fesber | ce737702069ea7b0859a498fe1bc349ca27ae182a1481ccd3ded35dedcc346f9

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/10/2026, 09:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Size 10.3MB
Sample261011-lq8cssg15s
SHA256 ce737702069ea7b0859a498fe1bc349ca27ae182a1481ccd3ded35dedcc346f9
MD5 83349ef655ef1969af03e9dfff269155
SHA1 66187c5c133e1a312da44e1f45f62358b541dcd6
SHA512 750c583b07e702b7bbadbbd4aebebf9c9d38af143ac0609ea3c4d8c682049a09101cd527e6a57e2fde48b48defeb3b9cc2c0626cec7a61dd996717de63aa834e
SSDEEP 196608:Y18U9EFfKpS2S9+ULdNPtbuPZOFnqogHh/0o:AREJK42SlLdNPt6ROFqZR
TLSH
T13EB6D02EF7448135E11A41B1995DA776C828FC6553344AC73384BB29BFB26C32F367A2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery fesber persistence upx worm

Malware Config

Signatures

Family: Fesber
Fesber is a Windows worm written in Delphi.
worm fesber

Detects Fesber payload 11 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c559-3.dat	family_fesber
behavioral2/memory/1496-506-0x0000000000400000-0x000000000041B000-memory.dmp	family_fesber
behavioral2/memory/1496-835-0x0000000000400000-0x000000000041B000-memory.dmp	family_fesber
behavioral2/memory/1496-1148-0x0000000000400000-0x000000000041B000-memory.dmp	family_fesber
behavioral2/files/0x00a300000001acbf-1266.dat	family_fesber
behavioral2/memory/1496-1269-0x0000000000400000-0x000000000041B000-memory.dmp	family_fesber
behavioral2/memory/1496-1270-0x0000000000400000-0x000000000041B000-memory.dmp	family_fesber
behavioral2/memory/1496-1271-0x0000000000400000-0x000000000041B000-memory.dmp	family_fesber
behavioral2/memory/1496-1272-0x0000000000400000-0x000000000041B000-memory.dmp	family_fesber
behavioral2/memory/1496-1274-0x0000000000400000-0x000000000041B000-memory.dmp	family_fesber
behavioral2/memory/1496-1278-0x0000000000400000-0x000000000041B000-memory.dmp	family_fesber

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe fsb.exe"	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\fsb.tmp	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Windows\SysWOW64\fsb.stb	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Windows\SysWOW64\fsb.tmp	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000d00000001c559-3.dat	upx
behavioral2/files/0x00a300000001acbf-1266.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe-	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe-	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files\dotnet\dotnet.exe-	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe-	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe-	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe-	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe-	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe-	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files\Microsoft Office\root\Office16\misc.exe	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe-	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe-	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE-	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe-	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe-	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe-	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe-	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javap.exe-	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe-	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe-	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe-	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe-	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe-	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files\Java\jre-1.8\bin\orbd.exe-	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE-	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe-	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe-	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe-	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe-	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe-	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files\7-Zip\Uninstall.exe-	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe-	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid
4

C:\Users\Admin\AppData\Local\Temp\2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-10_83349ef655ef1969af03e9dfff269155_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:1496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe-

Path C:\Program Files\7-Zip\7z.exe-
Size 10.8MB
SHA256 1a851d441e6b191b8e7aadd6cea05ec2777f6bb4d5a5547f2883f8c0080e03fd
MD5 bfbe97ad3959ccbbd2a24fbe3435b757
SHA1 eb2ce72bc245228c41ac34bff73eff37923f4e93
SHA512 54f05b3d56b77db2e41cffc978060185ea5953ceb19affb7e3a93e48555ebf71f69bbcbaaf14747cebb56694a04e5de649987f032cc1a10e67a04d23f8bd3a40
SSDEEP 196608:R18U9EFfKpS2S9+ULdNPtbuPZOFnqogHh/0o9o:TREJK42SlLdNPt6ROFqZRS
TLSH
T13CB6D02EF7448135E11A81B1D959A776C829FC6543344AC72384FB29BFB26C32F36762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EnterStep.exe-

Path C:\Users\Admin\Downloads\EnterStep.exe-
Size 11.2MB
SHA256 cafb87b00be77d409607168db9246580767ede09e81a4847282bcf3b2fab0f34
MD5 b2e8940e96531c77b20c5ede56cc39a1
SHA1 5317539f8fab70c7165baf5c8e19af38b802d4ec
SHA512 f67cb7cb41f0ab2c1d03441da0ec831c1a58c07831575e1fa133da0c6be20bf239902740f2e1c8bba373f926f98fd440e9101b4b5777dd01f78c55590e37fc20
SSDEEP 196608:R18U9EFfKpS2S9+ULdNPtbuPZOFnqogHh/0oU2jT:TREJK42SlLdNPt6ROFqZRU2f
TLSH
T142C6E12EF7458135E15A41B1995DA772C828FC6553344AC73384BB29BFB26C32F327A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1496-506-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/1496-835-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/1496-1148-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/1496-1269-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/1496-1270-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/1496-1271-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/1496-1272-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/1496-1274-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/1496-1278-0x0000000000400000-0x000000000041B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads