c2888a1407a6af3c5fa990eb5

5e3533df6aa40e86063dd0c9d1cd235f4523d8a67d864aa958403d7b3273eaaf

646a1e1d3fe5f2fac2c78f668e7ef37a25f9ded947d94a47c068d3c1d9989206

59a008592a15d9135ce359fe1cd31d60623beacfa1b77a1df4a1fc7708329e20

c37ad0937724166292e0379e548e2d2423f1fdfbb7f24f4f5ec322364aede54c

a83a8eb3b522c4517b8512f7f4e9335485fd5684b8653cde7f3b9b65c432fa81

bcb6c198120e62b49b92074de773f0e5d2ffb4fe37282a793d2514efb173e8db

329b33de989e6b489fad1f7cab5abd69c075ec14c42fc4ef8ee411772e5c00a2

336ed81d60acc3126160003ef4f92b196555cbdb2e58b8f0020657405dd22239

242fe5af1653b82f59db6caa34f578f1878990e270317a08a2f32ba096c6826e

92376b7ac38d7e933e82d32448aab013e66c590c1bbd7513840bbee0945184e4

333a0ec0e8a1e0608c9913182114796e573a16353d2bb3717acd98c92cdb6a82

f3c278a83619ade385ba939891d1455bd3f8eceb4e94566be2f5d1ef1289586d

a489dda37bc150a6d4caa17d5216311b972e73bad5a76e73f69e67160576ab38

0cb89b37239f94d214c12419addf49e3143ae71e53fe1934fa5776c8eafd9c51

48868c98dfabd703031587cffdbe5ca26ac180a15e89a52e59915710f1836f28

b213e86be459f90116978e1aa37b89d658fddc14b601ec48718b14c2a0c208fe

2a9dcf3104c8f2e76a49e9e72022375a69fa4aac16bbb17eddd8826dfcebccb6

a1cae85f535981fd72480c91b9fa2129c11884de850ce08d1ce4bf33984c29fd

21ee713585ed802b675b7144f7ebd875573e09809c2dff21e65da3d127fdca71

123901fa1f91f68dacd9ec972e2137be7e1586f69e419fc12d82ab362ace0ba9

6cb54ec004ff8b311e73ef8a8f69b8dd043b7b84c5499f4c6d79d462cea941d8

9de8bbc961ff450332f40935b739d6d546f4b2abf45aec713e86b37b0799526d

9af330760fe0cba41a081a1744a26cf40dc7a88edf73a2d6be15d60588ddf8c6

3cb8293f0d32099c3f714ebbbaf30a7fc2e18effced0d7a85a88601a4f7e998b

915edd3181f3242edaed0239ed80ffd4a3b4ec8927a18b69ea58fc132321987f

1c5a555fa581b0013d7811fa36dc1308dda11c5fd5f78f9acca78762b0c9397a

13bd105fe8076df715aacedf2718af7d444c12a7246809b8afae495b1f014db8

7c93c30b555e455f6b731de067654b59c7bc25d778f20f2b9b38448ba3ab6641

8d679c8671b8e78a7c24594f4b38d252483758a27ce5968fb80c5a12ee479aff

2ab27cd5ca5d2036bd482436e3a1b2c4103c5f356e88c5ae5c2e5678db9c86eb

848f4d357d90265607beed7de2cb6fb08d20f0989dcc5c36efe83b6fc5955eb2

29b481c9d5e81638d61a5d5f12f08c7c11fa4c10217cb3d049f8346a14a60274

c47268b4f154fa3691dcb4def82adfdbcfc2e7580aa5e4e4284766e1f12ee4d5

Detection Query 1 :

domainname like "http://updates-check-microsoft.ddns.net/MicrosoftOfficeUpdate.zip" or url like "http://updates-check-microsoft.ddns.net/MicrosoftOfficeUpdate.zip" or siteurl like "http://updates-check-microsoft.ddns.net/MicrosoftOfficeUpdate.zip" or domainname like "windows-updates-check.ddns.net" or url like "windows-updates-check.ddns.net" or siteurl like "windows-updates-check.ddns.net" or domainname like "microsoft-updates-windows.servehttp.com" or url like "microsoft-updates-windows.servehttp.com" or siteurl like "microsoft-updates-windows.servehttp.com" or domainname like "alashsec.hopto.me" or url like "alashsec.hopto.me" or siteurl like "alashsec.hopto.me" or domainname like "microsoft-secure-login.servehttp.com" or url like "microsoft-secure-login.servehttp.com" or siteurl like "microsoft-secure-login.servehttp.com" or domainname like "https://raw.githubusercontent.com/xzj4/1/refs/heads/main/Rrnsvc.exe" or url like "https://raw.githubusercontent.com/xzj4/1/refs/heads/main/Rrnsvc.exe" or siteurl like "https://raw.githubusercontent.com/xzj4/1/refs/heads/main/Rrnsvc.exe" or domainname like "ekolabrecycling.ddns.net" or url like "ekolabrecycling.ddns.net" or siteurl like "ekolabrecycling.ddns.net" or domainname like "systeminfo.dynns.com" or url like "systeminfo.dynns.com" or siteurl like "systeminfo.dynns.com" or domainname like "loading.hopto.me" or url like "loading.hopto.me" or siteurl like "loading.hopto.me" or domainname like "catalog-update-update-microsoft.serveftp.com" or url like "catalog-update-update-microsoft.serveftp.com" or siteurl like "catalog-update-update-microsoft.serveftp.com" or domainname like "http://154.205.145.179:8000/obsf.exe" or url like "http://154.205.145.179:8000/obsf.exe" or siteurl like "http://154.205.145.179:8000/obsf.exe" or domainname like "windows-rms.servehttp.com" or url like "windows-rms.servehttp.com" or siteurl like "windows-rms.servehttp.com" or domainname like "catalog-update-microsoft.servehttp.com" or url like "catalog-update-microsoft.servehttp.com" or siteurl like "catalog-update-microsoft.servehttp.com" or domainname like "mail-english.read-books.org" or url like "mail-english.read-books.org" or siteurl like "mail-english.read-books.org" or domainname like "http://62.113.66.137/WindowsUpdateService.ps1" or url like "http://62.113.66.137/WindowsUpdateService.ps1" or siteurl like "http://62.113.66.137/WindowsUpdateService.ps1" or domainname like "4.ddns.me" or url like "4.ddns.me" or siteurl like "4.ddns.me" or domainname like "licensing-mp-microsoft.serveexchange.com" or url like "licensing-mp-microsoft.serveexchange.com" or siteurl like "licensing-mp-microsoft.serveexchange.com" or domainname like "https://raw.githubusercontent.com/xzj4/1/refs/heads/main/324.ps1" or url like "https://raw.githubusercontent.com/xzj4/1/refs/heads/main/324.ps1" or siteurl like "https://raw.githubusercontent.com/xzj4/1/refs/heads/main/324.ps1" or domainname like "maill.ddns.net" or url like "maill.ddns.net" or siteurl like "maill.ddns.net" or domainname like "http://154.205.145.179:8000/agent.exe" or url like "http://154.205.145.179:8000/agent.exe" or siteurl like "http://154.205.145.179:8000/agent.exe" or domainname like "blog-tecnet-microsoft.serveftp.com" or url like "blog-tecnet-microsoft.serveftp.com" or siteurl like "blog-tecnet-microsoft.serveftp.com" or domainname like "upgrade.securitytactics.com" or url like "upgrade.securitytactics.com" or siteurl like "upgrade.securitytactics.com" or domainname like "updates-check-microsoft.ddns.net" or url like "updates-check-microsoft.ddns.net" or siteurl like "updates-check-microsoft.ddns.net" or domainname like "mobatex.ddns.net" or url like "mobatex.ddns.net" or siteurl like "mobatex.ddns.net" or domainname like "https://raw.githubusercontent.com/xzj4/1/refs/heads/main/569.ps1" or url like "https://raw.githubusercontent.com/xzj4/1/refs/heads/main/569.ps1" or siteurl like "https://raw.githubusercontent.com/xzj4/1/refs/heads/main/569.ps1" or domainname like "blog-tecnet-microsoft.servehttp.com" or url like "blog-tecnet-microsoft.servehttp.com" or siteurl like "blog-tecnet-microsoft.servehttp.com" or domainname like "toolbox.ddns.net" or url like "toolbox.ddns.net" or siteurl like "toolbox.ddns.net" or domainname like "https://raw.githubusercontent.com/GoBuster7777/asd/main/1.ps1" or url like "https://raw.githubusercontent.com/GoBuster7777/asd/main/1.ps1" or siteurl like "https://raw.githubusercontent.com/GoBuster7777/asd/main/1.ps1"

Detection Query 2 :

domainname like "https://raw.githubusercontent.com/xzj4/1/refs/heads/main/789.ps1" or url like "https://raw.githubusercontent.com/xzj4/1/refs/heads/main/789.ps1" or siteurl like "https://raw.githubusercontent.com/xzj4/1/refs/heads/main/789.ps1" or domainname like "cdn-redhatupdate.serveftp.com" or url like "cdn-redhatupdate.serveftp.com" or siteurl like "cdn-redhatupdate.serveftp.com" or domainname like "sysupdate.serveftp.com" or url like "sysupdate.serveftp.com" or siteurl like "sysupdate.serveftp.com" or domainname like "https://raw.githubusercontent.com/xzj4/1/refs/heads/main/wcrnsvc.exe" or url like "https://raw.githubusercontent.com/xzj4/1/refs/heads/main/wcrnsvc.exe" or siteurl like "https://raw.githubusercontent.com/xzj4/1/refs/heads/main/wcrnsvc.exe" or domainname like "http://6.ddns.me/789.ps1" or url like "http://6.ddns.me/789.ps1" or siteurl like "http://6.ddns.me/789.ps1" or domainname like "http://62.113.66.137/libcrypto-3.dll" or url like "http://62.113.66.137/libcrypto-3.dll" or siteurl like "http://62.113.66.137/libcrypto-3.dll" or domainname like "windows-update-ws.servehttp.com" or url like "windows-update-ws.servehttp.com" or siteurl like "windows-update-ws.servehttp.com" or domainname like "msedge-api-cdp-microsoft.serveftp.com" or url like "msedge-api-cdp-microsoft.serveftp.com" or siteurl like "msedge-api-cdp-microsoft.serveftp.com" or domainname like "n8nbot.sytes.net" or url like "n8nbot.sytes.net" or siteurl like "n8nbot.sytes.net" or domainname like "ctldl-windowsupdate.ddns.net" or url like "ctldl-windowsupdate.ddns.net" or siteurl like "ctldl-windowsupdate.ddns.net" or domainname like "drivers-windows-update.serveirc.com" or url like "drivers-windows-update.serveirc.com" or siteurl like "drivers-windows-update.serveirc.com" or domainname like "repo-ubuntu-webstatic-world.securitytactics.com" or url like "repo-ubuntu-webstatic-world.securitytactics.com" or siteurl like "repo-ubuntu-webstatic-world.securitytactics.com" or domainname like "catalog-update-microsoft.serveftp.com" or url like "catalog-update-microsoft.serveftp.com" or siteurl like "catalog-update-microsoft.serveftp.com" or domainname like "main.servecounterstrike.com" or url like "main.servecounterstrike.com" or siteurl like "main.servecounterstrike.com" or domainname like "https://raw.githubusercontent.com/xzj4/1/refs/heads/main/carnsvc.exe" or url like "https://raw.githubusercontent.com/xzj4/1/refs/heads/main/carnsvc.exe" or siteurl like "https://raw.githubusercontent.com/xzj4/1/refs/heads/main/carnsvc.exe" or domainname like "forti.access.ly" or url like "forti.access.ly" or siteurl like "forti.access.ly" or domainname like "auth-update-check.myddns.me" or url like "auth-update-check.myddns.me" or siteurl like "auth-update-check.myddns.me" or domainname like "english.read-books.org" or url like "english.read-books.org" or siteurl like "english.read-books.org" or domainname like "gov.zapto.org" or url like "gov.zapto.org" or siteurl like "gov.zapto.org" or domainname like "windows-update-catalog.serveftp.com" or url like "windows-update-catalog.serveftp.com" or siteurl like "windows-update-catalog.serveftp.com" or domainname like "https://raw.githubusercontent.com/xzj4/1/refs/heads/main/753.ps1" or url like "https://raw.githubusercontent.com/xzj4/1/refs/heads/main/753.ps1" or siteurl like "https://raw.githubusercontent.com/xzj4/1/refs/heads/main/753.ps1" or domainname like "maill.loginto.me" or url like "maill.loginto.me" or siteurl like "maill.loginto.me" or domainname like "debian-update-system.servehttp.com" or url like "debian-update-system.servehttp.com" or siteurl like "debian-update-system.servehttp.com" or domainname like "drivers-microsoft-catalog.serveirc.com" or url like "drivers-microsoft-catalog.serveirc.com" or siteurl like "drivers-microsoft-catalog.serveirc.com" or domainname like "http://62.113.66.137/comhost.exe" or url like "http://62.113.66.137/comhost.exe" or siteurl like "http://62.113.66.137/comhost.exe" or domainname like "mail.english.read-books.org" or url like "mail.english.read-books.org" or siteurl like "mail.english.read-books.org" or domainname like "security-updates-microsoft.servehttp.com" or url like "security-updates-microsoft.servehttp.com" or siteurl like "security-updates-microsoft.servehttp.com" or domainname like "windowsupdate-microsoft-com.servehttp.com" or url like "windowsupdate-microsoft-com.servehttp.com" or siteurl like "windowsupdate-microsoft-com.servehttp.com" or domainname like "www-mfa-gov-tm.dynns.com" or url like "www-mfa-gov-tm.dynns.com" or siteurl like "www-mfa-gov-tm.dynns.com" or domainname like "http://62.113.66.137/ssdpdrv.exe" or url like "http://62.113.66.137/ssdpdrv.exe" or siteurl like "http://62.113.66.137/ssdpdrv.exe" or domainname like "support-center.serveexchange.com" or url like "support-center.serveexchange.com" or siteurl like "support-center.serveexchange.com" or domainname like "msws-updates.ddns.me" or url like "msws-updates.ddns.me" or siteurl like "msws-updates.ddns.me"

Detection Query 3 :

domainname like "microsoft-updates-check-windows.serveftp.com" or url like "microsoft-updates-check-windows.serveftp.com" or siteurl like "microsoft-updates-check-windows.serveftp.com" or domainname like "http://154.205.145.179:8000/kworkerr" or url like "http://154.205.145.179:8000/kworkerr" or siteurl like "http://154.205.145.179:8000/kworkerr" or domainname like "telecommand-telemetry-microsoft.servehttp.com" or url like "telecommand-telemetry-microsoft.servehttp.com" or siteurl like "telecommand-telemetry-microsoft.servehttp.com" or domainname like "linux-update-system.serveftp.com" or url like "linux-update-system.serveftp.com" or siteurl like "linux-update-system.serveftp.com" or domainname like "http://62.113.66.137/WindowsUpdateService.vbs" or url like "http://62.113.66.137/WindowsUpdateService.vbs" or siteurl like "http://62.113.66.137/WindowsUpdateService.vbs" or domainname like "support-center-freeexchange.ddns.net" or url like "support-center-freeexchange.ddns.net" or siteurl like "support-center-freeexchange.ddns.net" or domainname like "microsoft-ws-updates.serveftp.com" or url like "microsoft-ws-updates.serveftp.com" or siteurl like "microsoft-ws-updates.serveftp.com" or domainname like "u.ddns.me" or url like "u.ddns.me" or siteurl like "u.ddns.me" or domainname like "http://updates-check-microsoft.ddns.net/1.pdf" or url like "http://updates-check-microsoft.ddns.net/1.pdf" or siteurl like "http://updates-check-microsoft.ddns.net/1.pdf" or domainname like "asan.zapto.org" or url like "asan.zapto.org" or siteurl like "asan.zapto.org" or domainname like "mail.mobatex.ddns.net" or url like "mail.mobatex.ddns.net" or siteurl like "mail.mobatex.ddns.net" or domainname like "repo-webtatic-server.servehttp.com" or url like "repo-webtatic-server.servehttp.com" or siteurl like "repo-webtatic-server.servehttp.com" or domainname like "mirror-centos-vault.serveftp.com" or url like "mirror-centos-vault.serveftp.com" or siteurl like "mirror-centos-vault.serveftp.com" or domainname like "http://154.205.145.179:8000/fscan" or url like "http://154.205.145.179:8000/fscan" or siteurl like "http://154.205.145.179:8000/fscan" or domainname like "http://178.128.40.89:8989/shell.exe" or url like "http://178.128.40.89:8989/shell.exe" or siteurl like "http://178.128.40.89:8989/shell.exe" or domainname like "inform.zapto.org" or url like "inform.zapto.org" or siteurl like "inform.zapto.org" or domainname like "q1q.ddns.net" or url like "q1q.ddns.net" or siteurl like "q1q.ddns.net" or domainname like "6.ddns.me" or url like "6.ddns.me" or siteurl like "6.ddns.me" or domainname like "windows-update.damnserver.com" or url like "windows-update.damnserver.com" or siteurl like "windows-update.damnserver.com" or domainname like "windows-update-server-microsoft.servehttp.com" or url like "windows-update-server-microsoft.servehttp.com" or siteurl like "windows-update-server-microsoft.servehttp.com" or domainname like "support-service-update.serveftp.com" or url like "support-service-update.serveftp.com" or siteurl like "support-service-update.serveftp.com" or domainname like "update-service-host.serveftp.com" or url like "update-service-host.serveftp.com" or siteurl like "update-service-host.serveftp.com" or domainname like "serviceupdate.dynns.com" or url like "serviceupdate.dynns.com" or siteurl like "serviceupdate.dynns.com" or domainname like "ntservicepack-update-microsoft.serveftp.com" or url like "ntservicepack-update-microsoft.serveftp.com" or siteurl like "ntservicepack-update-microsoft.serveftp.com" or domainname like "repo-centos-webtatic.serveftp.com" or url like "repo-centos-webtatic.serveftp.com" or siteurl like "repo-centos-webtatic.serveftp.com" or domainname like "daww3420.myddns.me" or url like "daww3420.myddns.me" or siteurl like "daww3420.myddns.me" or domainname like "7.ddns.me" or url like "7.ddns.me" or siteurl like "7.ddns.me" or domainname like "http://154.205.145.179:8000/dwm.7z" or url like "http://154.205.145.179:8000/dwm.7z" or siteurl like "http://154.205.145.179:8000/dwm.7z" or domainname like "https://raw.githubusercontent.com/xzj4/1/refs/heads/main/456.ps1" or url like "https://raw.githubusercontent.com/xzj4/1/refs/heads/main/456.ps1" or siteurl like "https://raw.githubusercontent.com/xzj4/1/refs/heads/main/456.ps1" or domainname like "yandex-cloud.ddns.me" or url like "yandex-cloud.ddns.me" or siteurl like "yandex-cloud.ddns.me" or domainname like "http://154.205.145.179:8000/ligolo-mp_linux_amd64" or url like "http://154.205.145.179:8000/ligolo-mp_linux_amd64" or siteurl like "http://154.205.145.179:8000/ligolo-mp_linux_amd64" or domainname like "it-support.workisboring.com" or url like "it-support.workisboring.com" or siteurl like "it-support.workisboring.com" or domainname like "microsoft-update-catalog.servehttp.com" or url like "microsoft-update-catalog.servehttp.com" or siteurl like "microsoft-update-catalog.servehttp.com" or domainname like "blog-tecnet-microsoft.servegame.com" or url like "blog-tecnet-microsoft.servegame.com" or siteurl like "blog-tecnet-microsoft.servegame.com" or domainname like "http://154.205.145.179:8000/dwm.exe" or url like "http://154.205.145.179:8000/dwm.exe" or siteurl like "http://154.205.145.179:8000/dwm.exe" or domainname like "cs.access.ly" or url like "cs.access.ly" or siteurl like "cs.access.ly" or domainname like "networks.zapto.org" or url like "networks.zapto.org" or siteurl like "networks.zapto.org" or domainname like "catalog-update-unix-systems.servehttp.com" or url like "catalog-update-unix-systems.servehttp.com" or siteurl like "catalog-update-unix-systems.servehttp.com" or domainname like "http://104.248.17.222:80/linux-update-repos.elf" or url like "http://104.248.17.222:80/linux-update-repos.elf" or siteurl like "http://104.248.17.222:80/linux-update-repos.elf" or domainname like "http://104.248.17.222:80/rev.elf" or url like "http://104.248.17.222:80/rev.elf" or siteurl like "http://104.248.17.222:80/rev.elf" or domainname like "http://62.113.66.137/libssl-3.dll" or url like "http://62.113.66.137/libssl-3.dll" or siteurl like "http://62.113.66.137/libssl-3.dll" or domainname like "windows-config-update.myddns.me" or url like "windows-config-update.myddns.me" or siteurl like "windows-config-update.myddns.me" or domainname like "srv.corehost.ddns.net" or url like "srv.corehost.ddns.net" or siteurl like "srv.corehost.ddns.net" or domainname like "http://104.248.17.222:443/9.exe" or url like "http://104.248.17.222:443/9.exe" or siteurl like "http://104.248.17.222:443/9.exe" or domainname like "http://104.248.17.222:8081/fish.exe" or url like "http://104.248.17.222:8081/fish.exe" or siteurl like "http://104.248.17.222:8081/fish.exe" or domainname like "repo-centos-webstatic-world.securitytactics.com" or url like "repo-centos-webstatic-world.securitytactics.com" or siteurl like "repo-centos-webstatic-world.securitytactics.com" or domainname like "https://raw.githubusercontent.com/xzj4/1/refs/heads/main/1.exe" or url like "https://raw.githubusercontent.com/xzj4/1/refs/heads/main/1.exe" or siteurl like "https://raw.githubusercontent.com/xzj4/1/refs/heads/main/1.exe" or domainname like "terea.serveexchange.com" or url like "terea.serveexchange.com" or siteurl like "terea.serveexchange.com" or domainname like "microsoft-service-manager.serveftp.com" or url like "microsoft-service-manager.serveftp.com" or siteurl like "microsoft-service-manager.serveftp.com" or domainname like "cdn-redhatcom.serveftp.com" or url like "cdn-redhatcom.serveftp.com" or siteurl like "cdn-redhatcom.serveftp.com" or domainname like "corehost.ddns.net" or url like "corehost.ddns.net" or siteurl like "corehost.ddns.net" or domainname like "darkpc.zapto.org" or url like "darkpc.zapto.org" or siteurl like "darkpc.zapto.org" or domainname like "domain-server-ms.securitytactics.com" or url like "domain-server-ms.securitytactics.com" or siteurl like "domain-server-ms.securitytactics.com" or domainname like "dtco.ddns.net" or url like "dtco.ddns.net" or siteurl like "dtco.ddns.net" or domainname like "ekolabrecycling.ddns.net" or url like "ekolabrecycling.ddns.net" or siteurl like "ekolabrecycling.ddns.net" or domainname like "esd.asan.gov.zapto.org" or url like "esd.asan.gov.zapto.org" or siteurl like "esd.asan.gov.zapto.org" or domainname like "gptbot.sytes.net" or url like "gptbot.sytes.net" or siteurl like "gptbot.sytes.net"

Detection Query 4 :

dstipaddress IN ("138.68.226.28","68.183.68.108","176.32.38.168","206.189.216.89","195.133.55.31","178.236.22.54","188.72.76.36","192.3.229.231","178.236.22.28","45.130.146.197","104.248.17.222","64.227.130.177","154.205.145.20","89.22.168.20","154.18.187.239","176.109.87.14","138.197.123.236","176.109.87.29","185.125.203.150","188.227.16.6","46.17.46.156","91.245.60.45","188.227.16.2","89.22.173.39","154.205.145.179","176.109.87.28","46.101.148.177","178.236.22.27","46.101.172.27","166.1.22.248","89.22.173.5","62.113.66.17","139.59.106.112","91.149.240.142","37.18.27.27","94.139.242.46","143.244.129.125","62.113.66.137","148.135.59.32","38.60.209.55","188.227.74.19","194.87.82.8","185.158.153.13","178.128.40.89","37.18.88.6","89.22.169.22","206.189.11.142","62.113.66.7","195.133.55.162","37.18.88.25","206.189.104.65","167.99.248.28","178.170.220.14","173.249.13.174","167.17.183.223","46.17.42.29","89.22.173.54","154.18.239.238","104.248.242.121","89.110.93.25","207.154.223.11","188.72.77.166","138.68.93.248") or srcipaddress IN ("138.68.226.28","68.183.68.108","176.32.38.168","206.189.216.89","195.133.55.31","178.236.22.54","188.72.76.36","192.3.229.231","178.236.22.28","45.130.146.197","104.248.17.222","64.227.130.177","154.205.145.20","89.22.168.20","154.18.187.239","176.109.87.14","138.197.123.236","176.109.87.29","185.125.203.150","188.227.16.6","46.17.46.156","91.245.60.45","188.227.16.2","89.22.173.39","154.205.145.179","176.109.87.28","46.101.148.177","178.236.22.27","46.101.172.27","166.1.22.248","89.22.173.5","62.113.66.17","139.59.106.112","91.149.240.142","37.18.27.27","94.139.242.46","143.244.129.125","62.113.66.137","148.135.59.32","38.60.209.55","188.227.74.19","194.87.82.8","185.158.153.13","178.128.40.89","37.18.88.6","89.22.169.22","206.189.11.142","62.113.66.7","195.133.55.162","37.18.88.25","206.189.104.65","167.99.248.28","178.170.220.14","173.249.13.174","167.17.183.223","46.17.42.29","89.22.173.54","154.18.239.238","104.248.242.121","89.110.93.25","207.154.223.11","188.72.77.166","138.68.93.248")

Detection Query 5 :

sha256hash IN ("48868c98dfabd703031587cffdbe5ca26ac180a15e89a52e59915710f1836f28","09cd1581f5f6a9db131e3c92c931f9c3b2f90b7a639d5cb85b29fb92ee937a4a","3590d897dd0c2350fe36460af85f7a76151c461380b146bc7edc9f01e276265e","80565a0855ed142decae819fbfa79a083b5cd90f5234106b0ae16b1d21affa3c","dff3461b7b0b793c6dc62a63ffb6560c3babd7ca0b8d479ee2f7cbd4486c9d85","c1bdcfd686d40cee8e58833b294ca478b0b843583bb8ece98022aa0c94e2f7cd","646a1e1d3fe5f2fac2c78f668e7ef37a25f9ded947d94a47c068d3c1d9989206","6e30a01b8175bac359bb85cf5ced9a1920aa6098a26affa4fc780323a549ce19","036a60aa2c62c8a9be89a2060e4300476aef1af2fd4d3dd8cac1bb286c520959","31bbd8f26ea51ee99b8126ef8afd20a99756fd89140a26f9f16570d302aed64c","5bae9c364ee4f89af83e1c7d3d6ee93e7f2ea7bd72f9da47d78a88ab5cfbd5d4","7c93c30b555e455f6b731de067654b59c7bc25d778f20f2b9b38448ba3ab6641","4627cc970b2af15a292e0286820ccec069507c827810b839e1c532a03206353c","ec714810410a4c9f76d2bcdb5a17f0099b820e65cdd76875f2e0ba133b904d92","1531f13142fc0ebfb7b406d99a02ec6441fc9e40725fe2d2ac11119780995cd3","32035c9d3b81ad72913f8db42038fcf6d95b51d4d84208067fe22cf6323f133c","821f1ee371482bfa9b5ff1aff33705ed16e0147a9375d7a9969974c43b9e16e8","2deda9985c6e8cca888a58746c96ae686a1aaf5c0b7a236c7557d88b4050f1f9","8d679c8671b8e78a7c24594f4b38d252483758a27ce5968fb80c5a12ee479aff","392b70086f10c23ce7b4173d1f68d72727ea0146260fb773c78642f6eb641775","803bd2bd9f93e6ab794dc7af1686b127c6fc2ddd5bf0e934cda0b582a879ba41","28a7ac0ee629cd3393509c3f633876ab1dfe1aa8e2628d04e6839b0315dfb787","c37ad0937724166292e0379e548e2d2423f1fdfbb7f24f4f5ec322364aede54c","b5a4f459bdff7947f27474840062cfce14ee2b1a0ef84da100679bc4aa2fcf77","b068fb284fdeaa1696aa24e0211793ef29e7439212a7f6dd77d09510e405b404","b87712a6eea5310319043414eabe69462e12738d4f460e66a59c3acb5f30e32e","cedc4ec0c238b1fc7a71dfa54f7d2d407539d22b87fe1c73b96b7a0dc17d4e40","59a008592a15d9135ce359fe1cd31d60623beacfa1b77a1df4a1fc7708329e20","1c5a555fa581b0013d7811fa36dc1308dda11c5fd5f78f9acca78762b0c9397a","19082f36392e48f68d61889ebf408b767810db3cbe081e66466b3ee8d36c1231","2ab27cd5ca5d2036bd482436e3a1b2c4103c5f356e88c5ae5c2e5678db9c86eb","97969978799100c7be211b9bf8a152bbd826ba6cb55377284537b381a4814216","3940ab38d2661765f6a9fb37df1b1a7b783365ad974d63f930db12c6393c31f4","6cb54ec004ff8b311e73ef8a8f69b8dd043b7b84c5499f4c6d79d462cea941d8","58bb311f564489ace95740498b8db7c039809e5b76747fd3ed67d27aa8ed1ce2","a7506a1d6818d69329d6d5e03f281337b74da045e818f81fbe6eced1b148df54","43dcb336876bd374a4125c4f6c2e1b6ce1b03297ab7692a8506fbe1c33be3582","a639a9043334dcd95e7cd239f8816851517ebb3850c6066a4f64ac39281242a3","884b0c24a421ec63cf7228f1de4cce7911730fbc2663422ca38fb840dd8003f7","697be7589b428f483736486a560f29088e3f8fa03a512b6ca8b606ace0186765","67cf0e32ad30a594442be87a99882fa4ac86494994eee23bdd21337adb804d3f","44af608e1f151932fa098b8ac06a424b681b167133a0c750d836c94fb91f4077","5c6b0f1ee2960a87e47ccf880c8780d4d7807eda5b33a02c262ecadf803de276","afb8220743a8373b1a6038aacd3c90abb960a3558858cc454cb83a7f56dd6c59","909a7cb3cc5ec6722b03d3538780fbd096e639a8f2993f6ea4d81d8fdba8bdda","123901fa1f91f68dacd9ec972e2137be7e1586f69e419fc12d82ab362ace0ba9","13bd105fe8076df715aacedf2718af7d444c12a7246809b8afae495b1f014db8","9af330760fe0cba41a081a1744a26cf40dc7a88edf73a2d6be15d60588ddf8c6","691c1d6c02c0153bdfaf6fb31506cd3aced24ed9902747c39fa6ac2094c202f1","1dcd7704273c22e14f08bd83b07da6133254f7b080e749e9cce9bd2feeb14957","e5c584172ec05f0db848f058390a62dcf51bd72f6f3f7b229010588f2b3c431a","303f03ae338fddfe77c6afab496ea5c3593d7831571ce697e2253d4b6ca8a69a","c663165e18319faf44a22e9286b53e1cfd974901a6b077aaf850a90e40d5ecc6","9de8bbc961ff450332f40935b739d6d546f4b2abf45aec713e86b37b0799526d","974dc6f3172d51f39eaa4693aeaf9706bd8bf66a76439e01ddf29f6500e037fc","336ed81d60acc3126160003ef4f92b196555cbdb2e58b8f0020657405dd22239","ef627bad812c25a665e886044217371f9e817770b892f65cff5877b02458374e","d7e0d98b9e574f3c47880f3f021de9e455d0807f733acfe27142c4dffb8fc7bd","21ee713585ed802b675b7144f7ebd875573e09809c2dff21e65da3d127fdca71","915edd3181f3242edaed0239ed80ffd4a3b4ec8927a18b69ea58fc132321987f","6806029ed72de2b592c18edb430ffabd56137a8428b7c23860ae4f000a02f0af","40d4d7b0bc47b1d30167dd7fc9bd6bd34d99b8e0ae2c4537f94716e58e7a5aeb","bb269b19beed984f99fdbce745286ac75bb235f91f113d4dae0752cf2fbed6b5","262f9c63c46a0c20d1feecbd0cad75dcb8f731aa5982fef47d2a87217ecda45b","463e407c362b87b572afe30bb576268e351402cd88e8708c2cb0e52844750898","384c5967dc5f929cd1a4e075a0a1b2a5bf76d8e2256c2fe0bdf0a8b80eb107da","0bce0e213690120afc94b53390d93a8874562de5ddcc5511c7b9b9d95cf8a15d","2c1764610a7f3113bb01fdaeede3b411acc99843bbb7d642c26024a601460efe","5e3533df6aa40e86063dd0c9d1cd235f4523d8a67d864aa958403d7b3273eaaf","2f62bbf3430c464ccbf42f7e449ddd1d48f95125cf2f472dce2e3e6c19bd1d4a","ae51aef21ea4b422ef0c7eb025356e45d1ce405d66afbb3f6479d10d0600bcfd","b0b2d12a377f3d02cc49165d69a5839c06f11986716a04b3a068e8dac6de7194","f3c278a83619ade385ba939891d1455bd3f8eceb4e94566be2f5d1ef1289586d","f379351908ddde7b0ee44e71ee395f92339cb2d87a7fb470eda23895afeea938","d12eef4b4b57c0186a166afc6246bf7fb4f668d0a84348c076c4943af1c98838","0cb89b37239f94d214c12419addf49e3143ae71e53fe1934fa5776c8eafd9c51","848f4d357d90265607beed7de2cb6fb08d20f0989dcc5c36efe83b6fc5955eb2","a527a96b091730408c62fa1414052cf7c527724d93a537f821d18333cfb9dbcd","681368d790607aba88b7e17a719e9d974ba84dc89c434a58dd648f1b33b7e2a7","2a2166b1342fd83ea0fb3e81e2b424a7360716f9b43e7b7f3b6731e5a51c329a","5b58133de33e818e082a5661d151326bce5eeddea0ef4d860024c1dbb9f94639","39707a7c6e938dfd71e130097a51ba4ef38dfeef6a97320bc8eb09f26a7d013d","de9d6d5cecf9c8ccb56b1c91ad4058e2f1def0c4b616b986055ff14242792229","a83a8eb3b522c4517b8512f7f4e9335485fd5684b8653cde7f3b9b65c432fa81","2915d5eb099a3673324148c1ca75311aebbe706fe706281310942d728127b504","a38af45a67fc9070d46649feab0b347011585d1e547fe88185e70dea6e6582ea","26aca51d555a0ea6d80715d8c6a9f49fea158dee11631735e16ea75c443a5802","b0ac155b99bc5cf17ecfd8d3c26037456bc59643344a3a30a92e2c71c4c6ce8d","907ce23b85da7e72c29cf55505765987f32e867a3361a53e61a52034d0a70c85","237a971277e1f549b950999f0334aa23d6238edf3f3693b3c9acfd13c75798c0","a05ece531189c12581493a60c8016174af69aa7978ba72acadc2e921210dc838","2a3e8405523a3a911ecebc90b067c2c8ad0fe56a0a07fbc9c3f772e397492eba","1b6808161f1ee5c545895ad2f33daea483b5b85defab7c17995b7701fa3ef1cc","e9c2a219ee9b80cee8f39abd3562ac618aeacfa50c4bd0f1faa3bac6ada90964","754311b2fe001ca1a60166bafe0c48d13c7277623f263861cfc743d0557e696d","27b6075cf2dc22a55afdf58548a90b6b983f396d901801bfc7a1a95ca1166a5f","be3124c0fd67dffc41c0c76c5e4e4dea23623417a6374dd6bb9583e0641bf3c6","987a3573307671e6a67bb0fd3de9d4966759c89d05f20d3eb636ff20578aaecf","7a2ac57809c57b258713ced5b09c7d38cfc71d5c2888a1407a6af3c5fa990eb5","bcb6c198120e62b49b92074de773f0e5d2ffb4fe37282a793d2514efb173e8db","329b33de989e6b489fad1f7cab5abd69c075ec14c42fc4ef8ee411772e5c00a2","242fe5af1653b82f59db6caa34f578f1878990e270317a08a2f32ba096c6826e","92376b7ac38d7e933e82d32448aab013e66c590c1bbd7513840bbee0945184e4","333a0ec0e8a1e0608c9913182114796e573a16353d2bb3717acd98c92cdb6a82","a489dda37bc150a6d4caa17d5216311b972e73bad5a76e73f69e67160576ab38","b213e86be459f90116978e1aa37b89d658fddc14b601ec48718b14c2a0c208fe","2a9dcf3104c8f2e76a49e9e72022375a69fa4aac16bbb17eddd8826dfcebccb6","a1cae85f535981fd72480c91b9fa2129c11884de850ce08d1ce4bf33984c29fd","3cb8293f0d32099c3f714ebbbaf30a7fc2e18effced0d7a85a88601a4f7e998b","29b481c9d5e81638d61a5d5f12f08c7c11fa4c10217cb3d049f8346a14a60274","c47268b4f154fa3691dcb4def82adfdbcfc2e7580aa5e4e4284766e1f12ee4d5","79e5808590f880383bcba871c02a013b66bb603b214e07ea601e5f525a564aea","71e9258247f89ba9f3ded3635a5bb6e55237fad127c95264aa600d386cb3358b","0e5423e9da92802f71171c07192410787092bd844d393d13d57018eb057f1aba","a2c5b66dd9168a89ff9d132bbbab87e1102746dbf2b8ed90b12ea1c91db74335","6129324ec0fd079d60ca428e33a45d22449f238290633b14261d5cfd14b60d5d","67d918d70b6231b141433db238f19bec26fdf60c66841adf9179536eddcd0f5c","ae1511cf6f1f1f01e6508bf3ca798355bef3acfecf50ed5ff1513d9a44f0588a","3b99dddf185d17f397d81e7403993221d582a2df4938964254376cc70e1dc927","6dfa12fbf5543984b799d502f6c52d078e46294c665a1581c54ce19da2b6e33a","ce7886943034f9e3896d54d46b5e815c1eed39822e6238a6e8a81186828e1dfc","97ef4aaa61beaff8f404187834ea3c5e628b41570ee1a5f23e7a43f84ee41ae6")