Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	May 25, 2023, 6:17 p.m.	May 25, 2023, 6:21 p.m.

Size	415.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`6f66d806f252bb81ed8954dceed8cce9`
SHA256	`380e904d62a0142c8afd063d6a79f6c067e9931859a38d65df81ed428e22dd63`
CRC32	`01E2CF19`
ssdeep	`6144:QOqoXskZaAz3G/GW3kwpLWJ9GlU6KBY/Zag6vyJ2J35VOneEvO13L3PSBaFxM:zZWOW31XKBY/ZapaIJ3KeEv0DO7`
PDB Path	updater.pdb
Yara	UPX_Zero - UPX packed file Win_Backdoor_njRAT_1_Zero - Win Backdoor njRAT Is_DotNET_EXE - (no description) PE_Header_Zero - PE File Signature IsPE32 - (no description) Generic_Malware_Zero - Generic Malware

up-do-dat-M2u7HcEuL9S7AFLW.exe "C:\Users\test22\AppData\Local\Temp\up-do-dat-M2u7HcEuL9S7AFLW.exe"
1880

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent May 25, 2023, 6:10 p.m.			0	0

This executable has a PDB path (1 event)

pdb_path

updater.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx May 25, 2023, 6:10 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.sdata

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ May 25, 2023, 6:10 p.m.	stacktrace: 0x7ff0016076a 0x7ff0016035d IEE+0xda16 GetUserStore-0xa7e mscorwks+0x2c1612 @ 0x7fef3801612 CreateAssemblyNameObject+0x5cbb CompareAssemblyIdentity-0x6ff9 mscorwks+0x1eee13 @ 0x7fef372ee13 PreBindAssembly+0x79a91 LoadStringRC-0x2544f mscorwks+0x69bc51 @ 0x7fef3bdbc51 GetCLRFunction+0xccaf CreateApplicationContext-0xa211 mscorwks+0x117dc7 @ 0x7fef3657dc7 StrongNameErrorInfo-0x31f0 mscorwks+0xf4118 @ 0x7fef3634118 GetAssemblyIdentityFromFile+0x195bd LegacyNGenFreeZapper-0x17af3 mscorwks+0x787e3d @ 0x7fef3cc7e3d StrongNameErrorInfo-0x10ded mscorwks+0xe651b @ 0x7fef362651b _CorExeMain+0xac GetCLRFunction-0x72b8 mscorwks+0x103e60 @ 0x7fef3643e60 _CorExeMain+0x5d CLRCreateInstance-0x2bd3 mscoreei+0x74e5 @ 0x7fef3ee74e5 _CorExeMain+0x69 ND_RU1-0x1707 mscoree+0x5b21 @ 0x7fef3f85b21 BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76fd652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x776ec521 exception.instruction_r: 48 8b 47 08 48 85 c0 76 1d 48 8b 4f 18 e8 ec b8 exception.instruction: mov rax, qword ptr [rdi + 8] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x7ff0016076a registers.r14: 0 registers.r15: 0 registers.rcx: 0 registers.rsi: 0 registers.r10: 8796092104728 registers.rbx: 0 registers.rsp: 4257920 registers.r11: 518 registers.r8: 4252416 registers.r9: 0 registers.rdx: 1 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 0 registers.r13: 0	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

May 25, 2023, 6:10 p.m.

stacktrace:

0x7ff0016076a
0x7ff0016035d
IEE+0xda16 GetUserStore-0xa7e mscorwks+0x2c1612 @ 0x7fef3801612
CreateAssemblyNameObject+0x5cbb CompareAssemblyIdentity-0x6ff9 mscorwks+0x1eee13 @ 0x7fef372ee13
PreBindAssembly+0x79a91 LoadStringRC-0x2544f mscorwks+0x69bc51 @ 0x7fef3bdbc51
GetCLRFunction+0xccaf CreateApplicationContext-0xa211 mscorwks+0x117dc7 @ 0x7fef3657dc7
StrongNameErrorInfo-0x31f0 mscorwks+0xf4118 @ 0x7fef3634118
GetAssemblyIdentityFromFile+0x195bd LegacyNGenFreeZapper-0x17af3 mscorwks+0x787e3d @ 0x7fef3cc7e3d
StrongNameErrorInfo-0x10ded mscorwks+0xe651b @ 0x7fef362651b
_CorExeMain+0xac GetCLRFunction-0x72b8 mscorwks+0x103e60 @ 0x7fef3643e60
_CorExeMain+0x5d CLRCreateInstance-0x2bd3 mscoreei+0x74e5 @ 0x7fef3ee74e5
_CorExeMain+0x69 ND_RU1-0x1707 mscoree+0x5b21 @ 0x7fef3f85b21
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76fd652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x776ec521

exception.instruction_r: 48 8b 47 08 48 85 c0 76 1d 48 8b 4f 18 e8 ec b8
exception.instruction: mov rax, qword ptr [rdi + 8]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x7ff0016076a
registers.r14: 0
registers.r15: 0
registers.rcx: 0
registers.rsi: 0
registers.r10: 8796092104728
registers.rbx: 0
registers.rsp: 4257920
registers.r11: 518
registers.r8: 4252416
registers.r9: 0
registers.rdx: 1
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 0
registers.r13: 0

Allocates read-write-execute memory (usually to unpack itself) (41 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory May 25, 2023, 6:10 p.m.	process_identifier: 1880 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000280000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 25, 2023, 6:10 p.m.	process_identifier: 1880 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000290000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 25, 2023, 6:10 p.m.	process_identifier: 1880 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3581000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 25, 2023, 6:10 p.m.	process_identifier: 1880 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef37fe000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 25, 2023, 6:10 p.m.	process_identifier: 1880 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef37fe000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 25, 2023, 6:10 p.m.	process_identifier: 1880 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef37ff000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 25, 2023, 6:10 p.m.	process_identifier: 1880 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef37ff000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 25, 2023, 6:10 p.m.	process_identifier: 1880 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef37ff000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 25, 2023, 6:10 p.m.	process_identifier: 1880 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef37ff000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 25, 2023, 6:10 p.m.	process_identifier: 1880 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef37ff000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 25, 2023, 6:10 p.m.	process_identifier: 1880 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef37ff000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 25, 2023, 6:10 p.m.	process_identifier: 1880 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef37ff000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 25, 2023, 6:10 p.m.	process_identifier: 1880 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef37ff000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 25, 2023, 6:10 p.m.	process_identifier: 1880 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3800000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 25, 2023, 6:10 p.m.	process_identifier: 1880 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3800000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 25, 2023, 6:10 p.m.	process_identifier: 1880 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3800000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 25, 2023, 6:10 p.m.	process_identifier: 1880 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3800000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 25, 2023, 6:10 p.m.	process_identifier: 1880 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3800000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 25, 2023, 6:10 p.m.	process_identifier: 1880 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3801000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 25, 2023, 6:10 p.m.	process_identifier: 1880 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3801000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 25, 2023, 6:10 p.m.	process_identifier: 1880 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3801000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 25, 2023, 6:10 p.m.	process_identifier: 1880 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3801000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 25, 2023, 6:10 p.m.	process_identifier: 1880 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef37fe000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 25, 2023, 6:10 p.m.	process_identifier: 1880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00022000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 25, 2023, 6:10 p.m.	process_identifier: 1880 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 25, 2023, 6:10 p.m.	process_identifier: 1880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 25, 2023, 6:10 p.m.	process_identifier: 1880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 25, 2023, 6:10 p.m.	process_identifier: 1880 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 25, 2023, 6:10 p.m.	process_identifier: 1880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 25, 2023, 6:10 p.m.	process_identifier: 1880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000da000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 25, 2023, 6:10 p.m.	process_identifier: 1880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00012000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 25, 2023, 6:10 p.m.	process_identifier: 1880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00023000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 25, 2023, 6:10 p.m.	process_identifier: 1880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000ea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 25, 2023, 6:10 p.m.	process_identifier: 1880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00112000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 25, 2023, 6:10 p.m.	process_identifier: 1880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000ed000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 25, 2023, 6:10 p.m.	process_identifier: 1880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff0002c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 25, 2023, 6:10 p.m.	process_identifier: 1880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 25, 2023, 6:10 p.m.	process_identifier: 1880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00160000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 25, 2023, 6:10 p.m.	process_identifier: 1880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00024000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 25, 2023, 6:10 p.m.	process_identifier: 1880 region_size: 24576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00161000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 25, 2023, 6:10 p.m.	process_identifier: 1880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (3 events)

section

{u'size_of_data': u'0x00064400', u'virtual_address': u'0x00002000', u'entropy': 7.460172468892314, u'name': u'.text', u'virtual_size': u'0x00064334'}

entropy

7.46017246889

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x00002e00', u'virtual_address': u'0x0006a000', u'entropy': 7.258393738117689, u'name': u'.rsrc', u'virtual_size': u'0x00002d34'}

entropy

7.25839373812

description

A section with a high entropy has been found

entropy

0.996376811594

description

Overall entropy of this PE file is high

File has been identified by 34 AntiVirus engines on VirusTotal as malicious (34 events)

tehtris	Generic.Malware
MicroWorld-eScan	Gen:Variant.Application.Barys.320654
FireEye	Generic.mg.6f66d806f252bb81
ALYac	Gen:Variant.Application.Barys.320654
Cylance	unsafe
VIPRE	Gen:Variant.Application.Barys.320654
Sangfor	Suspicious.Win32.Save.a
Cybereason	malicious.5e1097
Arcabit	Trojan.Application.Barys.D4E48E
Cyren	W32/MSIL_Troj.BWF.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/TrojanDownloader.Agent.MSK
Cynet	Malicious (score: 100)
APEX	Malicious
Kaspersky	HEUR:Trojan-Downloader.MSIL.CSDI.gen
BitDefender	Gen:Variant.Application.Barys.320654
Avast	Win32:AdwareX-gen [Adw]
Sophos	Generic ML PUA (PUA)
F-Secure	Heuristic.HEUR/AGEN.1323994
Trapmine	malicious.moderate.ml.score
Emsisoft	Gen:Variant.Application.Barys.320654 (B)
SentinelOne	Static AI - Malicious PE
Avira	HEUR/AGEN.1323994
ZoneAlarm	HEUR:Trojan-Downloader.MSIL.CSDI.gen
GData	Gen:Variant.Application.Barys.320654
Google	Detected
AhnLab-V3	Adware/Win32.RL_Amonetize.C3447279
Acronis	suspicious
MAX	malware (ai score=76)
MaxSecure	Trojan.Malware.300983.susgen
BitDefenderTheta	Gen:NN.ZemsilF.36196.zq0@aq3Rdqi
AVG	Win32:AdwareX-gen [Adw]
DeepInstinct	MALICIOUS
CrowdStrike	win/grayware_confidence_70% (D)

up-do-dat-M2u7HcEuL9S7AFLW.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All