popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

lsass.exe

PE32 PE File .NET EXE
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 June 8, 2024, 5:40 p.m. June 8, 2024, 5:44 p.m.
Size 6.0KB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 6293f7a0a604be58b31b34460fd5a71b
SHA256 da109106b97b7e8162f2a14a021aef67b1a6f26042c77559569e81177e30159a
CRC32 83471953
ssdeep 96:Gfirqeli5O5+tFrYeVY4KtzPptdnK7rzxr5y4fyQdy8yJzNt:Gfjeg5c+tZlVY4UzxLurd83Qgrr
Yara
  • PE_Header_Zero - PE File Signature
  • Is_DotNET_EXE - (no description)
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
theloftibiza.com
A 193.141.3.75
193.141.3.75
IP Address Status Action
164.124.101.2 Active Moloch
193.141.3.75 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49175 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49163 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49170 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49167 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49178 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49165 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49161 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49192 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49187 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49166 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49203 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49172 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49207 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49195 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49176 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49210 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49198 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49181 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49202 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49164 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49169 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49205 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49168 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49177 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49174 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49215 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49180 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49182 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49220 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49185 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49223 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49229 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49188 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49232 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49186 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49179 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49241 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49193 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49242 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49190 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49194 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49248 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49204 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49191 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49173 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49212 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49183 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49214 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49196 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49225 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49216 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49239 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49221 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49251 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49227 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49255 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49260 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49189 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49231 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49258 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49197 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49233 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49262 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49206 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49261 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49235 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49264 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49209 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49275 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49246 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49265 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49217 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49285 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49250 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49270 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49234 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49254 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49305 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49272 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49237 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49309 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49297 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49269 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49256 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49312 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49308 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49184 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49271 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49257 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49311 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49276 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49317 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49314 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49283 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49327 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49293 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49329 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49306 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49334 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49310 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49200 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49323 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49219 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49199 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49324 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49336 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49267 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49337 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49339 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49268 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49355 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49201 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49353 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49273 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49356 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49277 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49226 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49208 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49280 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49228 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49238 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49282 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49287 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49211 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49290 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49291 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49292 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49240 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49213 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49296 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49243 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49298 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49218 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49253 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49300 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49222 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49301 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49224 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49302 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49259 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49230 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49313 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49236 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49318 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49304 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49325 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49321 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49340 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49244 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49345 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49326 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49346 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49245 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49328 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49348 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49247 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49352 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49249 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49357 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49252 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49263 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49331 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49332 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49274 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49266 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49278 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49279 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49281 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49288 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49284 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49286 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49333 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49289 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49335 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49303 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49294 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49307 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49343 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49295 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49299 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49330 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49338 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49315 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49316 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49341 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49319 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49342 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49354 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49344 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49320 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49322 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49347 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49350 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49349 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49351 -> 193.141.3.75:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 1441792
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007a0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x008c0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2548
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x727a1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2548
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x727a2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 655360
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00440000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004a0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003e2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00415000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0041b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00417000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003fc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005a0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0040a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00407000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003ea000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00406000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0040b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003fa000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003ec000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 1158
family: 0
1 0 0
Time & API Arguments Status Return Repeated

NtQuerySystemInformation

 information_class: 8 (SystemProcessorPerformanceInformation)
1 0 0
description lsass.exe tried to sleep 5456486 seconds, actually delayed analysis time by 5456486 seconds
Time & API Arguments Status Return Repeated

WSASend

 buffer: sofdéŸ|» û[U¨†NÍsy<µ½µ• ð»n}`CÑÛ/5 ÀÀÀ À 28.ÿtheloftibiza.com  
socket: 944
0 0

WSASend

 buffer: sofdêø@Ñkø {Gß­Úþ¯ÏÜ¡¤[ìÔÅ^û­ /5 ÀÀÀ À 28.ÿtheloftibiza.com  
socket: 1224
0 0

WSASend

 buffer: sofdëð/-h’øÄyû⊎÷6Áö¥ºCRÇ)¨Ñ /5 ÀÀÀ À 28.ÿtheloftibiza.com  
socket: 1224
0 0

WSASend

 buffer: sofdëFw) ôƒ lB‚ÎWÛ¢™Ë„_Þ¦/5 ÀÀÀ À 28.ÿtheloftibiza.com  
socket: 1224
0 0

WSASend

 buffer: sofdìC`JWØvŸh.Ü;*Y«°Oz…ë{ßö/5 ÀÀÀ À 28.ÿtheloftibiza.com  
socket: 1224
0 0

WSASend

 buffer: sofdíÄ5èÌ`¸¸0éŠ*‡]•w"‡2à5ÉD¤"~/5 ÀÀÀ À 28.ÿtheloftibiza.com  
socket: 1224
0 0

WSASend

 buffer: sofdíÊáæß͇e@,£wr¶@¤»º¨Ÿ8£cjÓd/5 ÀÀÀ À 28.ÿtheloftibiza.com  
socket: 1260
0 0

WSASend

 buffer: sofdîçP:Ϻx€6Ƴp3Õ±fÑø%O×%fíê/5 ÀÀÀ À 28.ÿtheloftibiza.com  
socket: 1260
0 0

WSASend

 buffer: sofdî0Lþôyyµºjª>ñ<gÔè!wE»Ÿ!éÌ?kC/5 ÀÀÀ À 28.ÿtheloftibiza.com  
socket: 1260
0 0

WSASend

 buffer: sofdïüÖçߘþzDÑ눢ÁàÜ^Š/*¶Cc5G@¸¬/5 ÀÀÀ À 28.ÿtheloftibiza.com  
socket: 1260
0 0

WSASend

 buffer: sofdð,%5ILZüó©ùÌiæ`¤ßݹÞÜWAw/5 ÀÀÀ À 28.ÿtheloftibiza.com  
socket: 1260
0 0

WSASend

 buffer: sofdðÞ،¬©ápáÑÃCu}yµåj J7"†!x$V`/5 ÀÀÀ À 28.ÿtheloftibiza.com  
socket: 1284
0 0

WSASend

 buffer: sofdñÙÿgV]ªštß0¤,ûûBô¯Yß·šù>ž/5 ÀÀÀ À 28.ÿtheloftibiza.com  
socket: 1284
0 0

WSASend

 buffer: sofdñ 8Þ üm é¨£qt," çxIˆàsËß̦õ/5 ÀÀÀ À 28.ÿtheloftibiza.com  
socket: 1256
0 0

WSASend

 buffer: sofdòf‰±; hÄôTû}ü€€ô†ÃKɤb5®Ì+›²/5 ÀÀÀ À 28.ÿtheloftibiza.com  
socket: 1256
0 0

WSASend

 buffer: sofdó/†iÓþnŽ¡[…t}a•¯©7èz“Ùƒ/5 ÀÀÀ À 28.ÿtheloftibiza.com  
socket: 1256
0 0

WSASend

 buffer: sofdóKO=Ý'Ú`­ˆ×â!¶Ó~¤L̕1ó Ws½–/5 ÀÀÀ À 28.ÿtheloftibiza.com  
socket: 1256
0 0

WSASend

 buffer: sofdôY Æ:,±Ö /AÊêóå¯\뒣'½ú\/5 ÀÀÀ À 28.ÿtheloftibiza.com  
socket: 1256
0 0

WSASend

 buffer: sofdôÅ8qæ'úS¯ÜZ»VhÅ,‚ÞžÏx¬‚Q(û/5 ÀÀÀ À 28.ÿtheloftibiza.com  
socket: 1256
0 0

WSASend

 buffer: sofdõÄ¡þó«]Zöagá72–<rWôG…šzEî/5 ÀÀÀ À 28.ÿtheloftibiza.com  
socket: 1256
0 0

WSASend

 buffer: sofdö1»ªKì£ÖHõhﱡËDö(דfˆì½/5 ÀÀÀ À 28.ÿtheloftibiza.com  
socket: 1288
0 0

WSASend

 buffer: sofdöÀwL•,yžÙ•øûÃùÿmDž+.%1/5 ÀÀÀ À 28.ÿtheloftibiza.com  
socket: 1288
0 0

WSASend

 buffer: sofd÷¬™ç¨8ï YL Í?Š[l¿ë­â‘ÉÓdBf¿/5 ÀÀÀ À 28.ÿtheloftibiza.com  
socket: 1288
0 0

WSASend

 buffer: sofd÷}Äÿ­u° d?n7p[ûюPKÅ,,ž¨¿/5 ÀÀÀ À 28.ÿtheloftibiza.com  
socket: 1288
0 0

WSASend

 buffer: sofdøK¦ õPp€½pÑNB͜DDj( Í* /5 ÀÀÀ À 28.ÿtheloftibiza.com  
socket: 1288
0 0

WSASend

 buffer: sofdù´~o=ó~ʑ(2AüÄ®“uûR~=“ÍlOª/5 ÀÀÀ À 28.ÿtheloftibiza.com  
socket: 1288
0 0

WSASend

 buffer: sofdùšL-êí‘M o W ²?ZcŸ¨¾ŒQO4/5 ÀÀÀ À 28.ÿtheloftibiza.com  
socket: 1288
0 0

WSASend

 buffer: sofdú‹e™BŒË%©*Òؘpþ‰}}C‡†ˆP½Œ=/5 ÀÀÀ À 28.ÿtheloftibiza.com  
socket: 1288
0 0

WSASend

 buffer: sofdûS wúÏ3+‘Q1›àñxãYÒJË/5 ÀÀÀ À 28.ÿtheloftibiza.com  
socket: 1288
0 0

WSASend

 buffer: sofdûÜ)5[˜Ïƒ°¸`Clë®fΨ_;?Õ_b¯/5 ÀÀÀ À 28.ÿtheloftibiza.com  
socket: 1288
0 0

WSASend

 buffer: sofdüY·´øÃI6î˸Ï¿Ð׊ ^6™ y/=Ü/5 ÀÀÀ À 28.ÿtheloftibiza.com  
socket: 1288
0 0

WSASend

 buffer: sofdüÓ8ißK¯²‘ÂB!ÓLS·JbÈ@Z¹2º/5 ÀÀÀ À 28.ÿtheloftibiza.com  
socket: 1288
0 0

WSASend

 buffer: sofdý0¿ä $ˆÄ@Θ)Î¹ÃeoÚfAag@ñz/5 ÀÀÀ À 28.ÿtheloftibiza.com  
socket: 1288
0 0

WSASend

 buffer: sofdþ\¬> 59ö§×c…Ö„PX¢¬ªp"æ~ë]¤/5 ÀÀÀ À 28.ÿtheloftibiza.com  
socket: 1288
0 0

WSASend

 buffer: sofdþqÒ@,:T=žÝycßɜhøl–²f¬‚†€°¦áº/5 ÀÀÀ À 28.ÿtheloftibiza.com  
socket: 1288
0 0

WSASend

 buffer: sofdÿ&ÓQN3€‰ÖmÄfsH&?V™nM6¦°1Ì  ü/5 ÀÀÀ À 28.ÿtheloftibiza.com  
socket: 1288
0 0

WSASend

 buffer: sofdÿÞšBõ]ó*zÈÖç%Ôèä[ß5– •å{/5 ÀÀÀ À 28.ÿtheloftibiza.com  
socket: 1288
0 0

WSASend

 buffer: sofd¨·(Ï#aµÕbY("…Ñlò3¼pÿAZ™Üî/5 ÀÀÀ À 28.ÿtheloftibiza.com  
socket: 1288
0 0

WSASend

 buffer: sofd0ÚUÒB)e^ÍšÄѪqìSaIqƒì~S´/5 ÀÀÀ À 28.ÿtheloftibiza.com  
socket: 1288
0 0

WSASend

 buffer: sofdUø#0¤q´üÆ][‚m¹fv$‰M<>Õ}2”/5 ÀÀÀ À 28.ÿtheloftibiza.com  
socket: 1288
0 0

WSASend

 buffer: sofdk9!@ás ËÔIÆGГdg,¾¢–4ø¹/5 ÀÀÀ À 28.ÿtheloftibiza.com  
socket: 1288
0 0

WSASend

 buffer: sofd•ËÄÜÍ@i©5ñæ?Þi?÷XñȾ±×–Õs/5 ÀÀÀ À 28.ÿtheloftibiza.com  
socket: 1316
0 0

WSASend

 buffer: sofdqÈ°²¢†5Â~BÍš$Ã$_Zž‚TcX ôAf/5 ÀÀÀ À 28.ÿtheloftibiza.com  
socket: 1316
0 0

WSASend

 buffer: sofdh«·“™âŠ¤QƒÂ÷¥¼üHxÔyPjlÚa/5 ÀÀÀ À 28.ÿtheloftibiza.com  
socket: 1316
0 0

WSASend

 buffer: sofd[TuþàÖ¶7æBHé< |)Ïx ÊøZp„/5 ÀÀÀ À 28.ÿtheloftibiza.com  
socket: 1316
0 0

WSASend

 buffer: sofd!âÅË= ÂÞðYî˜»FRé" 3qÍp/5 ÀÀÀ À 28.ÿtheloftibiza.com  
socket: 1316
0 0

WSASend

 buffer: sofdtïí¥DðªµÖ%"%ºW»‹©Q¶ÿDšcc½/5 ÀÀÀ À 28.ÿtheloftibiza.com  
socket: 1316
0 0

WSASend

 buffer: sofdE˜]¬Ú£!¡nâÅ­z1ë+’WC´E/5 ÀÀÀ À 28.ÿtheloftibiza.com  
socket: 1316
0 0

WSASend

 buffer: sofdô&?ÎÛU$>Ôʺ¸y3càz¸S2†W¹dË¥/5 ÀÀÀ À 28.ÿtheloftibiza.com  
socket: 1316
0 0

WSASend

 buffer: sofdf| y»äV3“°¶˜é¸“-AZÇPG·4v/5 ÀÀÀ À 28.ÿtheloftibiza.com  
socket: 1316
0 0
Bkav W32.Common.E1564D06
Lionic Trojan.Win32.Blocker.V!c
Skyhigh Artemis!Trojan
McAfee Artemis!6293F7A0A604
Cylance Unsafe
VIPRE Trojan.GenericKD.73003278
Sangfor Downloader.Msil.Agent.Vz7m
BitDefender Trojan.GenericKD.73003278
Arcabit Trojan.Generic.D459F10E
VirIT Trojan.Win32.MSIL_Heur.A
Symantec MSIL.Downloader!gen7
Elastic malicious (high confidence)
ESET-NOD32 a variant of MSIL/TrojanDownloader.Agent.QUK
APEX Malicious
Avast Win32:PWSX-gen [Trj]
Kaspersky HEUR:Trojan-Ransom.MSIL.Blocker.gen
MicroWorld-eScan Trojan.GenericKD.73003278
Emsisoft Trojan.GenericKD.73003278 (B)
TrendMicro Trojan.MSIL.FRS.VSNW04F24
McAfeeD ti!DA109106B97B
FireEye Trojan.GenericKD.73003278
Sophos Mal/Generic-S
Ikarus Trojan-Downloader.MSIL.Agent
Webroot W32.Trojan.GenKD
Google Detected
MAX malware (ai score=80)
Antiy-AVL Trojan[Ransom]/MSIL.Blocker
Kingsoft MSIL.Trojan-Ransom.Blocker.gen
Microsoft Trojan:Win32/Leonem
ZoneAlarm HEUR:Trojan-Ransom.MSIL.Blocker.gen
GData Trojan.GenericKD.73003278
Varist W32/ABRisk.SFUL-7962
AhnLab-V3 Malware/Win.Generic.C5630007
BitDefenderTheta Gen:NN.ZemsilF.36806.am0@autp2yc
DeepInstinct MALICIOUS
Malwarebytes Trojan.Downloader.MSIL
Panda Trj/Chgt.AD
TrendMicro-HouseCall Trojan.MSIL.FRS.VSNW04F24
SentinelOne Static AI - Suspicious PE
Fortinet MSIL/Agent_AGen.BJG!tr.dldr
AVG Win32:PWSX-gen [Trj]
Paloalto generic.ml
alibabacloud Ransomware:MSIL/Leonem.Gen