1dfb3f6ad51552184df593f517e25157583c5cc9029a15f1e2551f3966743d78

Analysis

max time kernel
100s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 22:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_a6d8c86227525df79509ce93a92bcf44_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
Size 754KB
Sample260806-2p4afscf39
SHA256 1dfb3f6ad51552184df593f517e25157583c5cc9029a15f1e2551f3966743d78
MD5 a6d8c86227525df79509ce93a92bcf44
SHA1 9f98a20b27e2cea55f50a8caf6927ee6a5192e07
SHA512 0105912dfc4e57680d6277e19f02c1ee8ad2ddfafcb9afa8ccc84aa11548d8a2d54866bd4818406c0304a2c97bc7442ebf540992df942e6384f127b7e0f7f68e
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiGF:qCewdx5tul2Mf0nkxqatgl8bCaiGF
TLSH
T1D3F47D52BB8180B3D55702318CA763A7ABB9B8521F22934B239C536D5F733C0B736766
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 47 IoCs

resource	yara_rule
behavioral2/memory/3268-0-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c59d-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2f2-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3268-21-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5692-22-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b2fe-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c86-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a59-220.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019842-263.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-324.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-469.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-500.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-549.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a56-610.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-629.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-721.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-746.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-790.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-803.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-846.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-871.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-890.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-897.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-904.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-917.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-936.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-955.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-956.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1012.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1056.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1087.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1130.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1143.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1174.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1181.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1188.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1225.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1328.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1347.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1360.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1380.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1382.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1389.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1402.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1403.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1404.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1405.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 44 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c59d-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2f2-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b2fe-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c86-60.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a59-220.dat	aspack_v212_v242
behavioral2/files/0x0004000000019842-263.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d5-324.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-469.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-500.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-549.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a56-610.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-629.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-721.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-746.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-790.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-803.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-846.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-871.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-890.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-897.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-904.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-917.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-936.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-955.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-956.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1012.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1056.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1087.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1130.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1143.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1174.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1181.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1188.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1225.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1328.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1347.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1360.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1380.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1382.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1389.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1402.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-1403.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1404.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1405.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
5692	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-06_a6d8c86227525df79509ce93a92bcf44_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-06_a6d8c86227525df79509ce93a92bcf44_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-08-06_a6d8c86227525df79509ce93a92bcf44_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-08-06_a6d8c86227525df79509ce93a92bcf44_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-08-06_a6d8c86227525df79509ce93a92bcf44_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javap.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe$	2026-08-06_a6d8c86227525df79509ce93a92bcf44_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe$	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	patcher.exe

Drops file in Windows directory 27 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-06_a6d8c86227525df79509ce93a92bcf44_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-06_a6d8c86227525df79509ce93a92bcf44_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-06_a6d8c86227525df79509ce93a92bcf44_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-06_a6d8c86227525df79509ce93a92bcf44_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-06_a6d8c86227525df79509ce93a92bcf44_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-06_a6d8c86227525df79509ce93a92bcf44_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-06_a6d8c86227525df79509ce93a92bcf44_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-06_a6d8c86227525df79509ce93a92bcf44_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-06_a6d8c86227525df79509ce93a92bcf44_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-06_a6d8c86227525df79509ce93a92bcf44_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-06_a6d8c86227525df79509ce93a92bcf44_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-06_a6d8c86227525df79509ce93a92bcf44_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-06_a6d8c86227525df79509ce93a92bcf44_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-06_a6d8c86227525df79509ce93a92bcf44_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-06_a6d8c86227525df79509ce93a92bcf44_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-06_a6d8c86227525df79509ce93a92bcf44_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-06_a6d8c86227525df79509ce93a92bcf44_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3268	2026-08-06_a6d8c86227525df79509ce93a92bcf44_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
5692	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-06_a6d8c86227525df79509ce93a92bcf44_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_a6d8c86227525df79509ce93a92bcf44_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3268

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 754KB
SHA256 1dfb3f6ad51552184df593f517e25157583c5cc9029a15f1e2551f3966743d78
MD5 a6d8c86227525df79509ce93a92bcf44
SHA1 9f98a20b27e2cea55f50a8caf6927ee6a5192e07
SHA512 0105912dfc4e57680d6277e19f02c1ee8ad2ddfafcb9afa8ccc84aa11548d8a2d54866bd4818406c0304a2c97bc7442ebf540992df942e6384f127b7e0f7f68e
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiGF:qCewdx5tul2Mf0nkxqatgl8bCaiGF
TLSH
T1D3F47D52BB8180B3D55702318CA763A7ABB9B8521F22934B239C536D5F733C0B736766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.3MB
SHA256 626a493c6a8d76577d197f217326272b9964471f43db9ad753c2562ed1c43fe8
MD5 2bd882ad9e3be7a6bd9188f06e217dbd
SHA1 51bcb23d69f41b7ff1d6f842dee90d87d4d9bdf4
SHA512 5b9c7c0aaf7427566bedb4ce30ba97393dc66fa0798602f14e22f8c44935735bf133b80d7387245d7a410b07f17a3941b521a25dc88f34505250cf59c0eaeb74
SSDEEP 24576:qCewdx5tul2Mf0nkxqatgl8bCaiGB0Le5ji0hmxNrM:QgE2Mf3qatgliPji0Aj
TLSH
T13C556B56FAA48272D0738175C8E3A79AEEB174421B3186CB1399937C2F337D19636732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 769KB
SHA256 81a8bcb929a2ed1fc3157381f6f23a2fabc4bb3f604fa76df6a768ea1f9153ab
MD5 38c74c579c3126f043c58d558ca6678e
SHA1 ac5548e6630514b6b29a2aabe510f53e5cca937d
SHA512 e99980c9e1dedef3efc890dd37a7284d21379eaf25afbe3834a19c1b724c13e7cb416b9f910276786844eece5c8258c82aabe6e875d0384f0c0c011873557c55
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiGDa:qCewdx5tul2Mf0nkxqatgl8bCaiGDa
TLSH
T184F47D52BB8580B3D55702318CA763A7ABB9B8521F21934B239C536D5F733C0BB36366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 802KB
SHA256 2f6c6793723556cdde49b8e9e618ca2bf84233f9e4a476fedc82161ec9030a66
MD5 e6e2b4b43585968652f3f03d6ef5a792
SHA1 213434fc4a8ba738fd2da04f857721444b95d8ad
SHA512 42a84eb860bc9f5575ff269e7bc83f16001a2995c9d0c67c39098e35bd93a6f118c41564669aa982ab6d2bf4e2f2f16dcb6c4a0eb383bbbcf330cab0fddd8141
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiGQb:qCewdx5tul2Mf0nkxqatgl8bCaiGQb
TLSH
T1AB056C52BB8480B3D55703318CA763A76BB9B9521F22934B2398536D5F733C0BB32766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 778KB
SHA256 011a1e5bd307c205fb6a755fadb752fc9bd008ce08da8c4e8a8dcb6f76204c9e
MD5 060d6595b2ad453e7b79616aa2d68d57
SHA1 2737e1be04278607b3e7fee8345e85d66ef7912d
SHA512 1e56fda83d8b35e2239eb6fd1413ccf840ca55ad31d63d2b7f3ded2346270ec0f0e3d78b0a78d7cfa09b85073d7eb1768079d60cbffc42c063193a15664aa630
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiGi6:qCewdx5tul2Mf0nkxqatgl8bCaiGi6
TLSH
T11B057D52BB8180B3D55702318CA763A7ABB9B9521F21934B239C536D5F733C0BB36366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 778KB
SHA256 5c5ae65ff2e9c55ba03eaaffaf9830034fd18617c46ba84c287d3dd0c3e06f35
MD5 73b3e9c19a22f3eea66eec8576c836a6
SHA1 af2f731d3db937d554da555de65eeae9f0d281c5
SHA512 4ca9bae8d15401672e23af2a26430f08db7a73b0aba66138b3ccb431b21d4a00ead244eb59d43dae0dac367e306a78e5255e2b6622c503420f9865d3510e89d4
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiG6N:qCewdx5tul2Mf0nkxqatgl8bCaiG6N
TLSH
T1B3057D52BB8180B3D55702318CA763A7ABB9B9521F22934B239C536D5F733C0B736366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 778KB
SHA256 1de61074d7bbc57925594de2f0f53f11c5da1badaea461b26c3361fdc0131231
MD5 e60cfff0a6ee6c0845fb05da10e8c095
SHA1 44afa927a7779d95ffec7a3ac63ce4f9312f6cb7
SHA512 f91a203d97bb9f06c35fe73b17dfc70935bccd8335bbe51b12cd39f4c567bb8f375f895f8b33749756a72c1b2a465493815d0ce91151f43e783c083a8da3e6ea
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiGgf:qCewdx5tul2Mf0nkxqatgl8bCaiGgf
TLSH
T1DE057D52BB8180B3D55702318CA763A7ABB9B9521F22934B239C536D5F733C0B736366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 916KB
SHA256 5dbaeb05d31f867203659409be5ef13bedd75fe0996c9e2e28fa14a135522332
MD5 2e79b53f879a5f580d295b946ea4d337
SHA1 9ca2f3c86b37134ef89b677981e59b0e05451e66
SHA512 97af8c60a32e377cdd5638fc45acd5b52324f0dadcc61d7196d834b7507565938e71e9ebefbc730040400acb42c2ac4262518eb31141f831d19d7d3678af7b79
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiG+yPz5L87:qCewdx5tul2Mf0nkxqatgl8bCaiGjzy7
TLSH
T151157C53BB8180F2D16702318CA76796ABB5B8621F21934F2398536D5F733C0AF36766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 778KB
SHA256 50ed5aa4fb218a254a8cf01e2a05d8308893e11657f549d33b94c1455898602e
MD5 2f05a6fd2132195ec4a79169a95abcad
SHA1 0a2306e308bc543ed5dedd8fa807de1bd6ef0929
SHA512 4ec3982c29822fbd0d20e83f531067ac4be5985bea5ec018a71d2df6f0d60153fcd0bf5c0e48b2c8c0e2b934d30bcd96e14b51bbe8efe3e84d810ddcd1abc5fa
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiG6o:qCewdx5tul2Mf0nkxqatgl8bCaiG6o
TLSH
T1EA057D52BB8180B3D55702318CA763A7ABB9B9521F21934B239C536D5F733C0BB36366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 778KB
SHA256 87d3cede5ebc5707193f112eff5f965557d766478378c84a87324a0c93b6847b
MD5 252e5152fdd1d275206b033be29d1194
SHA1 7bc2b9e1d21203e6f011fb83b780a8a194465946
SHA512 99a58eb3ed39b5728958914f6f2813dbac05d7f7507bd1c7a68438b59c75de60718e2da9b576b074c4cc7ef78c2e6ba65b930d7c9311a699cd8bc5a7508fc0e7
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiGOu:qCewdx5tul2Mf0nkxqatgl8bCaiGOu
TLSH
T11D057D52BB8180B3D55702318CA763A7ABB9B9521F21934B239C536D5F733C0BB36366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 916KB
SHA256 a64b9577c6a8ed21aeba31e719b05a5e0515d6d1e669201e48173ad94f34ade3
MD5 c01e22228f1183c883f91c96a4413985
SHA1 47601854a211bdd500c2983aa067454ebcd7f5c6
SHA512 6d1d018a516d2bc92c3b63af5d5a456d27908400b32a356dccbaefb8ed9e70c304207ff6f548ecd880d8f23ef5827c9625fb1042490844ef7e5c1481f88f1466
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiG7yPz5L88:qCewdx5tul2Mf0nkxqatgl8bCaiG2zy8
TLSH
T13B157C53BB8180F2D16702318CA76796ABB5B8621F21934F2398536D5F733C0AF36766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 778KB
SHA256 0aaeb7a1e6c2d3846bde512561b3ed3ba304c67d4c016c695c1dee187201fff6
MD5 081013ee481807157cfc7eeef0f819c9
SHA1 9e7a68f0affebba4d20ba55be4cc0b32685d62db
SHA512 43be693ed691e625cbbf4f2c60964a4bdc050edc9697c56961123a4574f5c40b29fb09dd967966d643cf0d9ed42d972b339f131f2ea64572da224e78142fab12
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiGC9:qCewdx5tul2Mf0nkxqatgl8bCaiGC9
TLSH
T159057D52BB8180B3D55702318CA763A7ABB9B9521F21934B239C536D5F733C0BB36366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 778KB
SHA256 161416c58f466f4c4f47c3a892e2c7469634c88b86716eddb1252f3d0c71f287
MD5 fbc8126aa5b2334009045415cb6590a9
SHA1 c0f7c0bb8ac066b570f837b50fee8d42743fd9e5
SHA512 fb5e5f108f45101de86d4f89663d386cd5f005f7f00e7cb9dc06e0f49b13c4745684cc8c5470331fcf3ebdb1bf669747ecf25cc8ee7f90e3644780ae9131571e
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiGCc:qCewdx5tul2Mf0nkxqatgl8bCaiGCc
TLSH
T165057D52BB8180B3D55702318CA763A7ABB9B9521F21934B239C536D5F733C0BB36366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 778KB
SHA256 10a9e935b0defa18a66cc9dbc6f5e4821debb273bc2ea6b8f56119947a62e473
MD5 d8248094cac1e6f97486f13e013ab47d
SHA1 2375ad3de11d380b2cd7b332d35f14ddc05a49f5
SHA512 d9b59547ec2ac1cb97debb872ff240987530de5bd966998e1fd60f84b0437013d0645247f80de91e0ae3cfefbf0a5224ae639e1a182ab32cf333c7a9ba4c130b
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiGLp:qCewdx5tul2Mf0nkxqatgl8bCaiGLp
TLSH
T1DE057D52BB8180B3D55702318CA763A7ABB9B9521F22934B239C536D5F733C0B736366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 778KB
SHA256 1ec5094190481623ef869ff4c736c2baaa58366db03bde4201508719fd361a86
MD5 b010e7a034aba27d09f41556be7cf434
SHA1 9be804a2f6d781ae7562a88985b6164781a7ad3c
SHA512 bef7c95f4737bd0f8f002a6f8afc8f65e41f8666bdb3be4d90105997b682e00c8c19d83f7dc03e52d95f3b999a0692d4d2819ba84c5a677c8b97b3b73622edca
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiGc0a:qCewdx5tul2Mf0nkxqatgl8bCaiGcN
TLSH
T1DE057D52BB8180B3D55702318CA763A7ABB9B9521F22934B239C536D5F733C0B736366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 778KB
SHA256 6c57bd6403814904f1cbd08b26b49f1381a1d19150d1881a7fd9ab874f804490
MD5 3e361160c2273e36275800a67b67d849
SHA1 e955d80b3f574ed5d70fd456a4e919712917091f
SHA512 8a6a77a2adf1a6182b361d688c2af125971a4311c70a429fb6e69d24b71998895de381b37185e1a0afc319d9c6e81c1f1990a187c56f66021829198635602367
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiGEF:qCewdx5tul2Mf0nkxqatgl8bCaiGEF
TLSH
T15B057D52BB8180B3D55702318CA763A7ABB9B8521F21934B239C536D5F733C0BB36766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 778KB
SHA256 187b11734bc139ba4c17ad04138b804f821aefb7450c5ba4bb0342947f58adfb
MD5 ba319e29211b6c29c389960e6569849d
SHA1 3622b4a571c829d2bbf95c18fbdfe62bf9fe1ca9
SHA512 2626b55a70a1cd6a3e51a022908b2cab6081cc21d93d3afa7072e8de7c7807b8201933bea8ffef866a6591032002bc636b7aa684c58dbb679ebc03baf7bf4f56
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiGhC:qCewdx5tul2Mf0nkxqatgl8bCaiGhC
TLSH
T1DB057D52BB8180B3D55702318CA763A7ABB9B9521F22934B239C536D5F733C0B736366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 778KB
SHA256 15e55acb7dab7e8214b91aaf29991611fa4e37d9d1726df6615227e895f49558
MD5 d4be27f9170e4680eed47f345bc6f789
SHA1 ce05b31d8bb2eb5d4a157569f87b6451ed280934
SHA512 f9055d98d6d868c954e12e2af6491fda5c8d38de8974ec14f4398cd93952df5048e309003584609088a923f0e5665fd829f42bb1ad743c45b03c7709bcab647a
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiGiw:qCewdx5tul2Mf0nkxqatgl8bCaiGiw
TLSH
T1A6057D52BB8580B3D55702318CA763A7ABB9B8521F21934B239C536D5F733C0BB36366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 778KB
SHA256 27934074d5a91f5d46d0a2c520d2ab9bba5da35a3f1755a8517b8595f8f849b0
MD5 b6d1efe77b3dd4679def538d3b05cbff
SHA1 c255508284f7eb50f15ce69c992cd2033613a1bc
SHA512 87a8ca4986dcf81e2e66c8d5fbbc74483c93d87ecb57a3ffe4b4502175674e0317890143d4d24c33b4f321c100670c648d8b13950a8bc38c2b14dfeb3ba5dbfa
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiGpT:qCewdx5tul2Mf0nkxqatgl8bCaiGpT
TLSH
T163057D52BB8180B3D55702318CA763A7ABB9B9521F22934B239C536D5F733C0B736366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 778KB
SHA256 207cb6360292a4adac725bfaa38b7f4a3b439e17921dd633d4e702450c81f32f
MD5 75bdddb10776cda494d77e09b28a6e90
SHA1 77518966230f94a718c7b95d8aafe581ebfa0746
SHA512 c8a8c3ced19ac6d46e5e489b258783daed5b373c34332da9c7df49b3f5fec90037554aa0a021444d1e1763819507c6a62dc0edab86e979d069d18ebd52ebbd6a
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiGHu:qCewdx5tul2Mf0nkxqatgl8bCaiGHu
TLSH
T183057D52BB8180B3D55702318CA763A7ABB9B8521F21934B239C536D5F733C0BB36766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 778KB
SHA256 eab14dac0c67b592c881e17148c9208fe2e09295b06268d8dd1a971f6d2cb545
MD5 28b2410fe249394a3f7578f56481d7dd
SHA1 276082ee05dbd69ab9813b275013ece2f2009949
SHA512 d9626152a3c220fb349e24934a2a83b9e624315f83d106802aaad3335ed476caf3e0ae96658484e9448d7311f858c9376a9147c58a4e0e9c9d6acf05ae69e526
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiGbb:qCewdx5tul2Mf0nkxqatgl8bCaiGbb
TLSH
T112057D52BB8180B3D55702318CA763A7ABB9B9521F21934B239C536D5F733C0BB36366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 778KB
SHA256 d6055fd907a9d5fdaaa024f18927c359d9d0289a526c21ececee6422a6ea60e5
MD5 75f23e65959da8c1cc983cef512a9543
SHA1 7c07330bebc95cb8c699adeedb2cb89c36468418
SHA512 58a048bd57a5fd0d5993f17c0fe568f52135309d8912e63d1a71e98cb3dcf32a6676aa3dd9feddb17a7be5a6ec57025902419dce05f2261b03936d833a1f7836
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiGvf:qCewdx5tul2Mf0nkxqatgl8bCaiGvf
TLSH
T1F2057D52BB8180B3D55702318CA763A7ABB9B9521F22934B239C536D5F733C0B736366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 778KB
SHA256 814cd2c3631c8ba1c9a4c03a4c8d1102ccc8e04035fb947b0e2a56d960ac7421
MD5 a90b08dd786858980d263944a1c77628
SHA1 379341a64ac2d8cd383ad66c10f3d7ca0a2fa77a
SHA512 44968a28d83b35e1b1e7db2e42f73c0567cf8348eca68b134324f271002f09d19ce344eeb24fa97a7115196e7cac26b6f3563f32c9f59dc2c72e0c4c93da21e6
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiG4K:qCewdx5tul2Mf0nkxqatgl8bCaiG4K
TLSH
T12A057D52BB8180B3D55702318CA763A7ABB9B9521F22934B239C536D5F733C0B736366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 778KB
SHA256 92eef1df28cf1d2e7833df6f582a87d94bc2244ecb3e91565ab20222af635e69
MD5 704876ea9ada3853e6e895c24464ec2c
SHA1 d759f23549bf4b5d358a5de49ed93fadc6cbe885
SHA512 06efc5a8a00f304c051501ed6b8cfa7c81e3fb1f31aadc8c770ce1777e35ba17674e8cd3505b8cd7321228a42b6a37a957ed29cd07a2115aa234cbdf60c4e4c2
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiGlk:qCewdx5tul2Mf0nkxqatgl8bCaiGlk
TLSH
T19C057D52BB8180B3D55702318CA763A7ABB9B8521F21934B239C536D5F733C0BB36766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 778KB
SHA256 a9bd6ea1c829e942e65cfca76f5e3a6790a75a0d4c6884804dc71f196efc896c
MD5 96970cda69c6acfa10c5166f49fec19f
SHA1 4b088599b6340a643ddd5f5da0ae23182f4512a3
SHA512 dc93b716b0313a8c78f510e01a3b521ff963fe133fe19f344588a581b55d89b08728bd0f4f534e91949d8c001a5ba516f98fef471b18963bc47f21fda31a252e
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiG60:qCewdx5tul2Mf0nkxqatgl8bCaiG60
TLSH
T1B6057D52BB8180B3D55702318CA763A7ABB9B9521F21934B239C536D5F733C0BB36366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 778KB
SHA256 a9b4799546629523f7852606618593e6fb830b10141a948be893fddec15f18eb
MD5 6b6d24386c0bd50f2e9f24785a72da2f
SHA1 141914b6879c200f71f9a3ed4129c719331b4546
SHA512 8890947d036359c2abae560bdc50ba3240a14cd7220bdd55d8c91ff7cb38edda5b7ae6efbc6fbfbf9d5ea7e2864cac878291818c6c3f072d9a20808eba81d7a1
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiGp70:qCewdx5tul2Mf0nkxqatgl8bCaiGpg
TLSH
T1F5057D52BB8180B3D55702318CA763A7ABB9B9521F22934B239C536D5F733C0B736366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 778KB
SHA256 ca55f752040b577b031abff21fa08523d38142f1fda773b3a10bd867acd15232
MD5 04977bcd6a48a70149a472dbfe9df032
SHA1 3d4b1612b39d24a8a20d4647a5598486e24adc0d
SHA512 2b493d7a5ad2d4526fe7077864322ff0616b70657c7a94f60ad4a33bc2cd0564836e1f196efb9687da667359cdcf92fcd1ae45aaf5f1f7a0428a515780297f0f
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiGQr:qCewdx5tul2Mf0nkxqatgl8bCaiGQr
TLSH
T1D8057D52BB8180B3D55702318CA763A7ABB9B8521F21934B239C536D5F733C0BB36766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 778KB
SHA256 49c27b973f9f1f05b04e11cb6797d329a6316bf44a02dcb75ad89a652fb82bb9
MD5 3850e3d20456b6ee400d75e9b1e9ac58
SHA1 ee4a695017e3ae8604a89aa37993702c2a1d5070
SHA512 8df687dee38577b99b2e562082fd4e77d7e4e3847333fc759e7629ec4e18bb4eab556a8c97d980c327e2aa4a990b35c97aeb20fd323c5513a07d312ead686185
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiGOn:qCewdx5tul2Mf0nkxqatgl8bCaiGOn
TLSH
T1E4057D52BB8180B3D55702318CA763A7ABB9B8521F21934B239C536D5F733C0BB36766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 778KB
SHA256 0cd2d6f3bdac7b865e2adb5a5990f11eced73460459c08e3a4d5ad3344f01323
MD5 39b7fd0ec92a7c44e4655d32c6196633
SHA1 45b38b627ca1d5f3b3c10b353545fcbe699bc957
SHA512 fcb61b29c6a7c2c4244d79ec2e6697daafd433878d7c965c57ea78879d80c72ff513376054e8bd056069a55a4683c000b7e06276187472182a018a7d555697a2
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiGEx:qCewdx5tul2Mf0nkxqatgl8bCaiGEx
TLSH
T167057D52BB8180B3D55702318CA763A7ABB9B8521F21934B239C536D5F733C0BB36766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 778KB
SHA256 334e9a995faf9b6ba6a8cbbba01f1de25e93f6dbba1cc8f6e1a769762327afbf
MD5 139acbf1011a69987e0e4fbd6d08ce48
SHA1 7257c91076e3caa28ea0cee0051634040134b88d
SHA512 01fe4f8fd65df9941db707cf3aeb1aea85fa782f51f16c816bb4e91613d4e3a11ede62956e5c610776e945f4c8f53d284f6f560f8c48cd93a930ed556b65443a
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiGOA:qCewdx5tul2Mf0nkxqatgl8bCaiGOA
TLSH
T1E6057D52BB8180B3D55702318CA763A7ABB9B9521F21934B239C536D5F733C0BB36366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 778KB
SHA256 70cc76cb871ee719fc67092750d2ba89b78ef51ab5ba46dabe5e214b320076e8
MD5 016a51b67846f2b90f732b37619944c7
SHA1 081627a33ce388fda458ee7b5bc4b2b6ca84dae5
SHA512 c47eacd7639dadf91d986e4149b2cfdbaf6052bd68179183c525ce3ea28f35bfb7e0f0bb7419451bc8dff9df8f5822f7a207016b8217465d7a98654ced105637
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiGH9Q:qCewdx5tul2Mf0nkxqatgl8bCaiGH9Q
TLSH
T1C2057D52BB8180B3D55702318CA763A7ABB9B9521F22934B239C536D5F733C0B736366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 778KB
SHA256 40c6e7fc0f5c1b119cfd93e858f3e2e2baa9a4e10b134a02cce0deba928dc23f
MD5 35c6ec9b5d4dc6627cb4c53531a874ce
SHA1 b4227467256b2ff93ab1fe723cac6007cd65fbdd
SHA512 9fe7761085310bde366f7789d995e75f7fc7f1c6409212484cd210fa690f128cc5fa852f52afcf63ee14ab58a86c6e36fe909df0a5f0a71e569ba9b4a23e04ba
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiGO4:qCewdx5tul2Mf0nkxqatgl8bCaiGO4
TLSH
T162057D52BB8180B3D55702318CA763A7ABB9B8521F22934B239C536D5F733C0B736766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 778KB
SHA256 8183c39356c31b5ab1901deb87294000942cdd7a73b412548cae6c4fa7db6958
MD5 e6e21e28b4d15d2473a78d64dfc18e2d
SHA1 808ea64ee6896acffc4d3b4018c4caa31e970c6b
SHA512 49bdf992ffef7f7ae44b8db1c09877690d80a7650740ca94ba2112116a25deac320e2addedf5e1f24c89a2d5a996a3041506533ce506fdb40a4db9641259bff5
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiGtu:qCewdx5tul2Mf0nkxqatgl8bCaiGtu
TLSH
T19A057D52BB8180B3D55702318CA763A7ABB9B9521F21934B239C536D5F733C0BB36366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 778KB
SHA256 d89002238c38b1c892cff1e36dc8b95f00aa79364d543a1faafbae2b85d24556
MD5 43c1c60c40cc5a30aa4cec4737778cbc
SHA1 2d5db336ca7debcd2e7eb4ee448b8e3ee469163d
SHA512 6e51f0d1b1f3d31c4a176b4c19826e77cb4704b355e4f39e7dbfbeba67f9f60ccdd3c9c191628fbc3ca7b519f2a96fb4bc164dd50334fd2c3f61aab60bd01506
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiGgj:qCewdx5tul2Mf0nkxqatgl8bCaiGgj
TLSH
T198057D52BB8180B3D55702318CA763A7ABB9B8521F21934B239C536D5F733C0BB36766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 778KB
SHA256 cc378238702879e6140286ec5a501e61492dac0a602a838302ac0f023f66ad9e
MD5 e017ffd1944ad04109fcc0683cf1cf0b
SHA1 5de3037fbc0c627d9fdfceddd219e2f1e2eebd01
SHA512 00a7072c5d2c55d156a34c727d2a4ac50a927fed6a49819ed1ec79071f90236f1265c364b0b4225906685f56ddea6d02d4f3a28901b87c167e6e56e55278dd5d
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiGRg:qCewdx5tul2Mf0nkxqatgl8bCaiGRg
TLSH
T1A0057D52BB8180B3D55702318CA763A7ABB9B8521F21934B239C536D5F733C0BB36366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 778KB
SHA256 5917180530d15994c0ed58a06cdff4d56b3e73ae97c268d11330b6dfaa0e241a
MD5 e8476e1b34d09072e3919e538932907d
SHA1 d6952c7cacc5c0ba61e4126228f2ed483b99de1b
SHA512 e1457ccb21f906a220c92d59963d1f091c4e27512f9795d156be788f43e2a2ae54ed741471a9d1d51c61863a3073353fba9adcd08e48f0a4e0a17603224cdf60
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiGII:qCewdx5tul2Mf0nkxqatgl8bCaiGII
TLSH
T1D0057D52BB8180B3D55702318CA763A7ABB9B9521F22934B239C536D5F733C0B736366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 778KB
SHA256 9abc4924f40d27119c34530dd7d2a627fc85c0c332f75563a0f85f271431a8c3
MD5 1143ceb44efa2984f7e0d5cdba6c9cfe
SHA1 e621e3f2ef99d852f71dd0609a4dd6b06443b6d7
SHA512 1558fb273458a56d184a66f3a202a61eae51efb3f870e29e68b6423213f4465dda629f26893fb9875f8b095b79a67c611dfae12bafa1b4ca6c965062909db261
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiGqo:qCewdx5tul2Mf0nkxqatgl8bCaiGqo
TLSH
T1CA057D52BB8180B3D55702318CA763A7ABB9B9521F21934B239C536D5F733C0BB36366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 778KB
SHA256 67a237d684d818c608ec17a3994a9749016436ff34f2f7be72b0ddc4394c66c0
MD5 315fe87692d4d866c7fe0b0346d7df52
SHA1 10e57a359b38f3c081e1af377ee9c812372cc59e
SHA512 2014b23adbd55e12aa0d8e93c23c8ee7a37c31e47e390b6a6d4928a4416cdbc8eab7eb5002e69ab55d3eecc683b4d408289dcbce0a1ae3dd473f9e567aa112bd
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiGB+:qCewdx5tul2Mf0nkxqatgl8bCaiGB+
TLSH
T1BD057D52BB8180B3D55702318CA763A7ABB9B9521F22934B239C536D5F733C0B736366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 778KB
SHA256 d2da74112a2fe6cee37475162d219b6551bf0ea7a308d47b402d85b2f8440c2b
MD5 aabe8882ae99143ee9466fc599ce06e6
SHA1 47c23f13ec1b5e102ac01237bafea1a3ba719c57
SHA512 5a91330ba30f746abfa7aa8b5880d0772217dcd62b94289ebabae0e0b5ddd53dfc57e9ec59e3aa67d46eef5286b0e06f310f14140f366805f2ea69714bd2f41f
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiGPQ:qCewdx5tul2Mf0nkxqatgl8bCaiGPQ
TLSH
T175057D52BB8180B3D55702318CA763A7ABB9B8521F22934B239C536D5F733C0B736766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 778KB
SHA256 ae973887fae927ed8b406e8abcf8abec0b28d9faee64addb7826c1fd6941776b
MD5 6fd761616730d1e8cdc044a1b39e016f
SHA1 8bd7c638ed4109c1c51119ee2246a4bfc357844d
SHA512 4e83e3a224671a5760e06a5136f4c60ff989c87f3d15b26fa4e07a82821b378655fc3361317fa8876946901d3667fc5d70799f0d4e740e5bf5900c987fb46499
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiGUX:qCewdx5tul2Mf0nkxqatgl8bCaiGUX
TLSH
T113057D52BB8180B3D55702318CA763A7ABB9B9521F22934B239C536D5F733C0B736366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unpack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
Size 974KB
SHA256 52f45e7ca680b5d5b44fa8a00db0ffb283b822083c2b39c7ce8e291e66a923f5
MD5 289fc914143b3ae933acc40a01f53db4
SHA1 b4c34552b05e0126efa56cc8d96c3e5d1f9688bc
SHA512 fc1bc4981f0edb11cd3a5363cb81b04951a7965dbe4b3853bf50657e39abc8619693fc02029ef9118d5659fe4bbbd69f4fe30bd2c2624304d6b64e3aaa0e5263
SSDEEP 24576:qCewdx5tul2Mf0nkxqatgl8bCaiGTjCXF7IwZ:QgE2Mf3qatgleC17IwZ
TLSH
T1F7257D52BB8084B3D56702318C9767A7ABB5B9511F6193CB2398536D1F333C0B7363AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 778KB
SHA256 434301b8f9079b7bd58a558c38652c07a474dcf7a90eb7f8ae9036dab9f73344
MD5 fe24d8ae521a0793beffc83f8c1775a1
SHA1 f7262f593b6945bd0eac08232ba120d17a6ae51c
SHA512 873d5a7b5985bb22b5d6d3c448e7efa921fb45e729b0d01db76202440af3cf6c6cc6cdca8dea406e7002feb6d9f6e9650a7657aabea671dddc4da57d9f3c90ba
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiGyL:qCewdx5tul2Mf0nkxqatgl8bCaiGyL
TLSH
T1E5057D52BB8180B3D55702318CA763A7ABB9B8521F21934B239C536D5F733C0B736766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 778KB
SHA256 273c7a58fa2e7686e7dc3e8ad16f2585e7f35685d97851231f3f5d2a5628f3e0
MD5 6ed243b014105d90e115d806e1a25c87
SHA1 277b0a61505d472ccd5092b514e77c5377d9315f
SHA512 c27fc2415c5bec815056a0dfd18b727a28c2b1f58fe90d86b0180b43fe111d42a775eee9802498d308e6a03c05e4ddd2a15e379b9b3cd463ef4a9da52dc839e2
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiGWFC:qCewdx5tul2Mf0nkxqatgl8bCaiGWM
TLSH
T15C057D52BB8180B3D55702318CA763A7ABB9B9521F21934B239C536D5F733C0BB36366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 778KB
SHA256 68bba6dc17c236a6b61eb5e510057536df800e5903648880882978562e312636
MD5 b419a530901cf32b8fda6baee4859ef9
SHA1 448dca107665e0d2b158b03b96447d66a549a56d
SHA512 35518161b22a95bbe2bb8d4f983fac59a6a7d2bc60b90121d5fb570e4350f6cb98f81ecf70bbb3f2c77a290d025288bbc5d34bbf82b54ad9c04df85e280a3d20
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiGfh:qCewdx5tul2Mf0nkxqatgl8bCaiGfh
TLSH
T1F6057D52BB8180B3D55702318CA763A7ABB9B8521F21934B239C536D5F733C0BB36766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3268-21-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/3268-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/5692-22-0x0000000000400000-0x000000000040D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads