716086c2f1b62d7b4ae2a423762aa5152cff8f46f1945d8dc6dd58700c4f59b5

Analysis

max time kernel
100s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 22:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_059d528ebe7f4fbcd4b264ee31ba3a21_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 844KB
Sample260817-2walqa1fkd
SHA256 716086c2f1b62d7b4ae2a423762aa5152cff8f46f1945d8dc6dd58700c4f59b5
MD5 059d528ebe7f4fbcd4b264ee31ba3a21
SHA1 76daa9dd1f76659460dc96f5fc3dd868892c9a60
SHA512 3842c15b7b3fdf5bbfab453215a64b56aa5495b71d64749b6235016c11371f2f7f6e22a4099ad459f549bfc34d406662f899de40d0e1d6710e49c43f59365b75
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2qIRa:A3k03kB56r
TLSH
T16C056A07E6840FA4D10F81749A968662EA737C125F2097DF1354AE253F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/3980-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c536-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b305-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b30a-57.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3980-166-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4480-167-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019849-234.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-440.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001bb47-489.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0015000000018a5b-556.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-617.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-636.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-721.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-740.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-791.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-840.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-865.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-884.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-891.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-904.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-917.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-930.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-949.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1004.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1048.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1086.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1135.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1148.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1173.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1180.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1217.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1320.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1339.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1365.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1373.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1398.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c536-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b305-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b30a-57.dat	aspack_v212_v242
behavioral2/files/0x0004000000019849-234.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-440.dat	aspack_v212_v242
behavioral2/files/0x000400000001bb47-489.dat	aspack_v212_v242
behavioral2/files/0x0015000000018a5b-556.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-617.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-636.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-721.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-740.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-791.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-840.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-865.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-884.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-891.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-904.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-917.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-930.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-949.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1004.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1048.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1086.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1135.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1148.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1173.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1180.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1217.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1320.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1339.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1365.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1373.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1392.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1393.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1398.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4480	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-17_059d528ebe7f4fbcd4b264ee31ba3a21_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-17_059d528ebe7f4fbcd4b264ee31ba3a21_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe	patcher.exe
File created	C:\Program Files\7-Zip\Uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	patcher.exe
File created	C:\Program Files\VideoLAN\VLC\uninstall.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe$	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jar.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\firefox.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe$	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	patcher.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-08-17_059d528ebe7f4fbcd4b264ee31ba3a21_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe$	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe$	patcher.exe

Drops file in Windows directory 61 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-08-17_059d528ebe7f4fbcd4b264ee31ba3a21_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-17_059d528ebe7f4fbcd4b264ee31ba3a21_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-08-17_059d528ebe7f4fbcd4b264ee31ba3a21_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-17_059d528ebe7f4fbcd4b264ee31ba3a21_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-17_059d528ebe7f4fbcd4b264ee31ba3a21_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-17_059d528ebe7f4fbcd4b264ee31ba3a21_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-17_059d528ebe7f4fbcd4b264ee31ba3a21_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-08-17_059d528ebe7f4fbcd4b264ee31ba3a21_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-17_059d528ebe7f4fbcd4b264ee31ba3a21_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-08-17_059d528ebe7f4fbcd4b264ee31ba3a21_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-17_059d528ebe7f4fbcd4b264ee31ba3a21_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-17_059d528ebe7f4fbcd4b264ee31ba3a21_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-08-17_059d528ebe7f4fbcd4b264ee31ba3a21_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-17_059d528ebe7f4fbcd4b264ee31ba3a21_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-17_059d528ebe7f4fbcd4b264ee31ba3a21_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-08-17_059d528ebe7f4fbcd4b264ee31ba3a21_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-08-17_059d528ebe7f4fbcd4b264ee31ba3a21_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-08-17_059d528ebe7f4fbcd4b264ee31ba3a21_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-17_059d528ebe7f4fbcd4b264ee31ba3a21_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-17_059d528ebe7f4fbcd4b264ee31ba3a21_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-17_059d528ebe7f4fbcd4b264ee31ba3a21_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-08-17_059d528ebe7f4fbcd4b264ee31ba3a21_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-08-17_059d528ebe7f4fbcd4b264ee31ba3a21_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_059d528ebe7f4fbcd4b264ee31ba3a21_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-17_059d528ebe7f4fbcd4b264ee31ba3a21_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3980	2026-08-17_059d528ebe7f4fbcd4b264ee31ba3a21_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
4480	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-17_059d528ebe7f4fbcd4b264ee31ba3a21_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_059d528ebe7f4fbcd4b264ee31ba3a21_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3980

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 844KB
SHA256 716086c2f1b62d7b4ae2a423762aa5152cff8f46f1945d8dc6dd58700c4f59b5
MD5 059d528ebe7f4fbcd4b264ee31ba3a21
SHA1 76daa9dd1f76659460dc96f5fc3dd868892c9a60
SHA512 3842c15b7b3fdf5bbfab453215a64b56aa5495b71d64749b6235016c11371f2f7f6e22a4099ad459f549bfc34d406662f899de40d0e1d6710e49c43f59365b75
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2qIRa:A3k03kB56r
TLSH
T16C056A07E6840FA4D10F81749A968662EA737C125F2097DF1354AE253F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 8b3f5b00e63bb89b5bcfc258a0a0d1a15ab5434802cc2e618148c9ab761ddf8f
MD5 036e870da74fbf37de9b71b5aadfa433
SHA1 e04e50d449f5c88276ddaac33e129af8b0213063
SHA512 1d8a98b626865b09971705d0a365c6f0c9e402bdeab10592c0343625f3921c2b992f78f213b6713eb2217c3c05ac2778eaa59331e64f21d894a2c38f06ceb75b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2qIRaP0Le5ji0hmxNrM:A3k03kB56rCPji0Aj
TLSH
T191654A16F6A44B65D02BC078C5D29666EA733C421F3087CB1354EE283F67BD19A3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 859KB
SHA256 ec962298f4e8f9a882dd337f19822b7a9113e85bb7ca5f2bd3b83a5f92aab09c
MD5 0e0174a1ed923be6c754e0e5d4364751
SHA1 f6c1561b61792a637215bea64cfaa2bf6b970414
SHA512 e469ccfb4a5e46211d93c58a2961dbd2f2780b6f9244658d3e6531ca50adde0ca48ea82e33bc349c88f583bba77dafa71eb5c41d3357f5e1a2dfa58016c78ea9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2qIRaRa:A3k03kB56r
TLSH
T130156A07E6840FA4D10F81749A968A72EA737C125F2097DF1354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 868KB
SHA256 c11805fe46e7682468c08e9e744c937f02be43545dc2ba84317df98d48591577
MD5 e3fbbae8e832a03633d32fd513dc50ea
SHA1 76315364182157d658467578a6d35e669f6a69b7
SHA512 53ad89103ab9825b14c38dba0f3f8ae88edc2b17020db9e2f9f35cb9043e335dce4b02d0a648a3792773069c44cf26885fc8a041d1c93095b6cafc7c5141d88c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2qIRao6:A3k03kB56rs
TLSH
T1E9156A13E6850FA4D10FC1749A968662EA737C125F2093DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 868KB
SHA256 3d5cb64c0e9f95dda5419b65734c7bf33a60bd128321ef1470acd2f6fe57ff6f
MD5 61d36c505ac46894c4ef8aa9f6657802
SHA1 9e90a66a4ffb06a882889cf82890934eab5a3678
SHA512 b5d1839f96d0de9613d9c518dff9697d6a4add44f39f143fef5bff70309e8a7314f856ac549748619f28cfa56d8fbaeb8c47941a738d3beb4b5736f1f72c4284
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2qIRasN:A3k03kB56rR
TLSH
T148156A07E6840FA4D10FC1749A968662EA737C125F2097DF1358AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 868KB
SHA256 8d5cd0df032e1b99835cf3baa6c2520472033306ea386fa69cd365b3dd1a04e7
MD5 90f5f9425f8b5172b86a4c3efc68b00a
SHA1 a93031133c25c3f6916407774276ce1740b9a03f
SHA512 07c63b5673122518ff35330dfecd69be100284b214d8de55de8704df3c9bcc68aec0fdb671d307bc0200e6a480b2388dab978fa9014cbcc8124182190861bf30
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2qIRaif:A3k03kB56rR
TLSH
T128156A17E6840FA4D10FC1749A968662EA737C125F2093DF1358AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 868KB
SHA256 a95cd5f53b1a6d412d3ebae84ed9c76a727953ce059a1085d1d8e6668c761336
MD5 8abe62a9fb3dc133a625a58f92dd9889
SHA1 80f399a7c60db1f5baa3f38a7bfcb30de868959f
SHA512 e99d8367db8538fae718cb5dd59c1385ed400ca53658b395deeb984530f94d04edbc1601decb7ae1a6ef7f9f4ac3d997f4409ef24d7466199ef1d5dcd9d4471f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2qIRa8o:A3k03kB56rk
TLSH
T1BD156A07E6850FA4D10F81749A968662EA737C025F2097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 868KB
SHA256 07ff0882d18adec7db0ae867540f0dcecddf477e29a2a158c3d8a96e7e3d4ad2
MD5 3a38191636448ef93259cc577af04d90
SHA1 44c4a9e966f0d8bc93d3683b87cc3b008a28dad5
SHA512 9b5e17668fd5fd26042a83719411fa51b8baba1944d84e010aec3e2e3ff8ebba779ae179a1e2b2689b4f5734b4423d99c91eb8210049256314d02a35d9e5b3cd
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2qIRacu:A3k03kB56rW
TLSH
T1B5156A07E6840FA4D10F81749A968662EA737C125F2097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 868KB
SHA256 e8ea6e73b54a117dec9b7c3b0d8946e9e32146e56017c7615b57b9875bb5c9e3
MD5 dc461dc7b54cbc4d1f873324d46a6a50
SHA1 fba28273c43179e94e170402d47999e0355dfb10
SHA512 88789c774103bfa2a31d95119366eab78e6e83fc4d24a4b4693a21ab5f5d5810618253b7a594548163cb2c98bf54aab6bddf27bc8a4cca5258a625dc9ae1491c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2qIRag9:A3k03kB56r3
TLSH
T1B0156A07E6850FA4D10FC1749A968662EA737C025F2097DF1358AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 868KB
SHA256 8d30046e82800661edfb3fe0022781bb106f00fde4e2968801f6adcd79c9f566
MD5 f43f058fb80b467abf1b52334583657e
SHA1 a90316d13b657204044ba4e989514347591498cd
SHA512 9503c47f5e02bd24383772673f6234b72280fd1da503521261c343fffc87ad4dc10e1e2179a465ccd9f52afc52ca809f97430cc7451d90a1df0f6ffb2179f70d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2qIRaoc:A3k03kB56rG
TLSH
T102156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 868KB
SHA256 51e47e5a03a9d89923bc48ff36799e563870521b21ea56c1e252fb08adfdf742
MD5 91ef03a99d5fea6b2cee6d60c0ef26fd
SHA1 28440d7b83c6f228d2542dab37a6d61aa18ba15a
SHA512 7b71078e652ed250b5918aeacb2cad0d42eda87a50d19b480f60d8ad9d522d0ce64f242d41cefd781d42bc02d120b9c12a85922316d1417e06b9d60f2e036439
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2qIRaBp:A3k03kB56rU
TLSH
T15B156A03E6850FA4D10F81749A968662EA737C125F2097DF1358AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 868KB
SHA256 fc1c9e470017658d0f09f7142f60a86979500fdb021a0a36dffb110cf10d50f1
MD5 8cb524209711e12095f334f8019d1d20
SHA1 ead722c1f0e6d085bfd142270072682be87912db
SHA512 739a3aa3b2d8d5aabf0c00be4ec90e272c8bd4c2f4411a187e16dc54e66b2b6f4304567c839dd812590841e7d6bddd1689f54bd1173cc95e734ce0eeb98ea674
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2qIRaWN:A3k03kB56rj
TLSH
T163156A07E6850FA4D10F81749A968662EA737C025F2097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 868KB
SHA256 881f9fd3d9d1ee535b04562e7f5f7efaf88de11453855515e12875b63df42e73
MD5 07f4ea0fa640bc524e2480dd3c13af14
SHA1 9144afeb0557d42a2bce3ebc3093c95a95fb83ca
SHA512 24c1ecbbbd100142483ce3c9dfdd3002e1e96fe0a46c1c065c6583be758d44d4d8bbcd66f8b922a660e8f7852a0dd91968fe737b52e6244413e516aa7b03ab92
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2qIRaaF:A3k03kB56r1
TLSH
T141156A07E6850FA4D10FC1749A968662EA737C025F2097DF1358AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 868KB
SHA256 f0ad873a436a9d2a930707397141997986dc689eef1fcfd0ac308bcbcc91ed3d
MD5 62782de7dccba46bfa69557d64fa4ad5
SHA1 43948c18454ff8ad5770281487dc9e6b233478f8
SHA512 0bfda45c79171f5c6c63d2d0d7922bea723bd6f9d9ee0e0166693f6ca6ff6986f867bdf37a4cdf36f782344bfc12b838e5eb44d019b4214d63186e67edc2450b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2qIRavC:A3k03kB56rZ
TLSH
T14D156A07E6850FA8D10FC1749A968662EA737C025F2097DF1354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 868KB
SHA256 8c566ce175ed7ca80027b42e1386a23c5ff11cf180da39096c95e87250da48a7
MD5 17aa7eff24571aa6d2dcacaf1e16e496
SHA1 4a9112c0f97ab9c86b285c3e1e9ff97ea4c3aecd
SHA512 74d0e9672c7cf9c1babd5c39817eb25c8462ddb307a64eec27414497f95e8a0bf1a7a858ed154270019709d74b108a1f04d562e3e8b9fd3c6e7feeb53344ab25
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2qIRaQw:A3k03kB56rE
TLSH
T10D156A03E6850FA4D10FC1749A968662EA737C125F2097DF1358AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 868KB
SHA256 38355c8f0c6ddac5c9433c82221a236310cdce8bf09b77092bd00918ebd635df
MD5 1c05d3b7fe100454587e47fc1aa3d062
SHA1 c6182bafc603b7659eef96f1709cd84759e91044
SHA512 c9a89c4181105d1454147dc1507b91ce3d271b007fcafbd041862421fe31f0efaef1451024e38599d4e5dd2c7db36bb93430ac9be9e0dac30f411d896bdae2c4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2qIRavT:A3k03kB56rs
TLSH
T148156A13E6850FA4D10FC1749A968662EA737C025F2097DF1358AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 868KB
SHA256 f47d4a1c89f3af749609834951aed2ca2880eed905d3bec309f7b4f01de2e8cf
MD5 0b5ecf92e7a6535be6f9714b99828e88
SHA1 d4308c92c9f04cceb9e88851e50fdbc4f7fa407d
SHA512 2402be9952d7b86ad528451f364e9f4b45b55ce73c8d351985e947f576c2d611eab95651689d587594b732cda4d3e8ded8eb746a4549e74a9dedd737fffe874e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2qIRapu:A3k03kB56rL
TLSH
T1F5156A03E6850FA4D10FC1749A968662EA737C125F2097DF1358AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 868KB
SHA256 f1b156bcf0be5829d21cb35a7e343e74508866d0102b8c3d2afb8c562e09062c
MD5 51978902a4b04555d88a9aebf59d488a
SHA1 dd7f76f461fc7ed036e5195cd9c7e596946fca29
SHA512 97a61a5bb6e92b1b0e9f1a64236f8a116443e3ccac154c0abba591292e27dc7c2dd7d229a05f6dd903c53bc888128afaf09ff0cf5e3dd5bb06cdb2c24c5ca00d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2qIRahb:A3k03kB56ri
TLSH
T1B7156A13E6850FA4D10FC1749A968662EA737C125F2093DF1354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 868KB
SHA256 f3086f71d489966a787713d38ac7209ae8aa7784e45eb6083b378928818117bb
MD5 76ad71dfc07cfed60b7430e1340d79ce
SHA1 f8d9bf8c5d74ea3e5d8e2777ee402c6fd6723547
SHA512 9f0784468c6cd61cfc1c160b3663eec4c1493d10cec5d92658f9fa7bad91c57532b22c533dd1428907ab8804dab6366c900103c9e32775e6f6e679c94fcafbf9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2qIRapf:A3k03kB56rC
TLSH
T1A6156A17E6840FA4D10FC1749A968662EA737C025F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 868KB
SHA256 762e7cf4144936d3a54452d0d0cf551189e4ce1522310e9ff0b60a44d53db927
MD5 025d94dcd776fa36e106d6fd6785d113
SHA1 c73587d85d84bee68a9617c5e3f3fbfda26df11d
SHA512 bf5fdee524099120c319733188d67958103a3528cd4d3a8c562bb30b3cc05afec35b6225bf9463cfebfd2d48fa5df458a1d4c2e08055a6efd318bf115b70ebac
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2qIRaSK:A3k03kB56ri
TLSH
T193156A07E6840FA4D10FC1749A968662EA737C025F2097DF1358AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 868KB
SHA256 7b4f36855f4fb8c5148e2af9006aabc9be3c57169153a07b4212599aeb0ab09b
MD5 0e8b8dded2bf0bfc58e71c0d9326b7ab
SHA1 23a10f129955cad198ba202215110ad49440e54a
SHA512 406a66e062949d0c1b8cc676563aae0fccf616e8b09617b123b24c439bbbcc321d49fe853545fca40b9b502fae737e46d58a82b50fbea6293fe108a965d9475a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2qIRa3k:A3k03kB56r3
TLSH
T1A7156A03E6850FA4D10F81749A968672EA737C125F2097DF1358AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 868KB
SHA256 762a32168b011a5157ccbc8b71269bad193b4fe6016fa0218692b9e5d3dc1be4
MD5 c44c7dce790c95c6a40f66806e371a46
SHA1 fb16c148c80f72f2945b390a70416ca2e38af250
SHA512 32298bbf0a6e0ba8b130dc7d00ddd6d34352c705c66dd5d971810cb068150250ba43c9eeb96f0d09c2553db039f89c1cd1bfe140d7cdc5b5bd2c93d40799a8b7
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2qIRaA0:A3k03kB56rW
TLSH
T1B8156A13E6840FA4D10F81749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 868KB
SHA256 c16e6c9fa42c916100e46bb13d386887d1a2150a4fc1b3af34272e081c3b83e8
MD5 d4a3a9f7e77ae86e4be31d7abecf6253
SHA1 f24499623e3b8ae76d197da11220dbc9291f6c7e
SHA512 c8d168c42f7f1a3f4d45b868ebc3ff7c30eac9e7293f684bb8da1f126cc6a2205c7229acccfadab9912a1db3085fd6a88eadc9debb6e54314dde48bf79f4dbd8
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2qIRabg:A3k03kB56rv
TLSH
T1E6156A03E6850FA4D10FC1749A968662EA737C125F2093DF1358AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 868KB
SHA256 310c7791d3db41457311b6765aed4716cd9191d15d0a30bfcc04ced1eab35729
MD5 1cd076fd5ed7fa4c50fcd66452688afc
SHA1 ff13f4d7b25f7a28897222cbfcfca31f71d58042
SHA512 dc096819843e05e7485719d394b07223c441cfe05e880ef3f2d0b246a85a8f252ce8d763eb536322c56860b921d58e3ebb0f9d49aae8ffbe89203771c0056842
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2qIRaWr:A3k03kB56rJ
TLSH
T13F156A07E6850FA4D10F81749A968662EA737C025F2097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 868KB
SHA256 34b469921ba0e1743b0aa495e16c962d8fed074cf5502cfddd10fa463437b939
MD5 1236dc4e72e0365f275540d2ce6c2876
SHA1 bb91d82ee2af9c6d718ea01953b5e1f908fa8781
SHA512 fe0c24929c9ff444a7a4d18b4dbea4674e3c9d3e5ad8f7e75385d3e8c8e77319884ecbcaff84e0b3a8094399f743d576582fcc213b8d1805bb0d6c1b473f5368
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2qIRa8n:A3k03kB56rj
TLSH
T186156A03E6850FA4D10FC1749A968662EA737C125F2097DF1358AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 868KB
SHA256 1429905895df2f84c8e9da4d35481bdd99e9565d4c705eea89638db23152e760
MD5 da6b43506d46f8ae055b413456342e0d
SHA1 4a70ab2edb58b41c93c6bef427451b055fda0982
SHA512 c072a6d8b100580b36dc3f787b5442a05f4729c18561d0bd9ccbde76e413ced0a5c8e120680f2e591ecaa218935bafd00efb536a7062bb2d28118d56dcf38854
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2qIRa6x:A3k03kB56rB
TLSH
T188156A03E6850FA4D10FC1749A968662EA737C125F2097DF1358AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 868KB
SHA256 d62615517cb8e248bbed2d283b1218d9560fd3b6b438fcb3c6b02a4363a7594a
MD5 331493e0567589dabc43cc814e8aaa4d
SHA1 b06edeedefb79da6c7bce8f48507084d9577c913
SHA512 ad1b6c86951b984a2ea6dece08e0922b0728730d220f89bd2a1298e6762baeaa6269aed7f91588ed965e7f342a866d1cd0f4c87b56963e82233fb4878014a157
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2qIRa8A:A3k03kB56ru
TLSH
T122156A03E6850FA4D10FC1749A968662EA737C125F2097DF1358AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 868KB
SHA256 198ffd540bf1f49372f2b92d0ac70102cf9a786cb717cada44985afe8ffec5b7
MD5 1e1201e62d5a95d528caf12f72e234a4
SHA1 2ec9254b10e90a3a76e30d424ed3396df2797bc6
SHA512 c2e24621735fcb67a52c77f9e327e527d4742964cfab0c2f236c147a094906539b0f0d5cac598665d6968a7e78656d0a89150e0621c9685061e9b4248db40a8a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2qIRal9Q:A3k03kB56rz
TLSH
T179156A03E6850FA4D10FC1749A968662EA737C025F2097DF1358AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 868KB
SHA256 0adfabbc57365013766a454dc114205f91ddad4621db7bd03bccaf70b1b75081
MD5 bb46545758ba84dbc069ba05190d6f6d
SHA1 f319c1d9d1d554b03bd90151461d8e5aaafd42a9
SHA512 31cbf1cbc29d5819cc445b0f97a69fabdac0a26fc343029488a10977816d59e4646a7061bfbb3876f93f3327c646212894455bd156ba22898c39cd85d96972fa
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2qIRaQ4:A3k03kB56r0
TLSH
T120156A07E6850FA4D10FC1749A968662EA737C125F2093DF1358AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 868KB
SHA256 66e06d2d03da3e3321e73b959c1b5a862573ce9153d949fff592acb3bd434dad
MD5 08caf7dce9d7d6165664f455b8f37baa
SHA1 ed792fef6eb7fecbb3fcb0efc24c48b8a4586022
SHA512 3c1a93a44c23f3c9e100640678fc880e4871a2c8ffd2034110999c0e13ccc2f6ee631c52adac2fb859cf6d3c3de6908d25870ad31d9075e58e5bb53a27ab870e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2qIRaTu:A3k03kB56rl
TLSH
T1F4156A07E6850FA4D10FC1749A968662EA737C025F2097DF1358AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 868KB
SHA256 7cfb66505c98234c1e380c0c7ce5671f570c54134373bc1aaf45f0be48f59c75
MD5 509cd4683060eb8d3dd6258d5c98c4c4
SHA1 efb73eb523ef17f9e31d0d273b57e1b766c03bb3
SHA512 8b1ba3d68bb3eef98cf0248b87c88cf5943229f6ef69fc51842f84c05ec9181cc2195a80a60f5d35260343a644cfbbea9771a2e3f02e6ea71153e93b282ea286
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2qIRaOj:A3k03kB56rn
TLSH
T106156A07E6850FA4D10F81749A968662EA737C025F2097DF1358AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 868KB
SHA256 054b282cca30a72dd81d00c36cdc813f7f65a19c907b945de1283aeda857d066
MD5 ca23a5d8286a80846cb40a1ab92fc5e9
SHA1 b0c082ef0d813142139adc5e6881f48b1ed527f8
SHA512 6f25c4fe30800b716606f7ba94cf6826bdc7b08c5f879d66ad87593c2487dfa413dcd7a0b1b695cb0a74ceb81d299937e6485604aa4e0a23f46973259c933185
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2qIRa7g:A3k03kB56rP
TLSH
T123156A07E6850FA4D10FC1749A968662EA737C025F2097DF1358AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 868KB
SHA256 c99e6cb9cb07dffd61b97acece4d431ba0880f32a4f6fa21334a3203d0e4c163
MD5 392872c4bb452375ffd573ef35ed4a15
SHA1 c3d006608d336f1ce7296a7c44460fadf8639c17
SHA512 782e71614acc3a7c4a44f8ef3bbd58f8c900b31b03ee5c2c6f7458d11874c1b8203f319f8bc909ab5e3291ec2b16c04dd78d7927b1309737fbf5dd31cf2b9aff
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2qIRamI:A3k03kB56re
TLSH
T126156A07E6850FA4D10FC1749A968662EA737C125F2093DF1358AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 868KB
SHA256 01fbddc5256859e97da81ebec2553558870cf0046905547467c57edc4b995527
MD5 9ba387b0a8caa83db80d28a6181508d6
SHA1 b41a988df3d6d88b5d5f304fa52812bc64c789b8
SHA512 416fc617a17a7b5f9dbb43fbcf75f739bb604cd10311c60e8f81508f8ae87319ce8fb19143a711f2d9bc4e0cf59bc64726fa1e639dd3fbee90e5731cc570aaec
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2qIRaUo:A3k03kB56rc
TLSH
T197156A03E6850FA4D10FC1749A968662EA737C125F2093DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 868KB
SHA256 c5070cac792235ad922ffd8fe0b52add85af802bef8f0c95ec5bf5244720a122
MD5 03c8b4594d242258e9910cd8e3cdc8ce
SHA1 262b88abe05649b20023569804a7e9135cb6d460
SHA512 958ba0c96ed7994c63114a6616eebfbce7aaf22c0090dffd27f862eb026790a84bfa8da988b982a52fe2e95b3c24edbcdbafa6f37941c6be5e19ed012f03c52c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2qIRa3+:A3k03kB56rR
TLSH
T109156A13E6850FA4D10FC1749A968662EA737C125F2093DF1358AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 868KB
SHA256 cdb01c8e81a54c15891f7fe0f63f252042c2b0d7b2790eab91991e66fac4f271
MD5 24097e0b9acfb4b24e4d3a4e59a35909
SHA1 33fb21d8af02496ebabd58501112a581ee0c018a
SHA512 4a26425af429fabee419c55e61b0d1f5e94603acc2ddbef515631ae997484ba73b76140e4cfd9e7de19b40dab094546f7366e8ecb6c3e63831f900dccd4dc164
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2qIRaNQ:A3k03kB56rR
TLSH
T1C5156A07E6850FA4D10FC1749A968662EA737C025F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 868KB
SHA256 87cc03685e4ae06c094e875e399191973bb85396e7f9dddd8988affa0e1eba61
MD5 c7b87f89eca769f97d60ff268d39523b
SHA1 ccd7aa6cfd4946d9a9febec13eb9d2b9ff89fcd7
SHA512 e2a6b591135f4bee19966fa2c442787953cffcebc550ffde60cc15e3c8642bd20cc4a4bbd7528b1c8b49b6b6721c986bcac018cbdac3ef619cfebda92a293b46
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2qIRaCX:A3k03kB56rd
TLSH
T1C4156A03E6850FA4D10FC1749A968662EA737C125F2097DF1358AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 868KB
SHA256 9fba622d13eef6531295d3867da93cb4dd631bf017ada2f47dba286ecfc1a41c
MD5 6c9e40743a853114347b7adad252f0db
SHA1 9b37de6a65db411617cec414778f08f2ca54a1b8
SHA512 426b121abe025d692e7d95205afaaeccac63212a6219014e2c37aca833786f85123b6dd03aca36f9cbbde513d9263db1933b2e70ae2ea31589ec735180aec536
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2qIRakL:A3k03kB56rf
TLSH
T157156A03E6850FA4D10F81749A968662EA737C125F2097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 868KB
SHA256 b54fd73d7d64be58005a66b7195715721372220e09011b2405f03becfafb897a
MD5 1cafe65461238070af85157d1ee2e98a
SHA1 dadf7f67b54d1180edd5f0398521a7540251b657
SHA512 7d96c167fef6d2830c1e5f9f6da0c9d2ac038d7d4bad7a2245af230c142f758659263f40cb672b0690d117b005fcf5d5e81873d559a655fb69a279296f251252
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2qIRaAM:A3k03kB56rq
TLSH
T184156A13E6840FA4D10FC1749A968662EA737C125F2093DF1358AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 868KB
SHA256 c82e957da2a94f2055c237646a21d7404388700f8d7adedb84d5c565ae5048aa
MD5 70b3bda53f5913694a2360c65585acd9
SHA1 bfbfd62a654937fcfcb24a341f22b74edb4b4098
SHA512 9bbca4ac94abb25b0beec6e7da608193d86409b4dc8234170ffec303ede53f28d16690c6677480e227098f5df34105eafb4b4438c88c6e4f3322d52c3fcf6eab
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2qIRahh:A3k03kB56rk
TLSH
T1F9156A13E6850FA4D10FC1749A968662EA737C025F2097DF1358AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3980-166-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3980-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4480-167-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads