URL:

https://dosya.co/00f3emj2pydj/Babatools_VIP_Twitch_Series_Cracked_By_Rexy.zip.html

Full analysis: https://app.any.run/tasks/a7d59136-657e-40c0-b8cd-4d83a88376a5
Verdict: Malicious activity
Analysis date: December 26, 2019, 22:47:41
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

3401A3FAE8A2B9CBCF9E53DFB9EB6A2A

SHA1:

0C071D8761ADA895D76C66AD7D3CE6D43FDCF895

SHA256:

54715D44262A67D1F266539C9C0AFE1F14ECE05C561201C6E79CC3C4737BD973

SSDEEP:

3:N8SgLdoSm7kRvRUyRazEGOLL34crU5Gn:2SiRvlWEZLDq5Gn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Twitch-God-2017-v1.0_CrackedByRexy.exe (PID: 392)
      • Twitch-Viewer-Faker-2017-v1.0_CrackedByRexy.exe (PID: 6104)
      • Twitch-Ultra-Viewer-2017-v1.0_CrackedByRexy.exe (PID: 4668)
      • Twitch-God-2017-v1.0_CrackedByRexy.exe (PID: 2444)
      • Twitch-God-2017-v1.0_CrackedByRexy.exe (PID: 4912)
    • Changes settings of System certificates

      • Twitch-Viewer-Faker-2017-v1.0_CrackedByRexy.exe (PID: 6104)
  • SUSPICIOUS

    • Executed via COM

      • FlashUtil32_26_0_0_131_ActiveX.exe (PID: 2836)
    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2400)
    • Connects to unusual port

      • Twitch-God-2017-v1.0_CrackedByRexy.exe (PID: 392)
  • INFO

    • Creates files in the user directory

      • iexplore.exe (PID: 532)
      • iexplore.exe (PID: 3080)
      • FlashUtil32_26_0_0_131_ActiveX.exe (PID: 2836)
    • Reads internet explorer settings

      • iexplore.exe (PID: 3080)
    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3080)
    • Changes internet zones settings

      • iexplore.exe (PID: 532)
    • Changes settings of System certificates

      • iexplore.exe (PID: 532)
    • Reads settings of System Certificates

      • iexplore.exe (PID: 532)
      • Twitch-God-2017-v1.0_CrackedByRexy.exe (PID: 392)
      • Twitch-Viewer-Faker-2017-v1.0_CrackedByRexy.exe (PID: 6104)
      • Twitch-God-2017-v1.0_CrackedByRexy.exe (PID: 4912)
    • Application launched itself

      • iexplore.exe (PID: 532)
    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 532)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
9
Malicious processes
0
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start iexplore.exe iexplore.exe flashutil32_26_0_0_131_activex.exe no specs winrar.exe twitch-god-2017-v1.0_crackedbyrexy.exe twitch-ultra-viewer-2017-v1.0_crackedbyrexy.exe no specs twitch-viewer-faker-2017-v1.0_crackedbyrexy.exe no specs twitch-god-2017-v1.0_crackedbyrexy.exe no specs twitch-god-2017-v1.0_crackedbyrexy.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
392"C:\Users\admin\AppData\Local\Temp\Rar$EXa2400.1992\Twitch-God-2017-v1.0_CrackedByRexy.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2400.1992\Twitch-God-2017-v1.0_CrackedByRexy.exe
WinRAR.exe
User:
admin
Company:
Pooria Sharaffodin www.BabaTools.com
Integrity Level:
MEDIUM
Description:
Twitch God 2017 v1.0 (Vip Pro Edition)
Exit code:
4294967295
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2400.1992\twitch-god-2017-v1.0_crackedbyrexy.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
532"C:\Program Files\Internet Explorer\iexplore.exe" "https://dosya.co/00f3emj2pydj/Babatools_VIP_Twitch_Series_Cracked_By_Rexy.zip.html"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2400"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\78FHZUD8\Babatools%20VIP%20Twitch%20Series%20Cracked%20By%20Rexy[1].zip"C:\Program Files\WinRAR\WinRAR.exe
iexplore.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2444"C:\Users\admin\AppData\Local\Temp\Rar$EXa2400.20789\Twitch-God-2017-v1.0_CrackedByRexy.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2400.20789\Twitch-God-2017-v1.0_CrackedByRexy.exeWinRAR.exe
User:
admin
Company:
Pooria Sharaffodin www.BabaTools.com
Integrity Level:
MEDIUM
Description:
Twitch God 2017 v1.0 (Vip Pro Edition)
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2400.20789\twitch-god-2017-v1.0_crackedbyrexy.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2836C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe -EmbeddingC:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exesvchost.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe® Flash® Player Installer/Uninstaller 26.0 r0
Exit code:
0
Version:
26,0,0,131
Modules
Images
c:\windows\system32\macromed\flash\flashutil32_26_0_0_131_activex.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3080"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:532 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
4668"C:\Users\admin\AppData\Local\Temp\Rar$EXa2400.13188\Twitch-Ultra-Viewer-2017-v1.0_CrackedByRexy.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2400.13188\Twitch-Ultra-Viewer-2017-v1.0_CrackedByRexy.exeWinRAR.exe
User:
admin
Company:
Pooria Sharaffodin www.BabaTools.com
Integrity Level:
MEDIUM
Description:
Twitch Ultra Viewer 2017 v1.0 (VIP PRO EDITION)
Exit code:
4294967295
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2400.13188\twitch-ultra-viewer-2017-v1.0_crackedbyrexy.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
4912"C:\Users\admin\AppData\Local\Temp\Rar$EXa2400.21221\Twitch-God-2017-v1.0_CrackedByRexy.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2400.21221\Twitch-God-2017-v1.0_CrackedByRexy.exeWinRAR.exe
User:
admin
Company:
Pooria Sharaffodin www.BabaTools.com
Integrity Level:
MEDIUM
Description:
Twitch God 2017 v1.0 (Vip Pro Edition)
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2400.21221\twitch-god-2017-v1.0_crackedbyrexy.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
6104"C:\Users\admin\AppData\Local\Temp\Rar$EXa2400.16783\Twitch-Viewer-Faker-2017-v1.0_CrackedByRexy.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2400.16783\Twitch-Viewer-Faker-2017-v1.0_CrackedByRexy.exeWinRAR.exe
User:
admin
Company:
Pooria Sharaffodin www.BabaTools.com
Integrity Level:
MEDIUM
Description:
Twitch Viewer Faker 2017 v1.0 (VIP PRO EDITION)
Exit code:
4294967295
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2400.16783\twitch-viewer-faker-2017-v1.0_crackedbyrexy.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
1 459
Read events
1 293
Write events
163
Delete events
3

Modification events

(PID) Process:(532) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(532) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(532) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(532) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
(PID) Process:(532) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(532) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000092000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(532) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery\Active
Operation:writeName:{C1C81DCF-2831-11EA-AB41-5254004A04AF}
Value:
0
(PID) Process:(532) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Type
Value:
4
(PID) Process:(532) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Count
Value:
2
(PID) Process:(532) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Time
Value:
E3070C0004001A0016002F003800DB03
Executable files
15
Suspicious files
2
Text files
32
Unknown types
10

Dropped files

PID
Process
Filename
Type
532iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\favicon[1].ico
MD5:
SHA256:
532iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
MD5:
SHA256:
3080iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.datdat
MD5:
SHA256:
3080iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.datdat
MD5:
SHA256:
3080iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\78FHZUD8\Babatools_VIP_Twitch_Series_Cracked_By_Rexy.zip[1].htmlhtml
MD5:
SHA256:
3080iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\2RKFWV7B\css[1].txttext
MD5:
SHA256:
3080iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\78FHZUD8\desktop.iniini
MD5:4A3DEB274BB5F0212C2419D3D8D08612
SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38
3080iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\index.datdat
MD5:
SHA256:
3080iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@google[1].txttext
MD5:
SHA256:
3080iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\78FHZUD8\platform[1].jshtml
MD5:
SHA256:
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
132
TCP/UDP connections
17 899
DNS requests
58
Threats
71

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
392
Twitch-God-2017-v1.0_CrackedByRexy.exe
GET
301
104.27.190.7:80
http://checkerproxy.net/all_proxy
US
malicious
392
Twitch-God-2017-v1.0_CrackedByRexy.exe
GET
301
104.27.190.7:80
http://checkerproxy.net/all_proxy
US
malicious
392
Twitch-God-2017-v1.0_CrackedByRexy.exe
GET
302
216.105.38.10:80
http://proxysearcher.sourceforge.net/ProxyList.php?type=http&filtered=true
US
malicious
392
Twitch-God-2017-v1.0_CrackedByRexy.exe
GET
302
216.105.38.10:80
http://proxysearcher.sourceforge.net/ProxyList.php?type=http&filtered=true
US
malicious
392
Twitch-God-2017-v1.0_CrackedByRexy.exe
GET
200
213.174.129.16:80
http://proxy-list.org/german/index.php?p=1
US
html
75.0 Kb
unknown
392
Twitch-God-2017-v1.0_CrackedByRexy.exe
GET
301
173.254.28.147:80
http://www.babatools.com/hb98J.html
US
html
311 b
malicious
GET
301
195.201.59.57:80
http://www.proxy-listen.de/Proxy/Proxyliste.html
RU
html
257 b
suspicious
392
Twitch-God-2017-v1.0_CrackedByRexy.exe
GET
200
188.93.95.137:80
http://www.httptunnel.ge/ProxyListForFree.aspx
GE
html
290 Kb
unknown
532
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
GET
302
216.105.38.10:80
http://proxysearcher.sourceforge.net/ProxyList.php?type=http&filtered=true
US
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3080
iexplore.exe
195.201.111.49:443
dosya.co
Awanti Ltd.
RU
suspicious
532
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3080
iexplore.exe
104.17.65.4:443
cdnjs.cloudflare.com
Cloudflare Inc
US
unknown
3080
iexplore.exe
172.217.16.170:443
fonts.googleapis.com
Google Inc.
US
whitelisted
3080
iexplore.exe
172.217.23.99:443
fonts.gstatic.com
Google Inc.
US
whitelisted
3080
iexplore.exe
172.217.18.110:443
apis.google.com
Google Inc.
US
whitelisted
3080
iexplore.exe
185.60.216.19:443
connect.facebook.net
Facebook, Inc.
IE
whitelisted
532
iexplore.exe
195.201.111.49:443
dosya.co
Awanti Ltd.
RU
suspicious
3080
iexplore.exe
64.233.167.155:443
stats.g.doubleclick.net
Google Inc.
US
whitelisted
3080
iexplore.exe
185.60.216.35:443
www.facebook.com
Facebook, Inc.
IE
whitelisted

DNS requests

Domain
IP
Reputation
dosya.co
  • 195.201.111.49
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
cdnjs.cloudflare.com
  • 104.17.65.4
  • 104.17.64.4
whitelisted
maxcdn.bootstrapcdn.com
  • 209.197.3.15
whitelisted
apis.google.com
  • 172.217.18.110
whitelisted
fonts.googleapis.com
  • 172.217.16.170
whitelisted
fonts.gstatic.com
  • 172.217.23.99
whitelisted
www.google-analytics.com
  • 172.217.18.110
whitelisted
connect.facebook.net
  • 185.60.216.19
whitelisted
stats.g.doubleclick.net
  • 64.233.167.155
  • 64.233.167.157
  • 64.233.167.156
  • 64.233.167.154
whitelisted

Threats

PID
Process
Class
Message
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
392
Twitch-God-2017-v1.0_CrackedByRexy.exe
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
No debug info