e7d76533ecc78b50eed201afa5978856c6b39927d21a9449320997ee9ffdd096

Analysis

max time kernel
92s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 01:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_27d4f64c1a841f49fd3fe8cc9792f6e8_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Size 938KB
Sample260730-bzcblsab46
SHA256 e7d76533ecc78b50eed201afa5978856c6b39927d21a9449320997ee9ffdd096
MD5 27d4f64c1a841f49fd3fe8cc9792f6e8
SHA1 42d46c156580b9619c9ca14890a8525c586d25aa
SHA512 73424da6e40bc8aacc65b60392d54d9116521e193b2552090a0bf525b6dd5c57583b16af13c0ee32e604cd46f9edb688e58eeb98e0df8f2aba055e7fb03ec3f0
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD7hSF4s:A3kMP56rv
TLSH
T188157B03A6940FE9D11F817499914666EB777C125F6083CF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/5032-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000b00000001c63b-6.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2b0-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2d1-57.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5032-166-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5680-209-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a42-234.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001982f-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198bf-452.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c0-495.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a3f-586.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c4-617.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c5-690.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c6-733.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c7-782.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c8-820.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c9-852.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ca-871.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cc-890.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cd-903.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ce-916.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-929.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d0-948.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-1003.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-1046.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d3-1103.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-1140.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-1171.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-1178.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-1215.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-1318.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-1337.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-1362.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-1375.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-1389.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1398.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000b00000001c63b-6.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2b0-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2d1-57.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a42-234.dat	aspack_v212_v242
behavioral2/files/0x000400000001982f-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198bf-452.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c0-495.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a3f-586.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c4-617.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c5-690.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c6-733.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c7-782.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c8-820.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c9-852.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ca-871.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cc-890.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cd-903.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ce-916.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cf-929.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d0-948.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d1-1003.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-1046.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d3-1103.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d4-1140.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d5-1171.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-1178.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-1215.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-1318.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-1337.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-1362.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-1375.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-1389.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-1391.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-1392.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-1393.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-1398.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
5680	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-30_27d4f64c1a841f49fd3fe8cc9792f6e8_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-30_27d4f64c1a841f49fd3fe8cc9792f6e8_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe$	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-07-30_27d4f64c1a841f49fd3fe8cc9792f6e8_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-07-30_27d4f64c1a841f49fd3fe8cc9792f6e8_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE	patcher.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-07-30_27d4f64c1a841f49fd3fe8cc9792f6e8_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\mpextms.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-07-30_27d4f64c1a841f49fd3fe8cc9792f6e8_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe$	patcher.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javah.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnscfg.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wabmig.exe	2026-07-30_27d4f64c1a841f49fd3fe8cc9792f6e8_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-07-30_27d4f64c1a841f49fd3fe8cc9792f6e8_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-07-30_27d4f64c1a841f49fd3fe8cc9792f6e8_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	patcher.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-07-30_27d4f64c1a841f49fd3fe8cc9792f6e8_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-07-30_27d4f64c1a841f49fd3fe8cc9792f6e8_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-07-30_27d4f64c1a841f49fd3fe8cc9792f6e8_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-07-30_27d4f64c1a841f49fd3fe8cc9792f6e8_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-30_27d4f64c1a841f49fd3fe8cc9792f6e8_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-07-30_27d4f64c1a841f49fd3fe8cc9792f6e8_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-07-30_27d4f64c1a841f49fd3fe8cc9792f6e8_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-30_27d4f64c1a841f49fd3fe8cc9792f6e8_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-07-30_27d4f64c1a841f49fd3fe8cc9792f6e8_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-30_27d4f64c1a841f49fd3fe8cc9792f6e8_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-07-30_27d4f64c1a841f49fd3fe8cc9792f6e8_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-07-30_27d4f64c1a841f49fd3fe8cc9792f6e8_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-07-30_27d4f64c1a841f49fd3fe8cc9792f6e8_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-07-30_27d4f64c1a841f49fd3fe8cc9792f6e8_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-07-30_27d4f64c1a841f49fd3fe8cc9792f6e8_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_27d4f64c1a841f49fd3fe8cc9792f6e8_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-30_27d4f64c1a841f49fd3fe8cc9792f6e8_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5032	2026-07-30_27d4f64c1a841f49fd3fe8cc9792f6e8_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
5680	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-30_27d4f64c1a841f49fd3fe8cc9792f6e8_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_27d4f64c1a841f49fd3fe8cc9792f6e8_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5032

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 938KB
SHA256 e7d76533ecc78b50eed201afa5978856c6b39927d21a9449320997ee9ffdd096
MD5 27d4f64c1a841f49fd3fe8cc9792f6e8
SHA1 42d46c156580b9619c9ca14890a8525c586d25aa
SHA512 73424da6e40bc8aacc65b60392d54d9116521e193b2552090a0bf525b6dd5c57583b16af13c0ee32e604cd46f9edb688e58eeb98e0df8f2aba055e7fb03ec3f0
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD7hSF4s:A3kMP56rv
TLSH
T188157B03A6940FE9D11F817499914666EB777C125F6083CF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 a9e6bc76d1bafb97e348ad8045b7e94aa957d2845290bcea2734080eae34460a
MD5 73fe45af140f706c52c007c9762f3d52
SHA1 92c94fb0fa754e3a6d73948b98d987e78a9dfa41
SHA512 6e45f7746a6590569919cd389ac8c7368f01569dea023d8cac27c27904add95d4d205ed80b4dc1465be4fe05baba98202a6b75ec006cfd5ef054bbdb14f8c8a3
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD7hSF400Le5ji0hmxNrM:A3kMP56rbPji0Aj
TLSH
T122655A16F6A44BA5D02BC178C5D2569AEA733C425F3087CB1358DE283F237D19A3A772
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 953KB
SHA256 31f50a4547ab3bd1451668419f236b6e68e404e47f4c40b0d10f481edf1a418e
MD5 5e74249aca557a3b29697b39e3f8890d
SHA1 85ff9f162d1da91a2fd3a65e586f70139f05fe36
SHA512 858c6937f3421d3249f364f72ef4ce0d60595e1f0c2ca0c09d71ecd916cec498cdfd4a4e202f3377526c3094049fad55dd7849b08f7aeee48a4f52d62c51b689
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD7hSF4+a:A3kMP56r
TLSH
T154257B03A6940FE5D11F817499924666EB777C125F6083DF2368AE253F327C06E3A3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 962KB
SHA256 092ae87949b2c809f357779f06fc7b059a90fd5050d3860e6cd0e5a1986d7b59
MD5 eb5de69e6405a13f1c085e0f92ae92f1
SHA1 866ae8f8f580b726346cfdfb2a7d9926a03b0f72
SHA512 71e618bb7b9b7577503ae800ba70a4ab298c52288195c4e5605b56e61dc3636add2680d170293289298a1458972f08d9c21a71198b1bf17ee436af8b28600006
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD7hSF4/6:A3kMP56rj
TLSH
T1D7257B03A6940FE9D11F817499914666EB777C125F6083CF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 962KB
SHA256 2e5272278a79d3c561c8364d9775c225d4e15be76811602a7c9fd8fef85166fb
MD5 12b0f9d85fb634bbb675a48caab553e8
SHA1 6e4ececa1047057d7a3df64848274c3f7045dff7
SHA512 c7872ab0ace9c1dea8003434f9e54fb62e5cfbf1c082adc6d8f60f929f50f799f79162eed5744df915e752c40791314100df1035e98bd445364a4316deed9f1d
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD7hSF4hN:A3kMP56re
TLSH
T122257B07A6940FE9D11F817499914666EB777C125F6083CF2368AE253F327C06E3A3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 962KB
SHA256 27f4316e252282d9c5d69d6d66fdfc5ed9905ddefc8f667a7397f537fbe5cb5a
MD5 2cfe36fd22fe14b1d35488c801e93d40
SHA1 15e5dc22991fcd4e574952fbdb40bd322cd30a87
SHA512 ba81a0d676af77bf4404ceccda547d21b4a8521008f7b7f99cde1b8ce99d418901692e514e6d1391fdb2fdcd80d316eeedd8422b4273b11b2302bd93071579b3
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD7hSF4Xf:A3kMP56ry
TLSH
T196257B07A6940FE9D11F817499914666EB777C125F6083CF2368AE253F327C06E3A3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 962KB
SHA256 722a0244c95d44d1371a039327720b54a1584035a5e9fc5872b26d8bc537f9fd
MD5 c8e69bb41c6c8317f3ac2f16b87a3611
SHA1 1d6b6bf350ca94a51e50951552553ccec40c3750
SHA512 7a9518343585c3bf21b3c2d8a032901a02bed0b7ba0c4613e191031446f8eadc803725030ac745e8c4fc8ef8f7dadb4fca9f4d668b879e262761fc2457d361f9
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD7hSF4Zo:A3kMP56r7
TLSH
T1A7257B07A6940FE9D11F817499914666EB777C125F6083CF2368AE253F327C06E3A3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 962KB
SHA256 1400dcb172781815ce7a04bb661c5cb396f423c282d02f8e5d705b6d18ff8235
MD5 4382ea594a4be8e59f2d65bb04e271e4
SHA1 af65dda3703a78b4f4de0c925012ad9be03134aa
SHA512 4356a548b9932f8159d4bd69008afa7da071ed54f5f8f73ea50a510b4e88bb1a776f9bdd1d739d2593dca2bda7300b0ac1eec4f2b37b6614063ec699c9ca0edf
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD7hSF4Ju:A3kMP56r9
TLSH
T18E257B07A6940FE9D11F817499914666EB777C125F6083CF2368AE253F327C06E3A3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 962KB
SHA256 838a2c9843683466400265282caac272e21e7c69565ce8e7ad664f1122c801dc
MD5 350b5e5b37e5273db73113bbfe745e9b
SHA1 15902c3f323bc99c560139d4dda0f9276464d85b
SHA512 80cec9c79108a503f56c9db54ea2422284387ed40ed3d40ec66336ec3ca46d1c03a36a995a67b0ef30ccc35247197638e6af3c7076f9c4caf63e451959dc91cd
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD7hSF4v9:A3kMP56rI
TLSH
T1D5257B03A6940FE9D11F817499914666EB777C125F6083DF2368AE253F327C06E3A3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 962KB
SHA256 7f3530fd43ad3807459f78914b2a3adfe71521f0c922c6ae85a2ff38ff0a4ffe
MD5 77b2ae268c49992306b1d3b8f731e258
SHA1 216a50e206beedc5eca1a6a39708fed7c99d915e
SHA512 008f2b75a3dc1a9434be45f13fecf8f865ed6cf9a05943f6947fc346523cd85958a28d9d8b89edf4a202bfbd5eb547e729ec2c618416f39a94c7cad53d59f2e7
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD7hSF4Lc:A3kMP56rJ
TLSH
T13D257B07A6940FE9D11F817499914666EB777C125F6083CF2368AE253F327C06E3A3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 962KB
SHA256 533cb9d3112e57aa2cc82166284b317ddcd7c0a32157fb9a6096bc5abddbe987
MD5 118e83b4bcaacf2214c858f927c97776
SHA1 7a4229e988d13e2f41e909525c484bb5e317e5ab
SHA512 e855646a5b18270b482d0d29cccf1659794397ff0bc1b13d33b5b0d2dfa61eadbefeb4ea10dcc62de7ff40e48ba4e36201beee3d7f26cac87aed6591d84155de
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD7hSF40p:A3kMP56rn
TLSH
T146257B03A6940FE9D11F817499914666EB777C125F6083CF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 962KB
SHA256 47731ce9245ff5f5edfba92d84958e90f4289d6c4869792b2d26e1e3ed3244b5
MD5 dc874bf99ec1bff1973c532a4e2f9e36
SHA1 3b0ab1d2a25b40575f5749c8b168ba651610e82e
SHA512 1cc932020c5c577a4fcbd339d2dc4538b69099670bb532e8717f08cfa492c2d68abf97345441d71164bc3a8b37583e3ab8444a3d9d3b5cf151bc7e2415b441ab
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD7hSF47N:A3kMP56rs
TLSH
T184257B07A6940FE9D11F817499914666EB777C125F6083CF2368AE253F327C06E3A3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 962KB
SHA256 0f519e782d7196fce017c7061885ce4b52542e976aa82f61df4c038eb9411b62
MD5 b2cc04835b04051ec441ee0d2512e5b3
SHA1 3cae38af5b5f30ec4319caf918664a26c8f0deee
SHA512 f940af90e056a4b388fad7c72bf9f6297f3ac88f1cd5c9a211686c4ae138d94f1f86c3d98360af6a53221f641ad42ffee990c2888dee100623e7cc4e427922c4
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD7hSF4JF:A3kMP56r6
TLSH
T12B257B03A6940FE9D11F817499914666EB777C125F6083CF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 962KB
SHA256 cd014078565a22b00d2a1eb2d84dfe679c96e870f2b9afcf0c2b7315f969f382
MD5 5df009fd1d018813f80d1fefa0d048e2
SHA1 77dd448bccfe6643fc9006162787be32ac7699a1
SHA512 d603ff93c5b2bc59afd24031637f151a6ffac218a672220a7b3b04fe58cc79670de11b5a6de28eab9e3852b47ddbc4235f45667ee1950845c0db8563c5338ecc
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD7hSF4iC:A3kMP56rO
TLSH
T1F3257B03A6940FE9D11F817499914666EB777C125F6083CF2368AE253F327C06E3A3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 962KB
SHA256 8da549530184eb72baa944e2b2ea825b85a25f0079a3123f031c26035c3d2adf
MD5 93a736ad1c70fc6d43fd6e9acd9cc65b
SHA1 956bc66122c9318dd42755f1d1aa9cd950ca5a99
SHA512 8b21b2686ccae7d1bc60f32e2717bf326db3a3588ce547b88d32dd09882d5111806f673e2884ae6a53a5fa6c0d4726d0de4bbdfb0ccf598a1e64cc4bf935bbfd
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD7hSF49w:A3kMP56rb
TLSH
T184257B03A6940FE9D11F817499914666EB777C125F6083DF2368AE253F327C06E3A3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 962KB
SHA256 45f3fcf0491e68d52076013919fcb5ef7639f7c74daf64269236281d6a076230
MD5 39b83b468fb186acae51012ad3ec4fb4
SHA1 b436111a1abf579619578eb18acea1ed7f6610b1
SHA512 70ea738c475eaa4acd71fe59d4eb705955c0c82baedbf502aa8764ac19f83e26d0e5f38064a2a5480faeea5e56224f76c9932b6c3489287b8ee75e891329efe1
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD7hSF4sT:A3kMP56rH
TLSH
T1DF257B03A6940FE9D11F817499914666EB777C125F6083DF2368AE253F327C06E3A3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 962KB
SHA256 312797d685086060d7f078e1d55270baf626b325b3064d79f6202c425e9d0892
MD5 af3f2bbd4ba1a77e9635b72900565e6a
SHA1 fa302c16d3afe3a3acbe7066a7663350adad7381
SHA512 a3d60aeeb7229bb758a9b8b103ee5f55bb630f1700fae2e5d99f698e27efad2ec7ad8fee3e95ca840bed31417662c73c31c5bffa6dad025071765dd1f35487dc
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD7hSF4Au:A3kMP56rI
TLSH
T135257B03A6940FE9D11F817499914666EB777C125F6083DF2368AE253F327C06E3A3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 962KB
SHA256 29bcd356088015c401c7ba8e30a617f58ef5bf0dbd40d35a6334b2310203d228
MD5 1d0fce6859075fdea68dcb5489a02531
SHA1 40d5d7eb418aa03b1f54e9882ce34ca518b1ad46
SHA512 44f53de384bb17621a5e50fe01e68f3ebe883642bf68b96c12d57c621d8269de8178182acaa77d4a3c26f4c599dab1c97f9b8cc4d13c65088e4466f2c4c76776
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD7hSF4eb:A3kMP56rx
TLSH
T10A257B03A6940FE9D11F817499914666EB777C125F6083DF2368AE253F327C06E3A3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 962KB
SHA256 fea63a7e1d284223f3c75d6dbe49119d00354194e4edf6597f13e078cd1a7fe5
MD5 5eaff9341d81874d868846bb4756c57f
SHA1 a2a41030ddb2e467cc7379c05a2310a428e86596
SHA512 fa4028ed87fe4407dd01779397f242282b9aabe09d57b1c2a6db18334219f6ae90367fe76fa19436668f0c620c3e123916faa6ce4ebc90272eeb335094b8b5ea
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD7hSF4If:A3kMP56rx
TLSH
T132257B03A6940FE9D11F817499914666EB777C125F6083CF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 962KB
SHA256 05da6ae0609066c94403af71eccd5e9372941a4ff6327297da9c3e87660cad03
MD5 57a8776a0aff86d5ae79e66bdf0f9acb
SHA1 d6ca22fc0f2aa5da04846f75798223b0173ef7c0
SHA512 bbc0ebba325fad9a2a2d5ec0df89a603630d5a197c01bb31399fa5a9f2893d1fa8d2833a4724b93817144ff4058cc1c7e8a1bd9495414c32dbc98ce1e6f8853f
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD7hSF4lK:A3kMP56rJ
TLSH
T1EF257B03A6940FE9D11F817499914666EB777C125F6083CF2368AE253F327C06E3A3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 962KB
SHA256 fc5fdc8019e8850f6110891bc493e56591a068fcdc947cf6cd1ada296f8a7015
MD5 bc79c844b48ac257c5a4aca8f65b7d61
SHA1 ff8ed14199b031bf2f6f3f2b7a80e264a12643e1
SHA512 6e425950e950eb6f6c7476b340b9c7fe47add43345016b824e8d9920cf97752771d5c38372c64e37e2716408e48f80a8800100152b6ae832bac5d9538eba0fdf
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD7hSF4mk:A3kMP56rA
TLSH
T1B9257B03A6940FE9D11F817499914666EB777C125F6083CF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 962KB
SHA256 9d8283a2e377b458a773ab6a4e0a40a197001cd24a4bbe79cb1a3806aa023841
MD5 9dbecc6dc785144c5716ec7d8d83bdd7
SHA1 7dd124ed8ff476ba3ec80b247f3f12f370f13281
SHA512 3257fe1c83d1cd612ca306e0eff9e18445e435b1471c0174ecdc076ab14335703c4b1d31dffe363f717c37d63258e2df7b5e337cf9ef23cfa97c9cc1ef142133
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD7hSF4j0:A3kMP56rJ
TLSH
T1E1257B03A6940FE9D11F817499914666EB777C125F6083CF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 962KB
SHA256 f4228632592d1701be16fb80fa7d8ed8e455233e0a44aeb8ac6fb166e255003a
MD5 7e359678d9b0f3920f92d2c05535369e
SHA1 5e57ad308ccdc95f1634a3962543ab195b13a9eb
SHA512 f034e9cf930bc275b9e8b27095119157ba8976fbdc216540bdfe1ab43ede561260341f98e7f86292af891afa8141b5c50d70ee6f067a0e48de8ccd99f3ab4b85
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD7hSF4yg:A3kMP56rY
TLSH
T18C257B03A6940FE9D11F817499914666EB777C125F6083CF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 962KB
SHA256 39eed42a640587ab68a9c3088f5b7ab25a7fe837d29988a9abb41d0b867cb795
MD5 6b3275455add0fa148dc124ba632d26a
SHA1 a2e57711ec0524ea05e89c87cd819e578ce899f6
SHA512 150421db415078b858f5c90aa99d60297a3355d36107973c64c87348a21dcb5210baa7721039738ab4b135833ce19c49306832d82283bd51f5f4ab2423f584f4
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD7hSF4Tr:A3kMP56rC
TLSH
T144257B03A6940FE9D11F817499914666EB777C125F6083DF2368AE253F327C06E3A3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 962KB
SHA256 78efed9158a351222ea9af9543cee0eb9720453986c92cadefb3a52400596da5
MD5 2b289f2703e2d0ad20941191ec85bbc7
SHA1 ee02f9e16062ecd35fafb144851a4a34ae9acfa8
SHA512 32302a70e7f743b68e23aa97f5f7c6dcd16cf737faf97a6cf452c13bda3cda895b95628fd91fa848232c1ade4b60072d1d5daf0fd477b63f543a0d3d68eb388e
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD7hSF41n:A3kMP56rU
TLSH
T168257B03A6940FE9D11F817499914666EB777C125F6083DF2368AE253F327C06E3A3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 962KB
SHA256 3b8cf4cb8d693b98dac7c6d43f2be74c60f37122aee18aed760f2e7af61bb270
MD5 aa1274f484785a51efb069f7da7d259c
SHA1 48c07dc14e39d24a868019d1063e76e2b7d38892
SHA512 69e453dbd0dab6342d52df2eb3a6aeeda44d92ccb29c2317522190e8168ea7c7a7cd3e58cd64521f017bf672a21ec98a56d333200b1986794bd64f525e71c431
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD7hSF4Bx:A3kMP56rS
TLSH
T1C4257B03A6940FE9D11F817499914666EB777C125F6083CF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 962KB
SHA256 9092bc6250666bb28e2f22268b0599f739677183b0ba6fde0d6a3c832f1637ff
MD5 6378b5b57746980314144b4931620966
SHA1 8b616122019a3b8feed4fcf14171f8dba3418b72
SHA512 2ffdc8d270e21f21e1b196c6343bc3ab91e829ee2c8e9f692fe5f114f2b93df0534739c4ab6470d76f18ac22ec33cddb624bbd4db3f9ee39fc192ddce1fe94e1
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD7hSF4vA:A3kMP56rx
TLSH
T1DC257B03A6940FE9D11F817499914666EB777C125F6083DF2368AE253F327C06E3A3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 962KB
SHA256 1c75e39e1316fe8ab2f757019ff16d6bcc9da11ff10df503a14bc039d48d0487
MD5 25ffd97270023962b4722a8fbda8b0bf
SHA1 f34ff4cc5f0efd8a644be5cf5c68dbbf5f4e9ddb
SHA512 8b679dde6c23521309887bcbb60c2a51a54d77b2dd1a27986158bf26e3ba0b3baa479335a5ab1685c0a6f601ba08e2bd227ecb07bca1dd369849c759a5974335
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD7hSF4g9Q:A3kMP56rI
TLSH
T11E257B03A6940FE9D11F817499914666EB777C125F6083DF2368AE253F327C06E3A3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 962KB
SHA256 add4e8cc7109161f33fc470e25f83e0c5cebbb57b8b6da035d5929582399c5f9
MD5 e9089cb7d175ea20898c647de1a380ad
SHA1 fe58892e0774605f8db8e8880c4f5bdb4e5ffcd1
SHA512 5d57e7ee8258f03ff057458cb3734aab511ec20d126ab5c1919c97b9901f50c7ed0a141f627c094ada7937f2c5327ee5c4b39e1c923621b5d8f1a30667598d79
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD7hSF4h4:A3kMP56rz
TLSH
T1E0257B03A6940FE9D11F817499914666EB777C125F6083CF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 962KB
SHA256 71bf07b352e9b14a84db153c9e19863eff6e28b8c2e25d9d139274621512faf9
MD5 437c23ca1a05a4b7e58086cc598f2d34
SHA1 0619f358c54aa83ea5278dc2b06c6ab2e1eff949
SHA512 13c74e5f78118332253600c3f6e98f60e2ef5a6c02a3802e16fb8c5820c08bc2ec9760bf2a105733b7e97c1c1021b376408c07e3ad2b486b47bec8c3965b132c
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD7hSF4Eu:A3kMP56rW
TLSH
T149257B03A6940FE9D11F817499914666EB777C125F6083DF2368AE253F327C06E3A3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 962KB
SHA256 074ac82c60678bc2ca16bcadf92c982da6dcb78e03ae62d8ac5b95f7a5322732
MD5 fbb909c1a7d4ec475e27543116173e4e
SHA1 f28f03b1ec6497f053d8266a1efd83c67b369b48
SHA512 441750ccee9eb141e1bbbc50f657ceeb04c8be7c4acaeedeb287bd380103b526dcb9b21c368c4603c153e89408be2b663b69df2a86b4b7962bc81e2a88100f3f
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD7hSF41j:A3kMP56ro
TLSH
T1F3257B03A6940FE9D11F817499914666EB777C125F6083DF2368AE253F327C06E3A3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 962KB
SHA256 baf65a88ee713ed73a4dd99b08c14e2e1f2b44f35feeb6ab664339d3b3c5cf80
MD5 88b4840e568c4b3a62efe64d240b58b7
SHA1 fcf5e5eb9999ddc7735aa5c221cba0081beba927
SHA512 80e5a64f04f55f663b4624438bd23c4be4ffb376891947a967e60ce84f968f890efafca71d07b997c24cc393449aaa161b344fa16d6c1b291569d81bd4134d5d
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD7hSF4cg:A3kMP56rw
TLSH
T1A6257B03A6940FE9D11F817499914666EB777C125F6083DF2368AE253F327C06E3A3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 962KB
SHA256 3a409c685f3b490ff2d9699ae4c41f21024ebeb2eeb627981fcef05175f92c70
MD5 0234cdd4cd13f4437f720b4dd8d05bd0
SHA1 f47442aed5c08e69536ef78a3d0b6bd02c2e7f2a
SHA512 4108b335deac40a361fb503c0eceb45da1c01a3661860d3256ce9126f0d5db140f87155baf89380363b49d0b9d561e9f18ad6b5a78fcbb174f659400c068dd5b
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD7hSF4DI:A3kMP56rR
TLSH
T1C9257B03A6940FE9D11F817499914666EB777C125F6083DF2368AE253F327C06E3A3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 962KB
SHA256 6cc98046157fffe12f7e33d1c377f6c938ec3616a1768e9ae3a75db6dbc78075
MD5 1c06aa5f0385bf92308ed17b130bc200
SHA1 5a23d351ee4283c2d6afddeb92f961a83b125f5d
SHA512 8e18aa047a7b60b363c40ebba402815fc41694ab1f89b331a482aebbf06b9a6f3241387132c44514c70d2de87c25534d184e3e9f64bf6ba8f63fcebf5d416350
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD7hSF4Zo:A3kMP56rv
TLSH
T12F257B03A6940FE9D11F817499914666EB777C125F6083CF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 962KB
SHA256 ee154ebe4f619523d4ab828bba43d174d340016b5c8041c66d38b806393afd03
MD5 a3c8e79c02d5f43f14fb173d65c321b3
SHA1 d64e79737268dd58e222abd174b5ac809c8dd6df
SHA512 407e4a721ea3159f340cfe6c77ae87b3108e266ac65126ad33a18acf0c2c02da47f24bce3dfbdcfeed5e3eecf4430b3e7d2220bd9ccdec06ab5867b1c5cb7aa0
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD7hSF4K+:A3kMP56ra
TLSH
T1CF257B03A6940FE9D11F817499914666EB777C125F6083CF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 962KB
SHA256 6d17c0ac7a967ef143a84f9bb97da47e5f10b53a9bbd2ccf5973e0584786ab56
MD5 022f5b2d997f399f074349f8c81605fe
SHA1 3219e33d0ef6fbca91a29edf0292eff416a2a9c1
SHA512 5b4d1e63f1371eee82f2a5ea071ee518044b18b189cdede4268c7a90b938bd2ba17fa6ce840fdcf328ac438ea2b4dbdd742946ab5d4c1a5d90db29e1913c3333
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD7hSF4KQ:A3kMP56re
TLSH
T17A257B07A6940FE9D11F817499914666EB777C125F6083CF2368AE253F327C06E3A3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 962KB
SHA256 41afcb9d6edb23bf7b7700ef91596d171aac972bbd0c8dfb30c24504513773c8
MD5 b7589d258360ea4e02ad767b91e096cd
SHA1 1f754add00ffad102355bc8ce099a7c0e4ca4cb3
SHA512 f53c7db4d3a822653f0ab2546c785a2a36ea14bcf8483ff8be869faba8e92bba892e9423049a1d4235ba6c9cb33ebbb152bbdd4c7194d24cbe66ccdc76a26cb0
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD7hSF4bX:A3kMP56r+
TLSH
T19C257B03A6940FE9D11F817499914666EB777C125F6083CF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 962KB
SHA256 5d836bb91219f3ab3e4fe923e8cbb538e760f326336fd72b5f40d936d21cbf48
MD5 ad5b40b1f372202bf71a5d7c133df326
SHA1 55037b7cf0c2e48f1c2fee3f4301756d15264e97
SHA512 e41c05d23c603a91bb05d409707337807a3805c3f06853fcb4ecc6209eed7c4b49aacbddba8e9af3fafdd5f176ee4752e82b2296046a160824638f2d76dad023
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD7hSF4JL:A3kMP56rQ
TLSH
T10C257B03A6940FE9D11F817499914666EB777C125F6083CF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 962KB
SHA256 1b3579b4a6d46d4653a120340cb66373cdc5b217fd046c27886606b37bead058
MD5 eb30a1413ee4e98e5704ff880d981e78
SHA1 c8ed4e775add8209748df76c43006fe4a3a1d262
SHA512 24329334904d8261d46535f94d4c7a672b3252f9eca76cfdd4e5ad99c5edb97cc5e75c876821e37b50330d3b2dd0b4d3c7b2afe0396bfc4a4b88b99a909b8a88
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD7hSF43M:A3kMP56rB
TLSH
T197257B03A6940FE9D11F817499914666EB777C125F6083CF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 962KB
SHA256 b4c746f00d2784c7a518a99266bf264d48197afbe6a784a0cb1e533a3acbe9bd
MD5 a265de7d6284890c0adb33e4e66729d5
SHA1 58e8abf9d402b3c551c55f2f29e1feeb4c529911
SHA512 498585a571259ea9c7859b8ba44d5384c5c0f5ae86ffbe7625e48427e49ce2e7d1b964cd1865c3843dd3eb7fb5af19f2415835870f21cd355b00c66b73e844e7
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD7hSF4Ah:A3kMP56rT
TLSH
T1DA257B03A6940FE9D11F817499914666EB777C125F6083CF2368AE253F327C06E3A3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5032-166-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5032-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5680-209-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads