31c9105cef4c122e2a8912913fc2fed070ca600ab3612fe3e76a556708a8d7bc

Analysis

max time kernel
149s
max time network
70s
platform
windows10_x64
resource
win10v20201028
submitted
02-03-2021 17:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

31c9105cef4c122e2a8912913fc2fed070ca600ab3612fe3e76a556708a8d7bc.exe
Size

1.1MB
MD5

ba90cf935cc09c180e3ed1e2869b657c
SHA1

69470ef71d735535a2a9a577c6fbab53b0fe33f6
SHA256

31c9105cef4c122e2a8912913fc2fed070ca600ab3612fe3e76a556708a8d7bc
SHA512

1a18980f9a7edee5ca41fc3e86e7b5fd748224a0c7a95efd016b48372ca0890aa43151e0632df31c1f444da914fe4c98a82b04b7acbdb4dee2b07fe98f3ef506

Score

10^/10

aspackv2 persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

HelpMe.exeregfS

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	HelpMe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	regfS

ASPack v2.12-2.42 6 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
C:\Windows\SysWOW64\HelpMe.exe	aspack_v212_v242
C:\Windows\SysWOW64\HelpMe.exe	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\regfS	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\regfS	aspack_v212_v242
C:\$Recycle.Bin\S-1-5-21-1985363256-3005190890-1182679451-1000\desktop.ini.exe	aspack_v212_v242
C:\AutoRun.exe	aspack_v212_v242

Executes dropped EXE 2 IoCs

Processes:

HelpMe.exeregfS

pid process

1204 HelpMe.exe
1340 regfS

pid	process
1204	HelpMe.exe
1340	regfS

Drops startup file 3 IoCs

Processes:

HelpMe.exeregfS

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	regfS
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

HelpMe.exeregfS

description	ioc	process
File opened (read-only)	\??\X:	HelpMe.exe
File opened (read-only)	\??\Y:	HelpMe.exe
File opened (read-only)	\??\B:	regfS
File opened (read-only)	\??\I:	regfS
File opened (read-only)	\??\N:	regfS
File opened (read-only)	\??\G:	HelpMe.exe
File opened (read-only)	\??\H:	HelpMe.exe
File opened (read-only)	\??\N:	HelpMe.exe
File opened (read-only)	\??\P:	regfS
File opened (read-only)	\??\Z:	regfS
File opened (read-only)	\??\L:	HelpMe.exe
File opened (read-only)	\??\A:	regfS
File opened (read-only)	\??\K:	regfS
File opened (read-only)	\??\R:	HelpMe.exe
File opened (read-only)	\??\J:	regfS
File opened (read-only)	\??\M:	regfS
File opened (read-only)	\??\A:	HelpMe.exe
File opened (read-only)	\??\K:	HelpMe.exe
File opened (read-only)	\??\M:	HelpMe.exe
File opened (read-only)	\??\U:	regfS
File opened (read-only)	\??\J:	HelpMe.exe
File opened (read-only)	\??\V:	HelpMe.exe
File opened (read-only)	\??\Z:	HelpMe.exe
File opened (read-only)	\??\H:	regfS
File opened (read-only)	\??\W:	regfS
File opened (read-only)	\??\Y:	regfS
File opened (read-only)	\??\E:	HelpMe.exe
File opened (read-only)	\??\F:	HelpMe.exe
File opened (read-only)	\??\Q:	HelpMe.exe
File opened (read-only)	\??\T:	regfS
File opened (read-only)	\??\V:	regfS
File opened (read-only)	\??\X:	regfS
File opened (read-only)	\??\I:	HelpMe.exe
File opened (read-only)	\??\E:	regfS
File opened (read-only)	\??\L:	regfS
File opened (read-only)	\??\U:	HelpMe.exe
File opened (read-only)	\??\R:	regfS
File opened (read-only)	\??\S:	HelpMe.exe
File opened (read-only)	\??\T:	HelpMe.exe
File opened (read-only)	\??\W:	HelpMe.exe
File opened (read-only)	\??\F:	regfS
File opened (read-only)	\??\G:	regfS
File opened (read-only)	\??\B:	HelpMe.exe
File opened (read-only)	\??\O:	HelpMe.exe
File opened (read-only)	\??\P:	HelpMe.exe
File opened (read-only)	\??\O:	regfS
File opened (read-only)	\??\Q:	regfS
File opened (read-only)	\??\S:	regfS

Drops autorun.inf file 1 TTPs
Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media
T1091

Drops file in System32 directory 5 IoCs

Processes:

31c9105cef4c122e2a8912913fc2fed070ca600ab3612fe3e76a556708a8d7bc.exeHelpMe.exeregfS

description	ioc	process
File created	C:\Windows\SysWOW64\HelpMe.exe	31c9105cef4c122e2a8912913fc2fed070ca600ab3612fe3e76a556708a8d7bc.exe
File created	C:\Windows\SysWOW64\HelpMe.exe	HelpMe.exe
File created	C:\Windows\SysWOW64\HelpMe.exe	regfS
File opened for modification	C:\Windows\SysWOW64\HelpMe.exe	31c9105cef4c122e2a8912913fc2fed070ca600ab3612fe3e76a556708a8d7bc.exe
File created	C:\Windows\SysWOW64\notepad.exe.exe	31c9105cef4c122e2a8912913fc2fed070ca600ab3612fe3e76a556708a8d7bc.exe

Drops file in Program Files directory 1 IoCs

Processes:

31c9105cef4c122e2a8912913fc2fed070ca600ab3612fe3e76a556708a8d7bc.exe

description	ioc	process
File created	C:\Program Files (x86)\Internet Explorer\iexplore.exe.exe	31c9105cef4c122e2a8912913fc2fed070ca600ab3612fe3e76a556708a8d7bc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

31c9105cef4c122e2a8912913fc2fed070ca600ab3612fe3e76a556708a8d7bc.exe

pid	process
1456	31c9105cef4c122e2a8912913fc2fed070ca600ab3612fe3e76a556708a8d7bc.exe
1456	31c9105cef4c122e2a8912913fc2fed070ca600ab3612fe3e76a556708a8d7bc.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

31c9105cef4c122e2a8912913fc2fed070ca600ab3612fe3e76a556708a8d7bc.exe

description	pid	process	target process
PID 1456 wrote to memory of 1204	1456	31c9105cef4c122e2a8912913fc2fed070ca600ab3612fe3e76a556708a8d7bc.exe	HelpMe.exe
PID 1456 wrote to memory of 1204	1456	31c9105cef4c122e2a8912913fc2fed070ca600ab3612fe3e76a556708a8d7bc.exe	HelpMe.exe
PID 1456 wrote to memory of 1204	1456	31c9105cef4c122e2a8912913fc2fed070ca600ab3612fe3e76a556708a8d7bc.exe	HelpMe.exe
PID 1456 wrote to memory of 1340	1456	31c9105cef4c122e2a8912913fc2fed070ca600ab3612fe3e76a556708a8d7bc.exe	regfS
PID 1456 wrote to memory of 1340	1456	31c9105cef4c122e2a8912913fc2fed070ca600ab3612fe3e76a556708a8d7bc.exe	regfS
PID 1456 wrote to memory of 1340	1456	31c9105cef4c122e2a8912913fc2fed070ca600ab3612fe3e76a556708a8d7bc.exe	regfS

C:\Users\Admin\AppData\Local\Temp\31c9105cef4c122e2a8912913fc2fed070ca600ab3612fe3e76a556708a8d7bc.exe
"C:\Users\Admin\AppData\Local\Temp\31c9105cef4c122e2a8912913fc2fed070ca600ab3612fe3e76a556708a8d7bc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1456

C:\Windows\SysWOW64\HelpMe.exe
C:\Windows\system32\HelpMe.exe
2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Drops startup file
- Enumerates connected drives
- Drops file in System32 directory
PID:1204

C:\Users\Admin\AppData\Local\Temp\regfS
C:\Users\Admin\AppData\Local\Temp\\regfS
2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Drops startup file
- Enumerates connected drives
- Drops file in System32 directory
PID:1340

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1985363256-3005190890-1182679451-1000\desktop.ini.exe
MD5
48d901b175208b5644527950914457e7

SHA1
87d4370c6f7567e895cf362f5512578f1c537761

SHA256
5ce3b59dd3f3dfb0cf1e9605a94feea8e9bb0a68e60c9d52932109bdd849d5ff

SHA512
184b997633d2e02d7401e587e2c06b776b9689b2f735d4e3431c931dae7954b344813db5716c3e8d13074e5d2beb201d38dd2533b08da5a1a999eee44889f1d3

Download Submit
C:\AutoRun.exe
MD5
9395d6a1936ba1055c02510b825db59f

SHA1
c2bcc3702cea6c2caccf7b02280043eac0aad7c4

SHA256
5e65590b0fdb3ab446f5d0fb1f55cc5286181566165e709b2ba134c79ed0118c

SHA512
adf2cc9b770ce9ebc8aa47d29dc56ae6b0031c744065d4f3157b3ebec69369306723937e44d2b1deb3864018922805918b39d9451400591e08bc537564080d46

Download Submit
C:\Users\Admin\AppData\Local\Temp\regfS
MD5
ba90cf935cc09c180e3ed1e2869b657c

SHA1
69470ef71d735535a2a9a577c6fbab53b0fe33f6

SHA256
31c9105cef4c122e2a8912913fc2fed070ca600ab3612fe3e76a556708a8d7bc

SHA512
1a18980f9a7edee5ca41fc3e86e7b5fd748224a0c7a95efd016b48372ca0890aa43151e0632df31c1f444da914fe4c98a82b04b7acbdb4dee2b07fe98f3ef506

Download Submit
C:\Users\Admin\AppData\Local\Temp\regfS
MD5
ba90cf935cc09c180e3ed1e2869b657c

SHA1
69470ef71d735535a2a9a577c6fbab53b0fe33f6

SHA256
31c9105cef4c122e2a8912913fc2fed070ca600ab3612fe3e76a556708a8d7bc

SHA512
1a18980f9a7edee5ca41fc3e86e7b5fd748224a0c7a95efd016b48372ca0890aa43151e0632df31c1f444da914fe4c98a82b04b7acbdb4dee2b07fe98f3ef506

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
4c6bc30594192aee1c07b24bbc466f4d

SHA1
e2776d598f81633237b68a10eab21e128b0f3bcc

SHA256
eedba8dcd8e696529c09ced1bc3dfaf888522722c9b9bdb4a56494559bfd5235

SHA512
fdfa5b2c7f489faa891bebe9430a941d0e6ea45a6c98c36b9e4e1103391458075475a3893e736dfffa106ecc61786c81810afda0e7a0a7eee4400e61da68c737

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
afcd8a3dce301ffe5072dbc755d31db7

SHA1
15a59d7ccef94fdef567449ce8da334074155366

SHA256
38e37e8d1cc0bf8f2a7ea490b808c2ddee49461dee1e7e51ee229eda7d67d570

SHA512
8f0d8989778228112a42a8df0a245ad0807b50592185b5805f36804f3bb6946b9712101529b06240abc2edb5aeacbdcff25bcf7c78f1ccd9b604a78fa1c5baba

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
4c6bc30594192aee1c07b24bbc466f4d

SHA1
e2776d598f81633237b68a10eab21e128b0f3bcc

SHA256
eedba8dcd8e696529c09ced1bc3dfaf888522722c9b9bdb4a56494559bfd5235

SHA512
fdfa5b2c7f489faa891bebe9430a941d0e6ea45a6c98c36b9e4e1103391458075475a3893e736dfffa106ecc61786c81810afda0e7a0a7eee4400e61da68c737

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
afcd8a3dce301ffe5072dbc755d31db7

SHA1
15a59d7ccef94fdef567449ce8da334074155366

SHA256
38e37e8d1cc0bf8f2a7ea490b808c2ddee49461dee1e7e51ee229eda7d67d570

SHA512
8f0d8989778228112a42a8df0a245ad0807b50592185b5805f36804f3bb6946b9712101529b06240abc2edb5aeacbdcff25bcf7c78f1ccd9b604a78fa1c5baba

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
4c6bc30594192aee1c07b24bbc466f4d

SHA1
e2776d598f81633237b68a10eab21e128b0f3bcc

SHA256
eedba8dcd8e696529c09ced1bc3dfaf888522722c9b9bdb4a56494559bfd5235

SHA512
fdfa5b2c7f489faa891bebe9430a941d0e6ea45a6c98c36b9e4e1103391458075475a3893e736dfffa106ecc61786c81810afda0e7a0a7eee4400e61da68c737

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
afcd8a3dce301ffe5072dbc755d31db7

SHA1
15a59d7ccef94fdef567449ce8da334074155366

SHA256
38e37e8d1cc0bf8f2a7ea490b808c2ddee49461dee1e7e51ee229eda7d67d570

SHA512
8f0d8989778228112a42a8df0a245ad0807b50592185b5805f36804f3bb6946b9712101529b06240abc2edb5aeacbdcff25bcf7c78f1ccd9b604a78fa1c5baba

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
4c6bc30594192aee1c07b24bbc466f4d

SHA1
e2776d598f81633237b68a10eab21e128b0f3bcc

SHA256
eedba8dcd8e696529c09ced1bc3dfaf888522722c9b9bdb4a56494559bfd5235

SHA512
fdfa5b2c7f489faa891bebe9430a941d0e6ea45a6c98c36b9e4e1103391458075475a3893e736dfffa106ecc61786c81810afda0e7a0a7eee4400e61da68c737

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
afcd8a3dce301ffe5072dbc755d31db7

SHA1
15a59d7ccef94fdef567449ce8da334074155366

SHA256
38e37e8d1cc0bf8f2a7ea490b808c2ddee49461dee1e7e51ee229eda7d67d570

SHA512
8f0d8989778228112a42a8df0a245ad0807b50592185b5805f36804f3bb6946b9712101529b06240abc2edb5aeacbdcff25bcf7c78f1ccd9b604a78fa1c5baba

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
4c6bc30594192aee1c07b24bbc466f4d

SHA1
e2776d598f81633237b68a10eab21e128b0f3bcc

SHA256
eedba8dcd8e696529c09ced1bc3dfaf888522722c9b9bdb4a56494559bfd5235

SHA512
fdfa5b2c7f489faa891bebe9430a941d0e6ea45a6c98c36b9e4e1103391458075475a3893e736dfffa106ecc61786c81810afda0e7a0a7eee4400e61da68c737

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
afcd8a3dce301ffe5072dbc755d31db7

SHA1
15a59d7ccef94fdef567449ce8da334074155366

SHA256
38e37e8d1cc0bf8f2a7ea490b808c2ddee49461dee1e7e51ee229eda7d67d570

SHA512
8f0d8989778228112a42a8df0a245ad0807b50592185b5805f36804f3bb6946b9712101529b06240abc2edb5aeacbdcff25bcf7c78f1ccd9b604a78fa1c5baba

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
4c6bc30594192aee1c07b24bbc466f4d

SHA1
e2776d598f81633237b68a10eab21e128b0f3bcc

SHA256
eedba8dcd8e696529c09ced1bc3dfaf888522722c9b9bdb4a56494559bfd5235

SHA512
fdfa5b2c7f489faa891bebe9430a941d0e6ea45a6c98c36b9e4e1103391458075475a3893e736dfffa106ecc61786c81810afda0e7a0a7eee4400e61da68c737

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
afcd8a3dce301ffe5072dbc755d31db7

SHA1
15a59d7ccef94fdef567449ce8da334074155366

SHA256
38e37e8d1cc0bf8f2a7ea490b808c2ddee49461dee1e7e51ee229eda7d67d570

SHA512
8f0d8989778228112a42a8df0a245ad0807b50592185b5805f36804f3bb6946b9712101529b06240abc2edb5aeacbdcff25bcf7c78f1ccd9b604a78fa1c5baba

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
4c6bc30594192aee1c07b24bbc466f4d

SHA1
e2776d598f81633237b68a10eab21e128b0f3bcc

SHA256
eedba8dcd8e696529c09ced1bc3dfaf888522722c9b9bdb4a56494559bfd5235

SHA512
fdfa5b2c7f489faa891bebe9430a941d0e6ea45a6c98c36b9e4e1103391458075475a3893e736dfffa106ecc61786c81810afda0e7a0a7eee4400e61da68c737

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
afcd8a3dce301ffe5072dbc755d31db7

SHA1
15a59d7ccef94fdef567449ce8da334074155366

SHA256
38e37e8d1cc0bf8f2a7ea490b808c2ddee49461dee1e7e51ee229eda7d67d570

SHA512
8f0d8989778228112a42a8df0a245ad0807b50592185b5805f36804f3bb6946b9712101529b06240abc2edb5aeacbdcff25bcf7c78f1ccd9b604a78fa1c5baba

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
4c6bc30594192aee1c07b24bbc466f4d

SHA1
e2776d598f81633237b68a10eab21e128b0f3bcc

SHA256
eedba8dcd8e696529c09ced1bc3dfaf888522722c9b9bdb4a56494559bfd5235

SHA512
fdfa5b2c7f489faa891bebe9430a941d0e6ea45a6c98c36b9e4e1103391458075475a3893e736dfffa106ecc61786c81810afda0e7a0a7eee4400e61da68c737

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
afcd8a3dce301ffe5072dbc755d31db7

SHA1
15a59d7ccef94fdef567449ce8da334074155366

SHA256
38e37e8d1cc0bf8f2a7ea490b808c2ddee49461dee1e7e51ee229eda7d67d570

SHA512
8f0d8989778228112a42a8df0a245ad0807b50592185b5805f36804f3bb6946b9712101529b06240abc2edb5aeacbdcff25bcf7c78f1ccd9b604a78fa1c5baba

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
4c6bc30594192aee1c07b24bbc466f4d

SHA1
e2776d598f81633237b68a10eab21e128b0f3bcc

SHA256
eedba8dcd8e696529c09ced1bc3dfaf888522722c9b9bdb4a56494559bfd5235

SHA512
fdfa5b2c7f489faa891bebe9430a941d0e6ea45a6c98c36b9e4e1103391458075475a3893e736dfffa106ecc61786c81810afda0e7a0a7eee4400e61da68c737

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
afcd8a3dce301ffe5072dbc755d31db7

SHA1
15a59d7ccef94fdef567449ce8da334074155366

SHA256
38e37e8d1cc0bf8f2a7ea490b808c2ddee49461dee1e7e51ee229eda7d67d570

SHA512
8f0d8989778228112a42a8df0a245ad0807b50592185b5805f36804f3bb6946b9712101529b06240abc2edb5aeacbdcff25bcf7c78f1ccd9b604a78fa1c5baba

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
4c6bc30594192aee1c07b24bbc466f4d

SHA1
e2776d598f81633237b68a10eab21e128b0f3bcc

SHA256
eedba8dcd8e696529c09ced1bc3dfaf888522722c9b9bdb4a56494559bfd5235

SHA512
fdfa5b2c7f489faa891bebe9430a941d0e6ea45a6c98c36b9e4e1103391458075475a3893e736dfffa106ecc61786c81810afda0e7a0a7eee4400e61da68c737

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
afcd8a3dce301ffe5072dbc755d31db7

SHA1
15a59d7ccef94fdef567449ce8da334074155366

SHA256
38e37e8d1cc0bf8f2a7ea490b808c2ddee49461dee1e7e51ee229eda7d67d570

SHA512
8f0d8989778228112a42a8df0a245ad0807b50592185b5805f36804f3bb6946b9712101529b06240abc2edb5aeacbdcff25bcf7c78f1ccd9b604a78fa1c5baba

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
4c6bc30594192aee1c07b24bbc466f4d

SHA1
e2776d598f81633237b68a10eab21e128b0f3bcc

SHA256
eedba8dcd8e696529c09ced1bc3dfaf888522722c9b9bdb4a56494559bfd5235

SHA512
fdfa5b2c7f489faa891bebe9430a941d0e6ea45a6c98c36b9e4e1103391458075475a3893e736dfffa106ecc61786c81810afda0e7a0a7eee4400e61da68c737

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
afcd8a3dce301ffe5072dbc755d31db7

SHA1
15a59d7ccef94fdef567449ce8da334074155366

SHA256
38e37e8d1cc0bf8f2a7ea490b808c2ddee49461dee1e7e51ee229eda7d67d570

SHA512
8f0d8989778228112a42a8df0a245ad0807b50592185b5805f36804f3bb6946b9712101529b06240abc2edb5aeacbdcff25bcf7c78f1ccd9b604a78fa1c5baba

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
4c6bc30594192aee1c07b24bbc466f4d

SHA1
e2776d598f81633237b68a10eab21e128b0f3bcc

SHA256
eedba8dcd8e696529c09ced1bc3dfaf888522722c9b9bdb4a56494559bfd5235

SHA512
fdfa5b2c7f489faa891bebe9430a941d0e6ea45a6c98c36b9e4e1103391458075475a3893e736dfffa106ecc61786c81810afda0e7a0a7eee4400e61da68c737

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
afcd8a3dce301ffe5072dbc755d31db7

SHA1
15a59d7ccef94fdef567449ce8da334074155366

SHA256
38e37e8d1cc0bf8f2a7ea490b808c2ddee49461dee1e7e51ee229eda7d67d570

SHA512
8f0d8989778228112a42a8df0a245ad0807b50592185b5805f36804f3bb6946b9712101529b06240abc2edb5aeacbdcff25bcf7c78f1ccd9b604a78fa1c5baba

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
4c6bc30594192aee1c07b24bbc466f4d

SHA1
e2776d598f81633237b68a10eab21e128b0f3bcc

SHA256
eedba8dcd8e696529c09ced1bc3dfaf888522722c9b9bdb4a56494559bfd5235

SHA512
fdfa5b2c7f489faa891bebe9430a941d0e6ea45a6c98c36b9e4e1103391458075475a3893e736dfffa106ecc61786c81810afda0e7a0a7eee4400e61da68c737

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
afcd8a3dce301ffe5072dbc755d31db7

SHA1
15a59d7ccef94fdef567449ce8da334074155366

SHA256
38e37e8d1cc0bf8f2a7ea490b808c2ddee49461dee1e7e51ee229eda7d67d570

SHA512
8f0d8989778228112a42a8df0a245ad0807b50592185b5805f36804f3bb6946b9712101529b06240abc2edb5aeacbdcff25bcf7c78f1ccd9b604a78fa1c5baba

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
4c6bc30594192aee1c07b24bbc466f4d

SHA1
e2776d598f81633237b68a10eab21e128b0f3bcc

SHA256
eedba8dcd8e696529c09ced1bc3dfaf888522722c9b9bdb4a56494559bfd5235

SHA512
fdfa5b2c7f489faa891bebe9430a941d0e6ea45a6c98c36b9e4e1103391458075475a3893e736dfffa106ecc61786c81810afda0e7a0a7eee4400e61da68c737

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
afcd8a3dce301ffe5072dbc755d31db7

SHA1
15a59d7ccef94fdef567449ce8da334074155366

SHA256
38e37e8d1cc0bf8f2a7ea490b808c2ddee49461dee1e7e51ee229eda7d67d570

SHA512
8f0d8989778228112a42a8df0a245ad0807b50592185b5805f36804f3bb6946b9712101529b06240abc2edb5aeacbdcff25bcf7c78f1ccd9b604a78fa1c5baba

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
4c6bc30594192aee1c07b24bbc466f4d

SHA1
e2776d598f81633237b68a10eab21e128b0f3bcc

SHA256
eedba8dcd8e696529c09ced1bc3dfaf888522722c9b9bdb4a56494559bfd5235

SHA512
fdfa5b2c7f489faa891bebe9430a941d0e6ea45a6c98c36b9e4e1103391458075475a3893e736dfffa106ecc61786c81810afda0e7a0a7eee4400e61da68c737

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
afcd8a3dce301ffe5072dbc755d31db7

SHA1
15a59d7ccef94fdef567449ce8da334074155366

SHA256
38e37e8d1cc0bf8f2a7ea490b808c2ddee49461dee1e7e51ee229eda7d67d570

SHA512
8f0d8989778228112a42a8df0a245ad0807b50592185b5805f36804f3bb6946b9712101529b06240abc2edb5aeacbdcff25bcf7c78f1ccd9b604a78fa1c5baba

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
4c6bc30594192aee1c07b24bbc466f4d

SHA1
e2776d598f81633237b68a10eab21e128b0f3bcc

SHA256
eedba8dcd8e696529c09ced1bc3dfaf888522722c9b9bdb4a56494559bfd5235

SHA512
fdfa5b2c7f489faa891bebe9430a941d0e6ea45a6c98c36b9e4e1103391458075475a3893e736dfffa106ecc61786c81810afda0e7a0a7eee4400e61da68c737

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
afcd8a3dce301ffe5072dbc755d31db7

SHA1
15a59d7ccef94fdef567449ce8da334074155366

SHA256
38e37e8d1cc0bf8f2a7ea490b808c2ddee49461dee1e7e51ee229eda7d67d570

SHA512
8f0d8989778228112a42a8df0a245ad0807b50592185b5805f36804f3bb6946b9712101529b06240abc2edb5aeacbdcff25bcf7c78f1ccd9b604a78fa1c5baba

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
4c6bc30594192aee1c07b24bbc466f4d

SHA1
e2776d598f81633237b68a10eab21e128b0f3bcc

SHA256
eedba8dcd8e696529c09ced1bc3dfaf888522722c9b9bdb4a56494559bfd5235

SHA512
fdfa5b2c7f489faa891bebe9430a941d0e6ea45a6c98c36b9e4e1103391458075475a3893e736dfffa106ecc61786c81810afda0e7a0a7eee4400e61da68c737

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
afcd8a3dce301ffe5072dbc755d31db7

SHA1
15a59d7ccef94fdef567449ce8da334074155366

SHA256
38e37e8d1cc0bf8f2a7ea490b808c2ddee49461dee1e7e51ee229eda7d67d570

SHA512
8f0d8989778228112a42a8df0a245ad0807b50592185b5805f36804f3bb6946b9712101529b06240abc2edb5aeacbdcff25bcf7c78f1ccd9b604a78fa1c5baba

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
4c6bc30594192aee1c07b24bbc466f4d

SHA1
e2776d598f81633237b68a10eab21e128b0f3bcc

SHA256
eedba8dcd8e696529c09ced1bc3dfaf888522722c9b9bdb4a56494559bfd5235

SHA512
fdfa5b2c7f489faa891bebe9430a941d0e6ea45a6c98c36b9e4e1103391458075475a3893e736dfffa106ecc61786c81810afda0e7a0a7eee4400e61da68c737

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
afcd8a3dce301ffe5072dbc755d31db7

SHA1
15a59d7ccef94fdef567449ce8da334074155366

SHA256
38e37e8d1cc0bf8f2a7ea490b808c2ddee49461dee1e7e51ee229eda7d67d570

SHA512
8f0d8989778228112a42a8df0a245ad0807b50592185b5805f36804f3bb6946b9712101529b06240abc2edb5aeacbdcff25bcf7c78f1ccd9b604a78fa1c5baba

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
4c6bc30594192aee1c07b24bbc466f4d

SHA1
e2776d598f81633237b68a10eab21e128b0f3bcc

SHA256
eedba8dcd8e696529c09ced1bc3dfaf888522722c9b9bdb4a56494559bfd5235

SHA512
fdfa5b2c7f489faa891bebe9430a941d0e6ea45a6c98c36b9e4e1103391458075475a3893e736dfffa106ecc61786c81810afda0e7a0a7eee4400e61da68c737

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
afcd8a3dce301ffe5072dbc755d31db7

SHA1
15a59d7ccef94fdef567449ce8da334074155366

SHA256
38e37e8d1cc0bf8f2a7ea490b808c2ddee49461dee1e7e51ee229eda7d67d570

SHA512
8f0d8989778228112a42a8df0a245ad0807b50592185b5805f36804f3bb6946b9712101529b06240abc2edb5aeacbdcff25bcf7c78f1ccd9b604a78fa1c5baba

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
4c6bc30594192aee1c07b24bbc466f4d

SHA1
e2776d598f81633237b68a10eab21e128b0f3bcc

SHA256
eedba8dcd8e696529c09ced1bc3dfaf888522722c9b9bdb4a56494559bfd5235

SHA512
fdfa5b2c7f489faa891bebe9430a941d0e6ea45a6c98c36b9e4e1103391458075475a3893e736dfffa106ecc61786c81810afda0e7a0a7eee4400e61da68c737

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
afcd8a3dce301ffe5072dbc755d31db7

SHA1
15a59d7ccef94fdef567449ce8da334074155366

SHA256
38e37e8d1cc0bf8f2a7ea490b808c2ddee49461dee1e7e51ee229eda7d67d570

SHA512
8f0d8989778228112a42a8df0a245ad0807b50592185b5805f36804f3bb6946b9712101529b06240abc2edb5aeacbdcff25bcf7c78f1ccd9b604a78fa1c5baba

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
4c6bc30594192aee1c07b24bbc466f4d

SHA1
e2776d598f81633237b68a10eab21e128b0f3bcc

SHA256
eedba8dcd8e696529c09ced1bc3dfaf888522722c9b9bdb4a56494559bfd5235

SHA512
fdfa5b2c7f489faa891bebe9430a941d0e6ea45a6c98c36b9e4e1103391458075475a3893e736dfffa106ecc61786c81810afda0e7a0a7eee4400e61da68c737

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
afcd8a3dce301ffe5072dbc755d31db7

SHA1
15a59d7ccef94fdef567449ce8da334074155366

SHA256
38e37e8d1cc0bf8f2a7ea490b808c2ddee49461dee1e7e51ee229eda7d67d570

SHA512
8f0d8989778228112a42a8df0a245ad0807b50592185b5805f36804f3bb6946b9712101529b06240abc2edb5aeacbdcff25bcf7c78f1ccd9b604a78fa1c5baba

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
4c6bc30594192aee1c07b24bbc466f4d

SHA1
e2776d598f81633237b68a10eab21e128b0f3bcc

SHA256
eedba8dcd8e696529c09ced1bc3dfaf888522722c9b9bdb4a56494559bfd5235

SHA512
fdfa5b2c7f489faa891bebe9430a941d0e6ea45a6c98c36b9e4e1103391458075475a3893e736dfffa106ecc61786c81810afda0e7a0a7eee4400e61da68c737

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
afcd8a3dce301ffe5072dbc755d31db7

SHA1
15a59d7ccef94fdef567449ce8da334074155366

SHA256
38e37e8d1cc0bf8f2a7ea490b808c2ddee49461dee1e7e51ee229eda7d67d570

SHA512
8f0d8989778228112a42a8df0a245ad0807b50592185b5805f36804f3bb6946b9712101529b06240abc2edb5aeacbdcff25bcf7c78f1ccd9b604a78fa1c5baba

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
4c6bc30594192aee1c07b24bbc466f4d

SHA1
e2776d598f81633237b68a10eab21e128b0f3bcc

SHA256
eedba8dcd8e696529c09ced1bc3dfaf888522722c9b9bdb4a56494559bfd5235

SHA512
fdfa5b2c7f489faa891bebe9430a941d0e6ea45a6c98c36b9e4e1103391458075475a3893e736dfffa106ecc61786c81810afda0e7a0a7eee4400e61da68c737

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
afcd8a3dce301ffe5072dbc755d31db7

SHA1
15a59d7ccef94fdef567449ce8da334074155366

SHA256
38e37e8d1cc0bf8f2a7ea490b808c2ddee49461dee1e7e51ee229eda7d67d570

SHA512
8f0d8989778228112a42a8df0a245ad0807b50592185b5805f36804f3bb6946b9712101529b06240abc2edb5aeacbdcff25bcf7c78f1ccd9b604a78fa1c5baba

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
4c6bc30594192aee1c07b24bbc466f4d

SHA1
e2776d598f81633237b68a10eab21e128b0f3bcc

SHA256
eedba8dcd8e696529c09ced1bc3dfaf888522722c9b9bdb4a56494559bfd5235

SHA512
fdfa5b2c7f489faa891bebe9430a941d0e6ea45a6c98c36b9e4e1103391458075475a3893e736dfffa106ecc61786c81810afda0e7a0a7eee4400e61da68c737

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
afcd8a3dce301ffe5072dbc755d31db7

SHA1
15a59d7ccef94fdef567449ce8da334074155366

SHA256
38e37e8d1cc0bf8f2a7ea490b808c2ddee49461dee1e7e51ee229eda7d67d570

SHA512
8f0d8989778228112a42a8df0a245ad0807b50592185b5805f36804f3bb6946b9712101529b06240abc2edb5aeacbdcff25bcf7c78f1ccd9b604a78fa1c5baba

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
4c6bc30594192aee1c07b24bbc466f4d

SHA1
e2776d598f81633237b68a10eab21e128b0f3bcc

SHA256
eedba8dcd8e696529c09ced1bc3dfaf888522722c9b9bdb4a56494559bfd5235

SHA512
fdfa5b2c7f489faa891bebe9430a941d0e6ea45a6c98c36b9e4e1103391458075475a3893e736dfffa106ecc61786c81810afda0e7a0a7eee4400e61da68c737

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
afcd8a3dce301ffe5072dbc755d31db7

SHA1
15a59d7ccef94fdef567449ce8da334074155366

SHA256
38e37e8d1cc0bf8f2a7ea490b808c2ddee49461dee1e7e51ee229eda7d67d570

SHA512
8f0d8989778228112a42a8df0a245ad0807b50592185b5805f36804f3bb6946b9712101529b06240abc2edb5aeacbdcff25bcf7c78f1ccd9b604a78fa1c5baba

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
4c6bc30594192aee1c07b24bbc466f4d

SHA1
e2776d598f81633237b68a10eab21e128b0f3bcc

SHA256
eedba8dcd8e696529c09ced1bc3dfaf888522722c9b9bdb4a56494559bfd5235

SHA512
fdfa5b2c7f489faa891bebe9430a941d0e6ea45a6c98c36b9e4e1103391458075475a3893e736dfffa106ecc61786c81810afda0e7a0a7eee4400e61da68c737

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
afcd8a3dce301ffe5072dbc755d31db7

SHA1
15a59d7ccef94fdef567449ce8da334074155366

SHA256
38e37e8d1cc0bf8f2a7ea490b808c2ddee49461dee1e7e51ee229eda7d67d570

SHA512
8f0d8989778228112a42a8df0a245ad0807b50592185b5805f36804f3bb6946b9712101529b06240abc2edb5aeacbdcff25bcf7c78f1ccd9b604a78fa1c5baba

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
4c6bc30594192aee1c07b24bbc466f4d

SHA1
e2776d598f81633237b68a10eab21e128b0f3bcc

SHA256
eedba8dcd8e696529c09ced1bc3dfaf888522722c9b9bdb4a56494559bfd5235

SHA512
fdfa5b2c7f489faa891bebe9430a941d0e6ea45a6c98c36b9e4e1103391458075475a3893e736dfffa106ecc61786c81810afda0e7a0a7eee4400e61da68c737

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
afcd8a3dce301ffe5072dbc755d31db7

SHA1
15a59d7ccef94fdef567449ce8da334074155366

SHA256
38e37e8d1cc0bf8f2a7ea490b808c2ddee49461dee1e7e51ee229eda7d67d570

SHA512
8f0d8989778228112a42a8df0a245ad0807b50592185b5805f36804f3bb6946b9712101529b06240abc2edb5aeacbdcff25bcf7c78f1ccd9b604a78fa1c5baba

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
4c6bc30594192aee1c07b24bbc466f4d

SHA1
e2776d598f81633237b68a10eab21e128b0f3bcc

SHA256
eedba8dcd8e696529c09ced1bc3dfaf888522722c9b9bdb4a56494559bfd5235

SHA512
fdfa5b2c7f489faa891bebe9430a941d0e6ea45a6c98c36b9e4e1103391458075475a3893e736dfffa106ecc61786c81810afda0e7a0a7eee4400e61da68c737

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
afcd8a3dce301ffe5072dbc755d31db7

SHA1
15a59d7ccef94fdef567449ce8da334074155366

SHA256
38e37e8d1cc0bf8f2a7ea490b808c2ddee49461dee1e7e51ee229eda7d67d570

SHA512
8f0d8989778228112a42a8df0a245ad0807b50592185b5805f36804f3bb6946b9712101529b06240abc2edb5aeacbdcff25bcf7c78f1ccd9b604a78fa1c5baba

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
4c6bc30594192aee1c07b24bbc466f4d

SHA1
e2776d598f81633237b68a10eab21e128b0f3bcc

SHA256
eedba8dcd8e696529c09ced1bc3dfaf888522722c9b9bdb4a56494559bfd5235

SHA512
fdfa5b2c7f489faa891bebe9430a941d0e6ea45a6c98c36b9e4e1103391458075475a3893e736dfffa106ecc61786c81810afda0e7a0a7eee4400e61da68c737

Download Submit
C:\Windows\SysWOW64\HelpMe.exe
MD5
9395d6a1936ba1055c02510b825db59f

SHA1
c2bcc3702cea6c2caccf7b02280043eac0aad7c4

SHA256
5e65590b0fdb3ab446f5d0fb1f55cc5286181566165e709b2ba134c79ed0118c

SHA512
adf2cc9b770ce9ebc8aa47d29dc56ae6b0031c744065d4f3157b3ebec69369306723937e44d2b1deb3864018922805918b39d9451400591e08bc537564080d46

Download Submit
C:\Windows\SysWOW64\HelpMe.exe
MD5
9395d6a1936ba1055c02510b825db59f

SHA1
c2bcc3702cea6c2caccf7b02280043eac0aad7c4

SHA256
5e65590b0fdb3ab446f5d0fb1f55cc5286181566165e709b2ba134c79ed0118c

SHA512
adf2cc9b770ce9ebc8aa47d29dc56ae6b0031c744065d4f3157b3ebec69369306723937e44d2b1deb3864018922805918b39d9451400591e08bc537564080d46

Download Submit
memory/1204-2-0x0000000000000000-mapping.dmp

Download
memory/1204-6-0x00000000004C0000-0x00000000004C1000-memory.dmp

Filesize
4KB

Download
memory/1340-7-0x0000000000000000-mapping.dmp

Download
memory/1340-12-0x00000000006E0000-0x00000000006E1000-memory.dmp

Filesize
4KB

Download
memory/1456-5-0x0000000000710000-0x0000000000711000-memory.dmp

Filesize
4KB

Download
memory/1456-10-0x0000000002940000-0x0000000002941000-memory.dmp

Filesize
4KB

Download
memory/1456-11-0x0000000003140000-0x0000000003141000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads