d5615adb16c4877b88d097f98b870b94c4520c6a93e73b9b7e0cc12c64473341

Analysis

max time kernel
100s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/07/2026, 22:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-13_7c5e580a80450461d606a162512a0886_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
Size 832KB
Sample260713-1x59cabw21
SHA256 d5615adb16c4877b88d097f98b870b94c4520c6a93e73b9b7e0cc12c64473341
MD5 7c5e580a80450461d606a162512a0886
SHA1 a4b5bf8bc7721cd3d72d98406654b6324d3ee0c8
SHA512 080fbbe45b33af7345cf5f9230871bd58a94201c33bb7955a91c3b7c138aeee5c6ffeb5836bf5693915177e2f339612e3ed12447ae1a35ccd1276b3ada52a5f9
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybaBCE:J/sCv7QExqatgl8beJTTx0yFybaBCE
TLSH
T11B055B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F32BF0B73A769
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/4560-0-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c529-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2d6-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b300-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019857-214.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-257.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-372.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-469.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000b000000018a68-494.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-591.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-622.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-707.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-732.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-781.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-818.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-849.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-868.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-881.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-888.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-901.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-920.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-945.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-976.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1001.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1044.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1081.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1130.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1149.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1168.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1175.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1212.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1315.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1334.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-1359.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1366.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1373.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1386.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1387.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1388.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1389.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1390.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4560-2003-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/892-2022-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack

Executes dropped EXE 1 IoCs

pid	Process
892	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-13_7c5e580a80450461d606a162512a0886_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-13_7c5e580a80450461d606a162512a0886_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe	patcher.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-07-13_7c5e580a80450461d606a162512a0886_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe	2026-07-13_7c5e580a80450461d606a162512a0886_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe$	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe	2026-07-13_7c5e580a80450461d606a162512a0886_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmlaunch.exe	2026-07-13_7c5e580a80450461d606a162512a0886_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe$	patcher.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-07-13_7c5e580a80450461d606a162512a0886_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-13_7c5e580a80450461d606a162512a0886_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-07-13_7c5e580a80450461d606a162512a0886_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-13_7c5e580a80450461d606a162512a0886_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-07-13_7c5e580a80450461d606a162512a0886_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-07-13_7c5e580a80450461d606a162512a0886_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-07-13_7c5e580a80450461d606a162512a0886_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-07-13_7c5e580a80450461d606a162512a0886_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-07-13_7c5e580a80450461d606a162512a0886_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-13_7c5e580a80450461d606a162512a0886_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-13_7c5e580a80450461d606a162512a0886_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-07-13_7c5e580a80450461d606a162512a0886_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-13_7c5e580a80450461d606a162512a0886_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-13_7c5e580a80450461d606a162512a0886_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-13_7c5e580a80450461d606a162512a0886_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-07-13_7c5e580a80450461d606a162512a0886_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-07-13_7c5e580a80450461d606a162512a0886_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-07-13_7c5e580a80450461d606a162512a0886_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-13_7c5e580a80450461d606a162512a0886_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-13_7c5e580a80450461d606a162512a0886_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-07-13_7c5e580a80450461d606a162512a0886_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-13_7c5e580a80450461d606a162512a0886_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-13_7c5e580a80450461d606a162512a0886_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4560	2026-07-13_7c5e580a80450461d606a162512a0886_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
892	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-13_7c5e580a80450461d606a162512a0886_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-13_7c5e580a80450461d606a162512a0886_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4560

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 832KB
SHA256 d5615adb16c4877b88d097f98b870b94c4520c6a93e73b9b7e0cc12c64473341
MD5 7c5e580a80450461d606a162512a0886
SHA1 a4b5bf8bc7721cd3d72d98406654b6324d3ee0c8
SHA512 080fbbe45b33af7345cf5f9230871bd58a94201c33bb7955a91c3b7c138aeee5c6ffeb5836bf5693915177e2f339612e3ed12447ae1a35ccd1276b3ada52a5f9
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybaBCE:J/sCv7QExqatgl8beJTTx0yFybaBCE
TLSH
T11B055B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F32BF0B73A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.3MB
SHA256 4394b107a5d92830e8d460d52c6705634441267c19aab19ab6958a902c39efc3
MD5 8f471b4ffe9c73ec4622dedbaaa2ffd1
SHA1 ae1917fce5f6e2c6e266c154c147eb9d568dcaa4
SHA512 459c50592b3d81bc68ca7a8815c77d8f249ef35500d93ea0c11da96501f0d3e143c12fd5af0216955f72e76109cf11d5d209d7a5f3a717593e3827ff0dd06fc3
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaBCEP0Le5ji0hmxNrM:NDqatgl9TKWPji0Aj
TLSH
T185655A53FA648672D0228171C4E75686EA71B4461B3086CB13ADDB7C2F33BF1A63A735
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 846KB
SHA256 0f7b3f7131ae2614ad67131db4abe6358e0f95664745823acbc721819930829e
MD5 ba28bd6197532b7e727006a374c481e3
SHA1 3919d1c3fdd9c0e312086555bc0e23605e785864
SHA512 d2b6b4efa28de5dfba023e87028d50d34c4c089854370cbe228464d35bedd7d097c61e3f960d5c0e63f4178ed5d558728e13070740d23ec328b4d3a9f3536691
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaBCERa:NDqatgl9TK
TLSH
T1EC054B53BA4485A2D416023054EB4653EB71FC1A1F11968F23BCAB6D1F32BF0B73A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 855KB
SHA256 01e8cf41a5d4ca85b2985387b9de70aa307b4f8f2e532a55733bf66f87894209
MD5 e488b9aef1cdabc949394ebece2606b9
SHA1 4a144468ae1015a59e7e3b34e2f861cc1f300d4e
SHA512 26f852cd31dbaaa4ddc110d63842c479cecdf870db36fafd621a672cc1ffc930b18c435bbd687caa034dd849359bb486e4ecfb31c11d9eaa16f32a99159d87ee
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybaBCEo6:J/sCv7QExqatgl8beJTTx0yFybaBCEo6
TLSH
T136155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 855KB
SHA256 8cd8623efe9197517a03b3271afcd022a93db5b9fe3b30a612e352bbb5ba057d
MD5 6203b2e1aedb9066236d8496cfe0a8a2
SHA1 05fb3e0c65d882ba3baf78b774c3fb29d8d88899
SHA512 57f8d5b59645adc624f5dd532b34020ee8623275ecd7e6701e86c9afb4de09455051cfff6d21bad1985ec2dedc4fd4aca7028079a9b75a8c159922805a618fa5
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybaBCEsN:J/sCv7QExqatgl8beJTTx0yFybaBCEsN
TLSH
T101155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 855KB
SHA256 3bf39fc879a5be2804a8496a6a0adf4ee54a97e8b3491aabc008a865eeb37731
MD5 82bea6612a154d829b2e9df08f14cde7
SHA1 0e5db4638d4ef8411ec7ccf58e3a53da23fb0a35
SHA512 5caf303db2ea3d41b05b91e98777d51b2243052b202c9501abc69a87306ae4f34ca3c0822010864690670a4c86d1092fe3db01d19a56c4646753a8bef20f886b
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybaBCEif:J/sCv7QExqatgl8beJTTx0yFybaBCEif
TLSH
T119155B53BA4485A2D416023054EB4653EB71F81A1F11978F237CAB6D1F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 855KB
SHA256 90bf8dcab9f5a3b8754d3a0da4d7881b590cd4c3ee041b83d1444a9cc8c05a0f
MD5 e717ebc85c54d9afae2dfa1efc37eee8
SHA1 69766c1530a8da86a68c683bb0349655567ad171
SHA512 daf8b0a580d4f541bf54bd55c46691026d189b7bbead2a30e37ef861f24f93d888d8d50756a958d81d44ecc0c71f33302b10215964529c64b599bc9123348488
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybaBCE8o:J/sCv7QExqatgl8beJTTx0yFybaBCE8o
TLSH
T13B155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 855KB
SHA256 071ab5c4b172ff7472bb717996142facc4af65c518ad3f2d2f640f0319cc3f65
MD5 f02e02b0cdd91f36aba2d47a2700645c
SHA1 7f843232609aaba5a8c21521460038cda0c8c567
SHA512 e9a672b7a9bdf85abc6c42e3270feea434c0811ad8ff5b0986f4f63e545355aac22d3623a721eeb479f20782dca1f1edeb4b8717a344dc79f5580891aabd1671
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybaBCEcu:J/sCv7QExqatgl8beJTTx0yFybaBCEcu
TLSH
T1D6155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 855KB
SHA256 b6e7d0b5d44d50fa54c1cbf1f0894e9866ed4b131715befe363d2e6a78359f77
MD5 4673012bfe0cad0851ad40b42cbd6f8e
SHA1 69e003dde920982519f2c75eaab02108c25e3cc9
SHA512 2c7543f422bc93e85a96fa6353c26a487a230b50f0ddda559e18fbd01474065afb57ee578832fa7d30654692e1b2970809b53c0e955f088f5744b90ac7d000c3
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybaBCEg9:J/sCv7QExqatgl8beJTTx0yFybaBCEg9
TLSH
T1C1155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 855KB
SHA256 ab31ac635f84df0256a6ed2d9bb53a1afca0fd475dd70e7d528b304c3ba54530
MD5 38f288839da9ddb5b6fa7bc265e70ce6
SHA1 f8c148d5503c2ea9042bf689dfc86460b810d631
SHA512 fec218114aed05a0974d80d9d0a5159654c56036ca8b149e4979486c82234e41ab983da6077d76bf8598a2f11a448d0a56dbedc3c5b155feadd4c5ef49bda1b0
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybaBCEoc:J/sCv7QExqatgl8beJTTx0yFybaBCEoc
TLSH
T149155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 855KB
SHA256 fec0fb0edeb8ab2e75f2118361b7b22ca2f6b0af501a623c4eb0e85ff127cdd8
MD5 e450d3c77eea0cc0b6692576b6cc4fcd
SHA1 1edaf3a40f1594851e4294b0883dab29b9a1ffe3
SHA512 233bb7a5d04d1ba1327626ee1a4579a9213f21be1a9ac83b529923d27034739a87a0aad525991749a61372f2677c0f1f6f8170ddc0a45a38ae9e819030ba969d
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybaBCEBp:J/sCv7QExqatgl8beJTTx0yFybaBCEBp
TLSH
T160155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 855KB
SHA256 1df3274e176bbb367fb5880ceecf8de107531e1c950b6d7df8b87048b82d0655
MD5 1de74c6cfa6043480462e4e374c391df
SHA1 35da4812335953bacea60ac188e180194ddaf563
SHA512 21c97b0747f699fed77000ebdc93ab4d2e1c5e570bfa3dd8670640a93ab3a170b6f331c861649effe382bcf5d190c906c0a63c0063b50e6b0da05893b7bbcbdf
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybaBCEW0a:J/sCv7QExqatgl8beJTTx0yFybaBCEWN
TLSH
T1F3155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 855KB
SHA256 e8830abde4e5ef4c6828542b3af658ba876cbf4d9e544572491d2df702fa20ab
MD5 41faaade183a2a0c4fed56d17781afd3
SHA1 595c4ec5ff9357e546ebdba407aa5cbec5553b19
SHA512 d6484334f07979497df93df0e9aa7461d4b80a396fe599cc3509757f4db3407886587a9315c9c83f3613d8b5dc2bc22d0cbbc5115c72f423c244915a89e38059
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybaBCEaF:J/sCv7QExqatgl8beJTTx0yFybaBCEaF
TLSH
T148155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 855KB
SHA256 a25ce76ba91d9d1cda26cc083e1dab05d639c3980c0b81a7160fe77d290d1b1b
MD5 da0c7f53fe3fe48e104418eb1f5d605c
SHA1 f29445af76039304b0d1eabff3f426a9c9edb853
SHA512 89916384675aba9ff453780a8ddcec0340bfb8ef6b6e438b905d8aaf2eb1db2c3fa001b8210ab5588bc8cac4b6640564ac1560204817930dafbc7040265a0948
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybaBCEvC:J/sCv7QExqatgl8beJTTx0yFybaBCEvC
TLSH
T111155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 855KB
SHA256 5b6dd71abbc02c8cc9df8d1e800cc4c71641b6748c92089d605600c58689c0c5
MD5 f9bb1789adbed58e424226aea1e58b8d
SHA1 ddb6efa63c72ddf1615d436fe8bb13e59c46c02f
SHA512 016f01862face32fe5238b906fccaa123b8ff7fc9a1aade7db38b832d521a0584f7a46571bc955c3368039183d9932a499c4d8c2504de2dd102e0220bbae13fa
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybaBCEQw:J/sCv7QExqatgl8beJTTx0yFybaBCEQw
TLSH
T116155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 855KB
SHA256 a8abcc9fbd38cac8fc8acbe932f4569efe0b3897a35d7edcfd2ef877f509e65f
MD5 441209588e42215544c048dc2633d08b
SHA1 345f5dd38cfc0707c7e35db77a67b991ad3d008b
SHA512 6ae4c04d7f379f91ffd290b232c0a3a397d38b25efbaf04dd0a516e120c39c5468ba119b7b22bc57526b748fb40c218f40295b3a854963454aca46c451eb0e5b
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybaBCEvT:J/sCv7QExqatgl8beJTTx0yFybaBCEvT
TLSH
T122155B53BA4485A2D416023054EB4653EB71F81A1F11978F237CAB6D1F32BF0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 855KB
SHA256 7c9e747d05ede6887486aa35aa22e201fda8bf3596974314690110810d768f4f
MD5 9c2bdfebd0bab8ea1d8764550584bca9
SHA1 3587cccaf4bffdf5fdbeeb9e8885fcd6b9e849bf
SHA512 b7e0ede17661fcae391eb56279de6866fba85508040a9a9721c726af18646da66f8d1be0bd5db7230679cc97922a0fab6c93688a7bcf93ae7837a59cc453e23c
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybaBCEpu:J/sCv7QExqatgl8beJTTx0yFybaBCEpu
TLSH
T1B7155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 855KB
SHA256 2a5e5d41afb0dc5351a9bbc1eb89c86e8762d2803db8eb88d2049ad0b7e683fc
MD5 a43836b0c995fb7a40ae66cc869a1f29
SHA1 23397a5886186f688e35fff69359328d89060fe2
SHA512 b1bdede3ab26523f261a975d63e8277dd318fb3e7ef65ac8c410e5c477de94386aa423b423cd51521831e2c90adc9e8cebc9382a073f39ef50c64be62762b93c
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybaBCEhb:J/sCv7QExqatgl8beJTTx0yFybaBCEhb
TLSH
T161155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 855KB
SHA256 f02637cf590d929b18e9f3d4f28447c4cae461b56529b11cc0a0f2d93d00ae79
MD5 a75f60e9bd608a2e1aa5cdd1f787172f
SHA1 bf5d524487aaf11b410e57e6ec2112d530f19d24
SHA512 a9308f1dcfb654d6f34335e29f7956a55c9929750c4df23efec04671c10ac5dd3a32d9f7269333d74ea8972382d44c5d6349331bc81e9309facda4875271a0a7
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybaBCEpf:J/sCv7QExqatgl8beJTTx0yFybaBCEpf
TLSH
T173155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 855KB
SHA256 cb858481f619fd5ea7b4fa159660f6a41f3bfa57c359000d3a871eed99765036
MD5 219260e91c60ed2757443b18b9ac529a
SHA1 db0bda86f750eadb8201045302b21fca78a06a81
SHA512 9cac17bd081090cceca8158fb8344d779fffbfee6b1bfe3057d5f5b39527f075ef49cea4708a86ac614e9c557fb5b318af70184d46f184bfd94015924ad798f0
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybaBCESK:J/sCv7QExqatgl8beJTTx0yFybaBCESK
TLSH
T1F9155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 855KB
SHA256 fb9882a732e1f7b8a864027aa196d80d68b01ce1601b62c9eb1d110a3705436e
MD5 8fd67e9fb98ab17a9ba683a70c25ecfd
SHA1 06c261c9c7be64d06ccf7d94dc2a39ef3a7c92e3
SHA512 f5dbbeb1c452818411be0678a38cce28b7b20b30f6aa21e00fe4291e8fc7ed4121d5872bf97999a05ee77175e9e3ebaab093e147f65e0b80d5e9fb839a7b0a89
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybaBCE3k:J/sCv7QExqatgl8beJTTx0yFybaBCE3k
TLSH
T157155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 855KB
SHA256 a1fc7f3810908fd23767e18e7ab6633a386de6330462daef9b2d4d02bc44e919
MD5 b8118df2ca17657616d4a373a6c115ef
SHA1 c69a78d610da4c3151c65098d72b64817651de8a
SHA512 6040a9d2f54e293316a0823aa5b8f7cf25d3f91b44362fc1e345b2cc6efb6e0d4113fd248168ce0c28e36641248942d464584d59bbcb050f08c9fec48ff6af5b
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybaBCEA0:J/sCv7QExqatgl8beJTTx0yFybaBCEA0
TLSH
T1D5155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 855KB
SHA256 3a68bbc2a7b55e8a71010675d37684c624cfe4ca8aa05feadc83925e1b181c4a
MD5 7b372ca183dd2f6060583835eff2ec1d
SHA1 47236ea1beecc126ec35859932ca5b0919c9d2d0
SHA512 36aab04a8477eebb7bb188b170531e48bd1824bd9f25c42856f6f01bf9b54867cfa2812e388e12d6086950b150faa7e1508cac768010f4888967be113fc4e04e
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybaBCEb70:J/sCv7QExqatgl8beJTTx0yFybaBCEbg
TLSH
T16A155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 855KB
SHA256 5d09dab45431d7ab1caf076c503de58e04049c4ae4dd75f7632b765ef9b79606
MD5 86861d0cf9fddcc622b1805346357d3f
SHA1 49f9e6fafe22a71557e9332cdd873af3a8e0f726
SHA512 db059238e04bfcb4afbd91ae698071114c4f4aeb7701318f5127b4eb761d56b8a341f54761271a438bc4136a85d50c6404c743fa139f73c0a862352ae945eddc
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybaBCEWr:J/sCv7QExqatgl8beJTTx0yFybaBCEWr
TLSH
T167155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 855KB
SHA256 2cd0eced0d7087ab2cc53901f6739f4f1a68736907b7fe8061a078b4d2f0b4be
MD5 655be40e4679c0feb4f88408cfaa1357
SHA1 e3dbced5190c6f6dd440d006064f361e34334450
SHA512 2b1bae8cf6acb9abbfb1eecff23b5ed223eda7d2f05f5bcb5fcc6087cf04a0173256eb8a7a212ae3087422cdb0ec6e9b0ed6c63796094019f88f1790fd8ab034
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybaBCE8n:J/sCv7QExqatgl8beJTTx0yFybaBCE8n
TLSH
T144155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 855KB
SHA256 8636fa7b9bf3250d604eb18a8c515976e7f126ea4457850ded32e64243c26bb3
MD5 dd5d59401b645f66312f08dba7688d34
SHA1 f3146ae6864c6c7ef0b48cfce0e8120510afeab0
SHA512 5235d1f47d576f30ab197487186802e4bc7ad300c1b250267c540a0399d245fbc28845187f607582f393fc218188a70ff236263a61a4e476010ac674ecc030c4
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybaBCE6x:J/sCv7QExqatgl8beJTTx0yFybaBCE6x
TLSH
T1DC155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 855KB
SHA256 194d440694a16c2c3a3653d4ff568cb35ddeec72100c4449b983bf41f5736025
MD5 36d8f78bcc699b74dbcb8b9026926f3c
SHA1 4ed698b27f40c1dbfc3403b18c6fdc038ddd60a0
SHA512 694058a2c8f144b1e4352da421e0df80a757f33bc5ebf27ec78746ed71ebfd8840accc6728ccd33d871034de69117d7f913df81b172fc18c279acd4354b2a3df
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybaBCE8A:J/sCv7QExqatgl8beJTTx0yFybaBCE8A
TLSH
T1DA155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 855KB
SHA256 69ca710b9b4fae183274d831058a878ce2b87df7cc9a6c54a90bb8e44ca3ac67
MD5 cb8e979f61fcb1eb83b7c624075fcd83
SHA1 0aa26c1cd0963cf7e3d61f5c14fb688dbf2ba31f
SHA512 3dc2d9718db7a30c969a258a5ed39bc097828210e955ebe468faac6618ad701fda0f66f661e4bd77e45ae6afea567c16a4987fee23ef2eef20e734194b8fa486
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaBCEl9Q:NDqatgl9TKv
TLSH
T1EB155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 855KB
SHA256 389d692c9296e04a33abcffd2701bc1d347f413e83a2d1252aec27b610080acc
MD5 4f1524478143e188efa4ac364927fca3
SHA1 d314a1fc9af491f8f11d7a04baeac9851562b318
SHA512 fce10996f5e463d12429e73c10edd927988d15cc07491027d5bfd552b75d0430419868a393b390457d0fec87336bd4e14737fee8de3387d1bb76e75ae9d10491
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybaBCEQ4:J/sCv7QExqatgl8beJTTx0yFybaBCEQ4
TLSH
T14B155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 855KB
SHA256 737152e8be97e88154bf4bb0351d1c63d2155ed886a08e0babd44bd583348d9d
MD5 1cdea0b1a62480c9319392c97ab6c409
SHA1 b6a982821384e3071d04e4b16164df80aacce50c
SHA512 ea38f0b666fe281d047fa4e9ca6358a49315d391a7516c993a7702a052767335ce9f079f2ef92b180e0913556637b1f91314cb1f9ceeb4cd101618f013feb9a8
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybaBCETu:J/sCv7QExqatgl8beJTTx0yFybaBCETu
TLSH
T1DA155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 855KB
SHA256 906e1ca027927e9f37121dd17786017a178e5abc40dc0b7242a6ddf53d94cf72
MD5 ccf2804ec3e2b5d39507a44b6492e2d2
SHA1 99fc4b2ea3e0509d1c4d2e61809b29115a5ad4a5
SHA512 35c4dc9d9c7aecbf0547fa804f7b6864ed0780bac8060c796801f9186da81a218d90c1151420b57d4cf3f2970a52bd6b4bfeffd16316bd4dccefdffb850e81ac
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybaBCEOj:J/sCv7QExqatgl8beJTTx0yFybaBCEOj
TLSH
T167155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 855KB
SHA256 ac9daf26b9482353dce7e8a59ee603d8a3430781f8d637c6a11d3cdecddb1e4f
MD5 bff7b7726217d2d900f98162289f98ea
SHA1 51a9a70f4cba8aada16939c85c10616ca8a43ee3
SHA512 bdc1ad669aa9567dfbdf3338206cb117e70d8bee08d157f6e323b8011bc2200e4774a70fa248a081aa9d0f589d130931e3f57f026b45109a71bac07728dd960a
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybaBCE7g:J/sCv7QExqatgl8beJTTx0yFybaBCE7g
TLSH
T1FA155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 855KB
SHA256 b5c101e579e08036bed0aaf4865f3b7d0cc884fd85d49fbe39e8e2ed140eec0a
MD5 7d5d8cd72f42ee7374f1d01ff49d96ee
SHA1 491d5d4787e5f32dff230c9ea3449bd82c7e5416
SHA512 4b3eea70cb84081c44efd56c89800b1c705038d6e7f7c975b20772888bac1a9884f96d658d15dcc968ead9185bcfb6523b68b17bf8773f1e88d4f8edfce38765
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybaBCEmI:J/sCv7QExqatgl8beJTTx0yFybaBCEmI
TLSH
T17B155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 855KB
SHA256 2de934acf2511f62d449d81915b47318eca5cbd1afd7357bc2cbd031b97f952d
MD5 a842a181c9fdb3c869df4aa23fa5da26
SHA1 dedbc37d9518a78b6b5618d0d6ccfb0b9c2dddf9
SHA512 a1688dc111cf574e551221b8afca0301701e97cb407cb907d298697581ae38fd56e05d0adc4112c366a42162fc2175865604c882ac577663e95aa11d52564cbc
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybaBCEUo:J/sCv7QExqatgl8beJTTx0yFybaBCEUo
TLSH
T149155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 855KB
SHA256 b52ae63416d3783d0e669195abf98724f99bc183af62170c7af860e1dacd2e39
MD5 b385506be55707e7452684a17ffa89a1
SHA1 4b045cef5a188826bda38bf6cb75b67a93d6a981
SHA512 d20e20215db52722e1ce4739282b674d80f848a901981883001e5ffa792d0a34610a039e2667b977ed28c0bf76a0d0a11ab45c752b455e111e34d4400eb9a27e
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybaBCE3+:J/sCv7QExqatgl8beJTTx0yFybaBCE3+
TLSH
T112155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 855KB
SHA256 b80840cd26b7014658e8cc089a8529c94f23b9fa62e5a4bcba9905a2033e2ac7
MD5 f4c69bcaf94ef294030733b8e0d5b060
SHA1 829af0aa88d0abf51a70d45deca46e40f3c68ddd
SHA512 932fea0944ee5588281448ad3fcb74a4c0a79b965608d78ed24b734561f3487d8a5fbc00ac045e2fe24b0410f4943f40072d6c18589836813562dc0e48b6c97b
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybaBCENQ:J/sCv7QExqatgl8beJTTx0yFybaBCENQ
TLSH
T17B155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 855KB
SHA256 b8d40549852dbe3e13578f9bbad1650937004076fb9c106800f23423341e8b0f
MD5 92c586e7986dd7f068e8c874f001c016
SHA1 ab8bb9a8e18a9ac9997d264db644a85cc5998a1b
SHA512 5ab83a45a4bc2f1b25ef7d338c01673d6b46f0c579c0f581c70f521863bc8f14cebc5be8a014da5e9dd7e12c932368e70ec4cec949d22b9c762ae47c6b624c05
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybaBCECX:J/sCv7QExqatgl8beJTTx0yFybaBCECX
TLSH
T185155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F32BF0B73A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 855KB
SHA256 4f198d39c51c242f2c866469621758cc6393a21e49f1d599da0489c0875d2c15
MD5 f590c131b4113fa5494e448af0cbb389
SHA1 e7e7587e210b687127a21b2b53d5e2b96f5102fd
SHA512 95961a4ff00aa262f447b839c414475ae19524c54c8433fd1540f28de942963de239ba9ea644e3d1ef31252a5bac571f52c87a9e2c7bf8cdfc3ae7a49b1dd25b
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybaBCEkL:J/sCv7QExqatgl8beJTTx0yFybaBCEkL
TLSH
T124155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 855KB
SHA256 a41173223a8b2203c300ad7e94738a908cdfb17bd6dd06dd05e842d8df2ef106
MD5 a5e4bcf0a057560d137ae0a31c5f2eae
SHA1 0b0005dfae6e19c202f0c5019d6a4d43090b22a0
SHA512 155cc043d40d629c77fad37c9a9c2f8e2e4298384b9953581a3d3f24dc7ad7941430e91e5d1383888a386754642bda02a82e7b994b7315bbbee6bae1ff554494
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybaBCEAFC:J/sCv7QExqatgl8beJTTx0yFybaBCEAM
TLSH
T188155C53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 855KB
SHA256 df79ed5c88ae82154cd5874ad2d5660dcc57ed9770aa799a5138d75db4102595
MD5 ae2c6d5bed148539bf20079847db1992
SHA1 88ff22457a7d17d0baf6fd9d842a27c6668268aa
SHA512 44c98c915d183462849c3f67434b9985ac4c374b2444361fc31844e57b4b78e4d744eadeec35310bfb1483babd7766cefe427a8897afe2e58fb4fb9d843c074b
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybaBCEhh:J/sCv7QExqatgl8beJTTx0yFybaBCEhh
TLSH
T134155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/892-2022-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4560-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4560-2003-0x0000000000400000-0x000000000040D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads