redline | 70a7b4539fd77466de9aebe4d1e8eca3282df072e12fb8c95f5906d611febc5f

Analysis

max time kernel
132s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
15/01/2024, 03:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5c0d367fab1bd7c499b318e81980b717.exe
Size 2.3MB
Sample240115-ebjmkahfg4
SHA256 70a7b4539fd77466de9aebe4d1e8eca3282df072e12fb8c95f5906d611febc5f
MD5 5c0d367fab1bd7c499b318e81980b717
SHA1 540b90260ed89b4c0d8330c851dd542af52a7d0c
SHA512 4c99d846cf8e9c8c2209d3373c870e5e7663cfd2d5961d31d04457aebcaf6444faa46ae2e58b4237d2158b1f25123634b4c0fe7c6f6930192b957786d9b9fbb2
SSDEEP 49152:s5+hF7EUttWAykEbkd9yhJKyB67kuqgcM/mmtr9xiz8lVHTIioOFZQ+z:s5aFr/eAiJKyo7kuN/ZtBxiqZ7z
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline sectoprat @vodi4ka228 infostealer rat trojan

Malware Config

Extracted

Family

redline

Botnet

@vodi4ka228

45.14.49.109:54819

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0006000000023214-64.dat	family_redline
behavioral2/memory/4484-65-0x0000000000E30000-0x0000000000E4E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0006000000023214-64.dat	family_sectoprat
behavioral2/memory/4484-65-0x0000000000E30000-0x0000000000E4E000-memory.dmp	family_sectoprat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	5c0d367fab1bd7c499b318e81980b717.exe

Executes dropped EXE 9 IoCs

pid	Process
3588	7z.exe
4468	7z.exe
2208	7z.exe
2712	7z.exe
3672	7z.exe
4964	7z.exe
4808	7z.exe
4620	7z.exe
4484	@vodi4ka228.exe

Loads dropped DLL 8 IoCs

pid	Process
3588	7z.exe
4468	7z.exe
2208	7z.exe
2712	7z.exe
3672	7z.exe
4964	7z.exe
4808	7z.exe
4620	7z.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 33 IoCs

description	pid	Process
Token: SeRestorePrivilege	3588	7z.exe
Token: 35	3588	7z.exe
Token: SeSecurityPrivilege	3588	7z.exe
Token: SeSecurityPrivilege	3588	7z.exe
Token: SeRestorePrivilege	4468	7z.exe
Token: 35	4468	7z.exe
Token: SeSecurityPrivilege	4468	7z.exe
Token: SeSecurityPrivilege	4468	7z.exe
Token: SeRestorePrivilege	2208	7z.exe
Token: 35	2208	7z.exe
Token: SeSecurityPrivilege	2208	7z.exe
Token: SeSecurityPrivilege	2208	7z.exe
Token: SeRestorePrivilege	2712	7z.exe
Token: 35	2712	7z.exe
Token: SeSecurityPrivilege	2712	7z.exe
Token: SeSecurityPrivilege	2712	7z.exe
Token: SeRestorePrivilege	3672	7z.exe
Token: 35	3672	7z.exe
Token: SeSecurityPrivilege	3672	7z.exe
Token: SeSecurityPrivilege	3672	7z.exe
Token: SeRestorePrivilege	4964	7z.exe
Token: 35	4964	7z.exe
Token: SeSecurityPrivilege	4964	7z.exe
Token: SeSecurityPrivilege	4964	7z.exe
Token: SeRestorePrivilege	4808	7z.exe
Token: 35	4808	7z.exe
Token: SeSecurityPrivilege	4808	7z.exe
Token: SeSecurityPrivilege	4808	7z.exe
Token: SeRestorePrivilege	4620	7z.exe
Token: 35	4620	7z.exe
Token: SeSecurityPrivilege	4620	7z.exe
Token: SeSecurityPrivilege	4620	7z.exe
Token: SeDebugPrivilege	4484	@vodi4ka228.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 3648	1956	5c0d367fab1bd7c499b318e81980b717.exe	89
PID 1956 wrote to memory of 3648	1956	5c0d367fab1bd7c499b318e81980b717.exe	89
PID 3648 wrote to memory of 1400	3648	cmd.exe	91
PID 3648 wrote to memory of 1400	3648	cmd.exe	91
PID 3648 wrote to memory of 3588	3648	cmd.exe	92
PID 3648 wrote to memory of 3588	3648	cmd.exe	92
PID 3648 wrote to memory of 4468	3648	cmd.exe	93
PID 3648 wrote to memory of 4468	3648	cmd.exe	93
PID 3648 wrote to memory of 2208	3648	cmd.exe	95
PID 3648 wrote to memory of 2208	3648	cmd.exe	95
PID 3648 wrote to memory of 2712	3648	cmd.exe	94
PID 3648 wrote to memory of 2712	3648	cmd.exe	94
PID 3648 wrote to memory of 3672	3648	cmd.exe	102
PID 3648 wrote to memory of 3672	3648	cmd.exe	102
PID 3648 wrote to memory of 4964	3648	cmd.exe	101
PID 3648 wrote to memory of 4964	3648	cmd.exe	101
PID 3648 wrote to memory of 4808	3648	cmd.exe	100
PID 3648 wrote to memory of 4808	3648	cmd.exe	100
PID 3648 wrote to memory of 4620	3648	cmd.exe	99
PID 3648 wrote to memory of 4620	3648	cmd.exe	99
PID 3648 wrote to memory of 1980	3648	cmd.exe	98
PID 3648 wrote to memory of 1980	3648	cmd.exe	98
PID 3648 wrote to memory of 4484	3648	cmd.exe	96
PID 3648 wrote to memory of 4484	3648	cmd.exe	96
PID 3648 wrote to memory of 4484	3648	cmd.exe	96

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1980	attrib.exe

C:\Users\Admin\AppData\Local\Temp\5c0d367fab1bd7c499b318e81980b717.exe
"C:\Users\Admin\AppData\Local\Temp\5c0d367fab1bd7c499b318e81980b717.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\svchost\svchost.cmd" /S"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3648
- - C:\Windows\system32\mode.com
    mode 65,10
    3⤵
    PID:1400
- - C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
    7z.exe e file.zip -p -oextracted
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:3588
- - C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
    7z.exe e extracted/file_7.zip -oextracted
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:4468
- - C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
    7z.exe e extracted/file_5.zip -oextracted
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:2712
- - C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
    7z.exe e extracted/file_6.zip -oextracted
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:2208
- - C:\Users\Admin\AppData\Local\Temp\svchost\@vodi4ka228.exe
    "@vodi4ka228.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4484
- - C:\Windows\system32\attrib.exe
    attrib +H "@vodi4ka228.exe"
    3⤵
    - Views/modifies file attributes
    PID:1980
- - C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
    7z.exe e extracted/file_1.zip -oextracted
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:4620
- - C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
    7z.exe e extracted/file_2.zip -oextracted
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:4808
- - C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
    7z.exe e extracted/file_3.zip -oextracted
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:4964
- - C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
    7z.exe e extracted/file_4.zip -oextracted
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:3672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7z.dll

Path C:\Users\Admin\AppData\Local\Temp\svchost\7z.dll
Size 1.6MB
SHA256 34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891
MD5 72491c7b87a7c2dd350b727444f13bb4
SHA1 1e9338d56db7ded386878eab7bb44b8934ab1bc7
SHA512 583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511
SSDEEP 24576:S+clx4tCQJSVAFja8i/RwQQmzgO67V3bYgR+zypEqxr2VSlLP:jclmJSVARa86xzW3xRoyqqxrT
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.dll

Path C:\Users\Admin\AppData\Local\Temp\svchost\7z.dll
Size 1.3MB
SHA256 6a466bad8d8bfced4f668e97c99e92b1df3550acaa8117f047f65bcb60745f5e
MD5 328f9811aa7b62995876937c520f68d1
SHA1 a857f6337611a679b8869d1e44cb6764d5cc665e
SHA512 d4f746b6cb3eb7ea271cd2574b31105a7924db6f5e9c274aab12d2754883c0416f3a4edcd7308cd845d935a65b55685e84b4c729daf286ff5b14d146e36e042e
SSDEEP 24576:S+clx4tCQJSVAFja8i/RwQQmzgO67V3bYgR+zypEqxu:jclmJSVARa86xzW3xRoyqqxu
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.dll

Path C:\Users\Admin\AppData\Local\Temp\svchost\7z.dll
Size 1.2MB
SHA256 0a134beded9d245865b07ffaf4bf9bdd50e65ae3e859b9f27be90056fd8f60d7
MD5 f0229d3608e55a239fde86ba42525485
SHA1 132b16d277fad9d1907951474aea4092ef7f939a
SHA512 d7672e5ee824723bc9e8cfc8a6a78fb9d360eead7746772b08d8e471a1f142e873950975a457048481b5908b8d4720b0e98268910d3352cabae6aff09a2e6957
SSDEEP 24576:S+clx4tCQJSVAFja8i/RwQQmzgO67V3bYgR+zypEN:jclmJSVARa86xzW3xRoyqN
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
Size 458KB
SHA256 344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
MD5 619f7135621b50fd1900ff24aade1524
SHA1 6c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA512 2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628
SSDEEP 6144:fz1gL5pRTMTTjMkId/BynSx7dEe6XwzRaktNP08NhKs39zo43fTtl1fayCV7+DHV:r1gL5pRTcAkS/3hzN8qE43fm78V
MD5 SHA1 SHA512 SSDEEP

Submit Download

@vodi4ka228.exe

Path C:\Users\Admin\AppData\Local\Temp\svchost\@vodi4ka228.exe
Size 100KB
SHA256 274ebefd6b87d9d80ce30187508dda4cbd9c8f6c2d04ffa5619b29d6eedd7d94
MD5 cd64fc488ddbba5086426d69fa444e81
SHA1 1fda807efd6443acb1077a65657fe3990d8f0141
SHA512 af72cdba0ce6d97ec20ed329cb57b49d9085c1b79ea48bfd6f64aac595204f28b100d1ce02b0d3f80a8ebd208be7e54d93c4b3f7ff18522c3df051bc7dcf98de
SSDEEP 1536:jm386AEAOJYBp8DmnjpHDQ/SMPQzi7Ougbue7vhuvNyAsdtgi1xQeTEiG6WAaoi9:ji86AdearpEQziif3hulyddvsvwI
MD5 SHA1 SHA512 SSDEEP

Submit Download

ANTISC~1.DAT

Path C:\Users\Admin\AppData\Local\Temp\svchost\extracted\ANTISC~1.DAT
Size 2.0MB
SHA256 54170d18a4cd2359334ddf4f6586b6ff21f565613b715778161607b0439ef6b9
MD5 e61a0ecb987ef138eda42cf15886d21b
SHA1 59ec8d4860e5b69c94dce0431898e12e4ae886e8
SHA512 087f5b68f1ade6bcc6e4a93080759940f0af3fdf3bfdc17714ba234aacc0989ee82a8e8e9b1fe3801a943b104dcaf0cc99fe79d03adfe3aa491415d9caaaed4e
SSDEEP 24576:5yZBPkpRrP9pxC+XvoflcYy36s3vb0EecYy37n92k8GtGAQZ67hR7krC/Cyf0/xy:R9kqGu7okoZscCnf0/Zs9d
MD5 SHA1 SHA512 SSDEEP

Submit Download

file_1.zip

Path C:\Users\Admin\AppData\Local\Temp\svchost\extracted\file_1.zip
Size 40KB
SHA256 0c83522a147160adbe6018e28fea9af954aafcf6082bfa3abfc1f46cedc0d445
MD5 cfecf032edd131df57ba83d5f0ebe3f3
SHA1 a72b19a9de49af6893d5d7ebf0dc4419efdd2038
SHA512 098b0288c406ef35c105537374976d425756edcbdf84ff7d2a0f025b1e82e8a395009501c714134f61a792958b27601d18d83c705b7f74b842ba7dbdc79c2fa2
SSDEEP 768:CTkFY2FR/ajQRTevwKxbq3mZZg8NYOfg7ModBnnjsAXT+Z6klErSBbA5UpK:IkF3ajQRTRKBkSofnjs2T+ML2g
MD5 SHA1 SHA512 SSDEEP

Submit Download

file_2.zip

Path C:\Users\Admin\AppData\Local\Temp\svchost\extracted\file_2.zip
Size 40KB
SHA256 1f18bbc4e9e12d1d22c0f3b4b74122eddb4c26d1670c835e2b94c334392f4020
MD5 2bdd447167577ef0dc5ce1773bea3dfc
SHA1 e1ae68d3552fe9a16cbb870ed33b6d4361bc2dad
SHA512 0f653a0f22df92b7ecb9cbeca9bfd9d59fe2fe9c5459a2a017b7e9a47644f18edd62f899bed8172043e06659efd40a5e45361f270eab53ac99bea8231b4679a8
SSDEEP 768:TTkFY2FR/ajQRTJSAYWPGOfmRbRYy46ZCxvbtio3frSBbA5Up0:3kF3ajQRTJSdWPGam7qgCxvBb3j2y
MD5 SHA1 SHA512 SSDEEP

Submit Download

file_3.zip

Path C:\Users\Admin\AppData\Local\Temp\svchost\extracted\file_3.zip
Size 40KB
SHA256 a4ecf4783ac54508b4330ae0df0664c7bde929ba272a3f2da99440bf67cdcaa2
MD5 1b95c4778455cf5bac3eb295c236afb8
SHA1 1b2504ebf496b87ff7293f99d6cc1807978358d1
SHA512 7d7d3398bbaccea7ac8809490f1c139bfcd8fb401c9a05276791d28d2f6a1ba98333a8735227d31d3d40e4750700f3a3ebcc02984cd3b7fd0aba82039ed9410f
SSDEEP 768:ITkFY2FR/ajQRTRSAYWPGOfmRbRYy4MZCxvbtio3DzuD/rchE6vOM90f:CkF3ajQRTRSdWPGam7qiCxvBb32D/rcw
MD5 SHA1 SHA512 SSDEEP

Submit Download

file_4.zip

Path C:\Users\Admin\AppData\Local\Temp\svchost\extracted\file_4.zip
Size 41KB
SHA256 ec4d90dcc47a0b369bf104497dba25005288bbbcbb539d8961bedd2c7884c0a8
MD5 363dac196fb59e6e8fcfdd30511ee8db
SHA1 6c2e6d51846c63ffac96a9c9ebe60cb7be5c9f63
SHA512 90c39b5f5308e00ac0e96b141c8b4b0a0a6a02e037002b2cf4013c1ab77b713a555abc02bf4f25c973c02e3ea3ac3ce37b4e8635f6a96d32226b3de2ca0d41e9
SSDEEP 768:DTkFY2FR/ajQRTRSAYWPGOfmRbRYy4MZCxvbtio3DzuD/rchE6vOM90E:HkF3ajQRTRSdWPGam7qiCxvBb32D/rcj
MD5 SHA1 SHA512 SSDEEP

Submit Download

file_5.zip

Path C:\Users\Admin\AppData\Local\Temp\svchost\extracted\file_5.zip
Size 41KB
SHA256 3ad40903e20c77a44bcbdb49a9c1fc742a9d5e3ff599a11540d2afa232f81c7f
MD5 9b129871d205e2078d29d0cf1676f1a8
SHA1 f24ec528f8a0ccc9f3fb00c38bed8926d7a5a28d
SHA512 460a491d29ad102c65a8e23d0f5b083e3392e56d1294fb3ec01422043c80db141521c611e059dbf4dd46a45ee3fa3d298744baa0abfc4a394f157c8f277a50a6
SSDEEP 768:Y7lbx8Bxezb7fn8menqVSSdSAYWPGOfmRbRYy4kZCxvbtio3Iu9/AMyZT/+FZ:mbFffFe8SaSdWPGam7qqCxvBb3z9yZTG
MD5 SHA1 SHA512 SSDEEP

Submit Download

file_6.zip

Path C:\Users\Admin\AppData\Local\Temp\svchost\extracted\file_6.zip
Size 41KB
SHA256 bd51e9b6b6675b869a9f5a3de2e32f059e3dfd3bf7a82e735a3112805a396dc6
MD5 3890979cd3d325b35035669ab9d83f6e
SHA1 b6bea4b42d43008a3e5963ea69fe16fd93eed68c
SHA512 8b3d67391071668d859bbb85fa84945a933befa89aaadad7c9559a461cc84c2e47932b8c8da21d96ee6705116e4039ea6b5b76e331ef42198a922278a07f4718
SSDEEP 768:w7lbx8Bxezb7fn8menqVSSdSAYWPGOfmRbRYy4kZCxvbtio3Iu9/AMyZT/+F4:ebFffFe8SaSdWPGam7qqCxvBb3z9yZTP
MD5 SHA1 SHA512 SSDEEP

Submit Download

file_7.zip

Path C:\Users\Admin\AppData\Local\Temp\svchost\extracted\file_7.zip
Size 1.5MB
SHA256 a3fb42e77e9cd64de9a3983cc3be48f82d9e22e3f0a9e10ab73e639bd5654e8f
MD5 5538f12605af81919d8cb9dc5254f9e9
SHA1 e2ae1cdb79bcac3e466a62466781476ae14c364f
SHA512 491de6a4558f2ed1173585aa145d184db25f954f8832c28d003b8dfae69484c905571a7ab669c8aa4987278adcd83e1c7de7e57f181e23bb8fb2e2f3232bcb59
SSDEEP 49152:xujCK3D0AC/l5mwbBkDWYb1ZN4UIS7ZVr:xaR3D0Ae5mwdkDWm1T7/r
MD5 SHA1 SHA512 SSDEEP

Submit Download

payload.data

Path C:\Users\Admin\AppData\Local\Temp\svchost\payload.data
Size 1.5MB
SHA256 20d34f1e69ce1938f7f10b26191525380978234e7b4f14d88b68c6ad3ffba324
MD5 4bc94f2427d4a7f63ef72d77258889ea
SHA1 0d8691c76512492c84e55991a9869aed59497e0a
SHA512 9625baf0d253d40552e1a644873f0ce26784eb6e06d9b62ce82bea5f08b6e2bbb1eb6ab42dcd62ace60814897dc8da88f736e4e390aa56a160db7c130feaf048
SSDEEP 49152:ODUHYWAy3ObEdKyvJubI6Peu/xMM/mm2rB:eSg1cJubbPeun/Z2l
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.cmd

Path C:\Users\Admin\AppData\Local\Temp\svchost\svchost.cmd
Size 467B
SHA256 a71c7c1d79dd83986455cbfb1ee1b9951b4cfe118dd198333702d8721b435c0c
MD5 b603daf573a2d9a1ae12487bd94bde90
SHA1 fe4ac4092843a3d75f7f7f137d7883b6f2edfb16
SHA512 70d1421043cda9fb81f28ec59b12d5e2f1ee4fec0f72d74894c612088ff2e9877f8f2cc91b4e1cb7da30c7cd4667eb9c17f86778a62cf1251212da1e8cb7efd9
MD5 SHA1 SHA512

Submit Download

memory/4484-69-0x0000000005850000-0x000000000588C000-memory.dmp

Download

memory/4484-67-0x0000000005DB0000-0x00000000063C8000-memory.dmp

Download

memory/4484-68-0x00000000057F0000-0x0000000005802000-memory.dmp

Download

memory/4484-65-0x0000000000E30000-0x0000000000E4E000-memory.dmp

Download

memory/4484-66-0x0000000072DB0000-0x0000000073560000-memory.dmp

Download

memory/4484-70-0x0000000005950000-0x0000000005960000-memory.dmp

Download

memory/4484-71-0x0000000005890000-0x00000000058DC000-memory.dmp

Download

memory/4484-72-0x0000000005B00000-0x0000000005C0A000-memory.dmp

Download

memory/4484-73-0x0000000072DB0000-0x0000000073560000-memory.dmp

Download

memory/4484-74-0x0000000005950000-0x0000000005960000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads