Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
09/07/2024, 21:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
31fc550c1f570f6a9bb29fcb49690164_JaffaCakes118.exe
Resource
win7-20240704-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
31fc550c1f570f6a9bb29fcb49690164_JaffaCakes118.exe
Resource
win10v2004-20240709-en
3 signatures
150 seconds
General
-
Target
31fc550c1f570f6a9bb29fcb49690164_JaffaCakes118.exe
-
Size
24KB
-
MD5
31fc550c1f570f6a9bb29fcb49690164
-
SHA1
ea836ba32c4e9adeece467263a760496f9aa1d4f
-
SHA256
231b1559ab77ead9f48fba6416139fcff63c37d30ad5e22a2f15ce34a95d8469
-
SHA512
e9eafc47107d5ab62db3714bee4832e655fb48d9408250e94e4f7556f2bf7e51cef7f739bbe8752c444e67dc6dfcd392ddb5dcf4a4171fa2ef415c8fa0bdf489
-
SSDEEP
768:gdfizkgCGOI4rHDH+ExgxRZpIizM7/bM1iW9Qwh:gdfizWGd4rkxnzKM1b
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2748 imag.exe 1864 imag.exe 2760 imag.exe 2780 imag.exe 2764 imag.exe 2812 imag.exe 2564 imag.exe 3020 imag.exe 2832 imag.exe 2596 imag.exe 2728 imag.exe 2824 imag.exe 2560 imag.exe 2588 imag.exe 2676 imag.exe 2140 imag.exe 1260 imag.exe 1644 imag.exe 1896 imag.exe 1108 imag.exe 2980 imag.exe 2472 imag.exe 1556 imag.exe 1784 imag.exe 2284 imag.exe 2932 imag.exe 2908 imag.exe 1932 imag.exe 2088 imag.exe 2104 imag.exe 2164 imag.exe 1056 imag.exe 2412 imag.exe 372 imag.exe 2936 imag.exe 2984 imag.exe 2928 imag.exe 2912 imag.exe 2652 imag.exe 2904 imag.exe 1852 imag.exe 1568 imag.exe 1052 imag.exe 1216 imag.exe 2272 imag.exe 2496 imag.exe 2740 imag.exe 816 imag.exe 2516 imag.exe 588 imag.exe 2396 imag.exe 444 imag.exe 484 imag.exe 388 imag.exe 536 imag.exe 1688 imag.exe 2372 imag.exe 2332 imag.exe 2132 imag.exe 2344 imag.exe 2368 imag.exe 2148 imag.exe 2380 imag.exe 2184 imag.exe -
Loads dropped DLL 64 IoCs
pid Process 2836 31fc550c1f570f6a9bb29fcb49690164_JaffaCakes118.exe 2836 31fc550c1f570f6a9bb29fcb49690164_JaffaCakes118.exe 2748 imag.exe 2748 imag.exe 1864 imag.exe 1864 imag.exe 2760 imag.exe 2760 imag.exe 2780 imag.exe 2780 imag.exe 2764 imag.exe 2764 imag.exe 2812 imag.exe 2812 imag.exe 2564 imag.exe 2564 imag.exe 3020 imag.exe 3020 imag.exe 2832 imag.exe 2832 imag.exe 2596 imag.exe 2596 imag.exe 2728 imag.exe 2728 imag.exe 2824 imag.exe 2824 imag.exe 2560 imag.exe 2560 imag.exe 2588 imag.exe 2588 imag.exe 2676 imag.exe 2676 imag.exe 2140 imag.exe 2140 imag.exe 1260 imag.exe 1260 imag.exe 1644 imag.exe 1644 imag.exe 1896 imag.exe 1896 imag.exe 1108 imag.exe 1108 imag.exe 2980 imag.exe 2980 imag.exe 2472 imag.exe 2472 imag.exe 1556 imag.exe 1556 imag.exe 1784 imag.exe 1784 imag.exe 2284 imag.exe 2284 imag.exe 2932 imag.exe 2932 imag.exe 2908 imag.exe 2908 imag.exe 1932 imag.exe 1932 imag.exe 2088 imag.exe 2088 imag.exe 2104 imag.exe 2104 imag.exe 2164 imag.exe 2164 imag.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe imag.exe File created C:\Windows\SysWOW64\imag.exe imag.exe File created C:\Windows\SysWOW64\imag.exe imag.exe File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe imag.exe File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe imag.exe File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe imag.exe File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe imag.exe File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2836 wrote to memory of 2748 2836 31fc550c1f570f6a9bb29fcb49690164_JaffaCakes118.exe 30 PID 2836 wrote to memory of 2748 2836 31fc550c1f570f6a9bb29fcb49690164_JaffaCakes118.exe 30 PID 2836 wrote to memory of 2748 2836 31fc550c1f570f6a9bb29fcb49690164_JaffaCakes118.exe 30 PID 2836 wrote to memory of 2748 2836 31fc550c1f570f6a9bb29fcb49690164_JaffaCakes118.exe 30 PID 2748 wrote to memory of 1864 2748 imag.exe 31 PID 2748 wrote to memory of 1864 2748 imag.exe 31 PID 2748 wrote to memory of 1864 2748 imag.exe 31 PID 2748 wrote to memory of 1864 2748 imag.exe 31 PID 1864 wrote to memory of 2760 1864 imag.exe 32 PID 1864 wrote to memory of 2760 1864 imag.exe 32 PID 1864 wrote to memory of 2760 1864 imag.exe 32 PID 1864 wrote to memory of 2760 1864 imag.exe 32 PID 2760 wrote to memory of 2780 2760 imag.exe 33 PID 2760 wrote to memory of 2780 2760 imag.exe 33 PID 2760 wrote to memory of 2780 2760 imag.exe 33 PID 2760 wrote to memory of 2780 2760 imag.exe 33 PID 2780 wrote to memory of 2764 2780 imag.exe 34 PID 2780 wrote to memory of 2764 2780 imag.exe 34 PID 2780 wrote to memory of 2764 2780 imag.exe 34 PID 2780 wrote to memory of 2764 2780 imag.exe 34 PID 2764 wrote to memory of 2812 2764 imag.exe 35 PID 2764 wrote to memory of 2812 2764 imag.exe 35 PID 2764 wrote to memory of 2812 2764 imag.exe 35 PID 2764 wrote to memory of 2812 2764 imag.exe 35 PID 2812 wrote to memory of 2564 2812 imag.exe 36 PID 2812 wrote to memory of 2564 2812 imag.exe 36 PID 2812 wrote to memory of 2564 2812 imag.exe 36 PID 2812 wrote to memory of 2564 2812 imag.exe 36 PID 2564 wrote to memory of 3020 2564 imag.exe 37 PID 2564 wrote to memory of 3020 2564 imag.exe 37 PID 2564 wrote to memory of 3020 2564 imag.exe 37 PID 2564 wrote to memory of 3020 2564 imag.exe 37 PID 3020 wrote to memory of 2832 3020 imag.exe 38 PID 3020 wrote to memory of 2832 3020 imag.exe 38 PID 3020 wrote to memory of 2832 3020 imag.exe 38 PID 3020 wrote to memory of 2832 3020 imag.exe 38 PID 2832 wrote to memory of 2596 2832 imag.exe 39 PID 2832 wrote to memory of 2596 2832 imag.exe 39 PID 2832 wrote to memory of 2596 2832 imag.exe 39 PID 2832 wrote to memory of 2596 2832 imag.exe 39 PID 2596 wrote to memory of 2728 2596 imag.exe 40 PID 2596 wrote to memory of 2728 2596 imag.exe 40 PID 2596 wrote to memory of 2728 2596 imag.exe 40 PID 2596 wrote to memory of 2728 2596 imag.exe 40 PID 2728 wrote to memory of 2824 2728 imag.exe 41 PID 2728 wrote to memory of 2824 2728 imag.exe 41 PID 2728 wrote to memory of 2824 2728 imag.exe 41 PID 2728 wrote to memory of 2824 2728 imag.exe 41 PID 2824 wrote to memory of 2560 2824 imag.exe 42 PID 2824 wrote to memory of 2560 2824 imag.exe 42 PID 2824 wrote to memory of 2560 2824 imag.exe 42 PID 2824 wrote to memory of 2560 2824 imag.exe 42 PID 2560 wrote to memory of 2588 2560 imag.exe 43 PID 2560 wrote to memory of 2588 2560 imag.exe 43 PID 2560 wrote to memory of 2588 2560 imag.exe 43 PID 2560 wrote to memory of 2588 2560 imag.exe 43 PID 2588 wrote to memory of 2676 2588 imag.exe 44 PID 2588 wrote to memory of 2676 2588 imag.exe 44 PID 2588 wrote to memory of 2676 2588 imag.exe 44 PID 2588 wrote to memory of 2676 2588 imag.exe 44 PID 2676 wrote to memory of 2140 2676 imag.exe 45 PID 2676 wrote to memory of 2140 2676 imag.exe 45 PID 2676 wrote to memory of 2140 2676 imag.exe 45 PID 2676 wrote to memory of 2140 2676 imag.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\31fc550c1f570f6a9bb29fcb49690164_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\31fc550c1f570f6a9bb29fcb49690164_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2140 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1260 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1644 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1896 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1108 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2980 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2472 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1556 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1784 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"26⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2284 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2932 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2908 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1932 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2088 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2104 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2164 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"33⤵
- Executes dropped EXE
PID:1056 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"34⤵
- Executes dropped EXE
PID:2412 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"35⤵
- Executes dropped EXE
PID:372 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"36⤵
- Executes dropped EXE
PID:2936 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"37⤵
- Executes dropped EXE
PID:2984 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"38⤵
- Executes dropped EXE
PID:2928 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"39⤵
- Executes dropped EXE
PID:2912 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"40⤵
- Executes dropped EXE
PID:2652 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"41⤵
- Executes dropped EXE
PID:2904 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"42⤵
- Executes dropped EXE
PID:1852 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"43⤵
- Executes dropped EXE
PID:1568 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"44⤵
- Executes dropped EXE
PID:1052 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"45⤵
- Executes dropped EXE
PID:1216 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"46⤵
- Executes dropped EXE
PID:2272 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"47⤵
- Executes dropped EXE
PID:2496 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"48⤵
- Executes dropped EXE
PID:2740 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"49⤵
- Executes dropped EXE
PID:816 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"50⤵
- Executes dropped EXE
PID:2516 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"51⤵
- Executes dropped EXE
PID:588 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"52⤵
- Executes dropped EXE
PID:2396 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"53⤵
- Executes dropped EXE
PID:444 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"54⤵
- Executes dropped EXE
PID:484 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"55⤵
- Executes dropped EXE
PID:388 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"56⤵
- Executes dropped EXE
PID:536 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"57⤵
- Executes dropped EXE
PID:1688 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"58⤵
- Executes dropped EXE
PID:2372 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"59⤵
- Executes dropped EXE
PID:2332 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"60⤵
- Executes dropped EXE
PID:2132 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"61⤵
- Executes dropped EXE
PID:2344 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"62⤵
- Executes dropped EXE
PID:2368 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"63⤵
- Executes dropped EXE
PID:2148 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"64⤵
- Executes dropped EXE
PID:2380 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"65⤵
- Executes dropped EXE
PID:2184 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"66⤵PID:2100
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"67⤵PID:2128
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"68⤵PID:2108
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"69⤵PID:1744
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"70⤵PID:2872
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"71⤵PID:2196
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"72⤵PID:2096
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"73⤵PID:2200
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"74⤵PID:2356
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"75⤵PID:2388
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"76⤵PID:2264
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"77⤵PID:920
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"78⤵PID:1868
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"79⤵PID:1296
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"80⤵PID:1552
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"81⤵PID:2192
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"82⤵PID:1792
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"83⤵PID:940
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"84⤵PID:2060
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"85⤵PID:1684
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"86⤵PID:272
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"87⤵PID:2288
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"88⤵PID:2444
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"89⤵PID:924
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"90⤵PID:1504
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"91⤵PID:1592
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"92⤵PID:2736
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"93⤵PID:1444
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"94⤵PID:1940
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"95⤵PID:1704
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"96⤵PID:1912
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"97⤵PID:884
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"98⤵PID:1488
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"99⤵PID:2320
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"100⤵PID:2436
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"101⤵PID:1468
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"102⤵PID:2528
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"103⤵PID:1268
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"104⤵PID:1992
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"105⤵PID:2020
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"106⤵PID:1996
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"107⤵PID:1916
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"108⤵PID:1712
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"109⤵PID:2424
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"110⤵PID:2732
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"111⤵PID:1748
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"112⤵PID:2484
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"113⤵PID:3056
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"114⤵PID:2044
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"115⤵PID:1584
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"116⤵PID:2476
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"117⤵PID:648
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"118⤵PID:1440
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"119⤵PID:2300
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"120⤵PID:1616
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"121⤵PID:1900
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"122⤵PID:1564
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-