d03b466887d59a3c98ae312c7f317e998a73c7212a78391e859c95bd981c992a

General

Target

d03b466887d59a3c98ae312c7f317e998a73c7212a78391e859c95bd981c992a.exe
Size

1.5MB
MD5

13c291a51303cb5b0d165e16fb16adbf
SHA1

67770e925c3f03212afdbdf20e84a7de8d682465
SHA256

d03b466887d59a3c98ae312c7f317e998a73c7212a78391e859c95bd981c992a
SHA512

b2064b2ee4bdd4ac1bc8a3b1ba49c3cd359c098100ebf0ffe55566cb920478a806758a536b53b5216e66fdb2207d1df5ca2ff850a4ea23afc3941f81701205d1
SSDEEP

12288:wHZVm/7ePnv+TWM+6+xTGzgFA+u/x8acJdPACFFbLFi8cj5UQbM72voL:2v+NWu/adRYj5UQO5

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 10 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Processes:

reg.exereg.exereg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Windows Updater.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Updater.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Update\\winupdt.exe:*:Enabled:Windows Messanger"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe

UPX dump on OEP (original entry point) 15 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1076-31-0x0000000000400000-0x000000000045C000-memory.dmp	UPX
behavioral2/memory/1076-34-0x0000000000400000-0x000000000045C000-memory.dmp	UPX
behavioral2/memory/1076-35-0x0000000000400000-0x000000000045C000-memory.dmp	UPX
behavioral2/memory/1076-41-0x0000000000400000-0x000000000045C000-memory.dmp	UPX
behavioral2/memory/1076-42-0x0000000000400000-0x000000000045C000-memory.dmp	UPX
behavioral2/memory/1076-43-0x0000000000400000-0x000000000045C000-memory.dmp	UPX
behavioral2/memory/1076-45-0x0000000000400000-0x000000000045C000-memory.dmp	UPX
behavioral2/memory/1076-46-0x0000000000400000-0x000000000045C000-memory.dmp	UPX
behavioral2/memory/1076-47-0x0000000000400000-0x000000000045C000-memory.dmp	UPX
behavioral2/memory/1076-49-0x0000000000400000-0x000000000045C000-memory.dmp	UPX
behavioral2/memory/1076-50-0x0000000000400000-0x000000000045C000-memory.dmp	UPX
behavioral2/memory/1076-51-0x0000000000400000-0x000000000045C000-memory.dmp	UPX
behavioral2/memory/1076-53-0x0000000000400000-0x000000000045C000-memory.dmp	UPX
behavioral2/memory/1076-54-0x0000000000400000-0x000000000045C000-memory.dmp	UPX
behavioral2/memory/1076-55-0x0000000000400000-0x000000000045C000-memory.dmp	UPX

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

d03b466887d59a3c98ae312c7f317e998a73c7212a78391e859c95bd981c992a.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Control Panel\International\Geo\Nation	d03b466887d59a3c98ae312c7f317e998a73c7212a78391e859c95bd981c992a.exe

Executes dropped EXE 2 IoCs

Processes:

winupdt.exewinupdt.exe

pid process

4688 winupdt.exe
1076 winupdt.exe

pid	process
4688	winupdt.exe
1076	winupdt.exe

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1076-31-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral2/memory/1076-34-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral2/memory/1076-35-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral2/memory/1076-41-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral2/memory/1076-42-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral2/memory/1076-43-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral2/memory/1076-45-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral2/memory/1076-46-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral2/memory/1076-47-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral2/memory/1076-49-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral2/memory/1076-50-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral2/memory/1076-51-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral2/memory/1076-53-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral2/memory/1076-54-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral2/memory/1076-55-0x0000000000400000-0x000000000045C000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Window Updates = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Update\\winupdt.exe"	reg.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

winupdt.exe

description pid process target process

PID 4688 set thread context of 1076 4688 winupdt.exe winupdt.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies registry key 1 TTPs 4 IoCs

Modify Registry
T1112

Processes:

reg.exereg.exereg.exereg.exe

pid process

3224 reg.exe
4296 reg.exe
392 reg.exe
5060 reg.exe

description	pid	process	target process
PID 4688 set thread context of 1076	4688	winupdt.exe	winupdt.exe

pid	process
3224	reg.exe
4296	reg.exe
392	reg.exe
5060	reg.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

Processes:

winupdt.exe

description	pid	process
Token: 1	1076	winupdt.exe
Token: SeCreateTokenPrivilege	1076	winupdt.exe
Token: SeAssignPrimaryTokenPrivilege	1076	winupdt.exe
Token: SeLockMemoryPrivilege	1076	winupdt.exe
Token: SeIncreaseQuotaPrivilege	1076	winupdt.exe
Token: SeMachineAccountPrivilege	1076	winupdt.exe
Token: SeTcbPrivilege	1076	winupdt.exe
Token: SeSecurityPrivilege	1076	winupdt.exe
Token: SeTakeOwnershipPrivilege	1076	winupdt.exe
Token: SeLoadDriverPrivilege	1076	winupdt.exe
Token: SeSystemProfilePrivilege	1076	winupdt.exe
Token: SeSystemtimePrivilege	1076	winupdt.exe
Token: SeProfSingleProcessPrivilege	1076	winupdt.exe
Token: SeIncBasePriorityPrivilege	1076	winupdt.exe
Token: SeCreatePagefilePrivilege	1076	winupdt.exe
Token: SeCreatePermanentPrivilege	1076	winupdt.exe
Token: SeBackupPrivilege	1076	winupdt.exe
Token: SeRestorePrivilege	1076	winupdt.exe
Token: SeShutdownPrivilege	1076	winupdt.exe
Token: SeDebugPrivilege	1076	winupdt.exe
Token: SeAuditPrivilege	1076	winupdt.exe
Token: SeSystemEnvironmentPrivilege	1076	winupdt.exe
Token: SeChangeNotifyPrivilege	1076	winupdt.exe
Token: SeRemoteShutdownPrivilege	1076	winupdt.exe
Token: SeUndockPrivilege	1076	winupdt.exe
Token: SeSyncAgentPrivilege	1076	winupdt.exe
Token: SeEnableDelegationPrivilege	1076	winupdt.exe
Token: SeManageVolumePrivilege	1076	winupdt.exe
Token: SeImpersonatePrivilege	1076	winupdt.exe
Token: SeCreateGlobalPrivilege	1076	winupdt.exe
Token: 31	1076	winupdt.exe
Token: 32	1076	winupdt.exe
Token: 33	1076	winupdt.exe
Token: 34	1076	winupdt.exe
Token: 35	1076	winupdt.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

d03b466887d59a3c98ae312c7f317e998a73c7212a78391e859c95bd981c992a.exewinupdt.exewinupdt.exe

pid process

2456 d03b466887d59a3c98ae312c7f317e998a73c7212a78391e859c95bd981c992a.exe
4688 winupdt.exe
1076 winupdt.exe
1076 winupdt.exe
1076 winupdt.exe

pid	process
2456	d03b466887d59a3c98ae312c7f317e998a73c7212a78391e859c95bd981c992a.exe
4688	winupdt.exe
1076	winupdt.exe
1076	winupdt.exe
1076	winupdt.exe

Suspicious use of WriteProcessMemory 41 IoCs

Processes:

d03b466887d59a3c98ae312c7f317e998a73c7212a78391e859c95bd981c992a.execmd.exewinupdt.exewinupdt.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 2456 wrote to memory of 2504	2456	d03b466887d59a3c98ae312c7f317e998a73c7212a78391e859c95bd981c992a.exe	cmd.exe
PID 2456 wrote to memory of 2504	2456	d03b466887d59a3c98ae312c7f317e998a73c7212a78391e859c95bd981c992a.exe	cmd.exe
PID 2456 wrote to memory of 2504	2456	d03b466887d59a3c98ae312c7f317e998a73c7212a78391e859c95bd981c992a.exe	cmd.exe
PID 2504 wrote to memory of 5028	2504	cmd.exe	reg.exe
PID 2504 wrote to memory of 5028	2504	cmd.exe	reg.exe
PID 2504 wrote to memory of 5028	2504	cmd.exe	reg.exe
PID 2456 wrote to memory of 4688	2456	d03b466887d59a3c98ae312c7f317e998a73c7212a78391e859c95bd981c992a.exe	winupdt.exe
PID 2456 wrote to memory of 4688	2456	d03b466887d59a3c98ae312c7f317e998a73c7212a78391e859c95bd981c992a.exe	winupdt.exe
PID 2456 wrote to memory of 4688	2456	d03b466887d59a3c98ae312c7f317e998a73c7212a78391e859c95bd981c992a.exe	winupdt.exe
PID 4688 wrote to memory of 1076	4688	winupdt.exe	winupdt.exe
PID 4688 wrote to memory of 1076	4688	winupdt.exe	winupdt.exe
PID 4688 wrote to memory of 1076	4688	winupdt.exe	winupdt.exe
PID 4688 wrote to memory of 1076	4688	winupdt.exe	winupdt.exe
PID 4688 wrote to memory of 1076	4688	winupdt.exe	winupdt.exe
PID 4688 wrote to memory of 1076	4688	winupdt.exe	winupdt.exe
PID 4688 wrote to memory of 1076	4688	winupdt.exe	winupdt.exe
PID 4688 wrote to memory of 1076	4688	winupdt.exe	winupdt.exe
PID 1076 wrote to memory of 2212	1076	winupdt.exe	cmd.exe
PID 1076 wrote to memory of 2212	1076	winupdt.exe	cmd.exe
PID 1076 wrote to memory of 2212	1076	winupdt.exe	cmd.exe
PID 1076 wrote to memory of 3284	1076	winupdt.exe	cmd.exe
PID 1076 wrote to memory of 3284	1076	winupdt.exe	cmd.exe
PID 1076 wrote to memory of 3284	1076	winupdt.exe	cmd.exe
PID 1076 wrote to memory of 3908	1076	winupdt.exe	cmd.exe
PID 1076 wrote to memory of 3908	1076	winupdt.exe	cmd.exe
PID 1076 wrote to memory of 3908	1076	winupdt.exe	cmd.exe
PID 1076 wrote to memory of 4164	1076	winupdt.exe	cmd.exe
PID 1076 wrote to memory of 4164	1076	winupdt.exe	cmd.exe
PID 1076 wrote to memory of 4164	1076	winupdt.exe	cmd.exe
PID 3284 wrote to memory of 5060	3284	cmd.exe	reg.exe
PID 3284 wrote to memory of 5060	3284	cmd.exe	reg.exe
PID 3284 wrote to memory of 5060	3284	cmd.exe	reg.exe
PID 2212 wrote to memory of 3224	2212	cmd.exe	reg.exe
PID 2212 wrote to memory of 3224	2212	cmd.exe	reg.exe
PID 2212 wrote to memory of 3224	2212	cmd.exe	reg.exe
PID 4164 wrote to memory of 4296	4164	cmd.exe	reg.exe
PID 4164 wrote to memory of 4296	4164	cmd.exe	reg.exe
PID 4164 wrote to memory of 4296	4164	cmd.exe	reg.exe
PID 3908 wrote to memory of 392	3908	cmd.exe	reg.exe
PID 3908 wrote to memory of 392	3908	cmd.exe	reg.exe
PID 3908 wrote to memory of 392	3908	cmd.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\d03b466887d59a3c98ae312c7f317e998a73c7212a78391e859c95bd981c992a.exe
"C:\Users\Admin\AppData\Local\Temp\d03b466887d59a3c98ae312c7f317e998a73c7212a78391e859c95bd981c992a.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2456

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QPKJE.bat" "
2⤵
- Suspicious use of WriteProcessMemory
PID:2504

C:\Windows\SysWOW64\reg.exe
REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Window Updates" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe" /f
3⤵
- Adds Run key to start application
PID:5028

C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe
"C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4688

C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe
"C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1076

C:\Windows\SysWOW64\cmd.exe
cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
4⤵
- Suspicious use of WriteProcessMemory
PID:2212

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
5⤵
- Modifies firewall policy service
- Modifies registry key
PID:3224

C:\Windows\SysWOW64\cmd.exe
cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe:*:Enabled:Windows Messanger" /f
4⤵
- Suspicious use of WriteProcessMemory
PID:3284

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe:*:Enabled:Windows Messanger" /f
5⤵
- Modifies firewall policy service
- Modifies registry key
PID:5060

C:\Windows\SysWOW64\cmd.exe
cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
4⤵
- Suspicious use of WriteProcessMemory
PID:3908

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
5⤵
- Modifies firewall policy service
- Modifies registry key
PID:392

C:\Windows\SysWOW64\cmd.exe
cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Windows Updater.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows Updater.exe:*:Enabled:Windows Messanger" /f
4⤵
- Suspicious use of WriteProcessMemory
PID:4164

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Windows Updater.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows Updater.exe:*:Enabled:Windows Messanger" /f
5⤵
- Modifies firewall policy service
- Modifies registry key
PID:4296

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\QPKJE.txt
Filesize
158B

MD5
1954c7e666c5b4d1117ef07bc0c9b8ec

SHA1
559e3c0273c1463e9184027b749bdaad0a372681

SHA256
35e0dbc8b455ca38976157ce9d0293fd6cdca20f46f1cb69058a1e0f0af6f693

SHA512
3939de8d0ab7e67b59ff8bebed5580dafd38d8785193fd42a289728500761a68b9e6660605e19e10d4278dd106fea4b273a208f25485e7389c8f19b2958c926a

Download Submit
C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.txt
Filesize
1.5MB

MD5
7bd713ad3f4f78df7ef3cf9c26ead84e

SHA1
9e2ff737efee399dea8a120237417d6f8ebf08a2

SHA256
1ba94e7021358d974067423031d4e603c86cb8150e45045a1e6f110a378867da

SHA512
e32d7b19cd96a1f9ebd48077ca98f3e60291a07f1642929051635875a71759970aab2e57da042b9940ddef1952c67803c21eeacf099878269749b39a129af9b2

Download Submit
memory/1076-43-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1076-45-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1076-34-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1076-35-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1076-41-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1076-42-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1076-55-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1076-31-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1076-46-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1076-47-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1076-49-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1076-50-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1076-51-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1076-53-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1076-54-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2456-0-0x0000000000400000-0x000000000058D000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads