Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
113s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20/12/2024, 00:36
Static task
static1
Behavioral task
behavioral1
Sample
b133dcdcfb0b24ad9e785a5e9ec701a0072b71de77c3f66065a17b1eee3acf1dN.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
b133dcdcfb0b24ad9e785a5e9ec701a0072b71de77c3f66065a17b1eee3acf1dN.exe
Resource
win10v2004-20241007-en
General
-
Target
b133dcdcfb0b24ad9e785a5e9ec701a0072b71de77c3f66065a17b1eee3acf1dN.exe
-
Size
202KB
-
MD5
fbe5345d36c187ff6097937069209e20
-
SHA1
768bce8542cd07122d6874848e01d509fd0e93ef
-
SHA256
b133dcdcfb0b24ad9e785a5e9ec701a0072b71de77c3f66065a17b1eee3acf1d
-
SHA512
1b61d370a898f6b9543d73735202fd39969d8f4a1808a6f48fb21761c35e8ccbb5f75e9b02a6d5bf2cc17596a5ebf00ef4bdeff8087f1b9b3e4fbaae670f13fc
-
SSDEEP
3072:BRXdRefOZgmxAXRyBix3ugNebpQx3Kf3UT7YrTPo2PnZycxAAEgE1WeZH/CRuApd:jXDefmwk8ev/rToyMcxEgVeZiuuOs
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Metasploit family
-
Checks computer location settings 2 TTPs 7 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation b133dcdcfb0b24ad9e785a5e9ec701a0072b71de77c3f66065a17b1eee3acf1dN.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wnpvc3.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wnpvc3.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wnpvc3.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wnpvc3.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wnpvc3.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wnpvc3.exe -
Deletes itself 1 IoCs
pid Process 2380 wnpvc3.exe -
Executes dropped EXE 13 IoCs
pid Process 2248 wnpvc3.exe 2380 wnpvc3.exe 4928 wnpvc3.exe 4288 wnpvc3.exe 4312 wnpvc3.exe 2184 wnpvc3.exe 2432 wnpvc3.exe 4436 wnpvc3.exe 636 wnpvc3.exe 2492 wnpvc3.exe 4772 wnpvc3.exe 3768 wnpvc3.exe 5112 wnpvc3.exe -
Drops file in System32 directory 14 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\wnpvc3.exe wnpvc3.exe File opened for modification C:\Windows\SysWOW64\wnpvc3.exe wnpvc3.exe File created C:\Windows\SysWOW64\wnpvc3.exe wnpvc3.exe File opened for modification C:\Windows\SysWOW64\wnpvc3.exe b133dcdcfb0b24ad9e785a5e9ec701a0072b71de77c3f66065a17b1eee3acf1dN.exe File created C:\Windows\SysWOW64\wnpvc3.exe wnpvc3.exe File opened for modification C:\Windows\SysWOW64\wnpvc3.exe wnpvc3.exe File created C:\Windows\SysWOW64\wnpvc3.exe wnpvc3.exe File created C:\Windows\SysWOW64\wnpvc3.exe b133dcdcfb0b24ad9e785a5e9ec701a0072b71de77c3f66065a17b1eee3acf1dN.exe File created C:\Windows\SysWOW64\wnpvc3.exe wnpvc3.exe File opened for modification C:\Windows\SysWOW64\wnpvc3.exe wnpvc3.exe File opened for modification C:\Windows\SysWOW64\wnpvc3.exe wnpvc3.exe File opened for modification C:\Windows\SysWOW64\wnpvc3.exe wnpvc3.exe File created C:\Windows\SysWOW64\wnpvc3.exe wnpvc3.exe File created C:\Windows\SysWOW64\wnpvc3.exe wnpvc3.exe -
Suspicious use of SetThreadContext 7 IoCs
description pid Process procid_target PID 384 set thread context of 3120 384 b133dcdcfb0b24ad9e785a5e9ec701a0072b71de77c3f66065a17b1eee3acf1dN.exe 92 PID 2248 set thread context of 2380 2248 wnpvc3.exe 98 PID 4928 set thread context of 4288 4928 wnpvc3.exe 103 PID 4312 set thread context of 2184 4312 wnpvc3.exe 105 PID 2432 set thread context of 4436 2432 wnpvc3.exe 107 PID 636 set thread context of 2492 636 wnpvc3.exe 109 PID 4772 set thread context of 3768 4772 wnpvc3.exe 111 -
resource yara_rule behavioral2/memory/3120-1-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral2/memory/3120-2-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral2/memory/3120-0-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral2/memory/3120-6-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral2/memory/3120-8-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral2/memory/3120-7-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral2/memory/3120-10-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral2/memory/3120-9-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral2/memory/3120-44-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral2/memory/2380-55-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral2/memory/2380-57-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral2/memory/2380-54-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral2/memory/2380-53-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral2/memory/2380-58-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral2/memory/4288-67-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral2/memory/4288-69-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral2/memory/4288-68-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral2/memory/4288-72-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral2/memory/2184-84-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral2/memory/4436-93-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral2/memory/4436-97-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral2/memory/2492-105-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral2/memory/2492-111-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral2/memory/3768-125-0x0000000000400000-0x000000000046B000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b133dcdcfb0b24ad9e785a5e9ec701a0072b71de77c3f66065a17b1eee3acf1dN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpvc3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpvc3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpvc3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpvc3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b133dcdcfb0b24ad9e785a5e9ec701a0072b71de77c3f66065a17b1eee3acf1dN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpvc3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpvc3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpvc3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpvc3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpvc3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpvc3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpvc3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpvc3.exe -
Modifies registry class 7 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpvc3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpvc3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpvc3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ b133dcdcfb0b24ad9e785a5e9ec701a0072b71de77c3f66065a17b1eee3acf1dN.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpvc3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpvc3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpvc3.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 3120 b133dcdcfb0b24ad9e785a5e9ec701a0072b71de77c3f66065a17b1eee3acf1dN.exe 3120 b133dcdcfb0b24ad9e785a5e9ec701a0072b71de77c3f66065a17b1eee3acf1dN.exe 2380 wnpvc3.exe 2380 wnpvc3.exe 4288 wnpvc3.exe 4288 wnpvc3.exe 2184 wnpvc3.exe 2184 wnpvc3.exe 4436 wnpvc3.exe 4436 wnpvc3.exe 2492 wnpvc3.exe 2492 wnpvc3.exe 3768 wnpvc3.exe 3768 wnpvc3.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 384 wrote to memory of 3120 384 b133dcdcfb0b24ad9e785a5e9ec701a0072b71de77c3f66065a17b1eee3acf1dN.exe 92 PID 384 wrote to memory of 3120 384 b133dcdcfb0b24ad9e785a5e9ec701a0072b71de77c3f66065a17b1eee3acf1dN.exe 92 PID 384 wrote to memory of 3120 384 b133dcdcfb0b24ad9e785a5e9ec701a0072b71de77c3f66065a17b1eee3acf1dN.exe 92 PID 384 wrote to memory of 3120 384 b133dcdcfb0b24ad9e785a5e9ec701a0072b71de77c3f66065a17b1eee3acf1dN.exe 92 PID 384 wrote to memory of 3120 384 b133dcdcfb0b24ad9e785a5e9ec701a0072b71de77c3f66065a17b1eee3acf1dN.exe 92 PID 384 wrote to memory of 3120 384 b133dcdcfb0b24ad9e785a5e9ec701a0072b71de77c3f66065a17b1eee3acf1dN.exe 92 PID 384 wrote to memory of 3120 384 b133dcdcfb0b24ad9e785a5e9ec701a0072b71de77c3f66065a17b1eee3acf1dN.exe 92 PID 384 wrote to memory of 3120 384 b133dcdcfb0b24ad9e785a5e9ec701a0072b71de77c3f66065a17b1eee3acf1dN.exe 92 PID 3120 wrote to memory of 2248 3120 b133dcdcfb0b24ad9e785a5e9ec701a0072b71de77c3f66065a17b1eee3acf1dN.exe 97 PID 3120 wrote to memory of 2248 3120 b133dcdcfb0b24ad9e785a5e9ec701a0072b71de77c3f66065a17b1eee3acf1dN.exe 97 PID 3120 wrote to memory of 2248 3120 b133dcdcfb0b24ad9e785a5e9ec701a0072b71de77c3f66065a17b1eee3acf1dN.exe 97 PID 2248 wrote to memory of 2380 2248 wnpvc3.exe 98 PID 2248 wrote to memory of 2380 2248 wnpvc3.exe 98 PID 2248 wrote to memory of 2380 2248 wnpvc3.exe 98 PID 2248 wrote to memory of 2380 2248 wnpvc3.exe 98 PID 2248 wrote to memory of 2380 2248 wnpvc3.exe 98 PID 2248 wrote to memory of 2380 2248 wnpvc3.exe 98 PID 2248 wrote to memory of 2380 2248 wnpvc3.exe 98 PID 2248 wrote to memory of 2380 2248 wnpvc3.exe 98 PID 2380 wrote to memory of 4928 2380 wnpvc3.exe 101 PID 2380 wrote to memory of 4928 2380 wnpvc3.exe 101 PID 2380 wrote to memory of 4928 2380 wnpvc3.exe 101 PID 4928 wrote to memory of 4288 4928 wnpvc3.exe 103 PID 4928 wrote to memory of 4288 4928 wnpvc3.exe 103 PID 4928 wrote to memory of 4288 4928 wnpvc3.exe 103 PID 4928 wrote to memory of 4288 4928 wnpvc3.exe 103 PID 4928 wrote to memory of 4288 4928 wnpvc3.exe 103 PID 4928 wrote to memory of 4288 4928 wnpvc3.exe 103 PID 4928 wrote to memory of 4288 4928 wnpvc3.exe 103 PID 4928 wrote to memory of 4288 4928 wnpvc3.exe 103 PID 4288 wrote to memory of 4312 4288 wnpvc3.exe 104 PID 4288 wrote to memory of 4312 4288 wnpvc3.exe 104 PID 4288 wrote to memory of 4312 4288 wnpvc3.exe 104 PID 4312 wrote to memory of 2184 4312 wnpvc3.exe 105 PID 4312 wrote to memory of 2184 4312 wnpvc3.exe 105 PID 4312 wrote to memory of 2184 4312 wnpvc3.exe 105 PID 4312 wrote to memory of 2184 4312 wnpvc3.exe 105 PID 4312 wrote to memory of 2184 4312 wnpvc3.exe 105 PID 4312 wrote to memory of 2184 4312 wnpvc3.exe 105 PID 4312 wrote to memory of 2184 4312 wnpvc3.exe 105 PID 4312 wrote to memory of 2184 4312 wnpvc3.exe 105 PID 2184 wrote to memory of 2432 2184 wnpvc3.exe 106 PID 2184 wrote to memory of 2432 2184 wnpvc3.exe 106 PID 2184 wrote to memory of 2432 2184 wnpvc3.exe 106 PID 2432 wrote to memory of 4436 2432 wnpvc3.exe 107 PID 2432 wrote to memory of 4436 2432 wnpvc3.exe 107 PID 2432 wrote to memory of 4436 2432 wnpvc3.exe 107 PID 2432 wrote to memory of 4436 2432 wnpvc3.exe 107 PID 2432 wrote to memory of 4436 2432 wnpvc3.exe 107 PID 2432 wrote to memory of 4436 2432 wnpvc3.exe 107 PID 2432 wrote to memory of 4436 2432 wnpvc3.exe 107 PID 2432 wrote to memory of 4436 2432 wnpvc3.exe 107 PID 4436 wrote to memory of 636 4436 wnpvc3.exe 108 PID 4436 wrote to memory of 636 4436 wnpvc3.exe 108 PID 4436 wrote to memory of 636 4436 wnpvc3.exe 108 PID 636 wrote to memory of 2492 636 wnpvc3.exe 109 PID 636 wrote to memory of 2492 636 wnpvc3.exe 109 PID 636 wrote to memory of 2492 636 wnpvc3.exe 109 PID 636 wrote to memory of 2492 636 wnpvc3.exe 109 PID 636 wrote to memory of 2492 636 wnpvc3.exe 109 PID 636 wrote to memory of 2492 636 wnpvc3.exe 109 PID 636 wrote to memory of 2492 636 wnpvc3.exe 109 PID 636 wrote to memory of 2492 636 wnpvc3.exe 109 PID 2492 wrote to memory of 4772 2492 wnpvc3.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\b133dcdcfb0b24ad9e785a5e9ec701a0072b71de77c3f66065a17b1eee3acf1dN.exe"C:\Users\Admin\AppData\Local\Temp\b133dcdcfb0b24ad9e785a5e9ec701a0072b71de77c3f66065a17b1eee3acf1dN.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:384 -
C:\Users\Admin\AppData\Local\Temp\b133dcdcfb0b24ad9e785a5e9ec701a0072b71de77c3f66065a17b1eee3acf1dN.exe"C:\Users\Admin\AppData\Local\Temp\b133dcdcfb0b24ad9e785a5e9ec701a0072b71de77c3f66065a17b1eee3acf1dN.exe"2⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Windows\SysWOW64\wnpvc3.exe"C:\Windows\system32\wnpvc3.exe" C:\Users\Admin\AppData\Local\Temp\B133DC~1.EXE3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Windows\SysWOW64\wnpvc3.exe"C:\Windows\system32\wnpvc3.exe" C:\Users\Admin\AppData\Local\Temp\B133DC~1.EXE4⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Windows\SysWOW64\wnpvc3.exe"C:\Windows\system32\wnpvc3.exe" C:\Windows\SysWOW64\wnpvc3.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Windows\SysWOW64\wnpvc3.exe"C:\Windows\system32\wnpvc3.exe" C:\Windows\SysWOW64\wnpvc3.exe6⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Windows\SysWOW64\wnpvc3.exe"C:\Windows\system32\wnpvc3.exe" C:\Windows\SysWOW64\wnpvc3.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Windows\SysWOW64\wnpvc3.exe"C:\Windows\system32\wnpvc3.exe" C:\Windows\SysWOW64\wnpvc3.exe8⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Windows\SysWOW64\wnpvc3.exe"C:\Windows\system32\wnpvc3.exe" C:\Windows\SysWOW64\wnpvc3.exe9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Windows\SysWOW64\wnpvc3.exe"C:\Windows\system32\wnpvc3.exe" C:\Windows\SysWOW64\wnpvc3.exe10⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Windows\SysWOW64\wnpvc3.exe"C:\Windows\system32\wnpvc3.exe" C:\Windows\SysWOW64\wnpvc3.exe11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Windows\SysWOW64\wnpvc3.exe"C:\Windows\system32\wnpvc3.exe" C:\Windows\SysWOW64\wnpvc3.exe12⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Windows\SysWOW64\wnpvc3.exe"C:\Windows\system32\wnpvc3.exe" C:\Windows\SysWOW64\wnpvc3.exe13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4772 -
C:\Windows\SysWOW64\wnpvc3.exe"C:\Windows\system32\wnpvc3.exe" C:\Windows\SysWOW64\wnpvc3.exe14⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3768 -
C:\Windows\SysWOW64\wnpvc3.exe"C:\Windows\system32\wnpvc3.exe" C:\Windows\SysWOW64\wnpvc3.exe15⤵
- Executes dropped EXE
PID:5112
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
202KB
MD5fbe5345d36c187ff6097937069209e20
SHA1768bce8542cd07122d6874848e01d509fd0e93ef
SHA256b133dcdcfb0b24ad9e785a5e9ec701a0072b71de77c3f66065a17b1eee3acf1d
SHA5121b61d370a898f6b9543d73735202fd39969d8f4a1808a6f48fb21761c35e8ccbb5f75e9b02a6d5bf2cc17596a5ebf00ef4bdeff8087f1b9b3e4fbaae670f13fc