7cb05ded7feb53c62f1d263314ac4822f333aead4becafb5aa09ba6ce7b36beb

Analysis

user interaction
yes
max time kernel
298s
max time network
290s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 18:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jdszm.ps1
Size 20KB
Sample260910-w15prswygz
SHA256 7cb05ded7feb53c62f1d263314ac4822f333aead4becafb5aa09ba6ce7b36beb
MD5 6b785555636feb232d52ff61ff76b74f
SHA1 0268133bf60c94f9057da70c790efdb9fc4c9500
SHA512 01dd60a2419b04ff5bded7513479b2b455e279b6e8b7bbc618dcabd5a63068dd8c92bc65ecc2af4c83df2415e5dab84317108dcb40a8dd258ae739fb0ffa6c23
SSDEEP 384:5qbFTLBgEqRLM9oqr+hplz+FkOFR5JEav:5qbFTLGEqR49oqr+hplz+75JEav
TLSH
T195927E3DCDA8422ED2B7C229C9DE4503F852691F362CEE4960C7B35A5663143F89376E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Badlisted process makes network request 7 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	3780	powershell.exe
37	3936	powershell.exe
51	3936	powershell.exe
52	3936	powershell.exe
56	3936	powershell.exe
57	3936	powershell.exe
59	3936	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
652	powershell.exe
1044	powershell.exe
4012	powershell.exe
3780	powershell.exe
3936	powershell.exe
1736	powershell.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Drivers-Update-774 = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File \"C:\\Users\\Admin\\AppData\\Windows Update\\AppData\\LocalLow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\tfwbe.ps1\""	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Drivers-Update-465 = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File \"C:\\Users\\Admin\\AppData\\Windows Update\\AppData\\LocalLow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\tfwbe.ps1\""	powershell.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
3936	powershell.exe
3936	powershell.exe
4012	powershell.exe
4012	powershell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1504	cmd.exe
4068	cmd.exe
1768	cmd.exe
3252	cmd.exe
956	cmd.exe
2108	cmd.exe
4892	cmd.exe
360	cmd.exe
4312	cmd.exe
4748	cmd.exe
2640	cmd.exe
1656	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 24 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1656	cmd.exe
2108	cmd.exe
4448	PING.EXE
4316	PING.EXE
1288	PING.EXE
4312	cmd.exe
4748	cmd.exe
4068	cmd.exe
1684	PING.EXE
3252	cmd.exe
4892	cmd.exe
384	PING.EXE
1504	cmd.exe
1672	PING.EXE
3832	PING.EXE
4696	PING.EXE
360	cmd.exe
3464	PING.EXE
2932	PING.EXE
2144	PING.EXE
956	cmd.exe
2640	cmd.exe
4828	PING.EXE
1768	cmd.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2984	ipconfig.exe
4344	ipconfig.exe

Runs ping.exe 1 TTPs 12 IoCs

Remote System Discovery

T1018

pid	Process
384	PING.EXE
4448	PING.EXE
3464	PING.EXE
4316	PING.EXE
1288	PING.EXE
2144	PING.EXE
4696	PING.EXE
1684	PING.EXE
2932	PING.EXE
4828	PING.EXE
1672	PING.EXE
3832	PING.EXE

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
3780	powershell.exe
3780	powershell.exe
3936	powershell.exe
3936	powershell.exe
3936	powershell.exe
1736	powershell.exe
1736	powershell.exe
3936	powershell.exe
3936	powershell.exe
652	powershell.exe
3936	powershell.exe
652	powershell.exe
1044	powershell.exe
1044	powershell.exe
4012	powershell.exe
4012	powershell.exe
4012	powershell.exe
4012	powershell.exe
4012	powershell.exe
4012	powershell.exe
4012	powershell.exe
4012	powershell.exe
4012	powershell.exe
4012	powershell.exe
4012	powershell.exe
4012	powershell.exe
4012	powershell.exe
4012	powershell.exe
4012	powershell.exe
4012	powershell.exe
4012	powershell.exe
4012	powershell.exe
4012	powershell.exe
4012	powershell.exe
4012	powershell.exe
4012	powershell.exe
4012	powershell.exe
4012	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4012	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	3780	powershell.exe
Token: SeDebugPrivilege	3936	powershell.exe
Token: SeDebugPrivilege	1736	powershell.exe
Token: SeDebugPrivilege	652	powershell.exe
Token: SeDebugPrivilege	1044	powershell.exe
Token: SeDebugPrivilege	4012	powershell.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 3780 wrote to memory of 4344	3780	powershell.exe	88
PID 3780 wrote to memory of 2984	3780	powershell.exe	89
PID 3780 wrote to memory of 1428	3780	powershell.exe	90
PID 3780 wrote to memory of 5084	3780	powershell.exe	91
PID 3780 wrote to memory of 4360	3780	powershell.exe	92
PID 3780 wrote to memory of 3936	3780	powershell.exe	94
PID 3936 wrote to memory of 1656	3936	powershell.exe	107
PID 1656 wrote to memory of 1684	1656	cmd.exe	108
PID 3936 wrote to memory of 3252	3936	powershell.exe	109
PID 3936 wrote to memory of 956	3936	powershell.exe	110
PID 3936 wrote to memory of 2108	3936	powershell.exe	111
PID 3936 wrote to memory of 4892	3936	powershell.exe	112
PID 3936 wrote to memory of 1504	3936	powershell.exe	113
PID 2108 wrote to memory of 384	2108	cmd.exe	114
PID 3936 wrote to memory of 360	3936	powershell.exe	115
PID 3252 wrote to memory of 4448	3252	cmd.exe	116
PID 4892 wrote to memory of 4316	4892	cmd.exe	117
PID 956 wrote to memory of 3464	956	cmd.exe	118
PID 1504 wrote to memory of 2932	1504	cmd.exe	119
PID 360 wrote to memory of 1288	360	cmd.exe	120
PID 3936 wrote to memory of 4312	3936	powershell.exe	121
PID 3936 wrote to memory of 4748	3936	powershell.exe	122
PID 3936 wrote to memory of 2640	3936	powershell.exe	123
PID 4748 wrote to memory of 4828	4748	cmd.exe	124
PID 2640 wrote to memory of 1672	2640	cmd.exe	126
PID 4312 wrote to memory of 2144	4312	cmd.exe	125
PID 3936 wrote to memory of 1736	3936	powershell.exe	127
PID 3936 wrote to memory of 2804	3936	powershell.exe	132
PID 3936 wrote to memory of 4572	3936	powershell.exe	133
PID 3936 wrote to memory of 4444	3936	powershell.exe	134
PID 3936 wrote to memory of 4068	3936	powershell.exe	135
PID 4068 wrote to memory of 3832	4068	cmd.exe	136
PID 3936 wrote to memory of 1768	3936	powershell.exe	137
PID 1768 wrote to memory of 4696	1768	cmd.exe	138
PID 3936 wrote to memory of 4220	3936	powershell.exe	139
PID 3936 wrote to memory of 652	3936	powershell.exe	140
PID 3936 wrote to memory of 1044	3936	powershell.exe	141
PID 3936 wrote to memory of 4012	3936	powershell.exe	142
PID 3936 wrote to memory of 2936	3936	powershell.exe	144

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\jdszm.ps1
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3780
- C:\Windows\system32\ipconfig.exe
  "C:\Windows\system32\ipconfig.exe" /release
  2⤵
  - Gathers network information
  PID:4344
- C:\Windows\system32\ipconfig.exe
  "C:\Windows\system32\ipconfig.exe" /renew
  2⤵
  - Gathers network information
  PID:2984
- C:\Windows\system32\netsh.exe
  "C:\Windows\system32\netsh.exe" winsock reset
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1428
- C:\Windows\system32\netsh.exe
  "C:\Windows\system32\netsh.exe" int ip reset
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:5084
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pe4yr0r5\pe4yr0r5.cmdline"
  2⤵
  PID:4360
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy bypass -File C:\Users\Public\wvnkq_01.ps1
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3936
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\broadcastmsg_1778706846.txt"
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:1656
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1684
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_ndp472-kb4054530-x86-x64-allos-enu_decompression_log.txt"
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:3252
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4448
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistmsi4875.txt"
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:956
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3464
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistmsi489c.txt"
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:2108
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:384
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistui4875.txt"
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:4892
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4316
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistui489c.txt"
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:1504
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2932
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\jdszm.ps1"
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:360
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1288
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\ssjvw.txt"
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:4312
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2144
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\wvnkq_01.ps1"
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:4748
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4828
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\wywhs.txt"
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:2640
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1672
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass Set-MpPreference -DisableRealtimeMonitoring $true;Set-MpPreference -DisableIntrusiovnPreventionSystem $true;Set-MpPreference -MAPSReporting 0;Set-MpPreference -SubmitSamplesConsent 2;Add-MpPreference -ExclusionPath $env:SystemDrive\ ;
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1736
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Ivan\Desktop\IP47422703896_20260907_075158_1056f713df.js"
    3⤵
    PID:2804
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Ivan\Desktop\IP47422703896_20260907_075158_1056f713df.js"
    3⤵
    PID:4572
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Ivan\Desktop\IP47422703896_20260907_075158_1056f713df.js"
    3⤵
    PID:4444
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Ivan\Desktop\IP47422703896_20260907_075158_1056f713df.js" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IP47422703896_20260907_075158_1056f713df.js"
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:4068
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3832
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Ivan\Desktop\IP47422703896_20260907_075158_1056f713df.js & del "1"
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:1768
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Ivan\Desktop\IP47422703896_20260907_075158_1056f713df.js
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4696
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Ivan\Desktop\IP47422703896_20260907_075158_1056f713df.js"
    3⤵
    PID:4220
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Windows Update\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\mfqtz_01.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:652
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Windows Update\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\ulyws_02.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1044
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Windows Update\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\tfwbe.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:4012
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Ivan\Desktop\IP47422703896_20260907_075158_1056f713df.js"
    3⤵
    PID:2936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...