2253630dc1422ddb3194b699915532fd2ab9ff046902ad9e0be7e31b52ff54f4

Analysis

max time kernel
104s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 02:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_efba6b0210a6f5859264cb441f0c0b6c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 924KB
Sample260801-cxk2eavsdx
SHA256 2253630dc1422ddb3194b699915532fd2ab9ff046902ad9e0be7e31b52ff54f4
MD5 efba6b0210a6f5859264cb441f0c0b6c
SHA1 b6f81f56fd1d0596aa6e222e04b26596dd33557d
SHA512 68297848502c58127acea992b940aaff2eedb6fe850cd21e1f63a638203ecc578ccf9b502af91f497c8f8b820483a79d1824280f60e1af53541119e86852644d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSdN:A3k03kB56rw
TLSH
T154157B03E6850FA4D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 44 IoCs

resource	yara_rule
behavioral2/memory/628-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c61f-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c61c-10.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/628-15-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5588-34-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2de-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001983a-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c7-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c9-442.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ca-491.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a4a-546.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ce-607.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-638.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d0-723.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-742.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-791.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d3-840.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-866.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-886.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-893.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-906.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-931.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-950.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-1005.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-1042.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-1079.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-1129.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-1149.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-1174.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-1181.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-1218.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-1321.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-1340.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-1365.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1380.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c640-2135.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 41 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c61f-5.dat	aspack_v212_v242
behavioral2/files/0x000d00000001c61c-10.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2de-41.dat	aspack_v212_v242
behavioral2/files/0x000400000001983a-222.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c7-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c9-442.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ca-491.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a4a-546.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ce-607.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cf-638.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d0-723.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d1-742.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-791.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d3-840.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d4-866.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-886.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-893.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-906.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-931.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-950.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-1005.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-1042.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-1079.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-1129.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-1149.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-1174.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-1181.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-1218.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-1321.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-1340.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-1365.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-1380.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1393.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1398.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1399.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1401.dat	aspack_v212_v242
behavioral2/files/0x000c00000001c640-2135.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
5588	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-01_efba6b0210a6f5859264cb441f0c0b6c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-01_efba6b0210a6f5859264cb441f0c0b6c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-01_efba6b0210a6f5859264cb441f0c0b6c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmplayer.exe	2026-08-01_efba6b0210a6f5859264cb441f0c0b6c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-01_efba6b0210a6f5859264cb441f0c0b6c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	patcher.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-08-01_efba6b0210a6f5859264cb441f0c0b6c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe	2026-08-01_efba6b0210a6f5859264cb441f0c0b6c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-08-01_efba6b0210a6f5859264cb441f0c0b6c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-01_efba6b0210a6f5859264cb441f0c0b6c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	2026-08-01_efba6b0210a6f5859264cb441f0c0b6c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\private_browsing.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	patcher.exe
File created	C:\Program Files\7-Zip\7zG.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	patcher.exe

Drops file in Windows directory 52 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-01_efba6b0210a6f5859264cb441f0c0b6c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-01_efba6b0210a6f5859264cb441f0c0b6c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-01_efba6b0210a6f5859264cb441f0c0b6c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-08-01_efba6b0210a6f5859264cb441f0c0b6c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-01_efba6b0210a6f5859264cb441f0c0b6c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-01_efba6b0210a6f5859264cb441f0c0b6c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-01_efba6b0210a6f5859264cb441f0c0b6c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-01_efba6b0210a6f5859264cb441f0c0b6c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-08-01_efba6b0210a6f5859264cb441f0c0b6c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-08-01_efba6b0210a6f5859264cb441f0c0b6c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-08-01_efba6b0210a6f5859264cb441f0c0b6c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-08-01_efba6b0210a6f5859264cb441f0c0b6c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-01_efba6b0210a6f5859264cb441f0c0b6c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-01_efba6b0210a6f5859264cb441f0c0b6c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-08-01_efba6b0210a6f5859264cb441f0c0b6c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-08-01_efba6b0210a6f5859264cb441f0c0b6c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-08-01_efba6b0210a6f5859264cb441f0c0b6c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-08-01_efba6b0210a6f5859264cb441f0c0b6c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-08-01_efba6b0210a6f5859264cb441f0c0b6c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-01_efba6b0210a6f5859264cb441f0c0b6c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_efba6b0210a6f5859264cb441f0c0b6c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-01_efba6b0210a6f5859264cb441f0c0b6c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
628	2026-08-01_efba6b0210a6f5859264cb441f0c0b6c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
5588	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-01_efba6b0210a6f5859264cb441f0c0b6c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_efba6b0210a6f5859264cb441f0c0b6c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:628

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 924KB
SHA256 2253630dc1422ddb3194b699915532fd2ab9ff046902ad9e0be7e31b52ff54f4
MD5 efba6b0210a6f5859264cb441f0c0b6c
SHA1 b6f81f56fd1d0596aa6e222e04b26596dd33557d
SHA512 68297848502c58127acea992b940aaff2eedb6fe850cd21e1f63a638203ecc578ccf9b502af91f497c8f8b820483a79d1824280f60e1af53541119e86852644d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSdN:A3k03kB56rw
TLSH
T154157B03E6850FA4D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.4MB
SHA256 a403b914ee3fc0f2a57348890d56d3d82efc86ea76e66e129c6b728b85d2e7ab
MD5 24647e6aef1fb40eb08677b8d8a29510
SHA1 de3d7d0edc926bce52bd03f12b0011506e8967ac
SHA512 f670d59b14e84b03a5d8b1a489743f862bc074a740495ff4896c39a815224f66ac1e6d90a45a4bed114990c79f7541ab85bbdd56cd3377c7543164a37671e0ce
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSdZ0Le5ji0hmxNrM:A3k03kB56rIPji0Aj
TLSH
T120655B16F6A44BA5D02FC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 938KB
SHA256 05c7eb8bc8e8327526465dd08aa262494ece7edcd0883c30d38e7de2c3f0268f
MD5 90f8bbe4564209e3f08672ac71a110ac
SHA1 e955ecb1cbff08ac6032a9bbca740204c16737ee
SHA512 d7f8fecb71522d52e7ce52e0da6b7266408ea6045b086f7fa875f2cf473d4d769aa365cdead1b77b53612abb10ddb2fec8794798aeda8ed198e7a8ac69c69704
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSdLa:A3k03kB56r
TLSH
T198157B13E6840FA4D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 947KB
SHA256 39337b3f5b58c5c10fab949676211ac13642111ed32bf65d392bc6f2585f7f0e
MD5 8874b70b58a880924f552a52e98d53fe
SHA1 3cd7c64171a5f719afd6737d5b63c9a0d2bf0b0c
SHA512 d6bb37b15e86ca0e0b0fb31a9fd87d9f8e058153555feeae234769f048f6fc4e50d2a97a4e9f9c2d669217389ae4a16416e4731dd07e336cf1524a39cefea64d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSdK6:A3k03kB56r2
TLSH
T142257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 947KB
SHA256 84b06206864866b9986eace2222893c731c8e3799c81b6f4669b899abb3d75c4
MD5 2f790eaa1c3936e420543a3bca5a8d3b
SHA1 9d8964d61524ba8408c62b48e44a24ed9df60c08
SHA512 929df721522a2e9a0a8766f4dbbf11c90456812bcb0ad78a56b443edd27d4368411d88e245bb4ee71ac9e28507b0e476a548da201475f29b3d6dd2cf9011d159
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSdiN:A3k03kB56rH
TLSH
T13D257B03E6840FA5D10F81749A964662EA777C065F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 947KB
SHA256 1cb498d7f54d0b91a2d69495087d15a6edd444fcf303658e572b2d5de0078b32
MD5 1509b72ed2d64437ec37db901147a906
SHA1 c2bff245c1a775421d279ef82f20d45fa89faff2
SHA512 a847bead1d0855c2b39a7bd3f45ae8d92536f5ce8cb3710091d9e55390f3ae621070b096bb728385c1bae7f80af790c3a8b3a7647e382a8bfe827407f1cee81a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSdYf:A3k03kB56rj
TLSH
T18C257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 947KB
SHA256 5c21d5faa4f4a3e26c3614e070664ad332d410f4e5d7216f1d970a0f9f1f42ab
MD5 3bc518004804b39beafd2af2518b9637
SHA1 b322941c3c574154398657d686941080c648af44
SHA512 0e96d2f8793c62de7b882a79f78f3771abe0a86bedb5f62e3540ad63072cb786433b2cf275ba01d0972d14ce306f4cd0bfe8c67ea1486468306e2decadef3824
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSdyo:A3k03kB56rS
TLSH
T13E257B03E6840FA5D10F81749A964662EA777C065F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 947KB
SHA256 fe8e0b04142f0f5b217c96f2e7c200eec698b72db24b603f385faf52c79cce34
MD5 ba781ec91b535434ea1b805bbd4c5226
SHA1 1ab3ed8535f2e506438b109ffe4a05680e23294a
SHA512 a1993e750527b0f5c05d1eda59d83e055e2e9dce5a3d850763736be0683b2151903fb1f15711b8c196156e7a4877573ca95eabbdb6f65a70b111f552701f7506
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSdmu:A3k03kB56r8
TLSH
T18C257B03E6840FA5D10F81749A964662EA777C065F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 947KB
SHA256 aef58c230c652fdd679b288969bcd5efa020cc08717c257763e644ea46e195ae
MD5 4d0eae968d8311816e9b7a1eb4bf40c0
SHA1 2b252e83b5856f0440c126ff9e0ffb41d18ffd6a
SHA512 81359b26fc3871b643cd6095b2c21d7858f59e53dfd11bf1d03078aa4d739daddb04719f83645a428b5ae96e41de97aadfe1bbdd8461e7a432bd7189e76430a5
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSda9:A3k03kB56rh
TLSH
T195257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 947KB
SHA256 0a09589a640e4d77df79e64553855ec8c2d3e708b79fc9814d81b1b3e1c1e027
MD5 e3bdf0b537a275ce2536cd5bf2c1381c
SHA1 482df9a6fc993bd3a4ed15d9b46b3784d499999a
SHA512 1cc7ef48614afa5bdd6e51c16c1b51e6757f200bfcb824885b9c0ef87442d3a5077d20783b802f449f7aa58f48f1259b894eb2d80171c51e16b05dd91ab7b8df
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSdac:A3k03kB56r0
TLSH
T1BD257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 947KB
SHA256 e5fd501d93985cd61d62845c4ae2154893a8e1cbef0b9462d95f6efbc89b1d52
MD5 59ae271d758f1905123860b536c8f0f0
SHA1 12f02a5b12b9624a1cd0ff6efc4eeefab091a797
SHA512 038367f3d9caaf7616c88fca7633fa9c49492aeef37d72f7df30cf5909583b12c0db203a5d31ee4d1d519e80b446d9280f2c9b71b913f4a25ffcad0a863c00a8
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSdTp:A3k03kB56ri
TLSH
T174257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 947KB
SHA256 3b91db04c2c7941d09f56a7bd3e9d226deb744127ff807334c8b4ef792e780f2
MD5 d5ac248291e6897de1dad58e8c5dc8b7
SHA1 800d16d431969aabe221a02e37751609eb71d557
SHA512 e6369a66032a689a978105d79910f172423cf2ce06396be7818db74c42ee3ddccccd6396dc2894e84e3313108ce45b70cb388b1082f191a668db22b30443201d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSd0N:A3k03kB56rF
TLSH
T183257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 947KB
SHA256 eaf679b0599ef9e0820eb8f38ccd25f1f91a77315e48c506626c9473416fc35b
MD5 96acd7e87d20691f00351aaa1a0b0bc3
SHA1 f1f60cab9489ed52626cc9eda894b9a066c4dae1
SHA512 2328aa1678dc01cd32ddaf52702d3ac2b191560b90ac9801c2c615f878e936f86202d7012fbce3c38323f12fd7633e949422cbe7b771b6e4b8ec457c862abc96
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSdcF:A3k03kB56rP
TLSH
T1FD257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 947KB
SHA256 2d8409d1ba5429d2c963237a8c4bfcbe8ef2c3a656df9fc51ef04b85d9b84f45
MD5 29f3e7f0c9df4fe257ac49cb42fa9062
SHA1 b7645e1c1e430de4c45b41e69a99f287cb728d69
SHA512 4b93032a734bc7e3dc822d45374b4c8ac5c81e4b9c194db9c0e56e1d05616ae44543835f6280b174c6425a2c2f182981be901ef57d1b54375eecafe3c235680d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSdJC:A3k03kB56rD
TLSH
T12C257B03E6850FA4D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 947KB
SHA256 cf3387bfdbfd9d76517ab6c2bca6e84fc20062e905178a14d31d558ba2baf01c
MD5 e4e51d4a039dc6bdb59a23825ce7ab2d
SHA1 d7a4696127564da1367fddb4b7e4e3a39de6bab1
SHA512 7d08eb773c72f9a25d12ed7c42f61f4a92547b258f72612c901a5c1f1607832b5a85840576037abcd8553f5881d1b77855e3ba02612842321aab1e1f0ec8ad9a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSdqw:A3k03kB56rG
TLSH
T146257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 947KB
SHA256 01ed052466b119b737dfe088f191d9d78f1af3f2568db95a6f54ad8cdb54c301
MD5 91095927a4e80b18a7e9f80c9654b59c
SHA1 a538820182c82c3c338b832259e876ded27a4e8a
SHA512 24d6614500f9f2da24c81cc63128310c8e78e69e8ada73c0d49b600afbcb9e4f91e95c3217ee114c8e4c88a7f00ae31f80da07b852d6aef11f26eb49354173ae
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSdxT:A3k03kB56rG
TLSH
T11D257B13E6840FA4D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 947KB
SHA256 10d1d62aed49c20e017b2e09c601776e7119c70cd4c09c37b5abc5dc95280ae1
MD5 cb7e9df78d78466a17f820a3dbad9b51
SHA1 8e8d35f86d6b07127dc26cc7485a7c403e7a4bc5
SHA512 535e7970afb952741b4c06a8f8cfb6084053a7b296f6d4c6705eddf827b866fca193dff9e67b61903bf4421bf3ebcb51791979c6d863469fa724a72a24b05ac1
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSdfu:A3k03kB56rh
TLSH
T1E6257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 947KB
SHA256 9e278ab77c37d525431c93244f6f37c6ec450319b5bc47ea154d7644bcba0e56
MD5 bd697117fb4370938ce79b4656cf5723
SHA1 0efebedcc57a61a1be38a9cab2dbfc05c81c5292
SHA512 34a2d940e4f4d53f14cbc8513bc40d4687bed94c141db1754a7dbad8cb3b39d36333cf54ac0757402663d527c5127047c06b384463f6e83c35594ee1fbc6860f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSdDb:A3k03kB56rA
TLSH
T1C1257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 947KB
SHA256 cea4902a204acb9324c7ded9ee3e396ec88af7fc3509a7f28adafa3ecb4d209b
MD5 6633b96293e08906d2b2fcb44404cf89
SHA1 3a7359e70fd157df41753960a961c4a4b217a945
SHA512 05f3e02bc6cb61cae505c92b527037d077d9057d8b2dc4a2ae78beec3516a33c800e960404bd3636329ef96522ac30ab0e2091cca200e1f416c76b4514a2c272
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSdXf:A3k03kB56rw
TLSH
T10D257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 947KB
SHA256 3b228a75d24706264a439de377d228e85830f20c6c61209564c734bd75722571
MD5 6f84d601164f0ef77d99f51b8203c9f8
SHA1 e21a81bcd61e18ca583525bb52ea312f265e8091
SHA512 b9c10b10e8e0d6b13270c57f583eded09ef104875ee6f8370df8f4235233f08371794265e5933f5e9b3cf9aa4e2c0e2402197b9547eca59e1151a25efe42344c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSdgK:A3k03kB56rQ
TLSH
T181257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 947KB
SHA256 eafdf119ab0fd1b61d0d5369a507f1624b66741ef421395465eb65557d3505f5
MD5 72d88bab0736e5d25837084637c04452
SHA1 724945bcf66d8819d97c6b80fe6ec353f9b37b7c
SHA512 ff33b0e2c2f2423213be5812b7f8c2321d45d06a1c09526e2feb9fa5e794f0213927a0799a213c1eadf33088070f3a26ad0c21e244c7f2f8a0177cc8acd18a01
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSddk:A3k03kB56r5
TLSH
T1D4257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 947KB
SHA256 07175312e825c9af8da400f5f6269b5e63e439752581961ef54b06d2a2b370ef
MD5 af5ddbf305971f646b30c87cb1896817
SHA1 73a70c6ee5d27b9cee27b26a2936247f034145d4
SHA512 297e9240803668a898a2416256e5eb5828534928c0450b4ee4c7d4cd5fbd006e7fb7936ba24f9b7c155541cc51ed7dfdebb8ed7a0f1b2f6aa96cb9290862c80b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSdC0:A3k03kB56rM
TLSH
T112257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 947KB
SHA256 faf44762fd6470a27ddc9eba5d314bbe369d8fec5b1a54ddf14cbc3c39af74ce
MD5 b9d3665af1f56ef9e51c71f69ab3aad4
SHA1 0675bc5ceb91bef0da6e4385c568015c3199b861
SHA512 17772190f09525195b3a19080929ea44cf1dd9f7794d18fa84470c826fc7ec2f30e5ff068621d996b1c1c67c1b53aa7bde304eb9b2cc15b22c281aa36c8c87cf
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSdRg:A3k03kB56rx
TLSH
T159257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 947KB
SHA256 55aa954dedf1ef91de3a9be06922915088d5ec46c54b0ef42128fb1558264522
MD5 706495e605f917280ec18fba913ef73e
SHA1 a2f061be77527868b519fd9c13a0c1c321ef790c
SHA512 85753a6ff2db0b54185b8a1d6b9d12cc466e618cb3f8a6c67744bed40605d42fd0a9658bf633284cf195f7f4281e50789bbd92a532695a79f8a67895b9c7993d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSd4r:A3k03kB56rb
TLSH
T15C257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 947KB
SHA256 bffda8c910364fa4b088484cb693fa8dafba679f428ad5fb362aab538174dcb9
MD5 f5d55c558952e78f411473b53198ffd8
SHA1 5ef6e1d867a77d1e282eb436388b55246b90fcec
SHA512 6706b24cb5d9e7375572d699864b5bed404a14914ce39c5582fe04735eacfbfb2b6a1401ac3fa365c19fe1f942154663c9f2d14bb94f7b59e26669aa3ccc117f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSdWn:A3k03kB56rt
TLSH
T153257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 947KB
SHA256 dfef829847aaaf147791a38b6e7764d69acd793dd964d1cd2f0cb00d0e8a2227
MD5 b66cca2d1ed35a9b2a339b58f6de93af
SHA1 c6defd82ab845d7f4f58dfd433833835dfc28372
SHA512 0c8c8e81dddba47da691b2d3ecf66003c54b37816d67574d87f9d6d402e849be49b14e03f4e289966a25bbd4e0b9d772ac60df6fb4550585a8eaf8d5289bc70d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSd8x:A3k03kB56rT
TLSH
T104257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 947KB
SHA256 18a4254fb55307a8fe5128ebe324a8459d73ab9fdcba768c725418cf9e600ba1
MD5 633dc6768910c0b6016c66d025f34243
SHA1 931b32499872832e1eced46a3d7dc29466ad3eb9
SHA512 817bfb4967186fe908d465dbb534a146644c76a01ddfa8f5b604a9034232da936d334d78e98abac4dc4c69f734a6bda872ac05886801c4fa4aa3b1700ac892ed
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSd2A:A3k03kB56rs
TLSH
T169257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 947KB
SHA256 3763d5e28774543cd5c48756f9dad00f0a2967ade138ee773d6a26e71dce8d9e
MD5 0a58980e4491e68c58ab0e30cfbe9dd1
SHA1 2eabdb8fd9aede438b25905f3c06d35c75116a73
SHA512 f529f1b61bccb1656b20c4e39a6e1e1b70e265938ac271922f0cc6590ba847834407c5565734bbf6bf3a47626587ece6207f45f6306a4470143e69def992b273
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSdv9Q:A3k03kB56rN
TLSH
T197257B03E6850FA4D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 947KB
SHA256 92b61a49180355cec67bce58618bc772173849fc0c76c42d9dfe7e152866a57a
MD5 069f67c6248c012b246229c15b32e7da
SHA1 c35acdf100583eebb145b89a6bedec77f760fbaa
SHA512 3d2a4a757cdd044cb828e71eb68038d3eb32580bb53ef2bb611354efb86b9d37fff513f4d201abcfa67948b5c6b0bfe5f07038a3faf397f0dfb008787714f8fc
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSdG4:A3k03kB56rS
TLSH
T1A8257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 947KB
SHA256 35b08549069b58b4eeeb6e2524d5e3fe4516642dfe97e1efb6df6114026892b2
MD5 05077af5f37f0a97a0d53e57219098e4
SHA1 7fa2f9d98c82f5b48fc8dd41e97335f6d86fc600
SHA512 d75006aaf1c665dcac28f6b9e3c9157d324f27a89e10d2c21b586d0b230ad90b2ce17ad6b0fa265acfb307279585a9d840f919a35d34d74f02e33814d2515046
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSdVu:A3k03kB56rD
TLSH
T120257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 947KB
SHA256 2b23f0e8d354c569d477e1c4a784a8a6765507258cfd60b44136d27878a7928f
MD5 10442129ead368badc6b7e2a21a54237
SHA1 d2567bdfffd0837a849804449733d2e9ffd6f2ec
SHA512 0eeb4e635ee95f226e208a7dafbc900976e010de6b35a84051c3df50710f71439ce304489cf73513e0645350eaae4be6cb7f50d9f850949b1cea4d3d2091d081
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSdIj:A3k03kB56rt
TLSH
T1C2257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 947KB
SHA256 6c8e1d6b1ac9c066f3251998f3068777fc25dcd0d5f2dc1700d1c0792e5a8b9f
MD5 7ba9fc21bfbb165e82eea0ff0ca48c60
SHA1 4f9f4b889e7c3afe0418b531464c69bd981ab11e
SHA512 3421e99be298961cef5c5e1ac48118728d35ba73a4647e901efe2ecbd9f6d1733ef2c1e2ee7f664e03f14ae8420c28513c675b44e35f0ea4a8e6671e1627c817
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSd5g:A3k03kB56rx
TLSH
T12C257B03E6840FA5D10F81749A964662EA777C065F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 947KB
SHA256 ed6f709b6a1ecd8e800a8a4c2f7f91aa65182e0cbdbdfdda1d7667db84d084dc
MD5 4cd218743c545afcb1eea24ede2a01c6
SHA1 74e7a74d09f40971c9991fa13d450d3feac66790
SHA512 6e6a06d12ea5e4f58edcfa6fd9d5114caecb86f8428e5eeaf1a0411fab9f67557b570157e237f7eacc8eb98b573a1f8af91486fa0c9bd061fce72d4ae750c349
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSdgI:A3k03kB56rg
TLSH
T10B257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 947KB
SHA256 ff7630c4e75a1f5df9f48aee0efa7c6b108641a18a97714c2ca19c319a036fd4
MD5 8c26deba6ca301c342d55a9a12dc0207
SHA1 f686ffb5176492b6ae53623a74b4fd10ad93679e
SHA512 91cdc321a32c4c8d287987aa8c156846040801091aaca326e6b39d72f205940f138f8a08c93e447122d745ccbf06930334fd9166dbf62d47b3f061ee9ded08b5
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSdio:A3k03kB56rC
TLSH
T18E257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 947KB
SHA256 f9faac8dfb9bb7947eb240a110cdad2395188b6919c5caa34e467560e36e38bb
MD5 cb483a78e4c1229adc292cbd076d8297
SHA1 0515b0f15c4e1cf37b137ad7c5223892a816091c
SHA512 7365909bcb5d2941349ffe372da45394461706244250ce79ceccc2be72665c39fe1abe4cb2874a71e2e9d813cfc3f397d3fce8189c9280d3b3c895f21304cbc1
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSdZ+:A3k03kB56rn
TLSH
T173257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 947KB
SHA256 0106628c84c1661416322cf4c302ac0345f5e22591b3e0d74542619a0a27a3d5
MD5 5ccb7c1d972380f929149bb375732755
SHA1 d850a7fcc54dbf23223a17d402d898def4c2641e
SHA512 f6fe5cf86fb5d4820bc66a7ae486690e8a68f730456ac897fdcd74edf77187e92a2e8e7f66c909b95937b13258d2088a2ef0c7fab5250017ab71ff139d3551b6
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSdHQ:A3k03kB56rT
TLSH
T184257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 947KB
SHA256 15a984242cbc6f51e1e3d35845bf8ab22e2e2c5becf1703c8a9df83ae20ea1ef
MD5 f36e98a3d4554bab76d42f73db6c76ff
SHA1 aaa9dfc4b9eb57d52aebc68e960e3bd732c99d32
SHA512 3aed56dbe8e2e0aaf90c9add4c7317abc31c9fc4bb015986c9a879481e885f0ed06b15313347b0524309a69b39b77404c4095eacdd42453011781cdcaec59e45
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSdcX:A3k03kB56rH
TLSH
T1FF257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 947KB
SHA256 6a7b61317af72465aec674fcde123e0014f410a9b272dcb5a6a63d91dbc03076
MD5 89dfbdc6f121d55c1984d67781e6d532
SHA1 6b097728ff6aa0d55777d0e35e84f98b7adb3ca6
SHA512 766fbd55e429fcc86a194b84517ab3cacf4aa66bde4061553d828162023a80802f49a4e314bb9c2e2af81ed08e514ca9fbef892c33faff46b4e645aa41bc01cd
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSdaL:A3k03kB56rp
TLSH
T1EA257B03E6840FA4D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 947KB
SHA256 626d614e3521d23cdbdb386c86018dfa933895dfd699bfae7770de9d0a5b3f0a
MD5 e2c8fc334611893bf9def37c005ed1ba
SHA1 811fa068f66788ceda69a1a29aa7db4fe14b2bae
SHA512 4a7c33f0a95a0c86b629917e5a1771a244e83ed12673459cf1b76db42c8096a7fdecc0a2faf86785048bb76b1daa64831040d0f06ba1a1a54b194406a9aaed6b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSd+M:A3k03kB56rQ
TLSH
T166257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 947KB
SHA256 1401a88ca7b97d7375638136f082007be1354ece7763a78a9a47298fa21758b4
MD5 225c7efe9115b133a253f0a3dc221213
SHA1 9b578e55d2c57beccc0d19a2ca4d95c43955fc85
SHA512 c53329350cfcf6e7017b94d5ca84b8c63464c75f0319a4085ad8f00a6a7233d660111a547735a9dd9a1cd48ce66e59bdb1e3c0e1a2d2e38444e934d1a99917bf
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSdnh:A3k03kB56rC
TLSH
T146257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dfsvc.exe

Path C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe
Size 929KB
SHA256 31b18c26c2edf1d4bd2ef591651f1349ebe7c01b6af16a7e4466593d73904086
MD5 97697f06036975f33af233028723339e
SHA1 073b63baac99c6d2fb5b4edb482f3a49695ca6c1
SHA512 718c117712e6847e1cfcd9f8b7f6c83152bdb1402dfb40fc30d1172aac2028d6c5444ebc7376dfb6318fc61b38362c27ff88d14fa75bd649e033c30c82f8b747
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSdq+l:A3k03kB56r
TLSH
T1F9157B13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/628-15-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/628-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5588-34-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads