Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	March 7, 2023, 5:29 p.m.	March 7, 2023, 5:31 p.m.

Size	373.7KB
Type	PE32 executable (console) Intel 80386, for MS Windows
MD5	`fe78071bcd7b5fd9105734aaa485f816`
SHA256	`6406f876d483184b4f310a406d222a1320bd433f7afe76ff89766edab3793754`
CRC32	`1CB2DEC7`
ssdeep	`6144:9YNzvLnjAOAgwobtV22imO2ev8R5/PAixWAixWAixWAixWNGgb3w6Cnq:LOyAV229R/5/PAixWAixWAixWAixWNF3`
Yara	UPX_Zero - UPX packed file Malicious_Library_Zero - Malicious_Library OS_Processor_Check_Zero - OS Processor Check IsPE32 - (no description) PE_Header_Zero - PE File Signature

Setup.scr "C:\Users\test22\AppData\Local\Temp\Setup.scr"
3036
- AppLaunch.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  1376

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
142.132.186.212	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent March 7, 2023, 5:29 p.m.			0	0
IsDebuggerPresent March 7, 2023, 5:29 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (3 events)

Time & API	Arguments	Status	Return
CryptExportKey March 7, 2023, 5:29 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00585e80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 7, 2023, 5:29 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00585e80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 7, 2023, 5:29 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00585ec0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx March 7, 2023, 5:29 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.8Rt

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (39 events)

Time & API	Arguments	Status
NtProtectVirtualMemory March 7, 2023, 5:29 p.m.	process_identifier: 3036 stack_dep_bypass: 1 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003cf000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 7, 2023, 5:29 p.m.	process_identifier: 3036 region_size: 286720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00960000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 7, 2023, 5:29 p.m.	process_identifier: 1376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74232000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 7, 2023, 5:29 p.m.	process_identifier: 1376 region_size: 524288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007e0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 7, 2023, 5:29 p.m.	process_identifier: 1376 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00820000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 7, 2023, 5:29 p.m.	process_identifier: 1376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e72000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 7, 2023, 5:29 p.m.	process_identifier: 1376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x731bb000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 7, 2023, 5:29 p.m.	process_identifier: 1376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73831000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 7, 2023, 5:29 p.m.	process_identifier: 1376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73832000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 7, 2023, 5:29 p.m.	process_identifier: 1376 region_size: 2228224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00990000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 7, 2023, 5:29 p.m.	process_identifier: 1376 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 7, 2023, 5:29 p.m.	process_identifier: 1376 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004e2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 7, 2023, 5:29 p.m.	process_identifier: 1376 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007f5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 7, 2023, 5:29 p.m.	process_identifier: 1376 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007fb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 7, 2023, 5:29 p.m.	process_identifier: 1376 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007f7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 7, 2023, 5:29 p.m.	process_identifier: 1376 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004fc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 7, 2023, 5:29 p.m.	process_identifier: 1376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x741ba000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 7, 2023, 5:29 p.m.	process_identifier: 1376 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bb0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 7, 2023, 5:29 p.m.	process_identifier: 1376 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007e6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 7, 2023, 5:29 p.m.	process_identifier: 1376 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007ea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 7, 2023, 5:29 p.m.	process_identifier: 1376 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007e7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 7, 2023, 5:29 p.m.	process_identifier: 1376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74131000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 7, 2023, 5:29 p.m.	process_identifier: 1376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f09f000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 7, 2023, 5:29 p.m.	process_identifier: 1376 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004ea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 7, 2023, 5:29 p.m.	process_identifier: 1376 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007eb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 7, 2023, 5:29 p.m.	process_identifier: 1376 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004fa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 7, 2023, 5:29 p.m.	process_identifier: 1376 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007ec000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 7, 2023, 5:29 p.m.	process_identifier: 1376 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 7, 2023, 5:29 p.m.	process_identifier: 1376 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 7, 2023, 5:29 p.m.	process_identifier: 1376 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 7, 2023, 5:29 p.m.	process_identifier: 1376 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 7, 2023, 5:29 p.m.	process_identifier: 1376 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 7, 2023, 5:29 p.m.	process_identifier: 1376 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 7, 2023, 5:29 p.m.	process_identifier: 1376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74fc1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 7, 2023, 5:29 p.m.	process_identifier: 1376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74e61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 7, 2023, 5:29 p.m.	process_identifier: 1376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6ed81000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 7, 2023, 5:29 p.m.	process_identifier: 1376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6ecb8000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 7, 2023, 5:29 p.m.	process_identifier: 1376 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007ed000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 7, 2023, 5:29 p.m.	process_identifier: 1376 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007e8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (3 events)

section

{u'size_of_data': u'0x00047000', u'virtual_address': u'0x00011000', u'entropy': 7.084290203642015, u'name': u'.rdata', u'virtual_size': u'0x00046eba'}

entropy

7.08429020364

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x00000a00', u'virtual_address': u'0x0005a000', u'entropy': 7.344913446463518, u'name': u'.8Rt', u'virtual_size': u'0x000008f0'}

entropy

7.34491344646

description

A section with a high entropy has been found

entropy

0.794729542302

description

Overall entropy of this PE file is high

Yara rule detected in process memory (9 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	RedLine stealer	rule	RedLine_Stealer_m_Zero

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: 613001fb99c5e95300294a2678fff6d543f77c1a

Communicates with host for which no DNS query was performed (1 event)

host

142.132.186.212

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory March 7, 2023, 5:29 p.m.	process_identifier: 1376 region_size: 286720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000002c	1	0	0

Potential code injection by writing to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory March 7, 2023, 5:29 p.m.	buffer: @ base_address: 0xfffde008 process_identifier: 1376 process_handle: 0x0000002c	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 3036 called NtSetContextThread to modify thread in remote process 1376
NtSetContextThread March 7, 2023, 5:29 p.m.	registers.eip: 2001207748 registers.esp: 3800992 registers.edi: 0 registers.eax: 4294686 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000020 process_identifier: 1376	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 3036 resumed a thread in remote process 1376
NtResumeThread March 7, 2023, 5:29 p.m.	thread_handle: 0x00000020 suspend_count: 1 process_identifier: 1376	1	0	0

Executed a process and injected code into it, probably while unpacking (10 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW March 7, 2023, 5:29 p.m.	thread_identifier: 1188 thread_handle: 0x00000020 process_identifier: 1376 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000002c	1	1
NtGetContextThread March 7, 2023, 5:29 p.m.	thread_handle: 0x00000020	1	0
NtAllocateVirtualMemory March 7, 2023, 5:29 p.m.	process_identifier: 1376 region_size: 286720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000002c	1	0
WriteProcessMemory March 7, 2023, 5:29 p.m.	buffer: base_address: 0x00400000 process_identifier: 1376 process_handle: 0x0000002c	1	1
WriteProcessMemory March 7, 2023, 5:29 p.m.	buffer: @ base_address: 0xfffde008 process_identifier: 1376 process_handle: 0x0000002c	1	1
NtSetContextThread March 7, 2023, 5:29 p.m.	registers.eip: 2001207748 registers.esp: 3800992 registers.edi: 0 registers.eax: 4294686 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000020 process_identifier: 1376	1	0
NtResumeThread March 7, 2023, 5:29 p.m.	thread_handle: 0x00000020 suspend_count: 1 process_identifier: 1376	1	0
NtResumeThread March 7, 2023, 5:29 p.m.	thread_handle: 0x00000184 suspend_count: 1 process_identifier: 1376	1	0
NtResumeThread March 7, 2023, 5:29 p.m.	thread_handle: 0x000001fc suspend_count: 1 process_identifier: 1376	1	0
NtResumeThread March 7, 2023, 5:29 p.m.	thread_handle: 0x00000238 suspend_count: 1 process_identifier: 1376	1	0

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (50 out of 63 events)

dead_host	192.168.56.102:49172
dead_host	192.168.56.102:49187
dead_host	192.168.56.102:49205
dead_host	192.168.56.102:49216
dead_host	192.168.56.102:49196
dead_host	192.168.56.102:49176
dead_host	192.168.56.102:49191
dead_host	192.168.56.102:49209
dead_host	192.168.56.102:49220
dead_host	192.168.56.102:49171
dead_host	192.168.56.102:49227
dead_host	192.168.56.102:49200
dead_host	192.168.56.102:49180
dead_host	192.168.56.102:49195
dead_host	192.168.56.102:49213
dead_host	192.168.56.102:49224
dead_host	192.168.56.102:49175
dead_host	192.168.56.102:49186
dead_host	192.168.56.102:49204
dead_host	192.168.56.102:49219
dead_host	192.168.56.102:49166
dead_host	192.168.56.102:49199
dead_host	192.168.56.102:49179
dead_host	192.168.56.102:49190
dead_host	192.168.56.102:49208
dead_host	192.168.56.102:49223
dead_host	192.168.56.102:49170
dead_host	192.168.56.102:49203
dead_host	192.168.56.102:49183
dead_host	192.168.56.102:49194
dead_host	192.168.56.102:49212
dead_host	142.132.186.212:8901
dead_host	192.168.56.102:49174
dead_host	192.168.56.102:49207
dead_host	192.168.56.102:49218
dead_host	192.168.56.102:49198
dead_host	192.168.56.102:49178
dead_host	192.168.56.102:49185
dead_host	192.168.56.102:49211
dead_host	192.168.56.102:49222
dead_host	192.168.56.102:49165
dead_host	192.168.56.102:49202
dead_host	192.168.56.102:49182
dead_host	192.168.56.102:49215
dead_host	192.168.56.102:49226
dead_host	192.168.56.102:49169
dead_host	192.168.56.102:49206
dead_host	192.168.56.102:49193
dead_host	192.168.56.102:49173
dead_host	192.168.56.102:49184

Setup.scr

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All