fesber | 0958d606f0c3801cfbbb5a715c6dd9e9bfee0dcac4f73a9632dd6d34306522c9

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/10/2026, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
Size 7.8MB
Sample261016-e3vtxa1z3j
SHA256 0958d606f0c3801cfbbb5a715c6dd9e9bfee0dcac4f73a9632dd6d34306522c9
MD5 ced6c8648de54acef6fb9bf1717f7c7c
SHA1 2f656c20a12ffbed37f31810a59df68a0b41bc87
SHA512 75bfd9a0e6ea4e34d058612c5b34f4dfbe60affc4c9186e72a84abc7c62541edc465b72b3fd6585db33eee8923e1aaae378b7a142e89e822b03639961505e7f6
SSDEEP 98304:zDIkC69LapI2jidkB/qoHMdnJE7hAlKnsz2C2PYdhIqHpnF0E:y69cIAidJEul4szEonFt
TLSH
T182869D31B995C175E262807489D9BFF5C1A9B8360B7144CB27C0AB3E5E223D76E31F26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery fesber persistence upx worm

Malware Config

Signatures

Family: Fesber
Fesber is a Windows worm written in Delphi.
worm fesber

Detects Fesber payload 3 IoCs

resource	yara_rule
behavioral2/memory/4512-0-0x0000000000400000-0x000000000041E000-memory.dmp	family_fesber
behavioral2/files/0x000c00000001c612-4.dat	family_fesber
behavioral2/memory/4512-578-0x0000000000400000-0x000000000041E000-memory.dmp	family_fesber

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe fsb.exe"	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\fsb.tmp	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
File created	C:\Windows\SysWOW64\fsb.stb	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
File created	C:\Windows\SysWOW64\fsb.tmp	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4512-0-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/files/0x000c00000001c612-4.dat	upx
behavioral2/memory/4512-578-0x0000000000400000-0x000000000041E000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe-	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe-	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe-	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe-	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
File created	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe-	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe-	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
File created	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
File created	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122484\java.exe-	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe-	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
File created	C:\Program Files\Java\jdk-1.8\bin\orbd.exe-	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe-	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
File created	C:\Program Files\Java\jre-1.8\bin\klist.exe-	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
File created	C:\Program Files\Java\jre-1.8\bin\unpack200.exe-	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe-	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe-	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe-	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdb.exe-	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
File created	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe-	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
File created	C:\Program Files\7-Zip\Uninstall.exe	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe-	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe-	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe-	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe-	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe-	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE-	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe-	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe-	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe-	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe-	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
File created	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe-	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe-	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
File created	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe-	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
File created	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe-	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe-	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
File created	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid
4
4

C:\Users\Admin\AppData\Local\Temp\2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-15_ced6c8648de54acef6fb9bf1717f7c7c_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:4512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe-

Path C:\Program Files\7-Zip\7z.exe-
Size 8.4MB
SHA256 ad1e0bcc02ce1416ea46c536b70b525b7974119ff8872ab87a5cf93ebfbec210
MD5 e82fc72bbdc1b9d8662883e973e278c5
SHA1 85a1375659002a8e093135765fa4bbb7068fcaa4
SHA512 1afc0a79c59a88c69afa420deab42f056faceea3f2da3678239c45d6b27d149f8fa1c8d503569dce0a6d8f9f3b9a6367cbf1be43ecb3f46358a0f062ddda9f05
SSDEEP 98304:3DIkC69LapI2jidkB/qoHMdnJE7hAlKnsz2C2PYdhIqHpnF0Ekjo:e69cIAidJEul4szEonFtuo
TLSH
T1E3968D31B995C275D122807489D9BFE9C1A9B8360B7144CB27C0AB3E5E233D76E35B36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4512-0-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/4512-578-0x0000000000400000-0x000000000041E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads