popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

2041131341.exe

UltraVNC
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 March 12, 2021, 6:08 p.m. March 12, 2021, 6:13 p.m.
Size 256.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 526489ddbfd0d84e845ccd132cae5555
SHA256 93e07d6f564005880909df7a48a6775e409d50fd09f4ea55962003631fb7d81e
CRC32 A6D76A05
ssdeep 3072:sDKW1LgppLRHMY0TBfJvjcTp5XJXgNAqRO:sDKW1Lgbdl0TBBvjc/NgCk
PDB Path
Yara
  • PE_Header_Zero - PE File Signature Zero
  • OS_Processor_Check_Zero - OS Processor Check Signature Zero
  • UltraVNC_Zero - UltraVNC
  • win_files_operation - Affect private profile
  • IsPE32 - (no description)
  • IsWindowsGUI - (no description)
  • HasOverlay - Overlay Check
  • HasDebugData - DebugData Check
  • HasRichSignature - Rich Signature Check

Name Response Post-Analysis Lookup
5uxm.itdenther.ru
A 81.177.139.41
81.177.139.41
IP Address Status Action
164.124.101.2 Active Moloch
172.217.25.14 Active Moloch
81.177.139.41 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.102:49811 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49806 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49818 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49810 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49827 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49832 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49816 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49831 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49833 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49819 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49834 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49849 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49828 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49843 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49864 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49837 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49846 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49881 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49840 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49850 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49883 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49841 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49851 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49886 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49853 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49890 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49859 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49900 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49869 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49905 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49878 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49910 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49912 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49918 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49932 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49842 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49933 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49844 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49934 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49808 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49855 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49951 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49815 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49823 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49857 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49820 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49824 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49955 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49862 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49821 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49809 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49825 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49865 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49966 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49835 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49826 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49866 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49813 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49970 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49882 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49836 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49830 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49871 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49814 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49976 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49888 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49838 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49854 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49872 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49817 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49982 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49892 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49839 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49858 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49873 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49983 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49822 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49893 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49845 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49860 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49877 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49847 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49894 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49829 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49861 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49887 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49848 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49902 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49867 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49856 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49897 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49852 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49914 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49868 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49898 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49863 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49870 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49926 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49874 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49916 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49889 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49928 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49875 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49876 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49919 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49891 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49930 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49880 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49879 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49895 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49971 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49920 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49896 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49884 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49908 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49981 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49901 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49924 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49885 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49915 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49907 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49929 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49899 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49922 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49903 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49913 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49935 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49931 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49904 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49917 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49938 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49937 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49923 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49906 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49943 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49939 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49925 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49909 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49947 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49941 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49927 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49952 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49911 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49950 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49940 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49957 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49921 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49959 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49942 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49936 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49960 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49965 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49946 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49961 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49944 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49972 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49949 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49945 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49968 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49954 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49969 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49948 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49962 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49979 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49953 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49963 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49980 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49956 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49964 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49984 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49958 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49967 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49973 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49974 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49975 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49977 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49978 -> 81.177.139.41:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLS 1.2
192.168.56.102:49806
81.177.139.41:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.5uxm.itdenther.ru 0a:71:4c:d5:3a:6b:f3:90:84:48:b0:a4:09:7a:eb:7a:49:17:7b:38
TLS 1.2
192.168.56.102:49811
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49818
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49810
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49827
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49832
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49816
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49831
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49833
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49819
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49834
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49849
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49828
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49843
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49864
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49837
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49846
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49881
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49840
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49850
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49883
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49841
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49851
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49886
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49853
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49890
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49859
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49900
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49869
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49905
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49878
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49910
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49912
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49918
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49932
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49842
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49933
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49844
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49934
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49808
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49855
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49951
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49815
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49823
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49857
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49820
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49824
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49955
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49862
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49821
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49809
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49825
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49865
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49966
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49835
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49866
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49826
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49813
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49970
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49882
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49836
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49830
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49871
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49814
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49976
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49888
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49838
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49854
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49872
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49817
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49982
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49892
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49839
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49858
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49873
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49983
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49822
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49893
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49845
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49860
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49877
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49847
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49894
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49829
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49861
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49887
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49848
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49902
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49867
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49897
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49856
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49852
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49914
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49868
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49898
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49863
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49870
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49926
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49874
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49916
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49889
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49928
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49875
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49876
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49891
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49919
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49930
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49880
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49879
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49895
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49971
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49920
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49896
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49884
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49981
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49908
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49924
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49901
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49885
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49915
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49907
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49929
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49899
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49922
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49903
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49913
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49935
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49931
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49904
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49917
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49938
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49937
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49923
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49906
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49943
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49939
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49925
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49909
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49947
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49941
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49927
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49952
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49911
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49950
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49940
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49957
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49921
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49959
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49942
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49936
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49960
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49965
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49946
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49961
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49944
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49972
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49949
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49945
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49968
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49954
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49969
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49948
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49962
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49979
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49953
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49963
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49980
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49956
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49964
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49984
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49958
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49967
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49973
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49974
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49975
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49977
81.177.139.41:443 		None None None
TLS 1.2
192.168.56.102:49978
81.177.139.41:443 		None None None

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004e64a0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004e64a0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004e64e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004e64e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004e6520
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004e64a0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004e64a0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
pdb_path
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
2041131341+0x1fa2 @ 0x401fa2

exception.instruction_r: f3 aa 8b 45 f0 8b 4d 08 8b 55 10 03 c8 2b d0 52
exception.symbol: 2041131341+0xf088
exception.instruction: stosb byte ptr es:[edi], al
exception.module: 2041131341.exe
exception.exception_code: 0xc0000005
exception.offset: 61576
exception.address: 0x40f088
registers.esp: 1636996
registers.edi: 4350244
registers.eax: 0
registers.ebp: 1637012
registers.edx: 0
registers.ebx: 0
registers.esi: 4009296
registers.ecx: 12
1 0 0

__exception__

 stacktrace: 
2041131341+0xf054 @ 0x40f054
2041131341+0xf0a0 @ 0x40f0a0
2041131341+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 2041131341+0xefff
exception.address: 0x40efff
exception.module: 2041131341.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636940
registers.edi: 4353968
registers.eax: 4350256
registers.ebp: 1636944
registers.edx: 111
registers.ebx: 0
registers.esi: 4009296
registers.ecx: 148
1 0 0

__exception__

 stacktrace: 
2041131341+0xf054 @ 0x40f054
2041131341+0xf0a0 @ 0x40f0a0
2041131341+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 2041131341+0xefff
exception.address: 0x40efff
exception.module: 2041131341.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636940
registers.edi: 4358064
registers.eax: 4350256
registers.ebp: 1636944
registers.edx: 111
registers.ebx: 0
registers.esi: 4009296
registers.ecx: 116
1 0 0

__exception__

 stacktrace: 
2041131341+0xf054 @ 0x40f054
2041131341+0xf0a0 @ 0x40f0a0
2041131341+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 2041131341+0xefff
exception.address: 0x40efff
exception.module: 2041131341.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636940
registers.edi: 4362160
registers.eax: 4350256
registers.ebp: 1636944
registers.edx: 111
registers.ebx: 0
registers.esi: 4009296
registers.ecx: 84
1 0 0

__exception__

 stacktrace: 
2041131341+0xf054 @ 0x40f054
2041131341+0xf0a0 @ 0x40f0a0
2041131341+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 2041131341+0xefff
exception.address: 0x40efff
exception.module: 2041131341.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636940
registers.edi: 4366256
registers.eax: 4350256
registers.ebp: 1636944
registers.edx: 111
registers.ebx: 0
registers.esi: 4009296
registers.ecx: 52
1 0 0

__exception__

 stacktrace: 
2041131341+0xf054 @ 0x40f054
2041131341+0xf0a0 @ 0x40f0a0
2041131341+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 2041131341+0xefff
exception.address: 0x40efff
exception.module: 2041131341.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636940
registers.edi: 4370352
registers.eax: 4350256
registers.ebp: 1636944
registers.edx: 111
registers.ebx: 0
registers.esi: 4009296
registers.ecx: 20
1 0 0
suspicious_features GET method with no useragent header suspicious_request GET https://5uxm.itdenther.ru/SystemNetConfigurationConnectionManagementSectionInternalF
request GET https://5uxm.itdenther.ru/SystemNetConfigurationConnectionManagementSectionInternalF
domain 5uxm.itdenther.ru description Russian Federation domain TLD
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 996
region_size: 1638400
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f80000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 996
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x020d0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 996
region_size: 2293760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02150000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 996
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02340000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 996
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6fba1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 996
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6fba2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 996
region_size: 1179648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f80000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 996
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02060000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 996
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00492000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 996
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02341000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 996
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02342000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 996
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0049a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 996
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0049c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 996
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02343000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 996
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01cdc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 996
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02344000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 996
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01cfb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 996
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01cf7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 996
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04850000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 996
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01cf5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 996
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01cea000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 996
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01ce7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 996
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01ce6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 996
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04851000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 996
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01cda000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 996
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01ceb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 996
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01cec000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 996
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04b6f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 996
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04b60000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 996
region_size: 327680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0xfff50000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 996
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0xfff50000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 996
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0xfff50000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 996
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0xfff58000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 996
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0xfff40000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 996
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0xfff40000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 996
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01ce8000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
section {u'size_of_data': u'0x00006000', u'virtual_address': u'0x00026000', u'entropy': 7.931785122108059, u'name': u'.rsrc', u'virtual_size': u'0x00005f58'} entropy 7.93178512211 description A section with a high entropy has been found
url http://crl.comodo.net/TrustedCertificateServices.crl0
url http://apps.identrust.com/roots/dstrootcax
url http://www.e-szigno.hu/RootCA.crt0
url http://crl.identrust.com/DSTROOTCAX3CRL.crl0
url http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
url http://cert.startcom.org/policy.pdf0
url http://crl.securetrust.com/STCA.crl0
url http://crl.securetrust.com/SGCA.crl0
url http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0=
url http://www.ssc.lt/cps03
url http://www.informatik.admin.ch/PKI/links/CPS_2_16_756_1_17_3_1_0.pdf0
url http://crt.comodoca.com/COMODORSAAddTrustCA.crt0
url http://users.ocsp.d-trust.net03
url http://crl.startcom.org/sfsca-crl.crl0
url http://www.digsigtrust.com/DST_TRUST_CPS_v990701.html0
url https://5uxm.itdenther.ru/SystemNetConfigurationConnectionManagementSectionInternalF
url http://www.microsoft.com/pki/certs/TrustListPCA.crt0
url http://crl.comodo.net/AAACertificateServices.crl0
url http://www.pkioverheid.nl/policies/root-policy0
url https://www.verisign.com
url http://cps.chambersign.org/cps/chambersroot.html0
url http://www.disig.sk/ca/crl/ca_disig.crl0
url http://apps.identrust.com/roots/dstrootcaE
url http://www.entrust.net/CRL/Client1.crl0
url http://crl.chambersign.org/publicnotaryroot.crl0
url http://ocsp.comodoca.com0
url http://logo.verisign.com/vslogo.gif0
url https://www.certification.tn/cgi-bin/pub/crl/cacrl.crl0
url http://cert.s
url http://www.crc.bg0
url http://www.acabogacia.org/doc0
url http://www.e-szigno.hu/SZSZ/0
url http://go2.microsoft.com/fwlink/?LinkId=131738
url http://crl.ssc.lt/root-b/cacrl.crl0
url http://isrg.trustid.ocsp.identrust.com0
url https://www.verisign.com/rpa0
url https://5uxm.itdenther.ru/SystemNetConfigurationConnectionManagementSect
url https://www.catcert.net/verarrel05
url http://www.certificadodigital.com.br/repositorio/serasaca/crl/SerasaCAI.crl0
url http://crl.chambersign.org/chambersroot.crl0
url http://www.certificadodigital.com.br/repositorio/serasaca/crl/SerasaCAIII.crl0
url http://crl.globalsign.net/root-r2.crl0
url http://certificates.starfieldtech.com/repository/1604
url http://www.d-trust.net0
url https://www.catcert.net/verarrel
url http://pki-root.ecertpki.cl/CertEnroll/E-CERT%20ROOT%20CA.crl0
url http://crl.ssc.lt/root-a/cacrl.crl0
url http://r3.i.lencr.org/01
url http://crl.usertrust.com/UTN-DATACorpSGC.crl0
url http://www.certicamara.com/certicamaraca.crl0
description Code injection with CreateRemoteThread in a remote process rule inject_thread
description Hijack network configuration rule hijack_network
description Create a windows service rule create_service
description Create a COM server rule create_com_service
description Communications over UDP network rule network_udp_sock
description Listen for incoming communication rule network_tcp_listen
description Communications over Toredo network rule network_toredo
description Communications smtp rule network_smtp_dotNet
description Communications over P2P network rule network_p2p_win
description Communications over HTTP rule network_http
description File downloader/dropper rule network_dropper
description Communications over FTP rule network_ftp
description Communications over RAW socket rule network_tcp_socket
description Communications use DNS rule network_dns
description Communication using dga rule network_dga
description Escalade priviledges rule escalate_priv
description Take screenshot rule screenshot
description Run a keylogger rule keylogger
description Steal credential rule cred_local
description Record Audio rule sniff_audio
description APC queue tasks migration rule migrate_apc
description Malware can spread east-west file rule spreading_file
description Malware can spread east-west using share drive rule spreading_share
description Create or check mutex rule win_mutex
description Affect system registries rule win_registry
description Affect system token rule win_token
description Affect private profile rule win_private_profile
description Affect private profile rule win_files_operation
description Match Winsock 2 API library declaration rule Str_Win32_Winsock2_Library
description Match Windows Inet API library declaration rule Str_Win32_Wininet_Library
description Match Windows Inet API call rule Str_Win32_Internet_API
description Match Windows Http API call rule Str_Win32_Http_API
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerCheck__RemoteAPI
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule DebuggerException__ConsoleCtrl
description (no description) rule DebuggerException__SetConsoleCtrl
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description (no description) rule Check_Dlls
description Checks if being debugged rule anti_dbg
description Anti-Sandbox checks for ThreatExpert rule antisb_threatExpert
description Bypass DEP rule disable_dep
description Affect hook table rule win_hook
host 172.217.25.14
Bkav W32.AIDetect.malware2
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.45862691
FireEye Generic.mg.526489ddbfd0d84e
McAfee Artemis!526489DDBFD0
Cylance Unsafe
Sangfor Trojan.Win32.Save.a
K7AntiVirus Trojan-Downloader ( 005786501 )
Alibaba Trojan:MSIL/Generic.3007dbd3
K7GW Trojan-Downloader ( 005786501 )
CrowdStrike win/malicious_confidence_100% (W)
Arcabit Trojan.Generic.D2BBCF23
Cyren W32/Trojan.TJCG-9286
Symantec ML.Attribute.HighConfidence
APEX Malicious
Kaspersky HEUR:Trojan.Win32.Generic
BitDefender Trojan.GenericKD.45862691
Paloalto generic.ml
AegisLab Trojan.Win32.Generic.4!c
Tencent Msil.Trojan-downloader.Agent.Stua
Ad-Aware Trojan.GenericKD.45862691
Emsisoft Trojan.GenericKD.45862691 (B)
F-Secure Trojan.TR/Dropper.Gen
McAfee-GW-Edition BehavesLike.Win32.Generic.dm
Sophos Mal/Generic-S
SentinelOne Static AI - Malicious PE
ESET-NOD32 a variant of MSIL/TrojanDownloader.Agent.HLP
Webroot W32.Trojan.Gen
Avira TR/Dropper.Gen
Gridinsoft Trojan.Win32.Downloader.sa
Microsoft Trojan:Script/Phonzy.A!ml
ZoneAlarm HEUR:Trojan.Win32.Generic
GData Trojan.GenericKD.45862691
Cynet Malicious (score: 100)
Acronis suspicious
BitDefenderTheta Gen:NN.ZexaF.34608.qq3@aKt@Nmg
MAX malware (ai score=82)
Malwarebytes Spyware.RedLineStealer
TrendMicro-HouseCall TROJ_GEN.R06CH0CC821
Rising Dropper.Generic!8.35E (CLOUD)
Ikarus Trojan-Downloader.MSIL.Agent
Fortinet W32/Generic.HLP!tr
Cybereason malicious.7d8e15
Panda Trj/Genetic.gen
Qihoo-360 Win32/TrojanDropper.Generic.HwoCyBoA