| File name: | 01759319 |
| Full analysis: | https://app.any.run/tasks/f11637c6-d09b-40d7-8857-13a6803c271b |
| Verdict: | Malicious activity |
| Analysis date: | January 09, 2020, 01:17:46 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | D5D9D98058E46B1FFF2E19084519FB55 |
| SHA1: | C164661D62A75539FC1E97810BE62FE11D5DA61A |
| SHA256: | 76613CD0915C03EBDCC61C148E7F4BEB48654F54794250FD5B5E9086E0CF56BA |
| SSDEEP: | 393216:rJaHsJ05YjNlPZcnUd250JgD/yok8kAzmXvDaX6:rIwSWpZvACWDvt+f |
MALICIOUS
Changes settings of System certificates
- Config.exe (PID: 3752)
Loads the Task Scheduler COM API
- gsagent.exe (PID: 3844)
Loads dropped or rewritten executable
- GsAgent.exe (PID: 2356)
- Config.exe (PID: 3752)
- GsAgent.exe (PID: 2412)
- Config.exe (PID: 3432)
- Installer.exe (PID: 4088)
- gsagent.exe (PID: 3844)
Application was dropped or rewritten from another process
- GsAgent.exe (PID: 2412)
- Config.exe (PID: 3752)
- GsAgent.exe (PID: 2356)
- Config.exe (PID: 3432)
- Installer.exe (PID: 4088)
- gsagent.exe (PID: 3844)
SUSPICIOUS
Executable content was dropped or overwritten
- 01759319.exe (PID: 1784)
- Installer.exe (PID: 4088)
- gsagent.exe (PID: 3844)
Creates files in the Windows directory
- Config.exe (PID: 3752)
- Installer.exe (PID: 4088)
- gsagent.exe (PID: 3844)
Adds / modifies Windows certificates
- Config.exe (PID: 3752)
Creates files in the program directory
- GsAgent.exe (PID: 2356)
- GsAgent.exe (PID: 2412)
- gsagent.exe (PID: 3844)
- Installer.exe (PID: 4088)
Executed as Windows Service
- gsagent.exe (PID: 3844)
Removes files from Windows directory
- gsagent.exe (PID: 3844)
Creates or modifies windows services
- gsagent.exe (PID: 3844)
Creates a software uninstall entry
- gsagent.exe (PID: 3844)
INFO
No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable (generic) (52.9) |
|---|---|---|
| .exe | | | Generic Win/DOS Executable (23.5) |
| .exe | | | DOS Executable Generic (23.5) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2018:11:05 11:52:42+01:00 |
| PEType: | PE32 |
| LinkerVersion: | 14 |
| CodeSize: | 504320 |
| InitializedDataSize: | 251904 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x586f7 |
| OSVersion: | 5.1 |
| ImageVersion: | - |
| SubsystemVersion: | 5.1 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 4.0.0.0 |
| ProductVersionNumber: | 4.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Windows NT 32-bit |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Korean |
| CharacterSet: | Unicode |
| CompanyName: | GENIANS, INC. |
| FileDescription: | PackagerEx |
| FileVersion: | 4.0.0.0 |
| InternalName: | Packager.exe |
| LegalCopyright: | GENIANS, INC. All rights reserved. |
| OriginalFileName: | Packager.exe |
| PrivateBuild: | BN-201811051952-R1- -R |
| ProductName: | GENIAN |
| ProductVersion: | 4.0.0.0 |
Summary
| Architecture: | IMAGE_FILE_MACHINE_I386 |
|---|---|
| Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
| Compilation Date: | 05-Nov-2018 10:52:42 |
| Detected languages: |
|
| Debug artifacts: |
|
| CompanyName: | GENIANS, INC. |
| FileDescription: | PackagerEx |
| FileVersion: | 4.0.0.0 |
| InternalName: | Packager.exe |
| LegalCopyright: | GENIANS, INC. All rights reserved. |
| OriginalFilename: | Packager.exe |
| PrivateBuild: | BN-201811051952-R1- -R |
| ProductName: | GENIAN |
| ProductVersion: | 4.0.0.0 |
DOS Header
| Magic number: | MZ |
|---|---|
| Bytes on last page of file: | 0x0090 |
| Pages in file: | 0x0003 |
| Relocations: | 0x0000 |
| Size of header: | 0x0004 |
| Min extra paragraphs: | 0x0000 |
| Max extra paragraphs: | 0xFFFF |
| Initial SS value: | 0x0000 |
| Initial SP value: | 0x00B8 |
| Checksum: | 0x0000 |
| Initial IP value: | 0x0000 |
| Initial CS value: | 0x0000 |
| Overlay number: | 0x0000 |
| OEM identifier: | 0x0000 |
| OEM information: | 0x0000 |
| Address of NE header: | 0x00000130 |
PE Headers
| Signature: | PE |
|---|---|
| Machine: | IMAGE_FILE_MACHINE_I386 |
| Number of sections: | 8 |
| Time date stamp: | 05-Nov-2018 10:52:42 |
| Pointer to Symbol Table: | 0x00000000 |
| Number of symbols: | 0 |
| Size of Optional Header: | 0x00E0 |
| Characteristics: |
|
Sections
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
|---|---|---|---|---|---|
.text | 0x00001000 | 0x0007B1E7 | 0x0007B200 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.65241 |
.rdata | 0x0007D000 | 0x00025556 | 0x00025600 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.25768 |
.data | 0x000A3000 | 0x00006C4C | 0x00002600 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 4.13082 |
.gfids | 0x000AA000 | 0x00001A04 | 0x00001C00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 3.79971 |
.giats | 0x000AC000 | 0x00000004 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.0407808 |
.tls | 0x000AD000 | 0x00000009 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0.0203931 |
.rsrc | 0x000AE000 | 0x00008190 | 0x00008200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.67801 |
.reloc | 0x000B7000 | 0x00007174 | 0x00007200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 6.6332 |
Resources
Title | Entropy | Size | Codepage | Language | Type |
|---|---|---|---|---|---|
1 | 5.16876 | 1985 | UNKNOWN | English - United States | RT_MANIFEST |
2 | 6.19437 | 2440 | UNKNOWN | Korean - Korea | RT_ICON |
3 | 6.6398 | 3240 | UNKNOWN | Korean - Korea | RT_ICON |
4 | 5.69557 | 9640 | UNKNOWN | Korean - Korea | RT_ICON |
5 | 3.02695 | 308 | UNKNOWN | Korean - Korea | RT_CURSOR |
6 | 2.74274 | 180 | UNKNOWN | Korean - Korea | RT_CURSOR |
7 | 2.34038 | 308 | UNKNOWN | Korean - Korea | RT_CURSOR |
8 | 2.34004 | 308 | UNKNOWN | Korean - Korea | RT_CURSOR |
9 | 2.51649 | 308 | UNKNOWN | Korean - Korea | RT_CURSOR |
10 | 2.45401 | 308 | UNKNOWN | Korean - Korea | RT_CURSOR |
Imports
ADVAPI32.dll |
COMCTL32.dll |
GDI32.dll |
KERNEL32.dll |
OLEACC.dll |
OLEAUT32.dll |
SHELL32.dll |
SHLWAPI.dll |
USER32.dll |
WINSPOOL.DRV |
Exports
Title | Ordinal | Address |
|---|---|---|
?Compress@@YA_NPAEK0AAK@Z | 1 | 0x00029C10 |
?Uncompress@@YA_NPAEK0AAK@Z | 2 | 0x00029C60 |
?UnzipFile@@YA_NPB_W0_NHPA_NP6AXHH@Z@Z | 3 | 0x00028C30 |
?UnzipFileClose@@YAXPAX@Z | 4 | 0x00029700 |
?UnzipFileCount@@YAKPB_W@Z | 5 | 0x00029510 |
?UnzipFileForSelect@@YA_NPB_WAAV?$vector@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$allocator@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@std@@0_NHPA_NP6AXHH@Z@Z | 6 | 0x00029240 |
?UnzipFileInfo@@YA_NPAXAAU_ZIPLIB_FILEINFO@@@Z | 7 | 0x00029840 |
?UnzipFileOpen@@YAPAXPB_W@Z | 8 | 0x00029630 |
?UnzipGotoFirstFile@@YA_NPAX@Z | 9 | 0x00029740 |
?UnzipGotoNextFile@@YA_NPAX@Z | 10 | 0x000297B0 |
Total processes
46
Monitored processes
8
Malicious processes
6
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1784 | "C:\Users\admin\AppData\Local\Temp\01759319.exe" | C:\Users\admin\AppData\Local\Temp\01759319.exe | explorer.exe | ||||||||||||
User: admin Company: GENIANS, INC. Integrity Level: HIGH Description: PackagerEx Exit code: 0 Version: 4.0.0.0 Modules
| |||||||||||||||
| 2356 | "C:\Program Files\Geni\Insights\GsAgent.exe" --install | C:\Program Files\Geni\Insights\GsAgent.exe | — | Config.exe | |||||||||||
User: admin Company: GENIANS, INC. Integrity Level: HIGH Description: Genian Insights E Agent for Windows Exit code: 0 Version: 1.5.109.1113 Modules
| |||||||||||||||
| 2412 | "C:\Program Files\Geni\Insights\GsAgent.exe" | C:\Program Files\Geni\Insights\GsAgent.exe | — | Config.exe | |||||||||||
User: admin Company: GENIANS, INC. Integrity Level: HIGH Description: Genian Insights E Agent for Windows Exit code: 4294967295 Version: 1.5.109.1113 Modules
| |||||||||||||||
| 3400 | "C:\Users\admin\AppData\Local\Temp\01759319.exe" | C:\Users\admin\AppData\Local\Temp\01759319.exe | — | explorer.exe | |||||||||||
User: admin Company: GENIANS, INC. Integrity Level: MEDIUM Description: PackagerEx Exit code: 3221226540 Version: 4.0.0.0 Modules
| |||||||||||||||
| 3432 | "C:\PROGRAM FILES\Geni\Insights\Config.exe" -i | C:\PROGRAM FILES\Geni\Insights\Config.exe | — | Installer.exe | |||||||||||
User: admin Company: GENIANS, INC. Integrity Level: HIGH Description: Genian Insights E Configuration tool Exit code: 0 Version: 1.5.107.23 Modules
| |||||||||||||||
| 3752 | "C:\Users\admin\APPDATA\LOCAL\TEMP\$GNPACK_5DAA0763$\Config.exe" -c | C:\Users\admin\APPDATA\LOCAL\TEMP\$GNPACK_5DAA0763$\Config.exe | — | Installer.exe | |||||||||||
User: admin Company: GENIANS, INC. Integrity Level: HIGH Description: Genian Insights E Configuration tool Exit code: 0 Version: 1.5.107.23 Modules
| |||||||||||||||
| 3844 | "C:\Program Files\Geni\Insights\gsagent.exe" --service | C:\Program Files\Geni\Insights\gsagent.exe | services.exe | ||||||||||||
User: SYSTEM Company: GENIANS, INC. Integrity Level: SYSTEM Description: Genian Insights E Agent for Windows Exit code: 0 Version: 1.5.109.1113 Modules
| |||||||||||||||
| 4088 | "C:\Users\admin\APPDATA\LOCAL\TEMP\$GNPACK_5DAA0763$\Installer.exe" "C:\USERS\ADMIN\APPDATA\LOCAL\TEMP\$GNPACK_5DAA0763$\INSTALL.isf" "/N:25.147.117.1" | C:\Users\admin\APPDATA\LOCAL\TEMP\$GNPACK_5DAA0763$\Installer.exe | 01759319.exe | ||||||||||||
User: admin Company: GENIANS, INC. Integrity Level: HIGH Description: GENIANS Software Install Manager Exit code: 3221225725 Version: 4.0.0.0 Modules
| |||||||||||||||
Total events
976
Read events
885
Write events
91
Delete events
0
Modification events
| (PID) Process: | (1784) 01759319.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
| (PID) Process: | (1784) 01759319.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 1 | |||
| (PID) Process: | (3752) Config.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (3752) Config.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81 |
| Operation: | write | Name: | Blob |
Value: 0400000001000000100000008CCADC0B22CEF5BE72AC411A11A8D8120F000000010000001400000085FEF11B4F47FE3952F98301C9F98976FEFEE0CE09000000010000002A000000302806082B0601050507030106082B0601050507030206082B0601050507030406082B0601050507030353000000010000002500000030233021060B6086480186F8450107300130123010060A2B0601040182373C0101030200C01400000001000000140000007B5B45CFAFCECB7AFD31921A6AB6F346EB5748501D00000001000000100000005B3B67000EEB80022E42605B6B3B72400B000000010000000E000000740068006100770074006500000003000000010000001400000091C6D6EE3E8AC86384E548C299295C756C817B81190000000100000010000000DC73F9B71E16D51D26527D32B11A6A3D2000000001000000240400003082042030820308A0030201020210344ED55720D5EDEC49F42FCE37DB2B6D300D06092A864886F70D01010505003081A9310B300906035504061302555331153013060355040A130C7468617774652C20496E632E31283026060355040B131F43657274696669636174696F6E205365727669636573204469766973696F6E31383036060355040B132F2863292032303036207468617774652C20496E632E202D20466F7220617574686F72697A656420757365206F6E6C79311F301D06035504031316746861777465205072696D61727920526F6F74204341301E170D3036313131373030303030305A170D3336303731363233353935395A3081A9310B300906035504061302555331153013060355040A130C7468617774652C20496E632E31283026060355040B131F43657274696669636174696F6E205365727669636573204469766973696F6E31383036060355040B132F2863292032303036207468617774652C20496E632E202D20466F7220617574686F72697A656420757365206F6E6C79311F301D06035504031316746861777465205072696D61727920526F6F7420434130820122300D06092A864886F70D01010105000382010F003082010A0282010100ACA0F0FB8059D49CC7A4CF9DA159730910450C0D2C6E68F16C5B4868495937FC0B3319C2777FCC102D95341CE6EB4D09A71CD2B8C9973602B789D4245F06C0CC4494948D02626FEB5ADD118D289A5C8490107A0DBD74662F6A38A0E2D55444EB1D079F07BA6FEEE9FD4E0B29F53E84A001F19CABF81C7E89A4E8A1D871650DA3517BEEBCD222600DB95B9DDFBAFC515B0BAF98B2E92EE904E86287DE2BC8D74EC14C641EDDCF8758BA4A4FCA68071D1C9D4AC6D52F91CC7C71721CC5C067EB32FDC9925C94DA85C09BBF537D2B09F48C9D911F976A52CBDE0936A477D87B875044D53E6E2969FB3949261E09A5807B402DEBE82785C9FE61FD7EE67C971DD59D0203010001A3423040300F0603551D130101FF040530030101FF300E0603551D0F0101FF040403020106301D0603551D0E041604147B5B45CFAFCECB7AFD31921A6AB6F346EB574850300D06092A864886F70D010105050003820101007911C04BB391B6FCF0E967D40D6E45BE55E893D2CE033FEDDA25B01D57CB1E3A76A04CEC5076E864720CA4A9F1B88BD6D68784BB32E54111C077D9B3609DEB1BD5D16E4444A9A601EC55621D77B85C8E48497C9C3B5711ACAD73378E2F785C906847D96060E6FC073D222017C4F716E9C4D872F9C8737CDF162F15A93EFD6A27B6A1EB5ABA981FD5E34D640A9D13C861BAF5391C87BAB8BD7B227FF6FEAC4079E5AC106F3D8F1B79768BC437B3211884E53600EB632099B9E9FE3304BB41C8C102F94463209E81CE42D3D63F2C76D3639C59DD8FA6E10EA02E41F72E9547CFBCFD33F3F60B617E7E912B8147C22730EEA7105D378F5C392BE404F07B8D568C68 | |||
| (PID) Process: | (4088) Installer.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
| (PID) Process: | (4088) Installer.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 1 | |||
| (PID) Process: | (4088) Installer.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Geni\Insights\Install |
| Operation: | write | Name: | InstallPath |
Value: C:\PROGRAM FILES\Geni\Insights | |||
| (PID) Process: | (4088) Installer.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Geni\Insights\Install |
| Operation: | write | Name: | RunAppPath |
Value: C:\PROGRAM FILES\Geni\Insights\GsAgent.exe | |||
| (PID) Process: | (4088) Installer.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Geni\Insights\Install |
| Operation: | write | Name: | RunAppName |
Value: GsAgent.exe | |||
| (PID) Process: | (4088) Installer.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Geni\Insights\Install |
| Operation: | write | Name: | UpdateAppPath |
Value: C:\PROGRAM FILES\Geni\Insights\XUpdate.exe | |||
Executable files
260
Suspicious files
5
Text files
106
Unknown types
7
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1784 | 01759319.exe | C:\USERS\ADMIN\APPDATA\LOCAL\TEMP\$GNPACK_5DAA0763$\api-ms-win-core-console-l1-1-0.dll | executable | |
MD5:F4604E259459F5A0D5BE6914A6D4C5FB | SHA256:BCE066193FEB60B08EDF4CBEB490AAAA5DFFEB8A63A720CADF948748A9AF4B8F | |||
| 1784 | 01759319.exe | C:\USERS\ADMIN\APPDATA\LOCAL\TEMP\$GNPACK_5DAA0763$\api-ms-win-core-handle-l1-1-0.dll | executable | |
MD5:0A0084D4B3635E4D8EBAB587DCFCC16C | SHA256:5089484C8C56AC8E095CADC3DC971DF71EDEB52F856940632821FD37E81AE5CA | |||
| 1784 | 01759319.exe | C:\USERS\ADMIN\APPDATA\LOCAL\TEMP\$GNPACK_5DAA0763$\api-ms-win-core-file-l2-1-0.dll | executable | |
MD5:AD895B2A99A3EC18F1690BBAC1E2037A | SHA256:A11C772B2451B0C9C706B03381819E4A1DEF3E2FBBBA8362509BBE57DBD5C666 | |||
| 1784 | 01759319.exe | C:\USERS\ADMIN\APPDATA\LOCAL\TEMP\$GNPACK_5DAA0763$\api-ms-win-core-file-l1-2-0.dll | executable | |
MD5:EA4AE42721460002DC31515F295AD1C4 | SHA256:668F91E94E76DB4457184909E6A1AB4655E81A8EF37DC37B4ECFE93146C29A88 | |||
| 1784 | 01759319.exe | C:\USERS\ADMIN\APPDATA\LOCAL\TEMP\$GNPACK_5DAA0763$\GenianINSIGHTS_X86.zip | compressed | |
MD5:B881E5AD1C0BCDEE3E59B5067AA3CE2A | SHA256:0356DF7F7479595C461729F102AEA069B3B47EDFADD01EC6BA764537C08A18C9 | |||
| 1784 | 01759319.exe | C:\USERS\ADMIN\APPDATA\LOCAL\TEMP\$GNPACK_5DAA0763$\api-ms-win-core-debug-l1-1-0.dll | executable | |
MD5:405BB6A7CD56CBF5276C3A8DC631963D | SHA256:F654E56C4299F507BC34271B6BAA29290FD4919B853E17D7470596CAD779F063 | |||
| 1784 | 01759319.exe | C:\USERS\ADMIN\APPDATA\LOCAL\TEMP\$GNPACK_5DAA0763$\api-ms-win-core-heap-l1-1-0.dll | executable | |
MD5:0AEAF9CE58CBD0AF1E30D03B45C21F81 | SHA256:9A5952C82CBCB1A8ECE9C51C258667D9AB96D13EC6455873999FF0BF78C3CAB0 | |||
| 1784 | 01759319.exe | C:\USERS\ADMIN\APPDATA\LOCAL\TEMP\$GNPACK_5DAA0763$\api-ms-win-core-rtlsupport-l1-1-0.dll | executable | |
MD5:0AE94670FBD69ED5F8C923B75CE2C0BD | SHA256:6D541B215CFA452E54DC6AF9317A7FC24043FA465EF2B561E0F245A4870B2705 | |||
| 1784 | 01759319.exe | C:\USERS\ADMIN\APPDATA\LOCAL\TEMP\$GNPACK_5DAA0763$\api-ms-win-core-processenvironment-l1-1-0.dll | executable | |
MD5:87E0EF2D5DF6F6E18E6EA9171E3D77E7 | SHA256:9B5A5536AED84D45A00DA1056AF4762FEC805EABA742C6BF2D2FCA60993711BB | |||
| 1784 | 01759319.exe | C:\USERS\ADMIN\APPDATA\LOCAL\TEMP\$GNPACK_5DAA0763$\api-ms-win-core-processthreads-l1-1-1.dll | executable | |
MD5:F43A8E9CD787B6D91BB29DBB8EB1A4E5 | SHA256:5BACBBE62E36AD0F6D7742E70361F26BC56A44DBD28CC0291F588420E0C218A6 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report