Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
27/05/2024, 14:52
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe
-
Size
4.3MB
-
MD5
d946c7218f704088824dd614003f0671
-
SHA1
eaaec8de795d3e7cc7f29830978ce267204cca20
-
SHA256
c79c2a7b05c4bd9cbd7e4ecb4cae2cfe21a2e40558475b9dae585ae93c808223
-
SHA512
965226eedd30687c115a6bf8fe8176994c94ed5104130a6daa1921fed81d0695296c3d0452c30a9b18082143862a54934815cd03f123296cc686cfdcf76b44fe
-
SSDEEP
98304:NPFETgt2jmzZrEywhW+BGPDdIK9N1iS5I9:wTsPwhW+QPD19Ne
Malware Config
Signatures
-
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 4460 ipconfig.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4616 2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe Token: SeIncreaseQuotaPrivilege 2068 wmic.exe Token: SeSecurityPrivilege 2068 wmic.exe Token: SeTakeOwnershipPrivilege 2068 wmic.exe Token: SeLoadDriverPrivilege 2068 wmic.exe Token: SeSystemProfilePrivilege 2068 wmic.exe Token: SeSystemtimePrivilege 2068 wmic.exe Token: SeProfSingleProcessPrivilege 2068 wmic.exe Token: SeIncBasePriorityPrivilege 2068 wmic.exe Token: SeCreatePagefilePrivilege 2068 wmic.exe Token: SeBackupPrivilege 2068 wmic.exe Token: SeRestorePrivilege 2068 wmic.exe Token: SeShutdownPrivilege 2068 wmic.exe Token: SeDebugPrivilege 2068 wmic.exe Token: SeSystemEnvironmentPrivilege 2068 wmic.exe Token: SeRemoteShutdownPrivilege 2068 wmic.exe Token: SeUndockPrivilege 2068 wmic.exe Token: SeManageVolumePrivilege 2068 wmic.exe Token: 33 2068 wmic.exe Token: 34 2068 wmic.exe Token: 35 2068 wmic.exe Token: 36 2068 wmic.exe Token: SeIncreaseQuotaPrivilege 2068 wmic.exe Token: SeSecurityPrivilege 2068 wmic.exe Token: SeTakeOwnershipPrivilege 2068 wmic.exe Token: SeLoadDriverPrivilege 2068 wmic.exe Token: SeSystemProfilePrivilege 2068 wmic.exe Token: SeSystemtimePrivilege 2068 wmic.exe Token: SeProfSingleProcessPrivilege 2068 wmic.exe Token: SeIncBasePriorityPrivilege 2068 wmic.exe Token: SeCreatePagefilePrivilege 2068 wmic.exe Token: SeBackupPrivilege 2068 wmic.exe Token: SeRestorePrivilege 2068 wmic.exe Token: SeShutdownPrivilege 2068 wmic.exe Token: SeDebugPrivilege 2068 wmic.exe Token: SeSystemEnvironmentPrivilege 2068 wmic.exe Token: SeRemoteShutdownPrivilege 2068 wmic.exe Token: SeUndockPrivilege 2068 wmic.exe Token: SeManageVolumePrivilege 2068 wmic.exe Token: 33 2068 wmic.exe Token: 34 2068 wmic.exe Token: 35 2068 wmic.exe Token: 36 2068 wmic.exe Token: SeIncreaseQuotaPrivilege 2524 wmic.exe Token: SeSecurityPrivilege 2524 wmic.exe Token: SeTakeOwnershipPrivilege 2524 wmic.exe Token: SeLoadDriverPrivilege 2524 wmic.exe Token: SeSystemProfilePrivilege 2524 wmic.exe Token: SeSystemtimePrivilege 2524 wmic.exe Token: SeProfSingleProcessPrivilege 2524 wmic.exe Token: SeIncBasePriorityPrivilege 2524 wmic.exe Token: SeCreatePagefilePrivilege 2524 wmic.exe Token: SeBackupPrivilege 2524 wmic.exe Token: SeRestorePrivilege 2524 wmic.exe Token: SeShutdownPrivilege 2524 wmic.exe Token: SeDebugPrivilege 2524 wmic.exe Token: SeSystemEnvironmentPrivilege 2524 wmic.exe Token: SeRemoteShutdownPrivilege 2524 wmic.exe Token: SeUndockPrivilege 2524 wmic.exe Token: SeManageVolumePrivilege 2524 wmic.exe Token: 33 2524 wmic.exe Token: 34 2524 wmic.exe Token: 35 2524 wmic.exe Token: 36 2524 wmic.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4616 wrote to memory of 2068 4616 2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe 81 PID 4616 wrote to memory of 2068 4616 2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe 81 PID 4616 wrote to memory of 2068 4616 2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe 81 PID 4616 wrote to memory of 2524 4616 2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe 84 PID 4616 wrote to memory of 2524 4616 2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe 84 PID 4616 wrote to memory of 2524 4616 2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe 84 PID 4616 wrote to memory of 4980 4616 2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe 86 PID 4616 wrote to memory of 4980 4616 2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe 86 PID 4616 wrote to memory of 4980 4616 2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe 86 PID 4616 wrote to memory of 4460 4616 2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe 88 PID 4616 wrote to memory of 4460 4616 2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe 88 PID 4616 wrote to memory of 4460 4616 2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe 88 PID 4616 wrote to memory of 1924 4616 2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe 90 PID 4616 wrote to memory of 1924 4616 2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe 90 PID 4616 wrote to memory of 1924 4616 2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe 90 PID 4616 wrote to memory of 2000 4616 2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe 94 PID 4616 wrote to memory of 2000 4616 2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe 94 PID 4616 wrote to memory of 2000 4616 2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe 94 PID 4616 wrote to memory of 3212 4616 2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe 97 PID 4616 wrote to memory of 3212 4616 2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe 97 PID 4616 wrote to memory of 3212 4616 2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe 97 PID 4616 wrote to memory of 868 4616 2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe 99 PID 4616 wrote to memory of 868 4616 2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe 99 PID 4616 wrote to memory of 868 4616 2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe 99 PID 4616 wrote to memory of 1396 4616 2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe 101 PID 4616 wrote to memory of 1396 4616 2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe 101 PID 4616 wrote to memory of 1396 4616 2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe 101 PID 4616 wrote to memory of 5064 4616 2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe 104 PID 4616 wrote to memory of 5064 4616 2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe 104 PID 4616 wrote to memory of 5064 4616 2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe 104 PID 4616 wrote to memory of 3164 4616 2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe 106 PID 4616 wrote to memory of 3164 4616 2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe 106 PID 4616 wrote to memory of 3164 4616 2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe 106 PID 4616 wrote to memory of 2152 4616 2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe 109 PID 4616 wrote to memory of 2152 4616 2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe 109 PID 4616 wrote to memory of 2152 4616 2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe 109 PID 4616 wrote to memory of 4168 4616 2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe 112 PID 4616 wrote to memory of 4168 4616 2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe 112 PID 4616 wrote to memory of 4168 4616 2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe 112 PID 4616 wrote to memory of 4316 4616 2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe 114 PID 4616 wrote to memory of 4316 4616 2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe 114 PID 4616 wrote to memory of 4316 4616 2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe 114 PID 4616 wrote to memory of 2624 4616 2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe 116 PID 4616 wrote to memory of 2624 4616 2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe 116 PID 4616 wrote to memory of 2624 4616 2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe 116 PID 4616 wrote to memory of 3772 4616 2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe 118 PID 4616 wrote to memory of 3772 4616 2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe 118 PID 4616 wrote to memory of 3772 4616 2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe 118 PID 4616 wrote to memory of 320 4616 2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe 120 PID 4616 wrote to memory of 320 4616 2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe 120 PID 4616 wrote to memory of 320 4616 2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe 120 PID 4616 wrote to memory of 2988 4616 2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe 122 PID 4616 wrote to memory of 2988 4616 2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe 122 PID 4616 wrote to memory of 2988 4616 2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe 122 PID 4616 wrote to memory of 4328 4616 2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe 124 PID 4616 wrote to memory of 4328 4616 2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe 124 PID 4616 wrote to memory of 4328 4616 2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe 124 PID 4616 wrote to memory of 4188 4616 2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe 126 PID 4616 wrote to memory of 4188 4616 2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe 126 PID 4616 wrote to memory of 4188 4616 2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe 126 PID 4616 wrote to memory of 4456 4616 2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe 128 PID 4616 wrote to memory of 4456 4616 2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe 128 PID 4616 wrote to memory of 4456 4616 2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe 128 PID 4616 wrote to memory of 4608 4616 2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe 130
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-27_d946c7218f704088824dd614003f0671_magniber.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2068
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2524
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:4980
-
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /all2⤵
- Gathers network information
PID:4460
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:1924
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:2000
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:3212
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:868
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:1396
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:5064
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:3164
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:2152
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:4168
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:4316
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:2624
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:3772
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:320
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:2988
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:4328
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:4188
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:4456
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:4608
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:4016
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:4028
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:2992
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:3552
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:3756
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:4564
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:32
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:5044
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:4992
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:2960
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:636
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:4156
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:1756
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:4620
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:1684
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:3292
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:3560
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:220
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:3820
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:2268
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:1156
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:3192
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:3464
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:332
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:4288
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:4548
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:4388
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:3916
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:1612
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:3840
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:3196
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:1140
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:4864
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:680
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:2768
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:2072
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:4044
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:2164
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:1600
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:4912
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:3640
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:5004
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:2284
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:4084
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:5008
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:4224
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:3952
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:4480
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:3712
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:4072
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:3436
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:4672
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:2540
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:2488
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:764
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:1588
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:1808
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:2136
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:1456
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:4520
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:4664
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:3124
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:3488
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:3736
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:2264
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:2272
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:2928
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:1764
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:4852
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:3184
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:4544
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:4132
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:3412
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:4060
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:2356
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:512
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:1948
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:3508
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:3688
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:5108
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:4792
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:4264
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:5024
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:1440
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:3400
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:2692
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:3700
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:4400
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:1868
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:3064
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:880
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:216
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:3480
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:1648
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:116
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:4320
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:4312
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:3696
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:1772
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:4916
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:1064
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:3068
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:4748
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:4820
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:4256
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:3348
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:3328
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:2580
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:2080
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:4588
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:3260
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:2324
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:384
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:2380
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:3860
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:4808
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:4576
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:2484
-
-
C:\Windows\SysWOW64\route.exeroute print -42⤵PID:1656
-