rms | 310a090e8c001419cdcb694d92a3ab2f8356eae8467a3317a2bdee8e3b9c8e60

General

Target

1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
Size

6.3MB
MD5

1a677c62a46e22491dd7723687ebb212
SHA1

4af1c12b3b3300fa6e8ebf80f76238ccbaa12b0d
SHA256

310a090e8c001419cdcb694d92a3ab2f8356eae8467a3317a2bdee8e3b9c8e60
SHA512

34e55b3d2393e0bd188101de12958ea610a39dbf301417248a8bc84ab7224bd4dc67d9815b1228cedaefa9bb123c103ba160c9b9ce8d490ddd6d3e93aeaed143
SSDEEP

196608:3Pfa6YMRlp30bgwOGcjwppBR5dgI8H++:3KNMRlN0bgXGGwpj5gI8e

Score

10^/10

rms persistence rat trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe1systemsmss.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Windows\\System64\\1systemsmss.exe, explorer.exe"	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe"	1systemsmss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe"	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe

RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe1systemsmss.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	1systemsmss.exe

Executes dropped EXE 7 IoCs

Processes:

1systemsmss.exesvnhost.exesvnhost.exesvnhost.exesvnhost.exesystemsmss.exesystemsmss.exe

pid process

2556 1systemsmss.exe
1652 svnhost.exe
2468 svnhost.exe
2092 svnhost.exe
1360 svnhost.exe
3212 systemsmss.exe
2716 systemsmss.exe

pid	process
2556	1systemsmss.exe
1652	svnhost.exe
2468	svnhost.exe
2092	svnhost.exe
1360	svnhost.exe
3212	systemsmss.exe
2716	systemsmss.exe

Drops file in Windows directory 13 IoCs

Processes:

1systemsmss.exe1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe

description	ioc	process
File created	C:\Windows\System64\vp8decoder.dll	1systemsmss.exe
File opened for modification	C:\Windows\System64\vp8decoder.dll	1systemsmss.exe
File created	C:\Windows\System64\vp8encoder.dll	1systemsmss.exe
File opened for modification	C:\Windows\System64\svnhost.exe	1systemsmss.exe
File created	C:\Windows\System64\systemsmss.exe	1systemsmss.exe
File created	C:\Windows\Zont911\Tupe.bat	1systemsmss.exe
File opened for modification	C:\Windows\System64\1systemsmss.exe	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
File created	C:\Windows\Zont911\Home.zip	1systemsmss.exe
File created	C:\Windows\System64\svnhost.exe	1systemsmss.exe
File opened for modification	C:\Windows\System64\systemsmss.exe	1systemsmss.exe
File created	C:\Windows\System64\1systemsmss.exe	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
File opened for modification	C:\Windows\System64\vp8encoder.dll	1systemsmss.exe
File created	C:\Windows\Zont911\Regedit.reg	1systemsmss.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs .reg file with regedit 1 IoCs

Processes:

regedit.exe

pid process

1452 regedit.exe

pid	process
1452	regedit.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe

pid	process
1556	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
1556	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
1556	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
1556	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
1556	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
1556	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
1556	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
1556	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
1556	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
1556	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
1556	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
1556	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
1556	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
1556	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
1556	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
1556	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
1556	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
1556	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
1556	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
1556	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
1556	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
1556	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
1556	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
1556	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
1556	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
1556	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
1556	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
1556	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
1556	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
1556	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
1556	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
1556	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
1556	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
1556	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
1556	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
1556	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
1556	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
1556	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
1556	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
1556	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
1556	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
1556	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
1556	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
1556	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
1556	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
1556	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
1556	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
1556	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
1556	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
1556	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
1556	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
1556	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
1556	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
1556	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
1556	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
1556	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
1556	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
1556	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
1556	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
1556	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
1556	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
1556	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
1556	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
1556	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

svnhost.exesvnhost.exesvnhost.exe

description	pid	process
Token: SeDebugPrivilege	1652	svnhost.exe
Token: SeDebugPrivilege	2092	svnhost.exe
Token: SeTakeOwnershipPrivilege	1360	svnhost.exe
Token: SeTcbPrivilege	1360	svnhost.exe
Token: SeTcbPrivilege	1360	svnhost.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

systemsmss.exe

pid process

3212 systemsmss.exe
3212 systemsmss.exe
3212 systemsmss.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

systemsmss.exe

pid process

3212 systemsmss.exe
3212 systemsmss.exe
3212 systemsmss.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

svnhost.exesvnhost.exesvnhost.exesvnhost.exe

pid process

1652 svnhost.exe
2468 svnhost.exe
2092 svnhost.exe
1360 svnhost.exe

pid	process
3212	systemsmss.exe
3212	systemsmss.exe
3212	systemsmss.exe

pid	process
3212	systemsmss.exe
3212	systemsmss.exe
3212	systemsmss.exe

pid	process
1652	svnhost.exe
2468	svnhost.exe
2092	svnhost.exe
1360	svnhost.exe

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe1systemsmss.execmd.exesvnhost.exe

description	pid	process	target process
PID 1556 wrote to memory of 2556	1556	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe	1systemsmss.exe
PID 1556 wrote to memory of 2556	1556	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe	1systemsmss.exe
PID 1556 wrote to memory of 2556	1556	1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe	1systemsmss.exe
PID 2556 wrote to memory of 1452	2556	1systemsmss.exe	regedit.exe
PID 2556 wrote to memory of 1452	2556	1systemsmss.exe	regedit.exe
PID 2556 wrote to memory of 1452	2556	1systemsmss.exe	regedit.exe
PID 2556 wrote to memory of 3308	2556	1systemsmss.exe	cmd.exe
PID 2556 wrote to memory of 3308	2556	1systemsmss.exe	cmd.exe
PID 2556 wrote to memory of 3308	2556	1systemsmss.exe	cmd.exe
PID 3308 wrote to memory of 4644	3308	cmd.exe	chcp.com
PID 3308 wrote to memory of 4644	3308	cmd.exe	chcp.com
PID 3308 wrote to memory of 4644	3308	cmd.exe	chcp.com
PID 3308 wrote to memory of 1652	3308	cmd.exe	svnhost.exe
PID 3308 wrote to memory of 1652	3308	cmd.exe	svnhost.exe
PID 3308 wrote to memory of 1652	3308	cmd.exe	svnhost.exe
PID 3308 wrote to memory of 2468	3308	cmd.exe	svnhost.exe
PID 3308 wrote to memory of 2468	3308	cmd.exe	svnhost.exe
PID 3308 wrote to memory of 2468	3308	cmd.exe	svnhost.exe
PID 3308 wrote to memory of 2092	3308	cmd.exe	svnhost.exe
PID 3308 wrote to memory of 2092	3308	cmd.exe	svnhost.exe
PID 3308 wrote to memory of 2092	3308	cmd.exe	svnhost.exe
PID 1360 wrote to memory of 3212	1360	svnhost.exe	systemsmss.exe
PID 1360 wrote to memory of 3212	1360	svnhost.exe	systemsmss.exe
PID 1360 wrote to memory of 3212	1360	svnhost.exe	systemsmss.exe
PID 1360 wrote to memory of 2716	1360	svnhost.exe	systemsmss.exe
PID 1360 wrote to memory of 2716	1360	svnhost.exe	systemsmss.exe
PID 1360 wrote to memory of 2716	1360	svnhost.exe	systemsmss.exe

C:\Users\Admin\AppData\Local\Temp\1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Windows\System64\1systemsmss.exe
  "C:\Windows\System64\1systemsmss.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2556
- - C:\Windows\SysWOW64\regedit.exe
    "C:\Windows\System32\regedit.exe" /s "C:\Windows\Zont911\Regedit.reg"
    3⤵
    - Runs .reg file with regedit
    PID:1452
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Windows\Zont911\Tupe.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3308
  - - C:\Windows\SysWOW64\chcp.com
      Chcp 1251
      4⤵
      PID:4644
  - - C:\Windows\System64\svnhost.exe
      "C:\Windows\System64\svnhost.exe" /silentinstall
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:1652
  - - C:\Windows\System64\svnhost.exe
      "C:\Windows\System64\svnhost.exe" /firewall
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2468
  - - C:\Windows\System64\svnhost.exe
      "C:\Windows\System64\svnhost.exe" /start
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2092

C:\Windows\System64\svnhost.exe
C:\Windows\System64\svnhost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1360
- C:\Windows\System64\systemsmss.exe
  C:\Windows\System64\systemsmss.exe /tray
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3212
- C:\Windows\System64\systemsmss.exe
  C:\Windows\System64\systemsmss.exe
  2⤵
  - Executes dropped EXE
  PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System64\1systemsmss.exe

Filesize
6.3MB

MD5
1a677c62a46e22491dd7723687ebb212

SHA1
4af1c12b3b3300fa6e8ebf80f76238ccbaa12b0d

SHA256
310a090e8c001419cdcb694d92a3ab2f8356eae8467a3317a2bdee8e3b9c8e60

SHA512
34e55b3d2393e0bd188101de12958ea610a39dbf301417248a8bc84ab7224bd4dc67d9815b1228cedaefa9bb123c103ba160c9b9ce8d490ddd6d3e93aeaed143

Download Submit
C:\Windows\System64\svnhost.exe

Filesize
6.0MB

MD5
e437e8730f2163cba2552a5a374a885a

SHA1
514497f668ae7b80a698bd8cda6de2dcf104e450

SHA256
dde1cc7b34ad434fb515b4b315c2ec22a74e3b1b4d50fe83421fab4d6055b3a6

SHA512
e924929176c60f00bfd45f0ec991279d4bbb96be4f5f270e636594d4faad681c318cbc9374dd2126170e18f7b4e9db54b193c147b452655c2806921d8c76c445

Download Submit
C:\Windows\System64\systemsmss.exe

Filesize
5.1MB

MD5
bd458a26931f960f13958510e88a61a8

SHA1
be9fff29f269d649688e941e97ac03e669571837

SHA256
d295538301a5513d3e605e43586e48504ec22f87666a31ef06f697b5c9b611f3

SHA512
afe9e6209ade2846f31efb7b9977d42b28cd082eb0a4b9c4ba4b9c91d528afbc7efe748be0c78c938d042dc9d200c23d2f0552a7498ab23becac828df53245e7

Download Submit
C:\Windows\System64\vp8decoder.dll

Filesize
378KB

MD5
d43fa82fab5337ce20ad14650085c5d9

SHA1
678aa092075ff65b6815ffc2d8fdc23af8425981

SHA256
c022958429edd94bfe31f2eacfe24ff6b45d6f12747725c449a36116373de03b

SHA512
103e61a9f58df03316676a074487e50ec518479c11068df3736df139b85c7671048c65bce0ef2c55b3c50c61fde54e9e6c7d1b795aea71263ae94c91d4874e0d

Download Submit
C:\Windows\System64\vp8encoder.dll

Filesize
1.6MB

MD5
dab4646806dfca6d0e0b4d80fa9209d6

SHA1
8244dfe22ec2090eee89dad103e6b2002059d16a

SHA256
cb6ef96d3a66ef08ec2c8640b751a52d6d4f4530cf01162a69966f0fd5153587

SHA512
aa5eb93bf23a10de797d6fb52a55a95d36bc48927c76fedd81e0c48872745cb7f7d1b3f230eaae42fd4e79b6a59ca707e56bd6963b03644cbd5984f11e98d6e7

Download Submit
C:\Windows\Zont911\Regedit.reg

Filesize
11KB

MD5
8652240acb0c567db26f15721b4eb7a1

SHA1
8e302e822bd83dc106d735343267dcb7c2384b93

SHA256
d86fc93ea8d3f3a2c7b09c64942ddffd1cc6fbbbf002fec07815138fa634f1b8

SHA512
e95d58d7525c16659705522bbb700ee94985da8084ca55d59d5be04e86ca5a51186c287eabf9f78e1aa6403823011323ffded3964c73691a71ef2d0036acc4d9

Download Submit
C:\Windows\Zont911\Tupe.bat

Filesize
281B

MD5
691f040de6d335962416b319dcd416dc

SHA1
db49109c0917910f7fce8b6de690a1c7e2026226

SHA256
605d0b9c2fd1972c4ee60d8eefd336be636884dcdf54a4e5f2829c46e80fdcea

SHA512
f34ba36bdeaa43a1265ec69acfa0f199f2b4d5d90b4ea890327478f4f48ec7597d660b922dd1e149de3a1ff9b48c79e4c9c53e8a482b4cb5842bc0976f93bf89

Download Submit
\??\PIPE\wkssvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1360-77-0x0000000000400000-0x0000000000AA3000-memory.dmp

Filesize
6.6MB

Download
memory/1360-56-0x0000000000400000-0x0000000000AA3000-memory.dmp

Filesize
6.6MB

Download
memory/1360-86-0x0000000000400000-0x0000000000AA3000-memory.dmp

Filesize
6.6MB

Download
memory/1360-73-0x0000000000400000-0x0000000000AA3000-memory.dmp

Filesize
6.6MB

Download
memory/1360-65-0x0000000000400000-0x0000000000AA3000-memory.dmp

Filesize
6.6MB

Download
memory/1360-46-0x0000000000400000-0x0000000000AA3000-memory.dmp

Filesize
6.6MB

Download
memory/1360-60-0x0000000000400000-0x0000000000AA3000-memory.dmp

Filesize
6.6MB

Download
memory/1556-0-0x00000000027C0000-0x00000000027C1000-memory.dmp

Filesize
4KB

Download
memory/1556-9-0x0000000000400000-0x0000000000A50000-memory.dmp

Filesize
6.3MB

Download
memory/1652-31-0x0000000000400000-0x0000000000AA3000-memory.dmp

Filesize
6.6MB

Download
memory/2092-42-0x0000000000400000-0x0000000000AA3000-memory.dmp

Filesize
6.6MB

Download
memory/2468-33-0x0000000000400000-0x0000000000AA3000-memory.dmp

Filesize
6.6MB

Download
memory/2556-50-0x0000000000C00000-0x0000000000C01000-memory.dmp

Filesize
4KB

Download
memory/2556-45-0x0000000000400000-0x0000000000A50000-memory.dmp

Filesize
6.3MB

Download
memory/2556-10-0x0000000000C00000-0x0000000000C01000-memory.dmp

Filesize
4KB

Download
memory/2716-48-0x0000000000400000-0x00000000009A8000-memory.dmp

Filesize
5.7MB

Download
memory/3212-57-0x0000000000400000-0x00000000009A8000-memory.dmp

Filesize
5.7MB

Download
memory/3212-47-0x0000000000400000-0x00000000009A8000-memory.dmp

Filesize
5.7MB

Download
memory/3212-66-0x0000000000400000-0x00000000009A8000-memory.dmp

Filesize
5.7MB

Download
memory/3212-74-0x0000000000400000-0x00000000009A8000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads