skuld | 4bf1ea8ace7f1c427b54adc6c8d9da2f79f5be1475e3ca4609e997e2b93f5e87

General

Target

slinky.rar
Size

26.1MB
MD5

710f5f275317d3936d9dcbcb53a579ee
SHA1

b96c3a924aa3642f3b87b7063f7fa2060a9a10d0
SHA256

4bf1ea8ace7f1c427b54adc6c8d9da2f79f5be1475e3ca4609e997e2b93f5e87
SHA512

5775062891166e163b98de8130665bc9d5d400249ba1142e4cd7e901a3c62097347151e8eb58e297ca7b2fc7a36d680b92d3b6d0399a9b009fd0093380da80c3
SSDEEP

393216:T9cWRf8yrPoqsN8KhgKldFVtHyEPXBSeqQTr9BmcfCDLMnyXmJOU7f1cIDuz7Qq4:TSWmcoqstVIcxwMmtnqROecIQ3s

Score

10^/10

skuld persistence stealer

Malware Config

Extracted

Family

skuld

C2

https://ptb.discord.com/api/webhooks/1288586956971835474/KOwZpzzvHgBFnLYWk6PiicTPjzY_P0vpTibLIhpjtTMHi8CPkv2cwuhQTfaTc_MnkUX6

Signatures

Skuld stealer
An info stealer written in Go lang.
stealer skuld
Executes dropped EXE 2 IoCs

Processes:

slinky.exeslinky.exe

pid process

4760 slinky.exe
4228 slinky.exe

pid	process
4760	slinky.exe
4228	slinky.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

slinky.exeslinky.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio Universal Service = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\SecurityHealthSystray.exe"	slinky.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio Universal Service = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\SecurityHealthSystray.exe"	slinky.exe

Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

49 api.ipify.org
50 ip-api.com
57 api.ipify.org
48 api.ipify.org
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
GoLang User-Agent 2 IoCs
Uses default user-agent string defined by GoLang HTTP packages.

Processes:

description flow ioc

HTTP User-Agent header 52 Go-http-client/1.1
HTTP User-Agent header 58 Go-http-client/1.1

flow	ioc
49	api.ipify.org
50	ip-api.com
57	api.ipify.org
48	api.ipify.org

description	flow	ioc
HTTP User-Agent header	52	Go-http-client/1.1
HTTP User-Agent header	58	Go-http-client/1.1

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	OpenWith.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

slinky.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	slinky.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b9992367f000000010000000c000000300a06082b060105050703097a000000010000000c000000300a06082b060105050703097e00000001000000080000000000042beb77d501030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	slinky.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 5c000000010000000400000000080000190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c7e00000001000000080000000000042beb77d5017a000000010000000c000000300a06082b060105050703097f000000010000000c000000300a06082b060105050703091d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c990b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b060105050703080f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d0400000001000000100000003e455215095192e1b75d379fb187298a200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	slinky.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

vlc.exe

pid process

624 vlc.exe
Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

vlc.exe7zFM.exe

pid process

624 vlc.exe
1060 7zFM.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

7zFM.exeslinky.exewmic.exe7zFM.exeslinky.exewmic.exe

description	pid	process
Token: SeRestorePrivilege	1060	7zFM.exe
Token: 35	1060	7zFM.exe
Token: SeSecurityPrivilege	1060	7zFM.exe
Token: SeDebugPrivilege	4760	slinky.exe
Token: SeIncreaseQuotaPrivilege	3448	wmic.exe
Token: SeSecurityPrivilege	3448	wmic.exe
Token: SeTakeOwnershipPrivilege	3448	wmic.exe
Token: SeLoadDriverPrivilege	3448	wmic.exe
Token: SeSystemProfilePrivilege	3448	wmic.exe
Token: SeSystemtimePrivilege	3448	wmic.exe
Token: SeProfSingleProcessPrivilege	3448	wmic.exe
Token: SeIncBasePriorityPrivilege	3448	wmic.exe
Token: SeCreatePagefilePrivilege	3448	wmic.exe
Token: SeBackupPrivilege	3448	wmic.exe
Token: SeRestorePrivilege	3448	wmic.exe
Token: SeShutdownPrivilege	3448	wmic.exe
Token: SeDebugPrivilege	3448	wmic.exe
Token: SeSystemEnvironmentPrivilege	3448	wmic.exe
Token: SeRemoteShutdownPrivilege	3448	wmic.exe
Token: SeUndockPrivilege	3448	wmic.exe
Token: SeManageVolumePrivilege	3448	wmic.exe
Token: 33	3448	wmic.exe
Token: 34	3448	wmic.exe
Token: 35	3448	wmic.exe
Token: 36	3448	wmic.exe
Token: SeIncreaseQuotaPrivilege	3448	wmic.exe
Token: SeSecurityPrivilege	3448	wmic.exe
Token: SeTakeOwnershipPrivilege	3448	wmic.exe
Token: SeLoadDriverPrivilege	3448	wmic.exe
Token: SeSystemProfilePrivilege	3448	wmic.exe
Token: SeSystemtimePrivilege	3448	wmic.exe
Token: SeProfSingleProcessPrivilege	3448	wmic.exe
Token: SeIncBasePriorityPrivilege	3448	wmic.exe
Token: SeCreatePagefilePrivilege	3448	wmic.exe
Token: SeBackupPrivilege	3448	wmic.exe
Token: SeRestorePrivilege	3448	wmic.exe
Token: SeShutdownPrivilege	3448	wmic.exe
Token: SeDebugPrivilege	3448	wmic.exe
Token: SeSystemEnvironmentPrivilege	3448	wmic.exe
Token: SeRemoteShutdownPrivilege	3448	wmic.exe
Token: SeUndockPrivilege	3448	wmic.exe
Token: SeManageVolumePrivilege	3448	wmic.exe
Token: 33	3448	wmic.exe
Token: 34	3448	wmic.exe
Token: 35	3448	wmic.exe
Token: 36	3448	wmic.exe
Token: SeRestorePrivilege	5108	7zFM.exe
Token: 35	5108	7zFM.exe
Token: SeSecurityPrivilege	5108	7zFM.exe
Token: SeDebugPrivilege	4228	slinky.exe
Token: SeIncreaseQuotaPrivilege	2288	wmic.exe
Token: SeSecurityPrivilege	2288	wmic.exe
Token: SeTakeOwnershipPrivilege	2288	wmic.exe
Token: SeLoadDriverPrivilege	2288	wmic.exe
Token: SeSystemProfilePrivilege	2288	wmic.exe
Token: SeSystemtimePrivilege	2288	wmic.exe
Token: SeProfSingleProcessPrivilege	2288	wmic.exe
Token: SeIncBasePriorityPrivilege	2288	wmic.exe
Token: SeCreatePagefilePrivilege	2288	wmic.exe
Token: SeBackupPrivilege	2288	wmic.exe
Token: SeRestorePrivilege	2288	wmic.exe
Token: SeShutdownPrivilege	2288	wmic.exe
Token: SeDebugPrivilege	2288	wmic.exe
Token: SeSystemEnvironmentPrivilege	2288	wmic.exe

Suspicious use of FindShellTrayWindow 14 IoCs

Processes:

vlc.exe7zFM.exe7zFM.exe

pid	process
624	vlc.exe
624	vlc.exe
624	vlc.exe
624	vlc.exe
624	vlc.exe
624	vlc.exe
624	vlc.exe
624	vlc.exe
624	vlc.exe
624	vlc.exe
1060	7zFM.exe
1060	7zFM.exe
5108	7zFM.exe
5108	7zFM.exe

Suspicious use of SendNotifyMessage 9 IoCs

Processes:

vlc.exe

pid process

624 vlc.exe
624 vlc.exe
624 vlc.exe
624 vlc.exe
624 vlc.exe
624 vlc.exe
624 vlc.exe
624 vlc.exe
624 vlc.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

OpenWith.exevlc.exe

pid process

4232 OpenWith.exe
4232 OpenWith.exe
4232 OpenWith.exe
4232 OpenWith.exe
4232 OpenWith.exe
624 vlc.exe

pid	process
4232	OpenWith.exe
4232	OpenWith.exe
4232	OpenWith.exe
4232	OpenWith.exe
4232	OpenWith.exe
624	vlc.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

OpenWith.exeslinky.exeslinky.exe

description	pid	process	target process
PID 4232 wrote to memory of 624	4232	OpenWith.exe	vlc.exe
PID 4232 wrote to memory of 624	4232	OpenWith.exe	vlc.exe
PID 4760 wrote to memory of 3976	4760	slinky.exe	attrib.exe
PID 4760 wrote to memory of 3976	4760	slinky.exe	attrib.exe
PID 4760 wrote to memory of 1976	4760	slinky.exe	attrib.exe
PID 4760 wrote to memory of 1976	4760	slinky.exe	attrib.exe
PID 4760 wrote to memory of 3448	4760	slinky.exe	wmic.exe
PID 4760 wrote to memory of 3448	4760	slinky.exe	wmic.exe
PID 4228 wrote to memory of 4852	4228	slinky.exe	attrib.exe
PID 4228 wrote to memory of 4852	4228	slinky.exe	attrib.exe
PID 4228 wrote to memory of 2960	4228	slinky.exe	attrib.exe
PID 4228 wrote to memory of 2960	4228	slinky.exe	attrib.exe
PID 4228 wrote to memory of 2288	4228	slinky.exe	wmic.exe
PID 4228 wrote to memory of 2288	4228	slinky.exe	wmic.exe

Views/modifies file attributes 1 TTPs 4 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exeattrib.exeattrib.exe

pid process

3976 attrib.exe
1976 attrib.exe
4852 attrib.exe
2960 attrib.exe

pid	process
3976	attrib.exe
1976	attrib.exe
4852	attrib.exe
2960	attrib.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\slinky.rar
1⤵
- Modifies registry class
PID:4760

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4232
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\slinky.rar"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:624

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1964

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\slinky.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1060

C:\Users\Admin\Desktop\slinky\slinky.exe
"C:\Users\Admin\Desktop\slinky\slinky.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\Desktop\slinky\slinky.exe
  2⤵
  - Views/modifies file attributes
  PID:3976
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
  2⤵
  - Views/modifies file attributes
  PID:1976
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get UUID
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3448

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\slinky.rar"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5108

C:\Users\Admin\Desktop\slinky\slinky.exe
"C:\Users\Admin\Desktop\slinky\slinky.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4228
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\Desktop\slinky\slinky.exe
  2⤵
  - Views/modifies file attributes
  PID:4852
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
  2⤵
  - Views/modifies file attributes
  PID:2960
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get UUID
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

Modify Registry

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Desktop\slinky\slinky.exe

Filesize
14.2MB

MD5
5ef2d4590801769c57ea9b4690dc4a7d

SHA1
21a12ed600a2a69cb38091eb75b52c5bfee10c1d

SHA256
48e5cc1db19aacc0b68e6f4d8378fcd833f98cc7606e25a0fc185257332cf532

SHA512
358d4b1d78a7e6f8eabeb622ae6d8fe9d8dd6d2a0e839600ea637c2df42103639e34ac50bc8a7859f621ce858023f7fa527d2081f9c1dd24d200127a0977b99a

Download Submit
memory/624-17-0x00007FF6EBBF0000-0x00007FF6EBCE8000-memory.dmp

Filesize
992KB

Download
memory/624-18-0x00007FFBDA6B0000-0x00007FFBDA6E4000-memory.dmp

Filesize
208KB

Download
memory/624-19-0x00007FFBCA690000-0x00007FFBCA946000-memory.dmp

Filesize
2.7MB

Download
memory/624-20-0x00007FFBC91E0000-0x00007FFBCA290000-memory.dmp

Filesize
16.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads