Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	May 17, 2021, 5:37 p.m.	May 17, 2021, 5:40 p.m.

Size	179.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`61fccc142e2bbf498885bb6e42bae62c`
SHA256	`ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf`
CRC32	`745832DE`
ssdeep	`3072:yX7iPbPtN614Kej7QsyuEnQACE+6GJTOr/q+i5fAQXGfiPbPtN6144iPbPtN614V:y7Ity4KejEswQAxK+ilAQXGfIty44Itq`
PDB Path	C:\Users\lucas\Desktop\Matryoshka\MatryoshkaWorker\Matryoshka\obj\Release\net40\NitroSnypa.pdb
Yara	Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult Is_DotNET_EXE - (no description) PE_Header_Zero - PE File Signature IsPE32 - (no description)

Nitro_Snypa.exe "C:\Users\test22\AppData\Local\Temp\Nitro_Snypa.exe"
7092

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
172.217.25.14	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent May 17, 2021, 5:30 p.m.			0	0
IsDebuggerPresent May 17, 2021, 5:30 p.m.			0	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

This executable has a PDB path (1 event)

pdb_path

C:\Users\lucas\Desktop\Matryoshka\MatryoshkaWorker\Matryoshka\obj\Release\net40\NitroSnypa.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx May 17, 2021, 5:30 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 52 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory May 17, 2021, 5:30 p.m.	process_identifier: 7092 region_size: 917504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000007b0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 17, 2021, 5:30 p.m.	process_identifier: 7092 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000810000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 17, 2021, 5:30 p.m.	process_identifier: 7092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef24e1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 17, 2021, 5:30 p.m.	process_identifier: 7092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2b7b000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 17, 2021, 5:30 p.m.	process_identifier: 7092 region_size: 2293760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002250000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 17, 2021, 5:30 p.m.	process_identifier: 7092 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002400000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 17, 2021, 5:30 p.m.	process_identifier: 7092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef24e2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 17, 2021, 5:30 p.m.	process_identifier: 7092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef24e2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 17, 2021, 5:30 p.m.	process_identifier: 7092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef24e2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 17, 2021, 5:30 p.m.	process_identifier: 7092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef24e2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 17, 2021, 5:30 p.m.	process_identifier: 7092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef24e2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 17, 2021, 5:30 p.m.	process_identifier: 7092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef24e2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 17, 2021, 5:30 p.m.	process_identifier: 7092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef24e2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 17, 2021, 5:30 p.m.	process_identifier: 7092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef24e2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 17, 2021, 5:30 p.m.	process_identifier: 7092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef24e2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 17, 2021, 5:30 p.m.	process_identifier: 7092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef24e2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 17, 2021, 5:30 p.m.	process_identifier: 7092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef24e2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 17, 2021, 5:30 p.m.	process_identifier: 7092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef24e4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 17, 2021, 5:30 p.m.	process_identifier: 7092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef24e4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 17, 2021, 5:30 p.m.	process_identifier: 7092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef24e4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 17, 2021, 5:30 p.m.	process_identifier: 7092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef24e4000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 17, 2021, 5:30 p.m.	process_identifier: 7092 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 17, 2021, 5:30 p.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 17, 2021, 5:30 p.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 17, 2021, 5:30 p.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 17, 2021, 5:30 p.m.	process_identifier: 7092 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 17, 2021, 5:30 p.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 17, 2021, 5:30 p.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92d5a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 17, 2021, 5:30 p.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92e0c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 17, 2021, 5:30 p.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92e36000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 17, 2021, 5:30 p.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92e10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 17, 2021, 5:30 p.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92d6c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 17, 2021, 5:30 p.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92e80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 17, 2021, 5:30 p.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92d6a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 17, 2021, 5:30 p.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92d7b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 17, 2021, 5:30 p.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92dac000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 17, 2021, 5:30 p.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92d7d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 17, 2021, 5:30 p.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92d52000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 17, 2021, 5:30 p.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92d6b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 17, 2021, 5:30 p.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92ec0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 17, 2021, 5:30 p.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92ec1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 17, 2021, 5:30 p.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92d5b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 17, 2021, 5:30 p.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92ec2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 17, 2021, 5:30 p.m.	process_identifier: 7092 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92e81000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 17, 2021, 5:30 p.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92ec3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 17, 2021, 5:30 p.m.	process_identifier: 7092 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000735bc000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 17, 2021, 5:30 p.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92ec4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 17, 2021, 5:30 p.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92ec5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 17, 2021, 5:30 p.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92ec6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 17, 2021, 5:30 p.m.	process_identifier: 7092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92ec7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (3 events)

section

{u'size_of_data': u'0x00025e00', u'virtual_address': u'0x00002000', u'entropy': 7.659121329453185, u'name': u'.text', u'virtual_size': u'0x00025cb0'}

entropy

7.65912132945

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x00006a00', u'virtual_address': u'0x00028000', u'entropy': 7.797915112600991, u'name': u'.rsrc', u'virtual_size': u'0x0000691c'}

entropy

7.7979151126

description

A section with a high entropy has been found

entropy

0.997198879552

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (1 event)

host

172.217.25.14

File has been identified by 38 AntiVirus engines on VirusTotal as malicious (38 events)

MicroWorld-eScan	Gen:Heur.Ransom.HiddenTears.1
McAfee	Artemis!61FCCC142E2B
Cylance	Unsafe
Sangfor	Ransom.MSIL.Encoder.gen
K7AntiVirus	Trojan ( 0052dbd31 )
Alibaba	Trojan:MSIL/Filecoder.8d8d23c6
K7GW	Trojan ( 0052dbd31 )
Cybereason	malicious.42e2bb
Arcabit	Trojan.Ransom.HiddenTears.1
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Filecoder.IX
Avast	Win32:Malware-gen
Kaspersky	HEUR:Trojan-Ransom.MSIL.Encoder.gen
BitDefender	Gen:Heur.Ransom.HiddenTears.1
Paloalto	generic.ml
Ad-Aware	Gen:Heur.Ransom.HiddenTears.1
Sophos	Mal/Generic-S
TrendMicro	Ransom_Encoder.R002C0WEG21
McAfee-GW-Edition	Artemis!Trojan
FireEye	Gen:Heur.Ransom.HiddenTears.1
Emsisoft	Gen:Heur.Ransom.HiddenTears.1 (B)
Ikarus	Win32.Outbreak
Avira	TR/Ransom.tiwaq
Microsoft	Ransom:MacOS/Filecoder
AegisLab	Trojan.MSIL.Encoder.j!c
ZoneAlarm	HEUR:Trojan-Ransom.MSIL.Encoder.gen
GData	Gen:Heur.Ransom.HiddenTears.1
Cynet	Malicious (score: 99)
AhnLab-V3	Trojan/Win.Generic.C4474413
MAX	malware (ai score=100)
Malwarebytes	MachineLearning/Anomalous.96%
TrendMicro-HouseCall	Ransom_Encoder.R002C0WEG21
Rising	Ransom.Encoder!8.FFD4 (CLOUD)
Fortinet	MSIL/Filecoder.IX!tr
BitDefenderTheta	Gen:NN.ZemsilF.34690.lm0@aa70tTd
AVG	Win32:Malware-gen
Panda	Trj/GdSda.A
CrowdStrike	win/malicious_confidence_70% (W)

Nitro_Snypa.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All