Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Sept. 17, 2024, 1:30 p.m.	Sept. 17, 2024, 2:04 p.m.

Size	3.5MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`d6b80519cb7c625d200d2899c345c8c6`
SHA256	`9b31ce85872a2d41ea6e3181066790e56d4fb29d593ba9a156e12133490799ca`
CRC32	`04D81081`
ssdeep	`49152:RNBYHNB+FpvtioVlIhjVocyP1T8C89G89io3LZWMcuEyhtxUssFaTIQ0IHZTQ5:RNKtwFtDVlIhpnyO966LZ0iOblQ0IC`
Yara	Malicious_Library_Zero - Malicious_Library Admin_Tool_IN_Zero - Admin Tool Sysinternals PE_Header_Zero - PE File Signature Malicious_Packer_Zero - Malicious Packer IsPE32 - (no description) Generic_Malware_Zero - Generic Malware UPX_Zero - UPX packed file mzp_file_format - MZP(Delphi) file format OS_Processor_Check_Zero - OS Processor Check

freedom.exe "C:\Users\test22\AppData\Local\Temp\freedom.exe"
2576

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
188.124.59.28	Active	Moloch
45.156.25.118	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Sept. 17, 2024, 1:30 p.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW Sept. 17, 2024, 1:30 p.m.	computer_name: TEST22-PC	1	1	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (2 events)

registry	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\InstallDate

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 17, 2024, 1:30 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (2 events)

section	.itext
section	.didata

The executable uses a known packer (1 event)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 102 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Sept. 17, 2024, 1:30 p.m.	process_identifier: 2576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 5390336 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02781000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:30 p.m.	process_identifier: 2576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76f2f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:30 p.m.	process_identifier: 2576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76f2f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:30 p.m.	process_identifier: 2576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76f2f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:30 p.m.	process_identifier: 2576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76f2f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:30 p.m.	process_identifier: 2576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76f2f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:30 p.m.	process_identifier: 2576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76f2f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:30 p.m.	process_identifier: 2576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76f2f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:30 p.m.	process_identifier: 2576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76f2f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:30 p.m.	process_identifier: 2576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76f2f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:30 p.m.	process_identifier: 2576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76f2f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:30 p.m.	process_identifier: 2576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76f2f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:30 p.m.	process_identifier: 2576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76f2f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:30 p.m.	process_identifier: 2576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76f2f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:30 p.m.	process_identifier: 2576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76f2f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:30 p.m.	process_identifier: 2576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76f2f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:30 p.m.	process_identifier: 2576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76f2f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:30 p.m.	process_identifier: 2576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76f2f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:30 p.m.	process_identifier: 2576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76f2f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:30 p.m.	process_identifier: 2576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76f2f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:30 p.m.	process_identifier: 2576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76f2f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:30 p.m.	process_identifier: 2576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76f2f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:30 p.m.	process_identifier: 2576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76f2f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:30 p.m.	process_identifier: 2576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76f2f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:30 p.m.	process_identifier: 2576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76f2f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:30 p.m.	process_identifier: 2576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76f2f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:30 p.m.	process_identifier: 2576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76f2f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:30 p.m.	process_identifier: 2576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76f2f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:30 p.m.	process_identifier: 2576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76f2f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:30 p.m.	process_identifier: 2576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76f2f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:30 p.m.	process_identifier: 2576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76f2f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:30 p.m.	process_identifier: 2576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76f2f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:30 p.m.	process_identifier: 2576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76f2f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:30 p.m.	process_identifier: 2576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76f2f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:30 p.m.	process_identifier: 2576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76f2f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:30 p.m.	process_identifier: 2576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76f2f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:30 p.m.	process_identifier: 2576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76f2f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:30 p.m.	process_identifier: 2576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76f2f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:30 p.m.	process_identifier: 2576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76f2f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:30 p.m.	process_identifier: 2576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76f2f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:30 p.m.	process_identifier: 2576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76f2f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:30 p.m.	process_identifier: 2576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76f2f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:30 p.m.	process_identifier: 2576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76f2f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:30 p.m.	process_identifier: 2576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76f2f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:30 p.m.	process_identifier: 2576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76f2f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:30 p.m.	process_identifier: 2576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76f2f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:30 p.m.	process_identifier: 2576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76f2f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:30 p.m.	process_identifier: 2576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76f2f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:30 p.m.	process_identifier: 2576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76f2f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:30 p.m.	process_identifier: 2576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76f2f000 process_handle: 0xffffffff	1

A process attempted to delay the analysis task. (1 event)

description

freedom.exe tried to sleep 582 seconds, actually delayed analysis time by 582 seconds

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00365400', u'virtual_address': u'0x00001000', u'entropy': 7.773896585162653, u'name': u'.text', u'virtual_size': u'0x003653e8'}

entropy

7.77389658516

description

A section with a high entropy has been found

entropy

0.958643507031

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (2 events)

host	188.124.59.28
host	45.156.25.118

Checks the CPU name from registry, possibly for anti-virtualization (1 event)

registry

HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString

A process performed obfuscation on information about the computer or sent it to a remote location indicative of CnC Traffic/Preperations. (2 events)

Time & API	Arguments	Status	Return	Repeated
CryptHashData Sept. 17, 2024, 1:30 p.m.	buffer: 017bd04f-b3bf-45b6-8167-9e8f41ff87bfIntel64 Family 6 Model 158 Stepping 10Intel(R) Core(TM) i5-8400 CPU @ 2.80GHz7601.17514.amd64fre.win7sp1_rtm.101119-18507b7c15f9-747a-455f-9ba5-f521dde4252d12550-687-8634689-784717C6024AD20181311432220{3d3783a0-703a-11de-8c7a-806e6f6e6963}TEST22-PC187491005CE7E20DA4B7291CE2D30BD7 hash_handle: 0x008ce940 flags: 0	1	1	0
CryptHashData Sept. 17, 2024, 1:30 p.m.	buffer: 017bd04f-b3bf-45b6-8167-9e8f41ff87bfIntel64 Family 6 Model 158 Stepping 10Intel(R) Core(TM) i5-8400 CPU @ 2.80GHz7601.17514.amd64fre.win7sp1_rtm.101119-18507b7c15f9-747a-455f-9ba5-f521dde4252d12550-687-8634689-784717C6024AD20181311432220{3d3783a0-703a-11de-8c7a-806e6f6e6963}TEST22-PC187491005CE7E20DA4B7291CE2D30BD7 hash_handle: 0x008ce940 flags: 0	1	1	0

Generates some ICMP traffic

File has been identified by 59 AntiVirus engines on VirusTotal as malicious (50 out of 59 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Danabot.i!c
Cynet	Malicious (score: 100)
Skyhigh	BehavesLike.Win32.Generic.wc
ALYac	Gen:Variant.Barys.390454
Cylance	Unsafe
VIPRE	Gen:Variant.Barys.390454
Sangfor	Spyware.Win32.Danabot.Vdkh
CrowdStrike	win/malicious_confidence_100% (W)
BitDefender	Trojan.GenericKD.74137838
K7GW	Trojan-Downloader ( 005706321 )
K7AntiVirus	Trojan-Downloader ( 005706321 )
Arcabit	Trojan.Generic.D46B40EE
VirIT	Trojan.Win32.DelphGen.HHB
Symantec	Ransom.Zombie
Elastic	Windows.Generic.Threat
ESET-NOD32	a variant of Win32/Spy.Danabot.X
APEX	Malicious
Avast	Win32:SpywareX-gen [Trj]
Kaspersky	HEUR:Trojan-PSW.Win32.Stealer.gen
Alibaba	TrojanPSW:Win32/Danabot.4b4d1aca
NANO-Antivirus	Trojan.Win32.Danabot.krfcbd
MicroWorld-eScan	Trojan.GenericKD.74137838
Rising	Trojan.Znyonm!8.18A3A (TFE:4:8kNuGtRwuPR)
Emsisoft	Trojan.GenericKD.74137838 (B)
F-Secure	Trojan.TR/ATRAPS.Gen
Zillya	Trojan.Danabot.Win32.9547
TrendMicro	Trojan.Win32.DANABOT.YXEHYZ
McAfeeD	ti!9B31CE85872A
Trapmine	malicious.moderate.ml.score
CTX	exe.trojan.generic
Sophos	Mal/Generic-S
SentinelOne	Static AI - Suspicious PE
FireEye	Generic.mg.d6b80519cb7c625d
Webroot	W32.Trojan.Gen
Google	Detected
Avira	TR/ATRAPS.Gen
Antiy-AVL	Trojan[Spy]/Win32.Danabot
Kingsoft	Win32.Trojan-PSW.Stealer.gen
Gridinsoft	Trojan.Win32.Downloader.sa
Xcitium	Malware@#drwmldh7j666
Microsoft	Trojan:Win32/Danabot.SL!MTB
ViRobot	Trojan.Win.Z.Danabot.3715072
ZoneAlarm	HEUR:Trojan-PSW.Win32.Stealer.gen
GData	Trojan.GenericKD.74137838
Varist	W32/ABTrojan.MUQN-5646
AhnLab-V3	Trojan/Win.Generic.R643525
McAfee	Artemis!D6B80519CB7C
DeepInstinct	MALICIOUS
Malwarebytes	Trojan.Crypt

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 events)

dead_host	45.156.25.118:443
dead_host	188.124.59.28:443

freedom.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All