kpot | d1a24f64b436b5c97f167b45b00d6565887c8f7feae1bb9673b31bfe76868fca

Analysis

max time kernel
137s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
29/04/2024, 02:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d1a24f64b436b5c97f167b45b00d6565887c8f7feae1bb9673b31bfe76868fca.exe
Size 1.3MB
Sample240429-c3fnwaff86
SHA256 d1a24f64b436b5c97f167b45b00d6565887c8f7feae1bb9673b31bfe76868fca
MD5 8b41ca11262643b77a05737d525efd5a
SHA1 618f9f1b1b03c75431f9909c10c966d4d9913720
SHA512 f3ee1cc8a718e41e3ef246853b1f1f41f2f14055aa18486a44fe490455b75c094ba530c84595961062820a4dbf951bd632f64db3bd0b0203fff5cfffa13fe4a7
SSDEEP 24576:zQ5aILMCfmAUjzX6xQt+4En+bcMAOxA5zYlQvmp8RxAb5J6iHsl5TwnD4ug8:E5aIwC+Agr6StVEnmcKxYDvZThTwndg8
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kpot trickbot banker stealer trojan

Malware Config

Signatures

KPOT
KPOT is an information stealer that steals user data and account credentials.
trojan stealer kpot

KPOT Core Executable 1 IoCs

resource	yara_rule
behavioral2/files/0x000a000000023b73-23.dat	family_kpot

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 7 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

resource	yara_rule
behavioral2/memory/1332-16-0x0000000002FF0000-0x0000000003019000-memory.dmp	trickbot_loader32
behavioral2/memory/1332-20-0x0000000002FF0000-0x0000000003019000-memory.dmp	trickbot_loader32
behavioral2/memory/1332-24-0x0000000002FF0000-0x0000000003019000-memory.dmp	trickbot_loader32
behavioral2/memory/3332-44-0x00000000021E0000-0x0000000002209000-memory.dmp	trickbot_loader32
behavioral2/memory/3332-59-0x00000000021E0000-0x0000000002209000-memory.dmp	trickbot_loader32
behavioral2/memory/2724-80-0x0000000001520000-0x0000000001549000-memory.dmp	trickbot_loader32
behavioral2/memory/2724-94-0x0000000001520000-0x0000000001549000-memory.dmp	trickbot_loader32

Executes dropped EXE 3 IoCs

pid	Process
3332	d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe
2724	d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe
4472	d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTcbPrivilege	2724	d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe
Token: SeTcbPrivilege	4472	d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1332	d1a24f64b436b5c97f167b45b00d6565887c8f7feae1bb9673b31bfe76868fca.exe
3332	d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe
2724	d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe
4472	d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1332 wrote to memory of 3332	1332	d1a24f64b436b5c97f167b45b00d6565887c8f7feae1bb9673b31bfe76868fca.exe	84
PID 1332 wrote to memory of 3332	1332	d1a24f64b436b5c97f167b45b00d6565887c8f7feae1bb9673b31bfe76868fca.exe	84
PID 1332 wrote to memory of 3332	1332	d1a24f64b436b5c97f167b45b00d6565887c8f7feae1bb9673b31bfe76868fca.exe	84
PID 3332 wrote to memory of 436	3332	d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe	86
PID 3332 wrote to memory of 436	3332	d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe	86
PID 3332 wrote to memory of 436	3332	d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe	86
PID 3332 wrote to memory of 436	3332	d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe	86
PID 3332 wrote to memory of 436	3332	d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe	86
PID 3332 wrote to memory of 436	3332	d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe	86
PID 3332 wrote to memory of 436	3332	d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe	86
PID 3332 wrote to memory of 436	3332	d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe	86
PID 3332 wrote to memory of 436	3332	d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe	86
PID 3332 wrote to memory of 436	3332	d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe	86
PID 3332 wrote to memory of 436	3332	d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe	86
PID 3332 wrote to memory of 436	3332	d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe	86
PID 3332 wrote to memory of 436	3332	d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe	86
PID 3332 wrote to memory of 436	3332	d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe	86
PID 3332 wrote to memory of 436	3332	d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe	86
PID 3332 wrote to memory of 436	3332	d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe	86
PID 3332 wrote to memory of 436	3332	d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe	86
PID 3332 wrote to memory of 436	3332	d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe	86
PID 3332 wrote to memory of 436	3332	d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe	86
PID 3332 wrote to memory of 436	3332	d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe	86
PID 3332 wrote to memory of 436	3332	d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe	86
PID 3332 wrote to memory of 436	3332	d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe	86
PID 3332 wrote to memory of 436	3332	d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe	86
PID 3332 wrote to memory of 436	3332	d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe	86
PID 3332 wrote to memory of 436	3332	d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe	86
PID 3332 wrote to memory of 436	3332	d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe	86
PID 2724 wrote to memory of 4304	2724	d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe	99
PID 2724 wrote to memory of 4304	2724	d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe	99
PID 2724 wrote to memory of 4304	2724	d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe	99
PID 2724 wrote to memory of 4304	2724	d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe	99
PID 2724 wrote to memory of 4304	2724	d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe	99
PID 2724 wrote to memory of 4304	2724	d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe	99
PID 2724 wrote to memory of 4304	2724	d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe	99
PID 2724 wrote to memory of 4304	2724	d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe	99
PID 2724 wrote to memory of 4304	2724	d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe	99
PID 2724 wrote to memory of 4304	2724	d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe	99
PID 2724 wrote to memory of 4304	2724	d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe	99
PID 2724 wrote to memory of 4304	2724	d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe	99
PID 2724 wrote to memory of 4304	2724	d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe	99
PID 2724 wrote to memory of 4304	2724	d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe	99
PID 2724 wrote to memory of 4304	2724	d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe	99
PID 2724 wrote to memory of 4304	2724	d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe	99
PID 2724 wrote to memory of 4304	2724	d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe	99
PID 2724 wrote to memory of 4304	2724	d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe	99
PID 2724 wrote to memory of 4304	2724	d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe	99
PID 2724 wrote to memory of 4304	2724	d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe	99
PID 2724 wrote to memory of 4304	2724	d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe	99
PID 2724 wrote to memory of 4304	2724	d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe	99
PID 2724 wrote to memory of 4304	2724	d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe	99
PID 2724 wrote to memory of 4304	2724	d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe	99
PID 2724 wrote to memory of 4304	2724	d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe	99
PID 2724 wrote to memory of 4304	2724	d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe	99
PID 4472 wrote to memory of 3332	4472	d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe	101
PID 4472 wrote to memory of 3332	4472	d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe	101
PID 4472 wrote to memory of 3332	4472	d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe	101
PID 4472 wrote to memory of 3332	4472	d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe	101
PID 4472 wrote to memory of 3332	4472	d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe	101
PID 4472 wrote to memory of 3332	4472	d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe	101
PID 4472 wrote to memory of 3332	4472	d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe	101
PID 4472 wrote to memory of 3332	4472	d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe	101
PID 4472 wrote to memory of 3332	4472	d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\d1a24f64b436b5c97f167b45b00d6565887c8f7feae1bb9673b31bfe76868fca.exe
"C:\Users\Admin\AppData\Local\Temp\d1a24f64b436b5c97f167b45b00d6565887c8f7feae1bb9673b31bfe76868fca.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1332
- C:\Users\Admin\AppData\Roaming\WinSocket\d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe
  C:\Users\Admin\AppData\Roaming\WinSocket\d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3332
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:436

C:\Users\Admin\AppData\Roaming\WinSocket\d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe
C:\Users\Admin\AppData\Roaming\WinSocket\d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:4304

C:\Users\Admin\AppData\Roaming\WinSocket\d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe
C:\Users\Admin\AppData\Roaming\WinSocket\d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:3332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe

Path C:\Users\Admin\AppData\Roaming\WinSocket\d1a24f74b437b6c98f178b46b00d7676998c9f8feae1bb9783b31bfe87979fca.exe
Size 1.3MB
SHA256 d1a24f64b436b5c97f167b45b00d6565887c8f7feae1bb9673b31bfe76868fca
MD5 8b41ca11262643b77a05737d525efd5a
SHA1 618f9f1b1b03c75431f9909c10c966d4d9913720
SHA512 f3ee1cc8a718e41e3ef246853b1f1f41f2f14055aa18486a44fe490455b75c094ba530c84595961062820a4dbf951bd632f64db3bd0b0203fff5cfffa13fe4a7
SSDEEP 24576:zQ5aILMCfmAUjzX6xQt+4En+bcMAOxA5zYlQvmp8RxAb5J6iHsl5TwnD4ug8:E5aIwC+Agr6StVEnmcKxYDvZThTwndg8
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.ini

Path C:\Users\Admin\AppData\Roaming\WinSocket\settings.ini
Size 42KB
SHA256 adb065a1802474f3eaf8f5b8d90ed24cfeaf58d7e29fa7e2ea410f4604b29331
MD5 1d3bf49899cf775b496b5c0238a55ba1
SHA1 c315cb161c937131830e46682ab7ac4f2bb11513
SHA512 a9b706797e36d82b3e04ee8a899ecdb68fb78cfd298a5790be924e9e330c9f297fa0e66debcb5254a2e0c93238c5711d9ac8dee32bb36cecd3ff68dd4cbaf059
SSDEEP 768:FaJ4U/SfFjY9mb7ZwBhvBCjz2xN0bNL0atyqJM3RloYztnZYoAPIXvu5DSnhkz/h:2tTzq
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/436-56-0x0000023416D70000-0x0000023416D71000-memory.dmp

Download

memory/436-50-0x0000000010000000-0x000000001001E000-memory.dmp

Download

memory/1332-16-0x0000000002FF0000-0x0000000003019000-memory.dmp

Download

memory/1332-20-0x0000000002FF0000-0x0000000003019000-memory.dmp

Download

memory/1332-8-0x00000000021E0000-0x00000000021E1000-memory.dmp

Download

memory/1332-7-0x00000000021E0000-0x00000000021E1000-memory.dmp

Download

memory/1332-6-0x00000000021E0000-0x00000000021E1000-memory.dmp

Download

memory/1332-5-0x00000000021E0000-0x00000000021E1000-memory.dmp

Download

memory/1332-10-0x00000000021E0000-0x00000000021E1000-memory.dmp

Download

memory/1332-4-0x00000000021E0000-0x00000000021E1000-memory.dmp

Download

memory/1332-3-0x00000000021E0000-0x00000000021E1000-memory.dmp

Download

memory/1332-9-0x00000000021E0000-0x00000000021E1000-memory.dmp

Download

memory/1332-19-0x00000000021E0000-0x00000000021E1000-memory.dmp

Download

memory/1332-18-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/1332-2-0x00000000021E0000-0x00000000021E1000-memory.dmp

Download

memory/1332-11-0x00000000021E0000-0x00000000021E1000-memory.dmp

Download

memory/1332-24-0x0000000002FF0000-0x0000000003019000-memory.dmp

Download

memory/1332-12-0x00000000021E0000-0x00000000021E1000-memory.dmp

Download

memory/1332-14-0x00000000021E0000-0x00000000021E1000-memory.dmp

Download

memory/1332-13-0x00000000021E0000-0x00000000021E1000-memory.dmp

Download

memory/2724-72-0x0000000001510000-0x0000000001511000-memory.dmp

Download

memory/2724-75-0x0000000001510000-0x0000000001511000-memory.dmp

Download

memory/2724-94-0x0000000001520000-0x0000000001549000-memory.dmp

Download

memory/2724-88-0x0000000001BE0000-0x0000000001BE1000-memory.dmp

Download

memory/2724-80-0x0000000001520000-0x0000000001549000-memory.dmp

Download

memory/2724-79-0x0000000001510000-0x0000000001511000-memory.dmp

Download

memory/2724-78-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/2724-64-0x0000000001510000-0x0000000001511000-memory.dmp

Download

memory/2724-65-0x0000000001510000-0x0000000001511000-memory.dmp

Download

memory/2724-66-0x0000000001510000-0x0000000001511000-memory.dmp

Download

memory/2724-67-0x0000000001510000-0x0000000001511000-memory.dmp

Download

memory/2724-68-0x0000000001510000-0x0000000001511000-memory.dmp

Download

memory/2724-69-0x0000000001510000-0x0000000001511000-memory.dmp

Download

memory/2724-70-0x0000000001510000-0x0000000001511000-memory.dmp

Download

memory/2724-71-0x0000000001510000-0x0000000001511000-memory.dmp

Download

memory/2724-73-0x0000000001510000-0x0000000001511000-memory.dmp

Download

memory/2724-74-0x0000000001510000-0x0000000001511000-memory.dmp

Download

memory/3332-46-0x0000000010000000-0x0000000010007000-memory.dmp

Download

memory/3332-35-0x00000000021C0000-0x00000000021C1000-memory.dmp

Download

memory/3332-58-0x0000000003170000-0x0000000003439000-memory.dmp

Download

memory/3332-57-0x00000000030B0000-0x000000000316E000-memory.dmp

Download

memory/3332-37-0x00000000021C0000-0x00000000021C1000-memory.dmp

Download

memory/3332-36-0x00000000021C0000-0x00000000021C1000-memory.dmp

Download

memory/3332-38-0x00000000021C0000-0x00000000021C1000-memory.dmp

Download

memory/3332-55-0x0000000002B30000-0x0000000002B31000-memory.dmp

Download

memory/3332-43-0x00000000021C0000-0x00000000021C1000-memory.dmp

Download

memory/3332-44-0x00000000021E0000-0x0000000002209000-memory.dmp

Download

memory/3332-45-0x0000000010000000-0x0000000010007000-memory.dmp

Download

memory/3332-59-0x00000000021E0000-0x0000000002209000-memory.dmp

Download

memory/3332-42-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/3332-28-0x00000000021C0000-0x00000000021C1000-memory.dmp

Download

memory/3332-29-0x00000000021C0000-0x00000000021C1000-memory.dmp

Download

memory/3332-30-0x00000000021C0000-0x00000000021C1000-memory.dmp

Download

memory/3332-31-0x00000000021C0000-0x00000000021C1000-memory.dmp

Download

memory/3332-32-0x00000000021C0000-0x00000000021C1000-memory.dmp

Download

memory/3332-33-0x00000000021C0000-0x00000000021C1000-memory.dmp

Download

memory/3332-34-0x00000000021C0000-0x00000000021C1000-memory.dmp

Download

memory/3332-39-0x00000000021C0000-0x00000000021C1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads