Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Aug. 9, 2024, 4:42 p.m.	Aug. 9, 2024, 4:44 p.m.

Size	729.0KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`d7528cd33b73718b5949277420681f90`
SHA256	`3b8d07693e296aee36e7607c71503d981396a21b367e169146afdd052cdcf4d1`
CRC32	`CF34C73C`
ssdeep	`12288:koywWrwlTyC9yR+xBP4wMpAuhjH8/Hl19KKjNgzqE0CM6EpJMwk:PlTX9Xj4w+hbM1/g2kM`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description)

66ae9cc050ded_file0308.exe "C:\Users\test22\AppData\Local\Temp\66ae9cc050ded_file0308.exe"
2552
- 66ae9cc050ded_file0308.exe "C:\Users\test22\AppData\Local\Temp\66ae9cc050ded_file0308.exe"
  2692
  - icacls.exe icacls "C:\Users\test22\AppData\Local\bd4a28f1-cb77-421f-94db-ad2670c2c5c2" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    2792
  - 66ae9cc050ded_file0308.exe "C:\Users\test22\AppData\Local\Temp\66ae9cc050ded_file0308.exe" --Admin IsNotAutoStart IsNotTask
    2844
    - 66ae9cc050ded_file0308.exe "C:\Users\test22\AppData\Local\Temp\66ae9cc050ded_file0308.exe" --Admin IsNotAutoStart IsNotTask
      2948

Name	Response	Post-Analysis Lookup
cajgtus.com	A 109.98.58.98 A 190.13.174.94 A 181.128.22.240 A 148.230.249.9 A 220.125.3.190 A 186.101.193.110 A 125.7.253.10 A 190.220.21.28 A 190.224.203.37 A 189.163.163.13	190.220.21.28
api.2ip.ua	A 104.21.65.24 A 172.67.139.220	104.21.65.24

IP Address	Status	Action
104.21.65.24	Active	Moloch
109.98.58.98	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
UDP 192.168.56.101:59002 -> 164.124.101.2:53	2027026	ET POLICY External IP Address Lookup DNS Query (2ip .ua)	Device Retrieving External IP Address Detected
TCP 192.168.56.101:49165 -> 104.21.65.24:443	2033214	ET INFO Observed External IP Lookup Domain (api .2ip .ua in TLS SNI)	Potentially Bad Traffic
TCP 192.168.56.101:49165 -> 104.21.65.24:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49171 -> 104.21.65.24:443	2033214	ET INFO Observed External IP Lookup Domain (api .2ip .ua in TLS SNI)	Potentially Bad Traffic
TCP 192.168.56.101:49171 -> 104.21.65.24:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49172 -> 109.98.58.98:80	2002400	ET USER_AGENTS Suspicious User Agent (Microsoft Internet Explorer)	A Network Trojan was detected
TCP 192.168.56.101:49172 -> 109.98.58.98:80	2036334	ET MALWARE Win32/Filecoder.STOP Variant Request for Public Key	A Network Trojan was detected
TCP 109.98.58.98:80 -> 192.168.56.101:49172	2036335	ET MALWARE Win32/Filecoder.STOP Variant Public Key Download	A Network Trojan was detected

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.101:49165 104.21.65.24:443	C=US, O=Google Trust Services, CN=WE1	CN=2ip.ua	ff:79:da:c4:72:a8:32:8f:28:1d:c9:7f:3a:b0:c3:0e:3f:7e:7e:a1
TLSv1 192.168.56.101:49171 104.21.65.24:443	C=US, O=Google Trust Services, CN=WE1	CN=2ip.ua	ff:79:da:c4:72:a8:32:8f:28:1d:c9:7f:3a:b0:c3:0e:3f:7e:7e:a1

Queries for the computername (4 events)

Time & API	Arguments	Status	Return
GetComputerNameW Aug. 9, 2024, 4:42 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 9, 2024, 4:42 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 9, 2024, 4:42 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 9, 2024, 4:42 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Aug. 9, 2024, 4:42 p.m.			0	0
IsDebuggerPresent Aug. 9, 2024, 4:42 p.m.			0	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Performs some HTTP requests (2 events)

request	GET http://cajgtus.com/test1/get.php?pid=CD20CF071BA7C05D5F5E6CAF42496E78&first=true
request	GET https://api.2ip.ua/geo.json

Allocates read-write-execute memory (usually to unpack itself) (5 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Aug. 9, 2024, 4:42 p.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 598016 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01df0000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 9, 2024, 4:42 p.m.	process_identifier: 2552 region_size: 1159168 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e90000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2024, 4:42 p.m.	process_identifier: 2844 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 598016 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004d0000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 9, 2024, 4:42 p.m.	process_identifier: 2844 region_size: 1159168 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2024, 4:42 p.m.	process_identifier: 2948 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72d62000 process_handle: 0xffffffff	1

Foreign language identified in PE resource (8 events)

name

RT_ICON

language

LANG_TURKISH

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_DEFAULT

offset

0x000c3710

size

0x00000468

name

RT_ICON

language

LANG_TURKISH

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_DEFAULT

offset

0x000c3710

size

0x00000468

name

RT_ICON

language

LANG_TURKISH

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_DEFAULT

offset

0x000c3710

size

0x00000468

name

RT_ICON

language

LANG_TURKISH

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_DEFAULT

offset

0x000c3710

size

0x00000468

name

RT_ICON

language

LANG_TURKISH

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_DEFAULT

offset

0x000c3710

size

0x00000468

name

RT_ICON

language

LANG_TURKISH

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_DEFAULT

offset

0x000c3710

size

0x00000468

name

RT_ICON

language

LANG_TURKISH

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_DEFAULT

offset

0x000c3710

size

0x00000468

name

RT_GROUP_ICON

language

LANG_TURKISH

filetype

data

sublanguage

SUBLANG_DEFAULT

offset

0x000c3b78

size

0x00000068

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x000a6c00', u'virtual_address': u'0x00001000', u'entropy': 7.733615032334489, u'name': u'.text', u'virtual_size': u'0x000a6b37'}

entropy

7.73361503233

description

A section with a high entropy has been found

entropy

0.916208791209

description

Overall entropy of this PE file is high

Potentially malicious URLs were found in the process memory dump (1 event)

url	http://www.openssl.org/support/faq.html

Yara rule detected in process memory (40 events)

description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Communication using DGA	rule	Network_DGA
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Take ScreenShot	rule	ScreenShot
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	Communications use DNS	rule	Network_DNS
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Communication using DGA	rule	Network_DGA
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Take ScreenShot	rule	ScreenShot
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	Communications use DNS	rule	Network_DNS
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Match Windows Inet API call	rule	Str_Win32_Internet_API

Allocates execute permission to another process indicative of possible code injection (2 events)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Aug. 9, 2024, 4:42 p.m.	process_identifier: 2692 region_size: 1273856 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000080	1	0	0
NtAllocateVirtualMemory Aug. 9, 2024, 4:42 p.m.	process_identifier: 2948 region_size: 1273856 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000080	1	0	0

Looks for the Windows Idle Time to determine the uptime (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation Aug. 9, 2024, 4:42 p.m.	information_class: 8 (SystemProcessorPerformanceInformation)	1	0	0

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper

reg_value

"C:\Users\test22\AppData\Local\bd4a28f1-cb77-421f-94db-ad2670c2c5c2\66ae9cc050ded_file0308.exe" --AutoStart

Potential code injection by writing to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Aug. 9, 2024, 4:42 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2692 process_handle: 0x00000080	1	1	0
WriteProcessMemory Aug. 9, 2024, 4:42 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2948 process_handle: 0x00000080	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2552 called NtSetContextThread to modify thread in remote process 2692
Process injection	Process 2844 called NtSetContextThread to modify thread in remote process 2948
NtSetContextThread Aug. 9, 2024, 4:42 p.m.	registers.eip: 1995571652 registers.esp: 1638384 registers.edi: 0 registers.eax: 4342081 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000007c process_identifier: 2692	1	0	0
NtSetContextThread Aug. 9, 2024, 4:42 p.m.	registers.eip: 1995571652 registers.esp: 1638384 registers.edi: 0 registers.eax: 4342081 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000007c process_identifier: 2948	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (6 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2552 resumed a thread in remote process 2692
Process injection	Process 2692 resumed a thread in remote process 2844
Process injection	Process 2844 resumed a thread in remote process 2948
NtResumeThread Aug. 9, 2024, 4:42 p.m.	thread_handle: 0x0000007c suspend_count: 1 process_identifier: 2692	1	0	0
NtResumeThread Aug. 9, 2024, 4:42 p.m.	thread_handle: 0x000002c0 suspend_count: 1 process_identifier: 2844	1	0	0
NtResumeThread Aug. 9, 2024, 4:42 p.m.	thread_handle: 0x0000007c suspend_count: 1 process_identifier: 2948	1	0	0

Uses suspicious command line tools or Windows utilities (1 event)

cmdline

icacls "C:\Users\test22\AppData\Local\bd4a28f1-cb77-421f-94db-ad2670c2c5c2" /deny *S-1-1-0:(OI)(CI)(DE,DC)

Generates some ICMP traffic

Executed a process and injected code into it, probably while unpacking (17 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW Aug. 9, 2024, 4:42 p.m.	thread_identifier: 2696 thread_handle: 0x0000007c process_identifier: 2692 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\66ae9cc050ded_file0308.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\66ae9cc050ded_file0308.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\66ae9cc050ded_file0308.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000080	1	1
NtGetContextThread Aug. 9, 2024, 4:42 p.m.	thread_handle: 0x0000007c	1	0
NtUnmapViewOfSection Aug. 9, 2024, 4:42 p.m.	base_address: 0x00400000 region_size: 4096 process_identifier: 2692 process_handle: 0x00000080	1	0
NtAllocateVirtualMemory Aug. 9, 2024, 4:42 p.m.	process_identifier: 2692 region_size: 1273856 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000080	1	0
WriteProcessMemory Aug. 9, 2024, 4:42 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2692 process_handle: 0x00000080	1	1
NtSetContextThread Aug. 9, 2024, 4:42 p.m.	registers.eip: 1995571652 registers.esp: 1638384 registers.edi: 0 registers.eax: 4342081 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000007c process_identifier: 2692	1	0
NtResumeThread Aug. 9, 2024, 4:42 p.m.	thread_handle: 0x0000007c suspend_count: 1 process_identifier: 2692	1	0
CreateProcessInternalW Aug. 9, 2024, 4:42 p.m.	thread_identifier: 2796 thread_handle: 0x0000030c process_identifier: 2792 current_directory: filepath: track: 1 command_line: icacls "C:\Users\test22\AppData\Local\bd4a28f1-cb77-421f-94db-ad2670c2c5c2" /deny *S-1-1-0:(OI)(CI)(DE,DC) filepath_r: stack_pivoted: 0 creation_flags: 72 (DETACHED_PROCESS\|IDLE_PRIORITY_CLASS) inherit_handles: 0 process_handle: 0x000004f8	1	1
CreateProcessInternalW Aug. 9, 2024, 4:42 p.m.	thread_identifier: 2848 thread_handle: 0x000002c0 process_identifier: 2844 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\AppData\Local\Temp\66ae9cc050ded_file0308.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\66ae9cc050ded_file0308.exe" --Admin IsNotAutoStart IsNotTask filepath_r: C:\Users\test22\AppData\Local\Temp\66ae9cc050ded_file0308.exe stack_pivoted: 0 creation_flags: 67634196 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_SUSPENDED\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000002c8	1	1
NtResumeThread Aug. 9, 2024, 4:42 p.m.	thread_handle: 0x000002c0 suspend_count: 1 process_identifier: 2844	1	0
CreateProcessInternalW Aug. 9, 2024, 4:42 p.m.	thread_identifier: 2952 thread_handle: 0x0000007c process_identifier: 2948 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\66ae9cc050ded_file0308.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\66ae9cc050ded_file0308.exe" --Admin IsNotAutoStart IsNotTask filepath_r: C:\Users\test22\AppData\Local\Temp\66ae9cc050ded_file0308.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000080	1	1
NtGetContextThread Aug. 9, 2024, 4:42 p.m.	thread_handle: 0x0000007c	1	0
NtUnmapViewOfSection Aug. 9, 2024, 4:42 p.m.	base_address: 0x00400000 region_size: 4096 process_identifier: 2948 process_handle: 0x00000080	1	0
NtAllocateVirtualMemory Aug. 9, 2024, 4:42 p.m.	process_identifier: 2948 region_size: 1273856 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000080	1	0
WriteProcessMemory Aug. 9, 2024, 4:42 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2948 process_handle: 0x00000080	1	1
NtSetContextThread Aug. 9, 2024, 4:42 p.m.	registers.eip: 1995571652 registers.esp: 1638384 registers.edi: 0 registers.eax: 4342081 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000007c process_identifier: 2948	1	0
NtResumeThread Aug. 9, 2024, 4:42 p.m.	thread_handle: 0x0000007c suspend_count: 1 process_identifier: 2948	1	0

File has been identified by 60 AntiVirus engines on VirusTotal as malicious (50 out of 60 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Stop.13!c
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
CAT-QuickHeal	Ransom.Stop.P5
Skyhigh	BehavesLike.Win32.Lockbit.bc
ALYac	Trojan.Ransom.Stop
Cylance	Unsafe
VIPRE	Trojan.GenericKD.73785192
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 005b8d0d1 )
BitDefender	Trojan.GenericKD.73785192
K7GW	Trojan ( 005b8d0d1 )
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Kryptik.HXQM
APEX	Malicious
McAfee	Artemis!D7528CD33B73
Avast	Win32:PWSX-gen [Trj]
ClamAV	Win.Packed.Smokeloader-10033583-0
Kaspersky	HEUR:Trojan-Ransom.Win32.Stop.gen
Alibaba	Trojan:Win32/Redirector.542b5e93
NANO-Antivirus	Trojan.Win32.InstaBot.kqpqfm
MicroWorld-eScan	Trojan.GenericKD.73785192
Rising	Backdoor.Mokes!8.619 (TFE:5:zRLPcqYcSgN)
Emsisoft	Trojan.GenericKD.73785192 (B)
F-Secure	Trojan.TR/AD.InstaBot.oftur
DrWeb	Trojan.Siggen29.13882
TrendMicro	Trojan.Win32.PRIVATELOADER.YXEHDZ
McAfeeD	Real Protect-LS!D7528CD33B73
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.d7528cd33b73718b
Sophos	Mal/Generic-S
SentinelOne	Static AI - Malicious PE
Google	Detected
Avira	TR/AD.InstaBot.oftur
MAX	malware (ai score=87)
Antiy-AVL	Trojan/Win32.Sabsik
Kingsoft	malware.kb.a.1000
Gridinsoft	Ransom.Win32.Sabsik.sa
Microsoft	Trojan:HTML/Redirector.PAN!MTB
ViRobot	Trojan.Win.Z.Smokeloader_10033583_0.746496
ZoneAlarm	HEUR:Trojan-Ransom.Win32.Stop.gen
GData	Trojan.GenericKD.73785192
Varist	W32/Kryptik.MNU.gen!Eldorado
AhnLab-V3	Trojan/Win.Generic.R658943
BitDefenderTheta	Gen:NN.ZexaF.36810.Tq0@aiuO96kG
DeepInstinct	MALICIOUS
VBA32	BScope.Backdoor.Mokes
Malwarebytes	Trojan.MalPack.GS
Ikarus	Trojan.Win32.Crypt

66ae9cc050ded_file0308.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All