Analysis
-
max time kernel
83s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
20-08-2024 16:31
Static task
static1
Behavioral task
behavioral1
Sample
aff9d10b42cdc424420e9796fc9300ae_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
aff9d10b42cdc424420e9796fc9300ae_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
aff9d10b42cdc424420e9796fc9300ae_JaffaCakes118.exe
-
Size
85KB
-
MD5
aff9d10b42cdc424420e9796fc9300ae
-
SHA1
85c6c1bd6ef2afe43681caa8a1365fe5592f4428
-
SHA256
afb3ba732a2b39af9ff2c643e5380ef6d6faf242b9821e90196ba8484d40b152
-
SHA512
5a51456a343cd49563a9b760cc67fc052b9862f3897cee248db7658f9360bc04ecac8772fd7a46087b66ceccc8c29659e39c7e060aee0e86cc46ac8d16c0b932
-
SSDEEP
1536:oXjX7xsGA7EfM6iXJiyN2pD2rd8cV8tNcJ5kx13qjn/VPVwOD:ozrxG7mM6iXkp6B8cV8tY5k+zdVxD
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2740 DNFma.exe 2652 DNFma.exe 2828 DNFma.exe 2564 DNFma.exe 2556 DNFma.exe 2692 DNFma.exe 2584 DNFma.exe 2548 DNFma.exe 2124 DNFma.exe 3020 DNFma.exe 1576 DNFma.exe 2704 DNFma.exe 2892 DNFma.exe 2904 DNFma.exe 3004 DNFma.exe 1348 DNFma.exe 1456 DNFma.exe 1944 DNFma.exe 1676 DNFma.exe 1660 DNFma.exe 2840 DNFma.exe 1500 DNFma.exe 2852 DNFma.exe 2972 DNFma.exe 1996 DNFma.exe 2148 DNFma.exe 2348 DNFma.exe 2100 DNFma.exe 1712 DNFma.exe 1484 DNFma.exe 2420 DNFma.exe 2332 DNFma.exe 1516 DNFma.exe 1508 DNFma.exe 1208 DNFma.exe 2300 DNFma.exe 280 DNFma.exe 1196 DNFma.exe 1644 DNFma.exe 2504 DNFma.exe 892 DNFma.exe 984 DNFma.exe 2940 DNFma.exe 1436 DNFma.exe 2140 DNFma.exe 600 DNFma.exe 1556 DNFma.exe 1564 DNFma.exe 1464 DNFma.exe 1836 DNFma.exe 1152 DNFma.exe 1168 DNFma.exe 3044 DNFma.exe 3012 DNFma.exe 2968 DNFma.exe 2248 DNFma.exe 2936 DNFma.exe 1640 DNFma.exe 896 DNFma.exe 2608 DNFma.exe 2476 DNFma.exe 560 DNFma.exe 1072 DNFma.exe 1968 DNFma.exe -
Loads dropped DLL 64 IoCs
pid Process 1892 aff9d10b42cdc424420e9796fc9300ae_JaffaCakes118.exe 1892 aff9d10b42cdc424420e9796fc9300ae_JaffaCakes118.exe 2740 DNFma.exe 2740 DNFma.exe 2652 DNFma.exe 2652 DNFma.exe 2828 DNFma.exe 2828 DNFma.exe 2564 DNFma.exe 2564 DNFma.exe 2556 DNFma.exe 2556 DNFma.exe 2692 DNFma.exe 2692 DNFma.exe 2584 DNFma.exe 2584 DNFma.exe 2548 DNFma.exe 2548 DNFma.exe 2124 DNFma.exe 2124 DNFma.exe 3020 DNFma.exe 3020 DNFma.exe 1576 DNFma.exe 1576 DNFma.exe 2704 DNFma.exe 2704 DNFma.exe 2892 DNFma.exe 2892 DNFma.exe 2904 DNFma.exe 2904 DNFma.exe 3004 DNFma.exe 3004 DNFma.exe 1348 DNFma.exe 1348 DNFma.exe 1456 DNFma.exe 1456 DNFma.exe 1944 DNFma.exe 1944 DNFma.exe 1676 DNFma.exe 1676 DNFma.exe 1660 DNFma.exe 1660 DNFma.exe 2840 DNFma.exe 2840 DNFma.exe 1500 DNFma.exe 1500 DNFma.exe 2852 DNFma.exe 2852 DNFma.exe 2972 DNFma.exe 2972 DNFma.exe 1996 DNFma.exe 1996 DNFma.exe 2148 DNFma.exe 2148 DNFma.exe 2348 DNFma.exe 2348 DNFma.exe 2100 DNFma.exe 2100 DNFma.exe 1712 DNFma.exe 1712 DNFma.exe 1484 DNFma.exe 1484 DNFma.exe 2420 DNFma.exe 2420 DNFma.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\GAMERTCOM\DNFma.exe Process not Found File created C:\Windows\SysWOW64\GAMERTCOM\DNFma.exe Process not Found File created C:\Windows\SysWOW64\GAMERTCOM\DNFma.exe DNFma.exe File created C:\Windows\SysWOW64\GAMERTCOM\DNFma.exe DNFma.exe File created C:\Windows\SysWOW64\GAMERTCOM\DNFma.exe Process not Found File created C:\Windows\SysWOW64\GAMERTCOM\DNFma.exe Process not Found File created C:\Windows\SysWOW64\GAMERTCOM\DNFma.exe Process not Found File created C:\Windows\SysWOW64\GAMERTCOM\DNFma.exe Process not Found File created C:\Windows\SysWOW64\GAMERTCOM\DNFma.exe Process not Found File created C:\Windows\SysWOW64\GAMERTCOM\DNFma.exe Process not Found File created C:\Windows\SysWOW64\GAMERTCOM\DNFma.exe DNFma.exe File created C:\Windows\SysWOW64\GAMERTCOM\DNFma.exe Process not Found File created C:\Windows\SysWOW64\GAMERTCOM\DNFma.exe Process not Found File created C:\Windows\SysWOW64\GAMERTCOM\DNFma.exe Process not Found File created C:\Windows\SysWOW64\GAMERTCOM\DNFma.exe DNFma.exe File created C:\Windows\SysWOW64\GAMERTCOM\DNFma.exe Process not Found File created C:\Windows\SysWOW64\GAMERTCOM\DNFma.exe Process not Found File created C:\Windows\SysWOW64\GAMERTCOM\DNFma.exe DNFma.exe File created C:\Windows\SysWOW64\GAMERTCOM\DNFma.exe Process not Found File created C:\Windows\SysWOW64\GAMERTCOM\DNFma.exe Process not Found File created C:\Windows\SysWOW64\GAMERTCOM\DNFma.exe Process not Found File created C:\Windows\SysWOW64\GAMERTCOM\DNFma.exe DNFma.exe File created C:\Windows\SysWOW64\GAMERTCOM\DNFma.exe Process not Found File created C:\Windows\SysWOW64\GAMERTCOM\DNFma.exe Process not Found File created C:\Windows\SysWOW64\GAMERTCOM\DNFma.exe Process not Found File created C:\Windows\SysWOW64\GAMERTCOM\DNFma.exe Process not Found File created C:\Windows\SysWOW64\GAMERTCOM\DNFma.exe Process not Found File created C:\Windows\SysWOW64\GAMERTCOM\DNFma.exe DNFma.exe File created C:\Windows\SysWOW64\GAMERTCOM\DNFma.exe Process not Found File created C:\Windows\SysWOW64\GAMERTCOM\DNFma.exe Process not Found File created C:\Windows\SysWOW64\GAMERTCOM\DNFma.exe DNFma.exe File created C:\Windows\SysWOW64\GAMERTCOM\DNFma.exe DNFma.exe File created C:\Windows\SysWOW64\GAMERTCOM\DNFma.exe Process not Found File created C:\Windows\SysWOW64\GAMERTCOM\DNFma.exe Process not Found File created C:\Windows\SysWOW64\GAMERTCOM\DNFma.exe DNFma.exe File created C:\Windows\SysWOW64\GAMERTCOM\DNFma.exe Process not Found File created C:\Windows\SysWOW64\GAMERTCOM\DNFma.exe DNFma.exe File created C:\Windows\SysWOW64\GAMERTCOM\DNFma.exe Process not Found File created C:\Windows\SysWOW64\GAMERTCOM\DNFma.exe Process not Found File created C:\Windows\SysWOW64\GAMERTCOM\DNFma.exe Process not Found File created C:\Windows\SysWOW64\GAMERTCOM\DNFma.exe DNFma.exe File created C:\Windows\SysWOW64\GAMERTCOM\DNFma.exe Process not Found File created C:\Windows\SysWOW64\GAMERTCOM\DNFma.exe Process not Found File created C:\Windows\SysWOW64\GAMERTCOM\DNFma.exe Process not Found File created C:\Windows\SysWOW64\GAMERTCOM\DNFma.exe Process not Found File created C:\Windows\SysWOW64\GAMERTCOM\DNFma.exe DNFma.exe File created C:\Windows\SysWOW64\GAMERTCOM\DNFma.exe Process not Found File created C:\Windows\SysWOW64\GAMERTCOM\DNFma.exe Process not Found File created C:\Windows\SysWOW64\GAMERTCOM\DNFma.exe Process not Found File created C:\Windows\SysWOW64\GAMERTCOM\DNFma.exe Process not Found File created C:\Windows\SysWOW64\GAMERTCOM\DNFma.exe DNFma.exe File created C:\Windows\SysWOW64\GAMERTCOM\DNFma.exe DNFma.exe File created C:\Windows\SysWOW64\GAMERTCOM\DNFma.exe DNFma.exe File created C:\Windows\SysWOW64\GAMERTCOM\DNFma.exe DNFma.exe File created C:\Windows\SysWOW64\GAMERTCOM\DNFma.exe Process not Found File created C:\Windows\SysWOW64\GAMERTCOM\DNFma.exe DNFma.exe File created C:\Windows\SysWOW64\GAMERTCOM\DNFma.exe DNFma.exe File created C:\Windows\SysWOW64\GAMERTCOM\DNFma.exe DNFma.exe File created C:\Windows\SysWOW64\GAMERTCOM\DNFma.exe Process not Found File created C:\Windows\SysWOW64\GAMERTCOM\DNFma.exe Process not Found File created C:\Windows\SysWOW64\GAMERTCOM\DNFma.exe Process not Found File created C:\Windows\SysWOW64\GAMERTCOM\DNFma.exe DNFma.exe File created C:\Windows\SysWOW64\GAMERTCOM\DNFma.exe DNFma.exe File created C:\Windows\SysWOW64\GAMERTCOM\DNFma.exe Process not Found -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DNFma.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DNFma.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DNFma.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DNFma.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DNFma.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1892 aff9d10b42cdc424420e9796fc9300ae_JaffaCakes118.exe Token: SeDebugPrivilege 2740 DNFma.exe Token: SeDebugPrivilege 2652 DNFma.exe Token: SeDebugPrivilege 2828 DNFma.exe Token: SeDebugPrivilege 2564 DNFma.exe Token: SeDebugPrivilege 2556 DNFma.exe Token: SeDebugPrivilege 2692 DNFma.exe Token: SeDebugPrivilege 2584 DNFma.exe Token: SeDebugPrivilege 2548 DNFma.exe Token: SeDebugPrivilege 2124 DNFma.exe Token: SeDebugPrivilege 3020 DNFma.exe Token: SeDebugPrivilege 1576 DNFma.exe Token: SeDebugPrivilege 2704 DNFma.exe Token: SeDebugPrivilege 2892 DNFma.exe Token: SeDebugPrivilege 2904 DNFma.exe Token: SeDebugPrivilege 3004 DNFma.exe Token: SeDebugPrivilege 1348 DNFma.exe Token: SeDebugPrivilege 1456 DNFma.exe Token: SeDebugPrivilege 1944 DNFma.exe Token: SeDebugPrivilege 1676 DNFma.exe Token: SeDebugPrivilege 1660 DNFma.exe Token: SeDebugPrivilege 2840 DNFma.exe Token: SeDebugPrivilege 1500 DNFma.exe Token: SeDebugPrivilege 2852 DNFma.exe Token: SeDebugPrivilege 2972 DNFma.exe Token: SeDebugPrivilege 1996 DNFma.exe Token: SeDebugPrivilege 2148 DNFma.exe Token: SeDebugPrivilege 2348 DNFma.exe Token: SeDebugPrivilege 2100 DNFma.exe Token: SeDebugPrivilege 1712 DNFma.exe Token: SeDebugPrivilege 1484 DNFma.exe Token: SeDebugPrivilege 2420 DNFma.exe Token: SeDebugPrivilege 2332 DNFma.exe Token: SeDebugPrivilege 1516 DNFma.exe Token: SeDebugPrivilege 1508 DNFma.exe Token: SeDebugPrivilege 1208 DNFma.exe Token: SeDebugPrivilege 2300 DNFma.exe Token: SeDebugPrivilege 280 DNFma.exe Token: SeDebugPrivilege 1196 DNFma.exe Token: SeDebugPrivilege 1644 DNFma.exe Token: SeDebugPrivilege 2504 DNFma.exe Token: SeDebugPrivilege 892 DNFma.exe Token: SeDebugPrivilege 984 DNFma.exe Token: SeDebugPrivilege 2940 DNFma.exe Token: SeDebugPrivilege 1436 DNFma.exe Token: SeDebugPrivilege 2140 DNFma.exe Token: SeDebugPrivilege 600 DNFma.exe Token: SeDebugPrivilege 1556 DNFma.exe Token: SeDebugPrivilege 1564 DNFma.exe Token: SeDebugPrivilege 1464 DNFma.exe Token: SeDebugPrivilege 1836 DNFma.exe Token: SeDebugPrivilege 1152 DNFma.exe Token: SeDebugPrivilege 1168 DNFma.exe Token: SeDebugPrivilege 3044 DNFma.exe Token: SeDebugPrivilege 3012 DNFma.exe Token: SeDebugPrivilege 2968 DNFma.exe Token: SeDebugPrivilege 2248 DNFma.exe Token: SeDebugPrivilege 2936 DNFma.exe Token: SeDebugPrivilege 1640 DNFma.exe Token: SeDebugPrivilege 896 DNFma.exe Token: SeDebugPrivilege 2608 DNFma.exe Token: SeDebugPrivilege 2476 DNFma.exe Token: SeDebugPrivilege 560 DNFma.exe Token: SeDebugPrivilege 1072 DNFma.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1892 wrote to memory of 2740 1892 aff9d10b42cdc424420e9796fc9300ae_JaffaCakes118.exe 30 PID 1892 wrote to memory of 2740 1892 aff9d10b42cdc424420e9796fc9300ae_JaffaCakes118.exe 30 PID 1892 wrote to memory of 2740 1892 aff9d10b42cdc424420e9796fc9300ae_JaffaCakes118.exe 30 PID 1892 wrote to memory of 2740 1892 aff9d10b42cdc424420e9796fc9300ae_JaffaCakes118.exe 30 PID 2740 wrote to memory of 2652 2740 DNFma.exe 31 PID 2740 wrote to memory of 2652 2740 DNFma.exe 31 PID 2740 wrote to memory of 2652 2740 DNFma.exe 31 PID 2740 wrote to memory of 2652 2740 DNFma.exe 31 PID 2652 wrote to memory of 2828 2652 DNFma.exe 32 PID 2652 wrote to memory of 2828 2652 DNFma.exe 32 PID 2652 wrote to memory of 2828 2652 DNFma.exe 32 PID 2652 wrote to memory of 2828 2652 DNFma.exe 32 PID 2828 wrote to memory of 2564 2828 DNFma.exe 33 PID 2828 wrote to memory of 2564 2828 DNFma.exe 33 PID 2828 wrote to memory of 2564 2828 DNFma.exe 33 PID 2828 wrote to memory of 2564 2828 DNFma.exe 33 PID 2564 wrote to memory of 2556 2564 DNFma.exe 34 PID 2564 wrote to memory of 2556 2564 DNFma.exe 34 PID 2564 wrote to memory of 2556 2564 DNFma.exe 34 PID 2564 wrote to memory of 2556 2564 DNFma.exe 34 PID 2556 wrote to memory of 2692 2556 DNFma.exe 35 PID 2556 wrote to memory of 2692 2556 DNFma.exe 35 PID 2556 wrote to memory of 2692 2556 DNFma.exe 35 PID 2556 wrote to memory of 2692 2556 DNFma.exe 35 PID 2692 wrote to memory of 2584 2692 DNFma.exe 36 PID 2692 wrote to memory of 2584 2692 DNFma.exe 36 PID 2692 wrote to memory of 2584 2692 DNFma.exe 36 PID 2692 wrote to memory of 2584 2692 DNFma.exe 36 PID 2584 wrote to memory of 2548 2584 DNFma.exe 37 PID 2584 wrote to memory of 2548 2584 DNFma.exe 37 PID 2584 wrote to memory of 2548 2584 DNFma.exe 37 PID 2584 wrote to memory of 2548 2584 DNFma.exe 37 PID 2548 wrote to memory of 2124 2548 DNFma.exe 38 PID 2548 wrote to memory of 2124 2548 DNFma.exe 38 PID 2548 wrote to memory of 2124 2548 DNFma.exe 38 PID 2548 wrote to memory of 2124 2548 DNFma.exe 38 PID 2124 wrote to memory of 3020 2124 DNFma.exe 39 PID 2124 wrote to memory of 3020 2124 DNFma.exe 39 PID 2124 wrote to memory of 3020 2124 DNFma.exe 39 PID 2124 wrote to memory of 3020 2124 DNFma.exe 39 PID 3020 wrote to memory of 1576 3020 DNFma.exe 40 PID 3020 wrote to memory of 1576 3020 DNFma.exe 40 PID 3020 wrote to memory of 1576 3020 DNFma.exe 40 PID 3020 wrote to memory of 1576 3020 DNFma.exe 40 PID 1576 wrote to memory of 2704 1576 DNFma.exe 41 PID 1576 wrote to memory of 2704 1576 DNFma.exe 41 PID 1576 wrote to memory of 2704 1576 DNFma.exe 41 PID 1576 wrote to memory of 2704 1576 DNFma.exe 41 PID 2704 wrote to memory of 2892 2704 DNFma.exe 42 PID 2704 wrote to memory of 2892 2704 DNFma.exe 42 PID 2704 wrote to memory of 2892 2704 DNFma.exe 42 PID 2704 wrote to memory of 2892 2704 DNFma.exe 42 PID 2892 wrote to memory of 2904 2892 DNFma.exe 43 PID 2892 wrote to memory of 2904 2892 DNFma.exe 43 PID 2892 wrote to memory of 2904 2892 DNFma.exe 43 PID 2892 wrote to memory of 2904 2892 DNFma.exe 43 PID 2904 wrote to memory of 3004 2904 DNFma.exe 44 PID 2904 wrote to memory of 3004 2904 DNFma.exe 44 PID 2904 wrote to memory of 3004 2904 DNFma.exe 44 PID 2904 wrote to memory of 3004 2904 DNFma.exe 44 PID 3004 wrote to memory of 1348 3004 DNFma.exe 45 PID 3004 wrote to memory of 1348 3004 DNFma.exe 45 PID 3004 wrote to memory of 1348 3004 DNFma.exe 45 PID 3004 wrote to memory of 1348 3004 DNFma.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\aff9d10b42cdc424420e9796fc9300ae_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\aff9d10b42cdc424420e9796fc9300ae_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1348 -
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1456 -
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1944 -
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1676 -
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1660 -
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2840 -
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1500 -
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2852 -
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2972 -
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1996 -
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2148 -
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2348 -
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2100 -
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1712 -
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1484 -
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2420 -
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe33⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2332 -
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe34⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1516 -
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe35⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1508 -
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe36⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1208 -
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe37⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2300 -
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:280 -
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe39⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1196 -
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe40⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1644 -
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe41⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2504 -
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:892 -
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:984 -
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe44⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2940 -
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe45⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1436 -
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe46⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2140 -
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe47⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:600 -
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe48⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1556 -
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe49⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1564 -
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe50⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1464 -
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe51⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1836 -
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe52⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1152 -
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe53⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1168 -
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe54⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3044 -
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3012 -
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe56⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2968 -
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe57⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2248 -
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe58⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2936 -
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe59⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1640 -
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe60⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:896 -
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe61⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2608 -
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe62⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2476 -
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe63⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:560 -
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe64⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1072 -
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe65⤵
- Executes dropped EXE
PID:1968 -
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe66⤵PID:1972
-
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe67⤵PID:1960
-
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe68⤵PID:2200
-
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe69⤵PID:2312
-
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe70⤵PID:2684
-
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe71⤵PID:2772
-
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe72⤵PID:1632
-
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe73⤵PID:1636
-
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe74⤵PID:2676
-
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe75⤵PID:2764
-
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe76⤵PID:2844
-
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe77⤵PID:2552
-
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe78⤵PID:2528
-
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe79⤵PID:2576
-
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe80⤵PID:3016
-
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe81⤵PID:1780
-
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe82⤵PID:2868
-
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe83⤵PID:2880
-
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe84⤵PID:2192
-
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe85⤵PID:1544
-
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe86⤵PID:1788
-
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe87⤵PID:292
-
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe88⤵PID:1916
-
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe89⤵PID:1976
-
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe90⤵PID:3080
-
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe91⤵PID:3096
-
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe92⤵PID:3112
-
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe93⤵PID:3128
-
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe94⤵PID:3144
-
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe95⤵PID:3160
-
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe96⤵PID:3176
-
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe97⤵PID:3192
-
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe98⤵PID:3208
-
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe99⤵PID:3224
-
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe100⤵PID:3240
-
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe101⤵PID:3256
-
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe102⤵
- Drops file in System32 directory
PID:3272 -
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe103⤵PID:3288
-
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe104⤵PID:3304
-
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe105⤵PID:3320
-
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe106⤵PID:3336
-
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe107⤵PID:3352
-
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe108⤵PID:3368
-
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe109⤵PID:3384
-
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe110⤵PID:3400
-
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe111⤵PID:3416
-
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe112⤵PID:3432
-
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe113⤵PID:3448
-
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe114⤵PID:3464
-
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe115⤵PID:3480
-
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe116⤵PID:3496
-
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe117⤵PID:3512
-
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe118⤵PID:3528
-
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe119⤵PID:3544
-
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe120⤵PID:3560
-
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe121⤵PID:3576
-
C:\Windows\SysWOW64\GAMERTCOM\DNFma.exeC:\Windows\system32\GAMERTCOM\DNFma.exe122⤵PID:3592
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-