Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Aug. 2, 2024, 10:27 a.m.	Aug. 2, 2024, 10:29 a.m.

Size	55.2KB
Type	ASCII text, with CRLF line terminators
MD5	`c6ea5594b44dd4612456a0e4a98d3e8a`
SHA256	`5d058a1d781622fe3b79718e09cced55551106db9b1fa2149ebd94421dcaa007`
CRC32	`C75F6D3C`
ssdeep	`768:QBrKQoQq6ujEyj1eiX4XHLWL9Rzp3BrKQoQq6ujEyj1eiX4XHLWL9Rzpo:aO2q6jmBX20rO2q6jmBX20C`
Yara	Antivirus - Contains references to security software

powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy unrestricted -File C:\Users\test22\AppData\Local\Temp\payload_1_2.ps1
3040
- csc.exe "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\test22\AppData\Local\Temp\xcbpv-vj.cmdline"
  2104
  - cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\test22\AppData\Local\Temp\RES311E.tmp" "c:\Users\test22\AppData\Local\Temp\CSC310D.tmp"
    200
- csc.exe "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\test22\AppData\Local\Temp\uqjk_klz.cmdline"
  2404
  - cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\test22\AppData\Local\Temp\RES3302.tmp" "c:\Users\test22\AppData\Local\Temp\CSC32F2.tmp"
    2420

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch
5.61.59.53	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Aug. 2, 2024, 10:27 a.m.	computer_name: TEST22-PC	1	1	0

Uses Windows APIs to generate a cryptographic key (50 out of 92 events)

Time & API	Arguments	Status	Return
CryptExportKey Aug. 2, 2024, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x066515e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 2, 2024, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x066515e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 2, 2024, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x066515e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 2, 2024, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x066515e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 2, 2024, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00502870 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 2, 2024, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00502870 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 2, 2024, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051bce0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 2, 2024, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051bd20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 2, 2024, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051bd60 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 2, 2024, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051bca0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 2, 2024, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051bca0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 2, 2024, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051bca0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 2, 2024, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051bca0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 2, 2024, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051bca0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 2, 2024, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051bca0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 2, 2024, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051bca0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 2, 2024, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051bca0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 2, 2024, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051bca0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 2, 2024, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051bca0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 2, 2024, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051bca0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 2, 2024, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051bca0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 2, 2024, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051bca0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 2, 2024, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051bca0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 2, 2024, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051bca0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 2, 2024, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051bca0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 2, 2024, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051bca0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 2, 2024, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051bca0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 2, 2024, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051bca0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 2, 2024, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051bca0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 2, 2024, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051bca0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 2, 2024, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051bca0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 2, 2024, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051bca0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 2, 2024, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051bca0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 2, 2024, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051bca0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 2, 2024, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051bca0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 2, 2024, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051bca0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 2, 2024, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051bca0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 2, 2024, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051bca0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 2, 2024, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051bca0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 2, 2024, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051bca0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 2, 2024, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051bca0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 2, 2024, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051bca0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 2, 2024, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051bca0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 2, 2024, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051bca0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 2, 2024, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051bca0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 2, 2024, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051bca0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 2, 2024, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051bca0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 2, 2024, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051bca0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 2, 2024, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005ce600 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 2, 2024, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005ce600 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Aug. 2, 2024, 10:27 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (22 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Aug. 2, 2024, 10:27 a.m.	process_identifier: 3040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026ab000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 2, 2024, 10:27 a.m.	process_identifier: 3040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0273f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 2, 2024, 10:27 a.m.	process_identifier: 3040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02649000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 2, 2024, 10:27 a.m.	process_identifier: 3040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05620000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 2, 2024, 10:27 a.m.	process_identifier: 3040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05446000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 2, 2024, 10:27 a.m.	process_identifier: 3040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05447000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 2, 2024, 10:27 a.m.	process_identifier: 3040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05448000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 2, 2024, 10:27 a.m.	process_identifier: 3040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x057e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 2, 2024, 10:27 a.m.	process_identifier: 3040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02b52000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 2, 2024, 10:27 a.m.	process_identifier: 3040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05621000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 2, 2024, 10:27 a.m.	process_identifier: 3040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05449000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 2, 2024, 10:27 a.m.	process_identifier: 3040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0544a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 2, 2024, 10:27 a.m.	process_identifier: 3040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02739000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 2, 2024, 10:27 a.m.	process_identifier: 3040 region_size: 524288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06240000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 2, 2024, 10:27 a.m.	process_identifier: 3040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06280000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 2, 2024, 10:27 a.m.	process_identifier: 3040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06281000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 2, 2024, 10:27 a.m.	process_identifier: 3040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06282000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 2, 2024, 10:27 a.m.	process_identifier: 3040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06283000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 2, 2024, 10:27 a.m.	process_identifier: 2104 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005d0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 2, 2024, 10:27 a.m.	process_identifier: 2104 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 2, 2024, 10:27 a.m.	process_identifier: 2404 region_size: 1900544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01dd0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 2, 2024, 10:27 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f60000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates executable files on the filesystem (2 events)

file	c:\Users\test22\AppData\Local\Temp\uqjk_klz.dll
file	c:\Users\test22\AppData\Local\Temp\xcbpv-vj.dll

Drops an executable to the user AppData folder (2 events)

file	C:\Users\test22\AppData\Local\Temp\uqjk_klz.dll
file	C:\Users\test22\AppData\Local\Temp\xcbpv-vj.dll

File has been identified by 6 AntiVirus engines on VirusTotal as malicious (6 events)

ESET-NOD32	PowerShell/Kimsuky.Y
Kaspersky	Backdoor.PowerShell.Agent.eu
Microsoft	Trojan:Script/Wacatac.B!ml
ZoneAlarm	Backdoor.PowerShell.Agent.eu
Tencent	Win32.Backdoor.Agent.Iajl
alibabacloud	Backdoor:Win/Kimsuky.Y

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\test22\AppData\Local\Temp\xcbpv-vj.cmdline"
cmdline	"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\test22\AppData\Local\Temp\uqjk_klz.cmdline"

Communicates with host for which no DNS query was performed (1 event)

host

5.61.59.53

Deletes executed files from disk (1 event)

file	C:\Users\test22\AppData\Local\Temp\xcbpv-vj.cmdline

One or more non-whitelisted processes were created (2 events)

parent_process	powershell.exe				martian_process	"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\test22\AppData\Local\Temp\xcbpv-vj.cmdline"
parent_process	powershell.exe				martian_process	"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\test22\AppData\Local\Temp\uqjk_klz.cmdline"

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

5.61.59.53:14276

payload_1_2.ps1

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All