4758ce7fdf81da687b6cea9748f45fa3f31b5d9c11b4bc886dc389149b25c422

General

Target

4758ce7fdf81da687b6cea9748f45fa3f31b5d9c11b4bc886dc389149b25c422.exe
Size

128KB
MD5

2ab1b19ae34c99354bab69025bf5f3a0
SHA1

91bc941313140c00eaead07f799f312eee5bc82d
SHA256

4758ce7fdf81da687b6cea9748f45fa3f31b5d9c11b4bc886dc389149b25c422
SHA512

43438cfd47f5412158e9bb5ab79bd3220bf47f4f6b3fbb19c76160253089cd9142c89b06e19e6b0e8a7e07e374ffdb1768030a27a5725af36289421beb82b7e3
SSDEEP

1536:G7kkbuIXVHKTU097h9QKz7SFlc4IE3IezPoVtTqtFyUoHnkHUS65BciuJ3mnXYt:akkbugKTU0bGKXmWAojqbdBJ2It

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

4758ce7fdf81da687b6cea9748f45fa3f31b5d9c11b4bc886dc389149b25c422.exefhmuap.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	4758ce7fdf81da687b6cea9748f45fa3f31b5d9c11b4bc886dc389149b25c422.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	fhmuap.exe

Executes dropped EXE 1 IoCs

Processes:

fhmuap.exe

pid process

2000 fhmuap.exe

pid	process
2000	fhmuap.exe

Loads dropped DLL 2 IoCs

Processes:

4758ce7fdf81da687b6cea9748f45fa3f31b5d9c11b4bc886dc389149b25c422.exe

pid	process
2036	4758ce7fdf81da687b6cea9748f45fa3f31b5d9c11b4bc886dc389149b25c422.exe
2036	4758ce7fdf81da687b6cea9748f45fa3f31b5d9c11b4bc886dc389149b25c422.exe

Adds Run key to start application 2 TTPs 58 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

fhmuap.exe4758ce7fdf81da687b6cea9748f45fa3f31b5d9c11b4bc886dc389149b25c422.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\fhmuap = "C:\\Users\\Admin\\fhmuap.exe /s"	fhmuap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\fhmuap = "C:\\Users\\Admin\\fhmuap.exe /x"	fhmuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\fhmuap = "C:\\Users\\Admin\\fhmuap.exe /v"	fhmuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\fhmuap = "C:\\Users\\Admin\\fhmuap.exe /y"	fhmuap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\fhmuap = "C:\\Users\\Admin\\fhmuap.exe /j"	fhmuap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\fhmuap = "C:\\Users\\Admin\\fhmuap.exe /p"	fhmuap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\fhmuap = "C:\\Users\\Admin\\fhmuap.exe /e"	fhmuap.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\	fhmuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\fhmuap = "C:\\Users\\Admin\\fhmuap.exe /j"	fhmuap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\fhmuap = "C:\\Users\\Admin\\fhmuap.exe /t"	fhmuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\fhmuap = "C:\\Users\\Admin\\fhmuap.exe /d"	4758ce7fdf81da687b6cea9748f45fa3f31b5d9c11b4bc886dc389149b25c422.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\fhmuap = "C:\\Users\\Admin\\fhmuap.exe /d"	4758ce7fdf81da687b6cea9748f45fa3f31b5d9c11b4bc886dc389149b25c422.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\fhmuap = "C:\\Users\\Admin\\fhmuap.exe /s"	fhmuap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\fhmuap = "C:\\Users\\Admin\\fhmuap.exe /u"	fhmuap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\fhmuap = "C:\\Users\\Admin\\fhmuap.exe /f"	fhmuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\fhmuap = "C:\\Users\\Admin\\fhmuap.exe /n"	fhmuap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\fhmuap = "C:\\Users\\Admin\\fhmuap.exe /d"	fhmuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\fhmuap = "C:\\Users\\Admin\\fhmuap.exe /a"	fhmuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\fhmuap = "C:\\Users\\Admin\\fhmuap.exe /b"	fhmuap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\fhmuap = "C:\\Users\\Admin\\fhmuap.exe /c"	fhmuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\fhmuap = "C:\\Users\\Admin\\fhmuap.exe /u"	fhmuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\fhmuap = "C:\\Users\\Admin\\fhmuap.exe /i"	fhmuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\fhmuap = "C:\\Users\\Admin\\fhmuap.exe /w"	fhmuap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\fhmuap = "C:\\Users\\Admin\\fhmuap.exe /z"	fhmuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\fhmuap = "C:\\Users\\Admin\\fhmuap.exe /c"	fhmuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\fhmuap = "C:\\Users\\Admin\\fhmuap.exe /q"	fhmuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\fhmuap = "C:\\Users\\Admin\\fhmuap.exe /z"	fhmuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\fhmuap = "C:\\Users\\Admin\\fhmuap.exe /t"	fhmuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\fhmuap = "C:\\Users\\Admin\\fhmuap.exe /m"	fhmuap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\fhmuap = "C:\\Users\\Admin\\fhmuap.exe /r"	fhmuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\fhmuap = "C:\\Users\\Admin\\fhmuap.exe /k"	fhmuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\fhmuap = "C:\\Users\\Admin\\fhmuap.exe /p"	fhmuap.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\	4758ce7fdf81da687b6cea9748f45fa3f31b5d9c11b4bc886dc389149b25c422.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\fhmuap = "C:\\Users\\Admin\\fhmuap.exe /g"	fhmuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\fhmuap = "C:\\Users\\Admin\\fhmuap.exe /r"	fhmuap.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	fhmuap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\fhmuap = "C:\\Users\\Admin\\fhmuap.exe /l"	fhmuap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\fhmuap = "C:\\Users\\Admin\\fhmuap.exe /i"	fhmuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\fhmuap = "C:\\Users\\Admin\\fhmuap.exe /o"	fhmuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\fhmuap = "C:\\Users\\Admin\\fhmuap.exe /d"	fhmuap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\fhmuap = "C:\\Users\\Admin\\fhmuap.exe /n"	fhmuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\fhmuap = "C:\\Users\\Admin\\fhmuap.exe /h"	fhmuap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\fhmuap = "C:\\Users\\Admin\\fhmuap.exe /h"	fhmuap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\fhmuap = "C:\\Users\\Admin\\fhmuap.exe /o"	fhmuap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\fhmuap = "C:\\Users\\Admin\\fhmuap.exe /m"	fhmuap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\fhmuap = "C:\\Users\\Admin\\fhmuap.exe /v"	fhmuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\fhmuap = "C:\\Users\\Admin\\fhmuap.exe /g"	fhmuap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\fhmuap = "C:\\Users\\Admin\\fhmuap.exe /k"	fhmuap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\fhmuap = "C:\\Users\\Admin\\fhmuap.exe /y"	fhmuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\fhmuap = "C:\\Users\\Admin\\fhmuap.exe /e"	fhmuap.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	4758ce7fdf81da687b6cea9748f45fa3f31b5d9c11b4bc886dc389149b25c422.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\fhmuap = "C:\\Users\\Admin\\fhmuap.exe /f"	fhmuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\fhmuap = "C:\\Users\\Admin\\fhmuap.exe /x"	fhmuap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\fhmuap = "C:\\Users\\Admin\\fhmuap.exe /a"	fhmuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\fhmuap = "C:\\Users\\Admin\\fhmuap.exe /l"	fhmuap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\fhmuap = "C:\\Users\\Admin\\fhmuap.exe /q"	fhmuap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\fhmuap = "C:\\Users\\Admin\\fhmuap.exe /b"	fhmuap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\fhmuap = "C:\\Users\\Admin\\fhmuap.exe /w"	fhmuap.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

4758ce7fdf81da687b6cea9748f45fa3f31b5d9c11b4bc886dc389149b25c422.exefhmuap.exe

pid	process
2036	4758ce7fdf81da687b6cea9748f45fa3f31b5d9c11b4bc886dc389149b25c422.exe
2000	fhmuap.exe
2000	fhmuap.exe
2000	fhmuap.exe
2000	fhmuap.exe
2000	fhmuap.exe
2000	fhmuap.exe
2000	fhmuap.exe
2000	fhmuap.exe
2000	fhmuap.exe
2000	fhmuap.exe
2000	fhmuap.exe
2000	fhmuap.exe
2000	fhmuap.exe
2000	fhmuap.exe
2000	fhmuap.exe
2000	fhmuap.exe
2000	fhmuap.exe
2000	fhmuap.exe
2000	fhmuap.exe
2000	fhmuap.exe
2000	fhmuap.exe
2000	fhmuap.exe
2000	fhmuap.exe
2000	fhmuap.exe
2000	fhmuap.exe
2000	fhmuap.exe
2000	fhmuap.exe
2000	fhmuap.exe
2000	fhmuap.exe
2000	fhmuap.exe
2000	fhmuap.exe
2000	fhmuap.exe
2000	fhmuap.exe
2000	fhmuap.exe
2000	fhmuap.exe
2000	fhmuap.exe
2000	fhmuap.exe
2000	fhmuap.exe
2000	fhmuap.exe
2000	fhmuap.exe
2000	fhmuap.exe
2000	fhmuap.exe
2000	fhmuap.exe
2000	fhmuap.exe
2000	fhmuap.exe
2000	fhmuap.exe
2000	fhmuap.exe
2000	fhmuap.exe
2000	fhmuap.exe
2000	fhmuap.exe
2000	fhmuap.exe
2000	fhmuap.exe
2000	fhmuap.exe
2000	fhmuap.exe
2000	fhmuap.exe
2000	fhmuap.exe
2000	fhmuap.exe
2000	fhmuap.exe
2000	fhmuap.exe
2000	fhmuap.exe
2000	fhmuap.exe
2000	fhmuap.exe
2000	fhmuap.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

4758ce7fdf81da687b6cea9748f45fa3f31b5d9c11b4bc886dc389149b25c422.exefhmuap.exe

pid process

2036 4758ce7fdf81da687b6cea9748f45fa3f31b5d9c11b4bc886dc389149b25c422.exe
2000 fhmuap.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

4758ce7fdf81da687b6cea9748f45fa3f31b5d9c11b4bc886dc389149b25c422.exe

description	pid	process	target process
PID 2036 wrote to memory of 2000	2036	4758ce7fdf81da687b6cea9748f45fa3f31b5d9c11b4bc886dc389149b25c422.exe	fhmuap.exe
PID 2036 wrote to memory of 2000	2036	4758ce7fdf81da687b6cea9748f45fa3f31b5d9c11b4bc886dc389149b25c422.exe	fhmuap.exe
PID 2036 wrote to memory of 2000	2036	4758ce7fdf81da687b6cea9748f45fa3f31b5d9c11b4bc886dc389149b25c422.exe	fhmuap.exe
PID 2036 wrote to memory of 2000	2036	4758ce7fdf81da687b6cea9748f45fa3f31b5d9c11b4bc886dc389149b25c422.exe	fhmuap.exe

C:\Users\Admin\AppData\Local\Temp\4758ce7fdf81da687b6cea9748f45fa3f31b5d9c11b4bc886dc389149b25c422.exe
"C:\Users\Admin\AppData\Local\Temp\4758ce7fdf81da687b6cea9748f45fa3f31b5d9c11b4bc886dc389149b25c422.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Users\Admin\fhmuap.exe
  "C:\Users\Admin\fhmuap.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2000

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\fhmuap.exe

Filesize
128KB

MD5
6d99775418465a06d6be9de94502086d

SHA1
4c15e68d9e3228d19f4364fef2f33d373aaf9b52

SHA256
df6d941907d0dcc754b5190939c92acbc2b1777ac3490c6dd9b50ba99219b2e2

SHA512
fc24326b54acfe19ce28c4939b0b3eb57e7d1261ac86376a1f008e0d76db80da3959407666dd1d35e0c8cd97e12405656d2a81ce0412f62ee69064b96305c575

Download Submit
C:\Users\Admin\fhmuap.exe

Filesize
128KB

MD5
6d99775418465a06d6be9de94502086d

SHA1
4c15e68d9e3228d19f4364fef2f33d373aaf9b52

SHA256
df6d941907d0dcc754b5190939c92acbc2b1777ac3490c6dd9b50ba99219b2e2

SHA512
fc24326b54acfe19ce28c4939b0b3eb57e7d1261ac86376a1f008e0d76db80da3959407666dd1d35e0c8cd97e12405656d2a81ce0412f62ee69064b96305c575

Download Submit
\Users\Admin\fhmuap.exe

Filesize
128KB

MD5
6d99775418465a06d6be9de94502086d

SHA1
4c15e68d9e3228d19f4364fef2f33d373aaf9b52

SHA256
df6d941907d0dcc754b5190939c92acbc2b1777ac3490c6dd9b50ba99219b2e2

SHA512
fc24326b54acfe19ce28c4939b0b3eb57e7d1261ac86376a1f008e0d76db80da3959407666dd1d35e0c8cd97e12405656d2a81ce0412f62ee69064b96305c575

Download Submit
\Users\Admin\fhmuap.exe

Filesize
128KB

MD5
6d99775418465a06d6be9de94502086d

SHA1
4c15e68d9e3228d19f4364fef2f33d373aaf9b52

SHA256
df6d941907d0dcc754b5190939c92acbc2b1777ac3490c6dd9b50ba99219b2e2

SHA512
fc24326b54acfe19ce28c4939b0b3eb57e7d1261ac86376a1f008e0d76db80da3959407666dd1d35e0c8cd97e12405656d2a81ce0412f62ee69064b96305c575

Download Submit
memory/2000-59-0x0000000000000000-mapping.dmp

Download
memory/2036-56-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads