Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	July 27, 2021, 9:12 a.m.	July 27, 2021, 9:23 a.m.

Size	56.0KB
Type	PE32 executable (console) Intel 80386, for MS Windows
MD5	`1609d18c06f71cd892d6fb524ecfc2ad`
SHA256	`9df54d4e8faccc9aff9d8ea76a8aaf9e1f64ef0e32dbe9904b4654cee4884e1e`
CRC32	`D2DFDFF6`
ssdeep	`768:tY0swb0Bhe4KC7ojVTH/EdJ2cTspywATkIOsKCljh:0wuKCchTMdJ6pKHbljh`
Yara	IsPE32 - (no description) UPX_Zero - UPX packed file Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature

3003.exe "C:\Users\test22\AppData\Local\Temp\3003.exe"
1868
- 3003.exe "C:\Users\test22\AppData\Local\Temp\3003.exe" -a
  872
rundll32.exe rundll32.exe "C:\Users\test22\AppData\Local\Temp\sqlite.dll",global
2664
- rundll32.exe rundll32.exe "C:\Users\test22\AppData\Local\Temp\sqlite.dll",global
  1760

Name	Response	Post-Analysis Lookup
live.goatgame.live	A 104.21.70.98 A 172.67.222.125	104.21.70.98
google.vrthcobj.com		34.97.69.225
ol.gamegame.info	A 172.67.200.215 A 104.21.21.221	172.67.200.215
by.dirfgame.com	A 104.21.78.28 A 172.67.215.92	172.67.215.92
google.vrthcobj.com	A 34.97.69.225	34.97.69.225
ip-api.com	A 208.95.112.1	208.95.112.1

IP Address	Status	Action
104.21.78.28	Active	Moloch
164.124.101.2	Active	Moloch
172.67.200.215	Active	Moloch
172.67.222.125	Active	Moloch
208.95.112.1	Active	Moloch
34.97.69.225	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49198 -> 172.67.222.125:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49207 -> 208.95.112.1:80	2022082	ET POLICY External IP Lookup ip-api.com	Device Retrieving External IP Address Detected
TCP 192.168.56.101:49207 -> 208.95.112.1:80	2022082	ET POLICY External IP Lookup ip-api.com	Device Retrieving External IP Address Detected
TCP 192.168.56.101:49207 -> 208.95.112.1:80	2022082	ET POLICY External IP Lookup ip-api.com	Device Retrieving External IP Address Detected
TCP 192.168.56.101:49207 -> 208.95.112.1:80	2022082	ET POLICY External IP Lookup ip-api.com	Device Retrieving External IP Address Detected

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.101:49198 172.67.222.125:443	C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3	C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com	6e:af:7d:03:68:a7:53:bb:5d:6a:ab:d0:a0:25:76:e7:15:3c:7d:ae

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW July 27, 2021, 9:12 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 27, 2021, 9:12 a.m.			0	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 27, 2021, 9:12 a.m.		1	1	0

The executable uses a known packer (1 event)

packer

Armadillo v1.71

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (2 events)

suspicious_features	POST method with no referer header				suspicious_request	POST http://by.dirfgame.com/report7.4.php
suspicious_features	POST method with no referer header				suspicious_request	POST http://ol.gamegame.info/report7.4.php

Performs some HTTP requests (5 events)

request	GET http://ip-api.com/json/?fields=8198
request	POST http://by.dirfgame.com/report7.4.php
request	POST http://ol.gamegame.info/report7.4.php
request	GET https://live.goatgame.live/userf/dat/3003/sqlite.dat
request	GET https://live.goatgame.live/userf/dat/sqlite.dll

Sends data using the HTTP POST Method (2 events)

request	POST http://by.dirfgame.com/report7.4.php
request	POST http://ol.gamegame.info/report7.4.php

Allocates read-write-execute memory (usually to unpack itself) (18 events)

Time & API	Arguments	Status
NtProtectVirtualMemory July 27, 2021, 9:12 a.m.	process_identifier: 1760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d7d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 27, 2021, 9:12 a.m.	process_identifier: 1760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d00000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 27, 2021, 9:12 a.m.	process_identifier: 1760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73771000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 27, 2021, 9:12 a.m.	process_identifier: 1760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 27, 2021, 9:12 a.m.	process_identifier: 1760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72da4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 27, 2021, 9:12 a.m.	process_identifier: 1760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 27, 2021, 9:12 a.m.	process_identifier: 1760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72d21000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 27, 2021, 9:12 a.m.	process_identifier: 1760 region_size: 1638400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x020a0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 27, 2021, 9:12 a.m.	process_identifier: 1760 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 27, 2021, 9:12 a.m.	process_identifier: 1760 region_size: 1052672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x020a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 27, 2021, 9:12 a.m.	process_identifier: 1760 region_size: 385024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01dc0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 27, 2021, 9:12 a.m.	process_identifier: 1760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72ce1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 27, 2021, 9:12 a.m.	process_identifier: 1760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76891000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 27, 2021, 9:12 a.m.	process_identifier: 1760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72cc1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 27, 2021, 9:12 a.m.	process_identifier: 1760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75111000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 27, 2021, 9:12 a.m.	process_identifier: 1760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75241000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 27, 2021, 9:12 a.m.	process_identifier: 1760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74f41000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 27, 2021, 9:12 a.m.	process_identifier: 1760 region_size: 319488 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e90000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Looks up the external IP address (1 event)

domain

ip-api.com

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\sqlite.dll

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\sqlite.dll

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (7 events)

Time & API	Arguments	Status	Return
Process32NextW July 27, 2021, 9:12 a.m.	snapshot_handle: 0x00000120 process_name: SearchProtocolHost.exe process_identifier: 2120	1	1
Process32NextW July 27, 2021, 9:12 a.m.	snapshot_handle: 0x00000120 process_name: mobsync.exe process_identifier: 2060	1	1
Process32NextW July 27, 2021, 9:12 a.m.	snapshot_handle: 0x00000120 process_name: pw.exe process_identifier: 2296	1	1
Process32NextW July 27, 2021, 9:12 a.m.	snapshot_handle: 0x00000120 process_name: taskhost.exe process_identifier: 2832	1	1
Process32NextW July 27, 2021, 9:12 a.m.	snapshot_handle: 0x00000120 process_name: WmiPrvSE.exe process_identifier: 2932	1	1
Process32NextW July 27, 2021, 9:12 a.m.	snapshot_handle: 0x00000120 process_name: rundll32.exe process_identifier: 2664	1	1
Process32NextW July 27, 2021, 9:12 a.m.	snapshot_handle: 0x00000120 process_name: rundll32.exe process_identifier: 1760	1	1

Expresses interest in specific running processes (1 event)

process

rundll32.exe

Creates or sets a registry key to a long series of bytes, possibly to store a binary or malware config (1 event)

Time & API	Arguments	Status	Return	Repeated
RegSetValueExW July 27, 2021, 9:12 a.m.	key_handle: 0x00000124 regkey_r: 1 reg_type: 3 (REG_BINARY) value: ÁÕx4XÁåH<PÁýPwËoÜØ_µHÅµ¾HÅ¼«HcáA@Å±4^¯fZÅÊC@K°h·?ËjètM=ãK£¹áü÷¶Ãc~¹²$ ?xÃ{aLÇs°Íh$ÏüsEø½ç@tPAÊ]ù¸003ú6)Ã{¸ÍE´H±Æ·¹ÎMÅÉ`tÃ]ÁÍ`dÁÂGÅh»ÿ^ßptÃE&÷3áù¸HÃE¾(Ã×x\|ÃçHD(ÃÿPL ËGôqÃ çÁÕx<Åh,]ÅáHñÉm,Àe-Ã!E`3èâ.DDHîçLLLHÃÛHTÇÙB]ÆÉr}ÈEÏû~I#\|·@NRÆPÉ7¼BÉÌüp:ò2z½ÃÎòÿ)øTK¸ÀL½ThÃÞêúÎRÖ±¼ÃÄº[B!ãË·=ÊhêtªÀ4³pºÊúQiJó±x`AnóÁÏXNÛÅûrEN±½J¶<ÇÓyc¤c1~"yò8zBaj ;»¾ÊÊe©3vJÃÏ¸£@ÊÂUUJËCØJÓrêÞ7µÎ&JÂsëß!¦Aø.@\|2~oNÇH<>Î±~¦$ËÍÏJKP{û´®ÉÌ@p·OÁN±¾I¶?Âû¹y`§eXXJ>==>§"ÍÅ K¸ûòÁ#ÀL¼eIOfïÕBE´kWÅÀL[ß±¿À Æ¹X@#ãÛ·>Ëiët^õ;¡Ñï§±·ÅÀ8/]÷©¿ìOÃI)é1óÃ¸ÔðHÉEÀ_ËoÄÀûí·ËkáAËGìëÁÕx,]ËoÜxÃrrQcõ;Q!ïFáü÷¶ÁÍ`À6#F²$ ?xÃc9,F;ÂÁ ¬LÇkTAFð¾õz4ÇsGRFR¹Á ¤èu`·ÁÍ`lÇckx»3t4ó)¼V¸õZf_>s~²½ f_>r+KtÅ Hsâ«§T½nEt}½<u¶{¸ fãÁz(bÃA²z(vÄHðf_}zaÑàK¸óz8JÁ¹ úBZÉÜPLÈE´VkÄÊE:øÌþ¶JÑËBéarë¬ÔúÏÇr}~ñÅß¢»Ïßjjgá¾5FÒÊI¶µoù´'zó»OqÀAÊJxrCIÊÈGENHC;áÑÂÀÖsiÌÄ¶üËCJ¶ÚáêNLÏZÊkét¾ojn_¾øù@Aù¸00AÊYáú6ÃSÍEÏ_%»ÏÏzjÃ\ÃC¾(vúN¸^"wr8u:Èäh¸rÅÁÊJÚE´VgÎJÖEÀE´aTÊZÒHÅKKÔ¾(vú¯'Bî]WR8t²ÇçHõZf_:wweïK+GèEHKøÂ>sv7°EÏ D}¶;´HÅOÇPgto»NÏÉFEBË¼ý½AÊKËkà@9¤/³UE¾EwÁÇBMJ¸¶¸¹ððAN¸w¦Eâx¹ f]ú´dKÀaðJÇOMHÊBÃOfÿ¡¹vúBÉFLKÓ[NÏÉFEBË½ÖïÇ/¬EÏHÅ¹7EÏÅBHÏå~XKÈÏ{¼Oè§Oð«pmvúÇk¨ÍEÏü¾Êb¤t7z3ÂEÎr±ÃXÂGÍW«\| ¸e9ìOËAÀJKÐ,k°¤EvúÍEÏÄ½´Â+g·:Çv´&äHÆ;{u0\|Ê÷ËEÒEµôÍÇ/¬LÇçHdÏ' EÀE´S¬#¤E´iCðâ¿«ÇOÇH+éB¾ÁÖouvóKôW`Ã@KøºÌýq])(REµhXvóóáÃ@4(äáù¸HÃ@¾+=OZtMÃ×xT8ËGôqåàÍXìê"qÍ 666Ûyçpé â¸úåÔ¡ð"+ª®¤ðV ã)AËN ÊD@GLZ`` ¿1TU%'à!@ÃÆGM07 `Ð±80¥ ÊÄÀÌë6Ì«©/îççÿúõtLoF ØÇ.¡'çÔ(bÁ¯¥J@ JIÂÁqvz@úÁQÁ ÉgbÇÀúøú:PDDÇ¼sÕ÷å ÐÙÜ Þ¾uÒå»ÞÈRÀÒû{ÞÇKÃäÿxoooSSXÅTñ¨é5w©ÌÍHËoÄÀÿ3úvóó3ÒÁ·¨ÅÀÚÀèuEFPFNÁúRìa#GìÁw:£Ëÿó â5¸®'¿øÀÃBbhâá,Ìà©Åö"Âà!áÃ#ãÀÐ¶ï!äÀÃ èóûDu8(xÅáHd`hÃ#y_"3ÅÁÌE ¼À3cË¨Å Ôp«»»b&æ_ê0¾E[CZdA:ò8z¨HÃÆMH{þÅà´úÆaèuMWòàÍ¡ô!ÉèÈç£äê{YÁã÷Y\òmôßÀ³[õaé¢ª4ÜøøãpçêÚóÖSçHå6ááé6ê&uÈîlJÍE´d°6ZJBú«¹¼E@hõÌiÈÃ¢<ým©Vö\@ÔEHwvÁÕx,@ÁlH4XÁýP<ÈÁõXav( hÅ Q[-éÁJ±ê[G)1Õá²æõ´°3ÞKàëÑÅÍ;#Áâ;0`8¸ øwdï"+ZZföØ+(Càç§ÐáIÁÎÿð UäT%!öVÃa$&Ë K!D'}w@Ëmït´áhÃçHX4ßÿt$dÃ÷XlÁ KÁ+cD ®!@!`ÏD2 @AÅE51ÇDáäæbB_ ! '_ÈÀÃ×x0) i!Ãv¶þQúhÃrÄ¥ó5ã!uy·"¸!IÃÃ'¢ËLAY "æGiEH<Æÿxßþ·RÆ<I IÃKé]P¼à@Õ!ÃÂyÏ·]jÈ×[°Àk!Lb Ag¬~ú<$SÏVù°àó$×óÕÄ÷«z3Hx0ÀPI5êIï·;:1º tN[ñyê$1ãøÅ»çïü´±+&öü41°0Fj{BL_¨P¿ô³ µ³xyà¢ÂO ©t¶sb2âÑéìq¼YG¿êÒuÓE·ê¨.PB2y]\±çI·Ú»=3 !ÞäQj¨9®LÊ{¸ÃaZ£f}ñ"ÆDµe¨¯gXÌzö8ÇÈKµ!PutÃ^ÕL/£ÃÇë°x$é&31RozSx0Ãß»êá»}¥+h4Ê$ûÃÅ¶:Í÷vÀkG6N£Uh)_!¾Ññ÷êEµsMß¤HHD(@É`DPt`dT1?/v`1ð;ÇDgokáØF<G¥ µL//h\|Á 6E¯z³@18ÅÂàâÂÄ¤Ã¬Û1¿´rf³µtRä®øG¶u[x4@ÅÒ?gsPzüßG)_@öæWû º½uÃÌOÈI@ÃápJRTÃÛC[ÃÄ¯Èö¾]uLÖôó+4otÉËv°QCÄP÷êpdÄ¯'ÍîK¯_BZk3ÁÇH@#/ÌA¶,ÞÜQ\íáõãrs÷çºÁâO\|³ÒáÃÂªÐzØBÛ~ôQù@/$Oh(Ã»;ãú#¡¨¿âgÅpPS+Èókó»{ê¢#Rgêê×R¢sÁÔP6ò+º¡âzi[ôû´îççUø5ùqr`ÒòF$T§°rOíAfË+Y"$HØ)KjÞWWoo}µ¡@ËæÌ2Ë ÙAÅÁhr/ê\|ôEè'Õ\|§»ýà#u71FJÐô(F'-òLüa1ôïõÉ~³YÊC+~ýJ¥¦QÆ»?À°E´ùêTJzf_§êç²EIDTKk¿ÔG°»@K7LÇWÀâsQIúSwÆñ³à4¸¥-óÂzóK£è{¼ÇiªHb`>8¹-EÍzðAÈÊkkMbrQ¶¯ÀÒ[EÄòkUÈõxÍ+ìBGù»hÙ¦´\|_.9HÎu\|Ç@Ä¸·MemÎMÁÍD$qÂ_Å 7Aô÷ñ0÷Æ23±õÕý¤7ªE`xòÑÎu`ZÁõ+ÊBÃ@#¬Õô4xD,Ü®Vi4EzB¨ÔL(^NEX¤¦¢ÚÄL©-:â¸~tER·g,n°}ðY¨8!TÿÛË÷ÀrML7àÍÏ¹ê÷_w#¦G OÁ1+Ã±¶uÿ$æ\|îSG{$§Þ¶+ºÀ.Í´6ó*ãÅÌem(hÍL½yÏÜWÂ³é8ãZF$=JÁé,h,[Ð×ÆHÁREêÇÞF MÅí(¸¹y8"{ü¤T´Å²¸0(¼\l+ (ÃC{òNÐp4D¹ó5J;kàEwß¥ÃJñtÌ$Fs Lh£CÂ»ðøµæùî[2zù@5q7ó+î´µÅáýÉÑ3aØ@Uv×Æ)O4x<¤«ë¢_,%l$bDoêû³{QÊK%p?ûÐs¼ÏIÅ regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{LJU50KX1-5I52-VT6Q-WSWM-U2Z9XL21ZV61}\1	1	0	0

File has been identified by 24 AntiVirus engines on VirusTotal as malicious (24 events)

Lionic	Trojan.Win32.Ulise.4!c
DrWeb	Trojan.Inject4.14513
MicroWorld-eScan	Gen:Variant.Ulise.262572
FireEye	Gen:Variant.Ulise.262572
ALYac	Gen:Variant.Ulise.262572
Arcabit	Trojan.Ulise.D401AC
Symantec	Trojan.Gen.MBT
ESET-NOD32	a variant of Win32/TrojanDownloader.Agent.FTP
Paloalto	generic.ml
BitDefender	Gen:Variant.Ulise.262572
Avast	Win32:MalwareX-gen [Trj]
Ad-Aware	Gen:Variant.Ulise.262572
McAfee-GW-Edition	Artemis!Trojan
Emsisoft	Gen:Variant.Ulise.262572 (B)
Avira	TR/Redcap.xmzlv
MAX	malware (ai score=85)
Microsoft	Trojan:Win32/Wacatac.B!ml
GData	Gen:Variant.Ulise.262572
McAfee	Artemis!1609D18C06F7
VBA32	Trojan.Inject
TrendMicro-HouseCall	TROJ_GEN.R002H09GQ21
AVG	Win32:MalwareX-gen [Trj]
Panda	Trj/GdSda.A
Qihoo-360	Win32/Trojan.Generic.HgIASZEA

Uses WMI to create a new process (1 event)

Time & API	Arguments	Status	Return	Repeated
IWbemServices_ExecMethod July 27, 2021, 9:12 a.m.	inargs.CurrentDirectory: None inargs.CommandLine: rundll32.exe "C:\Users\test22\AppData\Local\Temp\sqlite.dll",global inargs.ProcessStartupInformation: None outargs.ProcessId: 2664 outargs.ReturnValue: 0 flags: 0 method: Create class: Win32_Process	1	0	0

3003.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All