popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

1873085694.exe

AsyncRAT UltraVNC
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 March 12, 2021, 2:21 p.m. March 12, 2021, 2:23 p.m.
Size 256.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 fea26a213a022eb79c3f7dee7f9d107a
SHA256 8cc60cbf7de2d220a546ecc0a9eefd4121133956cf680e7a104d12c8103c1e46
CRC32 7EF776E4
ssdeep 1536:KxKY+T6KW5CvEyXWvE344wAL5LO8XvdPTwZI3sq5gnToIfnIOlIOjcTp5XqTpc7s:wDKW1LgppLRHMY0TBfJvjcTp5XqmZuD
PDB Path
Yara
  • PE_Header_Zero - PE File Signature Zero
  • OS_Processor_Check_Zero - OS Processor Check Signature Zero
  • UltraVNC_Zero - UltraVNC
  • win_files_operation - Affect private profile
  • IsPE32 - (no description)
  • IsWindowsGUI - (no description)
  • HasOverlay - Overlay Check
  • HasDebugData - DebugData Check
  • HasRichSignature - Rich Signature Check

Name Response Post-Analysis Lookup
50n0.tolganfor.ru
A 81.177.139.41
81.177.139.41
pp.sldov.ru
A 81.177.139.41
81.177.139.41
xnw.itdenther.ru
A 81.177.139.41
81.177.139.41
IP Address Status Action
164.124.101.2 Active Moloch
81.177.139.41 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49207 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49201 -> 81.177.139.41:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49231 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49221 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49208 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49222 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49200 -> 81.177.139.41:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49220 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49224 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49227 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49225 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49206 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49228 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49232 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49210 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49230 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49235 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49213 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49238 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49214 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49239 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49216 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49203 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49259 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49219 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49260 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49233 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49211 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49261 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49251 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49215 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49262 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49254 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49218 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49263 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49275 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49223 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49272 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49281 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49234 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49279 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49284 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49242 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49282 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49248 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49291 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49292 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49249 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49295 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49293 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49236 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49299 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49300 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49265 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49209 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49250 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49274 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49310 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49212 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49280 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49311 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49237 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49253 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49217 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49286 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49241 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49226 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49330 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49256 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49287 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49243 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49229 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49334 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49301 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49266 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49289 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49267 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49240 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49276 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49336 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49320 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49268 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49244 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49283 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49365 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49321 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49273 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49245 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49285 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49329 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49278 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49246 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49297 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49335 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49288 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49247 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49306 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49290 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49340 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49252 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49312 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49294 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49345 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49314 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49255 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49347 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49302 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49317 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49257 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49348 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49304 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49318 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49258 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49350 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49305 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49319 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49264 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49353 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49307 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49333 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49269 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49355 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49338 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49270 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49356 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49352 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49271 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49361 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49357 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49277 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49368 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49358 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49296 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49303 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49370 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49360 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49298 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49313 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49371 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49372 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49315 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49316 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49373 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49323 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49324 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49325 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49308 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49342 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49326 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49309 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49346 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49327 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49362 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49322 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49331 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49366 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49328 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49332 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49369 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49339 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49337 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49374 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49341 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49344 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49351 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49349 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49359 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49363 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49364 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49367 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49201
81.177.139.41:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.pp.sldov.ru 83:b1:23:6a:fe:5e:38:7b:15:3f:f5:ca:10:b5:48:1b:e2:11:94:35
TLS 1.2
192.168.56.101:49207
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49231
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49221
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49208
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49222
81.177.139.41:443 		None None None
TLSv1
192.168.56.101:49200
81.177.139.41:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.xnw.itdenther.ru ee:3f:d6:da:5a:a3:f1:4e:c6:ec:f7:0d:cc:2b:81:2e:2f:93:c2:ea
TLS 1.2
192.168.56.101:49220
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49224
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49227
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49225
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49206
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49228
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49232
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49210
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49235
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49213
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49238
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49214
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49239
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49216
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49203
81.177.139.41:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.50n0.tolganfor.ru ae:48:fa:0d:93:75:e0:01:ab:65:f8:ac:82:b2:18:da:6e:65:d2:c9
TLS 1.2
192.168.56.101:49259
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49219
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49260
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49233
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49211
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49261
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49251
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49215
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49262
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49254
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49218
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49263
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49275
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49223
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49272
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49281
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49234
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49279
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49284
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49242
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49282
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49248
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49291
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49292
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49295
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49230
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49293
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49236
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49299
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49300
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49249
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49265
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49209
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49274
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49250
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49310
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49212
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49280
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49311
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49237
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49217
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49253
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49286
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49241
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49226
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49330
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49256
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49287
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49243
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49229
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49266
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49334
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49289
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49267
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49240
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49276
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49336
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49320
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49268
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49244
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49283
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49365
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49321
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49273
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49245
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49285
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49329
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49278
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49246
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49297
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49335
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49288
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49247
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49306
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49290
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49340
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49252
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49312
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49294
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49345
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49314
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49255
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49347
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49302
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49317
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49257
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49348
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49304
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49318
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49258
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49350
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49305
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49319
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49264
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49353
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49307
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49333
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49269
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49355
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49338
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49270
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49356
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49352
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49271
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49361
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49357
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49277
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49301
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49368
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49358
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49296
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49303
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49370
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49360
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49298
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49313
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49372
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49371
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49315
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49316
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49373
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49323
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49324
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49325
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49308
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49342
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49326
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49309
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49346
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49327
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49362
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49322
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49331
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49366
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49328
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49332
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49369
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49339
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49337
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49374
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49341
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49344
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49351
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49349
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49359
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49363
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49364
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.101:49367
81.177.139.41:443 		None None None

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002c6578
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002c6578
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002c65b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002c65b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005cf758
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005cf7d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005cf7d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
pdb_path
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
1873085694+0x1fa2 @ 0x401fa2

exception.instruction_r: f3 aa 8b 45 f0 8b 4d 08 8b 55 10 03 c8 2b d0 52
exception.symbol: 1873085694+0xf088
exception.instruction: stosb byte ptr es:[edi], al
exception.module: 1873085694.exe
exception.exception_code: 0xc0000005
exception.offset: 61576
exception.address: 0x40f088
registers.esp: 1636996
registers.edi: 4350244
registers.eax: 0
registers.ebp: 1637012
registers.edx: 0
registers.ebx: 0
registers.esi: 30485840
registers.ecx: 12
1 0 0

__exception__

 stacktrace: 
1873085694+0xf054 @ 0x40f054
1873085694+0xf0a0 @ 0x40f0a0
1873085694+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 1873085694+0xefff
exception.address: 0x40efff
exception.module: 1873085694.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636940
registers.edi: 4353968
registers.eax: 4350256
registers.ebp: 1636944
registers.edx: 23
registers.ebx: 0
registers.esi: 30485840
registers.ecx: 105
1 0 0

__exception__

 stacktrace: 
1873085694+0xf054 @ 0x40f054
1873085694+0xf0a0 @ 0x40f0a0
1873085694+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 1873085694+0xefff
exception.address: 0x40efff
exception.module: 1873085694.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636940
registers.edi: 4358064
registers.eax: 4350256
registers.ebp: 1636944
registers.edx: 23
registers.ebx: 0
registers.esi: 30485840
registers.ecx: 73
1 0 0

__exception__

 stacktrace: 
1873085694+0xf054 @ 0x40f054
1873085694+0xf0a0 @ 0x40f0a0
1873085694+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 1873085694+0xefff
exception.address: 0x40efff
exception.module: 1873085694.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636940
registers.edi: 4362160
registers.eax: 4350256
registers.ebp: 1636944
registers.edx: 23
registers.ebx: 0
registers.esi: 30485840
registers.ecx: 41
1 0 0

__exception__

 stacktrace: 
1873085694+0xf054 @ 0x40f054
1873085694+0xf0a0 @ 0x40f0a0
1873085694+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 1873085694+0xefff
exception.address: 0x40efff
exception.module: 1873085694.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636940
registers.edi: 4366256
registers.eax: 4350256
registers.ebp: 1636944
registers.edx: 23
registers.ebx: 0
registers.esi: 30485840
registers.ecx: 9
1 0 0
suspicious_features GET method with no useragent header suspicious_request GET https://xnw.itdenther.ru/855732125.exe
suspicious_features GET method with no useragent header suspicious_request GET https://pp.sldov.ru/856125340.exe
suspicious_features GET method with no useragent header suspicious_request GET https://50n0.tolganfor.ru/SystemNetHttpListenerExceptionU
request GET https://xnw.itdenther.ru/855732125.exe
request GET https://pp.sldov.ru/856125340.exe
request GET https://50n0.tolganfor.ru/SystemNetHttpListenerExceptionU
domain pp.sldov.ru description Russian Federation domain TLD
domain 50n0.tolganfor.ru description Russian Federation domain TLD
domain xnw.itdenther.ru description Russian Federation domain TLD
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 327680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01c80000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01c90000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 655360
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f00000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f60000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72741000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72742000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 1900544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x021b0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02340000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f22000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f61000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f62000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f2a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f2c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f63000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f3c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f64000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f5b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f57000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04850000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f55000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f46000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f4a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f47000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f4b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f3a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2256
region_size: 786432
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00730000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2256
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007b0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2256
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72741000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2256
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72742000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2256
region_size: 262144
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00480000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2256
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00480000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2256
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003a2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2256
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003d5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2256
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003db000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2256
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003d7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2256
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003bc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2256
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006e0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2256
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003ca000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2256
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003c7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2256
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003aa000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2256
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003c6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2256
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003ac000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2256
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003ba000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2256
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003cb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2256
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003cc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2256
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0071f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2256
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00710000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2256
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006e1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2256
region_size: 327680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef50000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2256
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef50000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\856125340.exe
file C:\Users\test22\AppData\Local\Temp\856125340.exe
file C:\Users\test22\AppData\Local\Temp\856125340.exe
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
section {u'size_of_data': u'0x00004a00', u'virtual_address': u'0x00026000', u'entropy': 7.916224196390613, u'name': u'.rsrc', u'virtual_size': u'0x00004898'} entropy 7.91622419639 description A section with a high entropy has been found
url http://crl.comodo.net/TrustedCertificateServices.crl0
url http://www2.public-trust.com/crl/ct/ctroot.crl0
url http://fedir.comsign.co.il/crl/ComSignAdvancedSecurityCA.crl0
url http://crl.identrust.com/DSTROOTCAX3CRL.crl0
url http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
url http://cert.startcom.org/policy.pdf0
url http://crl.securetrust.com/STCA.crl0
url http://crl.securetrust.com/SGCA.crl0
url http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0=
url http://www.ssc.lt/cps03
url http://www.informatik.admin.ch/PKI/links/CPS_2_16_756_1_17_3_1_0.pdf0
url http://crt.comodoca.com/COMODORSAAddTrustCA.crt0
url http://users.ocsp.d-trust.net03
url http://crl.startcom.org/sfsca-crl.crl0
url http://www.digsigtrust.com/DST_TRUST_CPS_v990701.html0
url http://www.microsoft.com/pki/certs/TrustListPCA.crt0
url http://crl.comodo.net/AAACertificateServices.crl0
url http://www.pkioverheid.nl/policies/root-policy0
url https://www.verisign.com
url http://cps.chambersign.org/cps/chambersroot.html0
url http://www.disig.sk/ca/crl/ca_disig.crl0
url http://www.entrust.net/CRL/Client1.crl0
url http://crl.chambersign.org/publicnotaryroot.crl0
url http://ocsp.comodoca.com0
url http://logo.verisign.com/vslogo.gif0
url https://www.certification.tn/cgi-bin/pub/crl/cacrl.crl0
url http://www.crc.bg0
url http://www.acabogacia.org/doc0
url http://www.e-szigno.hu/SZSZ/0
url http://go2.microsoft.com/fwlink/?LinkId=131738
url http://crl.ssc.lt/root-b/cacrl.crl0
url http://www.microsoft.com/schemas/ie8tldlistdescription/1.0
url http://isrg.trustid.ocsp.identrust.com0
url https://www.verisign.com/rpa0
url http://www.quovadis.bm0
url https://www.catcert.net/verarrel05
url http://www.certificadodigital.com.br/repositorio/serasaca/crl/SerasaCAI.crl0
url http://crl.chambersign.org/chambersroot.crl0
url http://www.certificadodigital.com.br/repositorio/serasaca/crl/SerasaCAIII.crl0
url http://crl.globalsign.net/root-r2.crl0
url http://certificates.starfieldtech.com/repository/1604
url http://www.d-trust.net0
url https://www.catcert.net/verarrel
url http://pki-root.ecertpki.cl/CertEnroll/E-CERT%20ROOT%20CA.crl0
url http://crl.ssc.lt/root-a/cacrl.crl0
url http://crl.usertrust.com/UTN-DATACorpSGC.crl0
url http://www.certicamara.com/certicamaraca.crl0
url http://www.d-trust.net/crl/d-trust_root_class_2_ca_2007.crl0
url http://crl.usertrust.com/UTN-USERFirst-Object.crl0)
url http://r3.i.lencr.org/0/
description Code injection with CreateRemoteThread in a remote process rule inject_thread
description Hijack network configuration rule hijack_network
description Create a windows service rule create_service
description Create a COM server rule create_com_service
description Communications over UDP network rule network_udp_sock
description Listen for incoming communication rule network_tcp_listen
description Communications over Toredo network rule network_toredo
description Communications smtp rule network_smtp_dotNet
description Communications over P2P network rule network_p2p_win
description Communications over HTTP rule network_http
description File downloader/dropper rule network_dropper
description Communications over FTP rule network_ftp
description Communications over RAW socket rule network_tcp_socket
description Communications use DNS rule network_dns
description Communication using dga rule network_dga
description Escalade priviledges rule escalate_priv
description Take screenshot rule screenshot
description Run a keylogger rule keylogger
description Steal credential rule cred_local
description Record Audio rule sniff_audio
description APC queue tasks migration rule migrate_apc
description Malware can spread east-west file rule spreading_file
description Malware can spread east-west using share drive rule spreading_share
description Create or check mutex rule win_mutex
description Affect system registries rule win_registry
description Affect system token rule win_token
description Affect private profile rule win_private_profile
description Affect private profile rule win_files_operation
description Match Winsock 2 API library declaration rule Str_Win32_Winsock2_Library
description Match Windows Inet API library declaration rule Str_Win32_Wininet_Library
description Match Windows Inet API call rule Str_Win32_Internet_API
description Match Windows Http API call rule Str_Win32_Http_API
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerCheck__RemoteAPI
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule DebuggerException__ConsoleCtrl
description (no description) rule DebuggerException__SetConsoleCtrl
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description (no description) rule Check_Dlls
description Checks if being debugged rule anti_dbg
description Anti-Sandbox checks for ThreatExpert rule antisb_threatExpert
description Bypass DEP rule disable_dep
description Affect hook table rule win_hook
description Code injection with CreateRemoteThread in a remote process rule inject_thread
description Hijack network configuration rule hijack_network
description Create a windows service rule create_service
description Create a COM server rule create_com_service
buffer Buffer with sha1: 4213ae0c48db3267f8bec3a3657acd6f50921f91
Bkav W32.AIDetect.malware2
Elastic malicious (high confidence)
Qihoo-360 Win32/TrojanDropper.Generic.HwoCy4cA
McAfee RDN/Generic Downloader.x
Cylance Unsafe
Sangfor Trojan.Win32.Save.a
K7AntiVirus Trojan-Downloader ( 00575f9d1 )
Alibaba Trojan:MSIL/Generic.84e3827e
K7GW Trojan-Downloader ( 00575f9d1 )
CrowdStrike win/malicious_confidence_90% (W)
Arcabit Trojan.Dopping.1
Cyren W32/Trojan.OATX-0102
ESET-NOD32 a variant of MSIL/TrojanDownloader.Small.CIQ
APEX Malicious
Paloalto generic.ml
Cynet Malicious (score: 100)
Kaspersky HEUR:Trojan.Win32.Generic
BitDefender Gen:Variant.Dopping.1
MicroWorld-eScan Gen:Variant.Dopping.1
Avast Win32:Trojan-gen
Rising Dropper.Generic!8.35E (CLOUD)
Ad-Aware Gen:Variant.Dopping.1
Emsisoft Gen:Variant.Dopping.1 (B)
F-Secure Trojan.TR/Dropper.Gen
DrWeb Trojan.Inject4.8500
VIPRE Trojan.Win32.Generic!BT
McAfee-GW-Edition BehavesLike.Win32.Generic.dt
FireEye Generic.mg.fea26a213a022eb7
Sophos Mal/Generic-S
Ikarus Trojan-Downloader.MSIL.Small
Avira TR/Dropper.Gen
Gridinsoft Trojan.Win32.Downloader.sa
Microsoft Trojan:Script/Phonzy.A!ml
AegisLab Trojan.Win32.Generic.4!c
ZoneAlarm HEUR:Trojan.Win32.Generic
GData Gen:Variant.Dopping.1
Acronis suspicious
ALYac Gen:Variant.Dopping.1
MAX malware (ai score=100)
Malwarebytes Trojan.Downloader
TrendMicro-HouseCall TROJ_GEN.R002H0CC921
Tencent Win32.Trojan.Generic.Ehhq
SentinelOne Static AI - Malicious PE
eGambit Unsafe.AI_Score_99%
Fortinet W32/Generic.CIQ!tr
BitDefenderTheta Gen:NN.ZexaF.34608.qq3@aGVYjmn
AVG Win32:Trojan-gen
Cybereason malicious.13a022
Panda Trj/Genetic.gen