remcos | d68f7e5a5a110bba3d6212f601d08f5288b018172005becf7459fe20a9a49c18

General

Target

ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
Size

877KB
MD5

ed74e3163746bae6e52a1b6fa73c6f60
SHA1

2a35b7923dcfb0916a2e488a74ce52c6a1a19ae2
SHA256

d68f7e5a5a110bba3d6212f601d08f5288b018172005becf7459fe20a9a49c18
SHA512

fb4787b4a3b4d8aa189ea4bb48727f3b2a15470b82cbc6fedff8390a06feb8a9b0a826e13b1f98e4dc1e6d0143a6bbdf8fdb1698c9f0f470952a0855c995d351
SSDEEP

12288:IHRdjF2If262FE3Y8r3zrtoH8EVeX9mgQlcYRrt/e9nY5hGOaW5q:orF2ImFE3YoDrCH8EW7+HkY5CW5

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Version

3.2.0 Pro

Botnet

RemoteHost

C2

185.140.53.139:2404

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-VT282N
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
notepad;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 6 IoCs

Processes:

ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe

description	pid	process	target process
PID 412 set thread context of 1252	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
PID 412 set thread context of 2356	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
PID 412 set thread context of 4624	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
PID 412 set thread context of 2560	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
PID 412 set thread context of 4984	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
PID 412 set thread context of 1260	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 412 ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe

pid process

2356 ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe

pid	process
2356	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:412

C:\Users\Admin\AppData\Local\Temp\ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe"
2⤵
PID:1252

C:\Users\Admin\AppData\Local\Temp\ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:2356

C:\Users\Admin\AppData\Local\Temp\ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe"
2⤵
PID:4624

C:\Users\Admin\AppData\Local\Temp\ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe"
2⤵
PID:2560

C:\Users\Admin\AppData\Local\Temp\ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe"
2⤵
PID:4984

C:\Users\Admin\AppData\Local\Temp\ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe"
2⤵
PID:1260

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\remcos\logs.dat

Filesize
184B

MD5
fc19aadf41854ba2e9654daa0a7138d5

SHA1
b004be1d5661d8e83363662a4727bff5840541eb

SHA256
605d4625e1e7facaf1b762089f753eed9417f2708f3bd2fee6dd2a424078ce26

SHA512
b8c1b88f04f3500a9e4ef95156b8a9d637a47cd6a9d060e0b27162889a58d60bbc3d00c93f5f2a5944e01dddfd679fec016ecac31eefed369ece741906997a95

Download Submit
memory/412-41-0x0000000004FE0000-0x0000000004FF0000-memory.dmp

Filesize
64KB

Download
memory/412-5-0x0000000004CB0000-0x0000000004CBA000-memory.dmp

Filesize
40KB

Download
memory/412-38-0x0000000075200000-0x00000000759B0000-memory.dmp

Filesize
7.7MB

Download
memory/412-0-0x0000000000200000-0x00000000002E2000-memory.dmp

Filesize
904KB

Download
memory/412-1-0x0000000075200000-0x00000000759B0000-memory.dmp

Filesize
7.7MB

Download
memory/412-6-0x0000000004FE0000-0x0000000004FF0000-memory.dmp

Filesize
64KB

Download
memory/412-7-0x0000000007FF0000-0x000000000808C000-memory.dmp

Filesize
624KB

Download
memory/412-8-0x0000000007F80000-0x0000000007FDE000-memory.dmp

Filesize
376KB

Download
memory/412-9-0x00000000081D0000-0x0000000008248000-memory.dmp

Filesize
480KB

Download
memory/412-39-0x0000000004FE0000-0x0000000004FF0000-memory.dmp

Filesize
64KB

Download
memory/412-3-0x0000000004D60000-0x0000000004DF2000-memory.dmp

Filesize
584KB

Download
memory/412-2-0x0000000005310000-0x00000000058B4000-memory.dmp

Filesize
5.6MB

Download
memory/412-4-0x0000000004FE0000-0x0000000004FF0000-memory.dmp

Filesize
64KB

Download
memory/1252-43-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1252-26-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1252-10-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1252-14-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1252-12-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1260-36-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1260-37-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1260-34-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2356-20-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2356-24-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2356-13-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2356-27-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2356-44-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2356-16-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2560-33-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2560-23-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2560-29-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/4624-17-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/4624-22-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/4624-30-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/4984-28-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/4984-32-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/4984-35-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download

description	pid	process	target process
PID 412 wrote to memory of 1252	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
PID 412 wrote to memory of 1252	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
PID 412 wrote to memory of 1252	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
PID 412 wrote to memory of 1252	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
PID 412 wrote to memory of 1252	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
PID 412 wrote to memory of 1252	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
PID 412 wrote to memory of 1252	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
PID 412 wrote to memory of 1252	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
PID 412 wrote to memory of 1252	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
PID 412 wrote to memory of 1252	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
PID 412 wrote to memory of 1252	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
PID 412 wrote to memory of 1252	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
PID 412 wrote to memory of 2356	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
PID 412 wrote to memory of 2356	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
PID 412 wrote to memory of 2356	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
PID 412 wrote to memory of 2356	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
PID 412 wrote to memory of 2356	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
PID 412 wrote to memory of 2356	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
PID 412 wrote to memory of 2356	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
PID 412 wrote to memory of 2356	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
PID 412 wrote to memory of 2356	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
PID 412 wrote to memory of 2356	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
PID 412 wrote to memory of 2356	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
PID 412 wrote to memory of 2356	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
PID 412 wrote to memory of 4624	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
PID 412 wrote to memory of 4624	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
PID 412 wrote to memory of 4624	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
PID 412 wrote to memory of 4624	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
PID 412 wrote to memory of 4624	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
PID 412 wrote to memory of 4624	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
PID 412 wrote to memory of 4624	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
PID 412 wrote to memory of 4624	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
PID 412 wrote to memory of 4624	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
PID 412 wrote to memory of 4624	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
PID 412 wrote to memory of 4624	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
PID 412 wrote to memory of 4624	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
PID 412 wrote to memory of 2560	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
PID 412 wrote to memory of 2560	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
PID 412 wrote to memory of 2560	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
PID 412 wrote to memory of 2560	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
PID 412 wrote to memory of 2560	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
PID 412 wrote to memory of 2560	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
PID 412 wrote to memory of 2560	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
PID 412 wrote to memory of 2560	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
PID 412 wrote to memory of 2560	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
PID 412 wrote to memory of 2560	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
PID 412 wrote to memory of 2560	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
PID 412 wrote to memory of 2560	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
PID 412 wrote to memory of 4984	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
PID 412 wrote to memory of 4984	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
PID 412 wrote to memory of 4984	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
PID 412 wrote to memory of 4984	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
PID 412 wrote to memory of 4984	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
PID 412 wrote to memory of 4984	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
PID 412 wrote to memory of 4984	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
PID 412 wrote to memory of 4984	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
PID 412 wrote to memory of 4984	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
PID 412 wrote to memory of 4984	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
PID 412 wrote to memory of 4984	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
PID 412 wrote to memory of 4984	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
PID 412 wrote to memory of 1260	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
PID 412 wrote to memory of 1260	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
PID 412 wrote to memory of 1260	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe
PID 412 wrote to memory of 1260	412	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe	ed74e3163746bae6e52a1b6fa73c6f60_JaffaCakes118.exe

Analysis

Sharing