Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	April 1, 2025, 2:15 a.m.	April 1, 2025, 2:18 a.m.

Size	43.0MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`52bef8ec8e901d538293303ac6ad67d4`
SHA256	`fd234510561641d41e09d169f55038a972ea60ce50daadce7ea23aa967e6f327`
CRC32	`1BB81451`
ssdeep	`786432:PRBiLDOZNt2zX9ZPZZShJ1JkyU9sLWEGaFYRsYypXf9Mos0LkT8pljHge8qHyNR2:PzegNAzX9RCn1JBNXGNR3yd9DPfplMdq`
Yara	PE_Header_Zero - PE File Signature Malicious_Library_Zero - Malicious_Library mzp_file_format - MZP(Delphi) file format Win32_Trojan_Emotet_2_Zero - Win32 Trojan Emotet IsPE32 - (no description) UPX_Zero - UPX packed file

aida64engineer660.exe "C:\Users\test22\AppData\Local\Temp\aida64engineer660.exe"
2668
- aida64engineer660.tmp "C:\Users\test22\AppData\Local\Temp\is-6RDTQ.tmp\aida64engineer660.tmp" /SL5="$80178,44738220,56832,C:\Users\test22\AppData\Local\Temp\aida64engineer660.exe"
  2720
  - aida64.exe "C:\Program Files (x86)\FinalWire\AIDA64 Engineer\aida64.exe"
    2056
    - ie4uinit.exe "C:\Windows\System32\ie4uinit.exe" -ClearIconCache
      2684
  - hh.exe "C:\Windows\hh.exe" C:\Program Files (x86)\FinalWire\AIDA64 Engineer\aida64.chm
    1404
explorer.exe C:\Windows\Explorer.EXE
1452

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (12 events)

Time & API	Arguments	Status	Return
GetComputerNameA April 1, 2025, 2:16 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 1, 2025, 2:16 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 1, 2025, 2:16 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 1, 2025, 2:16 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 1, 2025, 2:09 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 1, 2025, 2:09 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 1, 2025, 2:09 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 1, 2025, 2:09 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 1, 2025, 2:17 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA April 1, 2025, 2:17 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA April 1, 2025, 2:10 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 1, 2025, 2:10 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent April 1, 2025, 2:15 a.m.			0	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Tries to locate where the browsers are installed (2 events)

file	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
file	c:\program files\mozilla firefox\firefox.exe

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx April 1, 2025, 2:15 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 events)

section	CODE
section	DATA
section	BSS

One or more processes crashed (2 events)

Time & API	Arguments	Status	Return	Repeated
__exception__ April 1, 2025, 2:17 a.m.	stacktrace: aida64+0x1fc5e @ 0x41fc5e aida64+0x1fb31 @ 0x41fb31 aida64+0x1e7c3 @ 0x41e7c3 aida64+0x5cc09b @ 0x9cc09b aida64+0xa7c5c4 @ 0xe7c5c4 aida64+0xa0f4a3 @ 0xe0f4a3 aida64+0x949cf @ 0x4949cf aida64+0x946af @ 0x4946af aida64+0x9bfac @ 0x49bfac aida64+0xb54c22 @ 0xf54c22 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xeedfade exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 80214544 registers.edi: 106692640 registers.eax: 80214544 registers.ebp: 80214624 registers.edx: 0 registers.ebx: 106736776 registers.esi: 106832140 registers.ecx: 7	1	0	0
__exception__ April 1, 2025, 2:17 a.m.	stacktrace: aida64+0x1fc5e @ 0x41fc5e aida64+0x1fb31 @ 0x41fb31 aida64+0x1e7c3 @ 0x41e7c3 aida64+0x5cc09b @ 0x9cc09b aida64+0xa76831 @ 0xe76831 aida64+0xa0f8fe @ 0xe0f8fe aida64+0x949cf @ 0x4949cf aida64+0x946af @ 0x4946af aida64+0x9bfac @ 0x49bfac aida64+0xb54c22 @ 0xf54c22 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xeedfade exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 80214632 registers.edi: 106823712 registers.eax: 80214632 registers.ebp: 80214712 registers.edx: 0 registers.ebx: 106828064 registers.esi: 107140980 registers.ecx: 7	1	0	0

Allocates read-write-execute memory (usually to unpack itself) (11 events)

Time & API	Arguments	Status
NtProtectVirtualMemory April 1, 2025, 2:15 a.m.	process_identifier: 2668 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 1, 2025, 2:15 a.m.	process_identifier: 2668 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 40960 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00401000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 1, 2025, 2:15 a.m.	process_identifier: 2668 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 20480 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0040f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 1, 2025, 2:15 a.m.	process_identifier: 2668 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bc2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 1, 2025, 2:15 a.m.	process_identifier: 2720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 1, 2025, 2:15 a.m.	process_identifier: 2720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bc2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 1, 2025, 2:10 a.m.	process_identifier: 1452 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000007890000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 1, 2025, 2:17 a.m.	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06720000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 1, 2025, 2:17 a.m.	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bc2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 1, 2025, 2:17 a.m.	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x09df0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 1, 2025, 2:10 a.m.	process_identifier: 1404 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007304c000 process_handle: 0xffffffffffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (9 events)

Time & API	Arguments	Status	Return
GetDiskFreeSpaceExW April 1, 2025, 2:16 a.m.	total_number_of_free_bytes: 0 free_bytes_available: 8468295145849449705 root_path: C:\Program Files (x86)\FinalWire\AIDA64 Engineer\ total_number_of_bytes: 4294967295		0
GetDiskFreeSpaceExW April 1, 2025, 2:16 a.m.	total_number_of_free_bytes: 0 free_bytes_available: 8468295145849449705 root_path: C:\Program Files (x86)\FinalWire\ total_number_of_bytes: 4294967295		0
GetDiskFreeSpaceExW April 1, 2025, 2:16 a.m.	total_number_of_free_bytes: 0 free_bytes_available: 13279100928 root_path: C:\Program Files (x86)\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW April 1, 2025, 2:09 a.m.	total_number_of_free_bytes: 0 free_bytes_available: 13196345344 root_path: C:\Users\test22\AppData\Local\Microsoft\Windows\Explorer total_number_of_bytes: 0	1	1
GetDiskFreeSpaceExW April 1, 2025, 2:09 a.m.	total_number_of_free_bytes: 0 free_bytes_available: 13196414976 root_path: C:\Users\test22\AppData\Local\Microsoft\Windows\Explorer total_number_of_bytes: 0	1	1
GetDiskFreeSpaceExW April 1, 2025, 2:09 a.m.	total_number_of_free_bytes: 0 free_bytes_available: 13195939840 root_path: C:\Users\test22\AppData\Local\Microsoft\Windows\Explorer total_number_of_bytes: 0	1	1
GetDiskFreeSpaceExW April 1, 2025, 2:09 a.m.	total_number_of_free_bytes: 0 free_bytes_available: 13195939840 root_path: C:\Users\test22\AppData\Local\Microsoft\Windows\Explorer total_number_of_bytes: 0	1	1
GetDiskFreeSpaceExW April 1, 2025, 2:09 a.m.	total_number_of_free_bytes: 0 free_bytes_available: 13195939840 root_path: C:\Users\test22\AppData\Local\Microsoft\Windows\Explorer total_number_of_bytes: 0	1	1
GetDiskFreeSpaceExW April 1, 2025, 2:09 a.m.	total_number_of_free_bytes: 0 free_bytes_available: 13195939840 root_path: C:\Users\test22\AppData\Local\Microsoft\Windows\Explorer total_number_of_bytes: 0	1	1

Creates executable files on the filesystem (5 events)

file	C:\Users\test22\Desktop\AIDA64 Engineer.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FinalWire\AIDA64 Engineer\AIDA64 Engineer.lnk
file	C:\Users\test22\AppData\Local\Temp\is-DRUVL.tmp\_isetup\_shfoldr.dll
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FinalWire\AIDA64 Engineer\AIDA64 Engineer Documentation.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FinalWire\AIDA64 Engineer\AIDA64 Engineer on the Web.lnk

Creates a service (2 events)

Time & API	Arguments	Status	Return	Repeated
CreateServiceA April 1, 2025, 2:17 a.m.	service_start_name: start_type: 3 password: display_name: FinalWire AIDA64 Kernel Driver filepath: C:\Program Files (x86)\FinalWire\AIDA64 Engineer\kerneld.x64 service_name: AIDA64Driver filepath_r: C:\Program Files (x86)\FinalWire\AIDA64 Engineer\kerneld.x64 desired_access: 65584 service_handle: 0x09db89f8 error_control: 1 service_type: 1 service_manager_handle: 0x09db89a8	1	165382648	0
CreateServiceA April 1, 2025, 2:17 a.m.	service_start_name: start_type: 3 password: display_name: FinalWire AIDA64 Kernel Driver filepath: C:\Program Files (x86)\FinalWire\AIDA64 Engineer\kerneld.v64 service_name: AIDA64Driver filepath_r: C:\Program Files (x86)\FinalWire\AIDA64 Engineer\kerneld.v64 desired_access: 65584 service_handle: 0x09db8a20 error_control: 1 service_type: 1 service_manager_handle: 0x09db89a8	1	165382688	0

Creates a shortcut to an executable file (17 events)

file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Explorer.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Snipping Tool.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Welcome Center.lnk
file	C:\Users\test22\Desktop\AIDA64 Engineer.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Fax and Scan.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Chrome.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Firefox.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FinalWire\AIDA64 Engineer\AIDA64 Engineer.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XPS Viewer.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Sticky Notes.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Calculator.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Paint.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\displayswitch.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FinalWire\AIDA64 Engineer\AIDA64 Engineer Documentation.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FinalWire\AIDA64 Engineer\AIDA64 Engineer on the Web.lnk

Drops an executable to the user AppData folder (2 events)

file	C:\Users\test22\AppData\Local\Temp\is-6RDTQ.tmp\aida64engineer660.tmp
file	C:\Users\test22\AppData\Local\Temp\is-DRUVL.tmp\_isetup\_shfoldr.dll

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW April 1, 2025, 2:17 a.m.	show_type: 0 filepath_r: ie4uinit.exe parameters: -ClearIconCache filepath: ie4uinit.exe	1	1	0

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory April 1, 2025, 2:10 a.m.	process_identifier: 1404 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x000007fffff90000 process_handle: 0xffffffffffffffff	1	0	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (12 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW April 1, 2025, 2:09 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW April 1, 2025, 2:09 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW April 1, 2025, 2:09 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW April 1, 2025, 2:09 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW April 1, 2025, 2:09 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW April 1, 2025, 2:09 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW April 1, 2025, 2:09 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW April 1, 2025, 2:09 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW April 1, 2025, 2:09 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW April 1, 2025, 2:09 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW April 1, 2025, 2:09 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW April 1, 2025, 2:09 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1

Queries for potentially installed applications (8 events)

Time & API	Arguments	Status	Return
RegOpenKeyExA April 1, 2025, 2:15 a.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\AIDA64 Engineer_is1 base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00000001 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\AIDA64 Engineer_is1		2
RegOpenKeyExA April 1, 2025, 2:15 a.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\AIDA64 Engineer_is1 base_handle: 0x80000002 key_handle: 0x00000000 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\AIDA64 Engineer_is1		2
RegOpenKeyExA April 1, 2025, 2:15 a.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\AIDA64 Engineer_is1 base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00000001 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\AIDA64 Engineer_is1		2
RegOpenKeyExA April 1, 2025, 2:15 a.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\AIDA64 Engineer_is1 base_handle: 0x80000002 key_handle: 0x00000000 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\AIDA64 Engineer_is1		2
RegOpenKeyExA April 1, 2025, 2:16 a.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\AIDA64 Engineer_is1 base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00000008 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\AIDA64 Engineer_is1		2
RegOpenKeyExA April 1, 2025, 2:16 a.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\AIDA64 Engineer_is1 base_handle: 0x80000002 key_handle: 0x00000000 options: 0 access: 0x00000008 regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\AIDA64 Engineer_is1		2
RegOpenKeyExA April 1, 2025, 2:17 a.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\AIDA64 Engineer_is1 base_handle: 0x80000002 key_handle: 0x00000210 options: 0 access: 0x0002021f regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\AIDA64 Engineer_is1	1	0
RegOpenKeyExA April 1, 2025, 2:17 a.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\AIDA64 Engineer_is1 base_handle: 0x80000002 key_handle: 0x00000000 options: 0 access: 0x0002011f regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\AIDA64 Engineer_is1		2

Creates a windows hook that monitors keyboard input (keylogger) (1 event)

Time & API	Arguments	Status	Return	Repeated
SetWindowsHookExW April 1, 2025, 2:09 a.m.	thread_identifier: 0 callback_function: 0x00000000ff8fae10 hook_identifier: 13 (WH_KEYBOARD_LL) module_address: 0x00000000ff850000	1	328273	0

aida64engineer660.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All