Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Jan. 29, 2024, 7:55 a.m.	Jan. 29, 2024, 8:04 a.m.

Size	7.5MB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`0fb0767520be820c0c3f415fb1bad41d`
SHA256	`92e4602f85cc9714e48613d178b5dc8ec55bd78474c73c69de3678e94f7f0921`
CRC32	`13474035`
ssdeep	`196608:1c7qW725oFNKI4eVrTdNqNkNxdL0ws3vnDcekNeMt:1OqW72oFNv4iHdNkkdYwqDcekN`
Yara	IsPE32 - (no description) PE_Header_Zero - PE File Signature Is_DotNET_EXE - (no description)

latestroc.exe "C:\Users\test22\AppData\Local\Temp\latestroc.exe"
2688
- toolspub1.exe "C:\Users\test22\AppData\Local\Temp\toolspub1.exe"
  2768
- 7b0d48dbbf50fe239f1097f5d01c2a6d.exe "C:\Users\test22\AppData\Local\Temp\7b0d48dbbf50fe239f1097f5d01c2a6d.exe"
  2816
- rty25.exe "C:\Users\test22\AppData\Local\Temp\rty25.exe"
  2864
- FirstZ.exe "C:\Users\test22\AppData\Local\Temp\FirstZ.exe"
  2908

Name	Response	Post-Analysis Lookup
apps.identrust.com	A 23.200.75.26 CNAME a1952.dscq.akamai.net CNAME identrust.edgesuite.net A 23.200.75.28	23.50.121.137
i.alie3ksgaa.com	A 154.92.15.189	154.92.15.189
pastebin.com	A 104.20.67.143 A 172.67.34.170 A 104.20.68.143	172.67.34.170
zeph-eu2.nanopool.org	A 51.195.43.17 A 51.15.61.114 A 51.210.150.92 A 51.195.138.197 A 163.172.171.111 A 51.15.89.13 A 51.68.137.186	51.195.43.17

IP Address	Status	Action
104.20.68.143	Active	Moloch
154.92.15.189	Active	Moloch
163.172.171.111	Active	Moloch
164.124.101.2	Active	Moloch
23.200.75.28	Active	Moloch
51.68.137.186	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49166 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49168 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49169 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49170 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49171 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49174 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49172 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49180 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49175 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49173 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49186 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49212 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49189 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49178 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49187 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49221 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49198 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49181 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49195 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49200 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49176 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49197 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49203 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49183 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49207 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49205 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49184 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49210 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49211 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49182 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49213 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49226 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49188 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49223 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49191 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49225 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49230 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49192 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49229 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49237 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49194 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49241 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49249 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49202 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49246 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49242 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49250 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49208 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49243 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49256 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49196 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49252 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49261 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49199 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49244 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49263 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49201 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49245 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49265 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49204 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49248 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49276 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49209 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49254 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49272 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49290 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49215 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49273 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49297 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49216 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49300 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49264 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49217 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49305 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49268 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49224 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49307 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49235 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49311 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49236 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49316 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49247 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49177 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49327 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49255 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49258 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49260 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49270 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49214 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49329 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49279 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49218 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49331 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49220 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49283 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49343 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49346 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49227 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49292 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49228 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49350 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49185 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49302 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49233 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49353 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49304 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49234 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49354 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49277 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49310 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49286 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49281 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49360 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49284 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49190 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49370 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49239 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49313 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49375 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49291 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49321 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49287 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49294 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49334 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49303 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49295 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49342 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49193 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49306 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49240 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49388 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49253 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49312 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49262 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49315 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49267 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49345 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49322 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49269 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49347 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49325 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49282 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49352 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49333 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49285 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49337 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49361 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49288 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49338 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49296 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49363 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49339 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49299 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49368 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49341 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49293 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49379 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49351 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49301 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49383 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49355 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49206 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49385 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49309 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49356 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49317 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49359 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49386 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49318 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49308 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49396 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49323 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49413 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49319 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49324 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49433 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49326 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49434 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49330 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49438 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49362 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49443 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49364 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49447 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49376 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49449 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49219 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49384 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49452 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49391 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49453 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49367 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49398 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49369 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49418 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49461 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49419 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49390 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49380 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49470 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49320 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49222 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49394 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49479 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49335 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49439 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49395 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49483 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49454 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49484 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49403 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49473 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49409 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49382 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49340 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49485 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49412 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49416 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49489 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49358 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49492 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49422 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49366 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49495 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49231 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49430 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49373 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49500 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49435 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49477 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49503 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49436 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49232 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49387 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49491 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49441 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49393 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49517 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49445 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49397 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49377 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49446 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49399 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49378 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49467 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49400 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49389 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49472 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49401 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49402 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49478 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49238 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49510 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49429 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49487 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49513 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49437 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49490 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49519 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49444 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49499 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49404 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49451 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49504 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49407 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49456 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49508 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49414 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49468 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49509 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49420 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49471 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49511 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49425 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49474 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49426 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49480 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49428 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49494 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49497 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49432 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49505 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49442 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49251 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49455 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49459 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49460 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49463 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49466 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49469 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49481 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49257 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49486 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49488 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49493 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49259 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49496 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49498 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49502 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49506 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49507 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
UDP 192.168.56.101:55146 -> 164.124.101.2:53	2033268	ET POLICY Observed DNS Query to Coin Mining Domain (nanopool .org)	Potential Corporate Privacy Violation
TCP 192.168.56.101:49515 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49516 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49529 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49271 -> 104.20.68.143:443	906200068	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (CoinMiner)	undefined
TCP 192.168.56.101:49275 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49278 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49280 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49289 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49298 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49314 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49328 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49332 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49336 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49344 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49348 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49349 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49357 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49365 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49371 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49372 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49374 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49381 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49392 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49405 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49406 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49408 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49410 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49411 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49415 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49417 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49421 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49423 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49424 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49427 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49431 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49440 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49448 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49450 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49457 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49458 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49462 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49464 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49465 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49475 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49476 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49482 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49501 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49512 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49514 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49518 -> 154.92.15.189:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.101:49166 154.92.15.189:443	C=US, O=Let's Encrypt, CN=R3	CN=i.alie3ksgaa.com	e3:88:72:04:24:5c:12:17:a4:e2:c1:d9:33:f0:d9:60:91:71:d3:dc
TLSv1 192.168.56.101:49168 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49169 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49170 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49171 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49174 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49172 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49180 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49175 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49173 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49186 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49212 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49189 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49178 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49187 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49221 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49198 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49195 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49200 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49176 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49197 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49203 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49183 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49207 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49205 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49184 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49210 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49181 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49211 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49182 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49213 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49226 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49188 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49223 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49191 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49225 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49230 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49192 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49229 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49237 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49194 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49241 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49249 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49202 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49246 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49242 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49250 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49256 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49196 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49243 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49252 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49208 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49261 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49199 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49244 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49263 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49201 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49245 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49265 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49204 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49248 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49276 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49272 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49209 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49290 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49215 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49273 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49297 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49254 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49216 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49300 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49264 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49217 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49305 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49268 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49224 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49307 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49235 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49311 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49236 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49316 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49247 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49177 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49255 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49327 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49258 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49260 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49270 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49214 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49329 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49279 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49218 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49331 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49220 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49283 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49343 154.92.15.189:443	None	None	None
TLS 1.3 192.168.56.101:49266 163.172.171.111:10943	None	None	None
TLSv1 192.168.56.101:49227 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49346 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49292 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49228 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49350 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49185 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49302 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49233 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49353 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49304 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49354 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49277 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49281 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49360 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49234 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49310 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49370 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49284 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49190 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49313 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49375 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49286 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49291 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49321 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49287 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49294 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49334 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49303 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49239 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49193 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49240 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49306 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49253 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49312 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49262 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49342 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49315 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49267 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49345 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49322 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49269 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49347 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49325 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49282 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49352 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49333 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49285 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49295 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49361 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49337 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49338 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49296 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49363 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49339 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49288 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49368 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49341 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49299 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49379 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49351 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49293 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49383 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49301 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49355 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49206 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49309 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49356 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49385 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49317 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49359 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49388 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49318 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49396 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49323 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49308 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49413 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49324 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49433 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49326 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49434 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49330 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49438 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49362 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49443 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49364 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49447 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49376 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49449 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49384 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49219 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49452 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49391 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49453 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49367 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49398 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49369 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49418 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49386 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49461 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49319 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49419 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49390 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49470 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49320 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49222 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49394 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49479 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49380 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49439 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49395 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49483 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49454 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49484 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49403 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49335 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49409 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49382 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49340 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49412 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49485 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49358 154.92.15.189:443	C=US, O=Let's Encrypt, CN=R3	CN=i.alie3ksgaa.com	e3:88:72:04:24:5c:12:17:a4:e2:c1:d9:33:f0:d9:60:91:71:d3:dc
TLSv1 192.168.56.101:49489 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49416 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49492 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49422 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49366 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49495 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49430 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49231 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49473 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49500 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49435 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49477 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49436 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49232 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49387 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49491 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49441 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49393 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49517 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49373 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49445 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49397 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49377 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49446 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49399 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49378 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49467 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49400 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49389 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49472 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49503 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49402 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49478 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49510 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49429 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49238 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49487 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49513 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49437 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49490 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49519 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49401 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49444 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49499 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49404 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49451 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49504 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49407 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49456 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49508 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49414 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49468 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49509 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49420 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49471 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49511 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49425 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49474 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49426 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49480 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49494 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49428 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49497 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49432 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49505 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49442 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49455 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49251 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49459 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49460 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49463 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49466 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49469 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49481 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49257 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49486 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49488 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49493 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49259 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49496 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49498 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49502 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49506 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49507 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49515 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49516 154.92.15.189:443	None	None	None
TLS 1.3 192.168.56.101:49271 104.20.68.143:443	None	None	None
TLSv1 192.168.56.101:49275 154.92.15.189:443	None	None	None
TLS 1.3 192.168.56.101:49274 51.68.137.186:10943	None	None	None
TLSv1 192.168.56.101:49278 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49280 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49289 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49298 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49314 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49328 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49332 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49336 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49344 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49348 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49349 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49357 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49365 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49371 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49372 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49374 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49381 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49392 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49405 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49406 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49408 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49410 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49411 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49415 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49417 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49421 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49423 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49424 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49427 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49431 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49440 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49448 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49450 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49457 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49458 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49462 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49464 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49465 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49475 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49476 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49482 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49501 154.92.15.189:443	C=US, O=Let's Encrypt, CN=R3	CN=i.alie3ksgaa.com	e3:88:72:04:24:5c:12:17:a4:e2:c1:d9:33:f0:d9:60:91:71:d3:dc
TLSv1 192.168.56.101:49512 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49514 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49518 154.92.15.189:443	None	None	None
TLSv1 192.168.56.101:49529 154.92.15.189:443	None	None	None

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Jan. 29, 2024, 7:55 a.m.			0	0
IsDebuggerPresent Jan. 29, 2024, 7:55 a.m.			0	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Jan. 29, 2024, 7:55 a.m.		1	1	0

Performs some HTTP requests (1 event)

request

GET http://apps.identrust.com/roots/dstrootcax3.p7c

Allocates read-write-execute memory (usually to unpack itself) (18 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Jan. 29, 2024, 7:55 a.m.	process_identifier: 2688 region_size: 1507328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006a0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 29, 2024, 7:55 a.m.	process_identifier: 2688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 29, 2024, 7:55 a.m.	process_identifier: 2688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 29, 2024, 7:55 a.m.	process_identifier: 2688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 29, 2024, 7:55 a.m.	process_identifier: 2688 region_size: 1638400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027d0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 29, 2024, 7:55 a.m.	process_identifier: 2688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02920000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 29, 2024, 7:55 a.m.	process_identifier: 2688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00522000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 29, 2024, 7:55 a.m.	process_identifier: 2688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00555000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 29, 2024, 7:55 a.m.	process_identifier: 2688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0055b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 29, 2024, 7:55 a.m.	process_identifier: 2688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00557000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 29, 2024, 7:55 a.m.	process_identifier: 2688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0053c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 29, 2024, 7:55 a.m.	process_identifier: 2688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00760000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 29, 2024, 7:55 a.m.	process_identifier: 2688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0052a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 29, 2024, 7:55 a.m.	process_identifier: 2768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 86016 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02bba000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 29, 2024, 7:55 a.m.	process_identifier: 2768 region_size: 45056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 29, 2024, 7:55 a.m.	process_identifier: 2816 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4161536 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x031c0000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 29, 2024, 7:55 a.m.	process_identifier: 2816 region_size: 9351168 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04ce0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 29, 2024, 7:55 a.m.	process_identifier: 2864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000ff2ad000 process_handle: 0xffffffffffffffff	1

Creates executable files on the filesystem (4 events)

file	C:\Users\test22\AppData\Local\Temp\toolspub1.exe
file	C:\Users\test22\AppData\Local\Temp\FirstZ.exe
file	C:\Users\test22\AppData\Local\Temp\7b0d48dbbf50fe239f1097f5d01c2a6d.exe
file	C:\Users\test22\AppData\Local\Temp\rty25.exe

Drops a binary and executes it (4 events)

file	C:\Users\test22\AppData\Local\Temp\toolspub1.exe
file	C:\Users\test22\AppData\Local\Temp\7b0d48dbbf50fe239f1097f5d01c2a6d.exe
file	C:\Users\test22\AppData\Local\Temp\rty25.exe
file	C:\Users\test22\AppData\Local\Temp\FirstZ.exe

Drops an executable to the user AppData folder (2 events)

file	C:\Users\test22\AppData\Local\Temp\7b0d48dbbf50fe239f1097f5d01c2a6d.exe
file	C:\Users\test22\AppData\Local\Temp\toolspub1.exe

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Jan. 29, 2024, 7:55 a.m.	flags: 15 family: 0		111	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00779c00', u'virtual_address': u'0x00002000', u'entropy': 7.8509057969848675, u'name': u'.text', u'virtual_size': u'0x00779ae4'}

entropy

7.85090579698

description

A section with a high entropy has been found

entropy

0.999738801097

description

Overall entropy of this PE file is high

latestroc.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All