hxxps://github[.]com/Banana135/Discord-Token-Generator/blob/a78bbe7e91989224677cabf0fe978662c3f85a08/DiscordTokenGen[.]EXE

General

Target

https://github.com/Banana135/Discord-Token-Generator/blob/a78bbe7e91989224677cabf0fe978662c3f85a08/DiscordTokenGen.EXE

Score

8^/10

persistence

Malware Config

Signatures

Downloads MZ/PE file
Executes dropped EXE 2 IoCs

Processes:

DiscordTokenGen.EXEI7rWXBO.exe

pid process

1876 DiscordTokenGen.EXE
1684 I7rWXBO.exe
Loads dropped DLL 2 IoCs

Processes:

iexplore.exeDiscordTokenGen.EXE

pid process

1780 iexplore.exe
1876 DiscordTokenGen.EXE

pid	process
1876	DiscordTokenGen.EXE
1684	I7rWXBO.exe

pid	process
1780	iexplore.exe
1876	DiscordTokenGen.EXE

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

DiscordTokenGen.EXE

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	DiscordTokenGen.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	DiscordTokenGen.EXE

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

Processes:

iexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = c0083ffccf00d901	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 52 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TypedURLs\url3 = "https://login.aliexpress.com/"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TypedURLs\url6 = "https://twitter.com/"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url2 = 0000000000000000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url6 = 0000000000000000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376147000"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url5 = 0000000000000000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbec07815684004d899a318f710de6af00000000020000000000106600000001000020000000575fb6c353f6a285c2655047b5999a96ed5e6cb50d16ca1f1f498ddb974d431f000000000e8000000002000020000000532226b579f847323c2e55aed128ecfaab42a732da5ed5cc86645d0d7987c572900000007197ac959d7eafec6f832a0c61d8146b123e6bb6fe5b5c6f0612500c46e3f3d50f64b259aea48f0b7c486c4151c86b01348f95adc446330cd5c1ffb9eb60ad7c04784f51e37800ac10c7d960c5b686e0a46a6b10a5a136a7e3414275b36b90fcbd054e30f1023b60c586413d721d9db7705005ddf68892323fdc66b0e0fe4e4e15088551797e18c9e6e785b24bba0bd8400000003901c4cf9d1a3b6ce27feb8f329e14c5d92058463dac84fd3ef21008917267020a4c8f3c3e539404a169ee968c928721bd8294369f2e6cdaa9844a6099545378	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url4 = 0000000000000000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TypedURLs\url5 = "https://login.live.com/"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 702ea5e8cf00d901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url3 = 0000000000000000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TypedURLs	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TypedURLs\url2 = "https://www.facebook.com/"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TypedURLs\url4 = "https://signin.ebay.com/ws/ebayisapi.dll"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url1 = 805d7ae8cf00d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TypedURLs\url1 = "https://github.com/Banana135/Discord-Token-Generator/blob/a78bbe7e91989224677cabf0fe978662c3f85a08/DiscordTokenGen.EXE"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TypedURLsTime	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F72AE480-6CC2-11ED-BB5A-5A9C998014C3} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbec07815684004d899a318f710de6af0000000002000000000010660000000100002000000057ccb026e79a3e821f38c89bebfa54f9509e0b274295884f8ef253dd1b74d92c000000000e80000000020000200000002d5973ca1464ed97544d59e6908e3c79ec856555d8f59843aeab3bbf9f45e7d62000000014289de270b39356ba1e4a649f94682c7cb56f8e4bcb2c5dde5338406d0da5af40000000d0bde11ceeafd0d41bc8498045fb5f887c2663bb4c74b18805ba179e982b7e59c6da53363cb43329c520b59ad2c06bef916849b53fc2850669e4fd9882985906	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

IEXPLORE.EXE

pid process

1680 IEXPLORE.EXE
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

iexplore.exe

pid process

1780 iexplore.exe
1780 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1780 iexplore.exe
1780 iexplore.exe
1680 IEXPLORE.EXE
1680 IEXPLORE.EXE
1680 IEXPLORE.EXE
1680 IEXPLORE.EXE

pid	process
1680	IEXPLORE.EXE

pid	process
1780	iexplore.exe
1780	iexplore.exe

pid	process
1780	iexplore.exe
1780	iexplore.exe
1680	IEXPLORE.EXE
1680	IEXPLORE.EXE
1680	IEXPLORE.EXE
1680	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

iexplore.exeDiscordTokenGen.EXE

description	pid	process	target process
PID 1780 wrote to memory of 1680	1780	iexplore.exe	IEXPLORE.EXE
PID 1780 wrote to memory of 1680	1780	iexplore.exe	IEXPLORE.EXE
PID 1780 wrote to memory of 1680	1780	iexplore.exe	IEXPLORE.EXE
PID 1780 wrote to memory of 1680	1780	iexplore.exe	IEXPLORE.EXE
PID 1780 wrote to memory of 1876	1780	iexplore.exe	DiscordTokenGen.EXE
PID 1780 wrote to memory of 1876	1780	iexplore.exe	DiscordTokenGen.EXE
PID 1780 wrote to memory of 1876	1780	iexplore.exe	DiscordTokenGen.EXE
PID 1876 wrote to memory of 1684	1876	DiscordTokenGen.EXE	I7rWXBO.exe
PID 1876 wrote to memory of 1684	1876	DiscordTokenGen.EXE	I7rWXBO.exe
PID 1876 wrote to memory of 1684	1876	DiscordTokenGen.EXE	I7rWXBO.exe

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://github.com/Banana135/Discord-Token-Generator/blob/a78bbe7e91989224677cabf0fe978662c3f85a08/DiscordTokenGen.EXE
1⤵
- Loads dropped DLL
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1780

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1780 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1680

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\96W2ZDRZ\DiscordTokenGen.EXE
"C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\96W2ZDRZ\DiscordTokenGen.EXE"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1876

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\I7rWXBO.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\I7rWXBO.exe
3⤵
- Executes dropped EXE
PID:1684

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

Web Service

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1033e8b370b34570ab29faabdce8e4d8

SHA1
6905f2afee900cb6c4dbdbb34618e8a62121b421

SHA256
64a3e811bb85116946160b4d525ec31d848b8201675fd261afdf69b6829e3e05

SHA512
d2b87f4aaa5be6a7bb633d18ed337bd2a90099dfba1b01591753f12a07fe5ac01829bab13a832f17b5c4b0dca98a6e49680edd4f0d00ea3efa2b171aa4635e3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\try74lz\imagestore.dat

Filesize
1KB

MD5
46053a963cb71e4d87b772fcd1020e40

SHA1
f8f05d8907b45ef199c2d3d73657e8e541e5aefc

SHA256
5d64fa75e0c5e60a55c4d025381a52e5d41acc8b975abed263fbd7815e929544

SHA512
f703058834b7bfde456d08c6eca1189bf07adfb3108f2da38b94640489d307bc97b6f2aa6489bc312e801f29f60b82c195714edfcd90d2e5f516abe345639a32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\96W2ZDRZ\DiscordTokenGen.EXE

Filesize
19.0MB

MD5
8ee0fa9869165fce2bd29cb3b3d0a608

SHA1
0cf146fe687bde007868d3adc8dde827e146f7b0

SHA256
a8a2f861149bcf1fd2bc9891fdc44b41f837e05f5e31384a6fc9c1e7ec44d4ec

SHA512
c0ea93cd78138bfdcc1eba8c522af2ba3ff90abb4435b29d21ae3fa456c78f12bc21e4914e2006368add2ae00e3b8b094a537a323fe75504ea9442bd21d4b9a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\96W2ZDRZ\DiscordTokenGen.EXE.ioo1xnu.partial

Filesize
19.0MB

MD5
8ee0fa9869165fce2bd29cb3b3d0a608

SHA1
0cf146fe687bde007868d3adc8dde827e146f7b0

SHA256
a8a2f861149bcf1fd2bc9891fdc44b41f837e05f5e31384a6fc9c1e7ec44d4ec

SHA512
c0ea93cd78138bfdcc1eba8c522af2ba3ff90abb4435b29d21ae3fa456c78f12bc21e4914e2006368add2ae00e3b8b094a537a323fe75504ea9442bd21d4b9a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\I7rWXBO.exe

Filesize
40.5MB

MD5
bcb9c4e63bf92b525260759c46116c9b

SHA1
e6e7ed88a810d560843d627d64d7c4ea057b6fc2

SHA256
2a13f2d9bf02b16e90c73e971de8ecf365067942f0761a18a92d5ecba3710b02

SHA512
de1febb9690bb99ec2505d7187fba4a62b2ae49b746253d68bf243b295acf6dcf90b454fca30b8cea6b9cf9110a9d5f6941653d8b111c899f4f69471ec0b34b7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\DH5FA6ZQ.txt

Filesize
601B

MD5
61324aa8ac4e15e3e53fb2e977b1f37a

SHA1
ad6e7f5b94816cb160b71c4078b2371f67f324ce

SHA256
032997e22179c501ad6fccb6b87f2a033a9d4fcb05d6a673df0ffccf5b3f07de

SHA512
c0b2a488688e47eb782928b0fa9647297af97ed89d7a8cfb7a51b8ba14fbf184785982c9989d4794af580229c8c4a1aa30c1ea69b7407cdc25978478110fd6e2

Download Submit
\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\96W2ZDRZ\DiscordTokenGen.EXE

Filesize
19.0MB

MD5
8ee0fa9869165fce2bd29cb3b3d0a608

SHA1
0cf146fe687bde007868d3adc8dde827e146f7b0

SHA256
a8a2f861149bcf1fd2bc9891fdc44b41f837e05f5e31384a6fc9c1e7ec44d4ec

SHA512
c0ea93cd78138bfdcc1eba8c522af2ba3ff90abb4435b29d21ae3fa456c78f12bc21e4914e2006368add2ae00e3b8b094a537a323fe75504ea9442bd21d4b9a8

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\I7rWXBO.exe

Filesize
40.5MB

MD5
bcb9c4e63bf92b525260759c46116c9b

SHA1
e6e7ed88a810d560843d627d64d7c4ea057b6fc2

SHA256
2a13f2d9bf02b16e90c73e971de8ecf365067942f0761a18a92d5ecba3710b02

SHA512
de1febb9690bb99ec2505d7187fba4a62b2ae49b746253d68bf243b295acf6dcf90b454fca30b8cea6b9cf9110a9d5f6941653d8b111c899f4f69471ec0b34b7

Download Submit
memory/1684-63-0x0000000000000000-mapping.dmp

Download
memory/1876-59-0x0000000000000000-mapping.dmp

Download
memory/1876-61-0x000007FEFB5D1000-0x000007FEFB5D3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads