Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
09/07/2024, 21:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
31fc550c1f570f6a9bb29fcb49690164_JaffaCakes118.exe
Resource
win7-20240704-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
31fc550c1f570f6a9bb29fcb49690164_JaffaCakes118.exe
Resource
win10v2004-20240709-en
3 signatures
150 seconds
General
-
Target
31fc550c1f570f6a9bb29fcb49690164_JaffaCakes118.exe
-
Size
24KB
-
MD5
31fc550c1f570f6a9bb29fcb49690164
-
SHA1
ea836ba32c4e9adeece467263a760496f9aa1d4f
-
SHA256
231b1559ab77ead9f48fba6416139fcff63c37d30ad5e22a2f15ce34a95d8469
-
SHA512
e9eafc47107d5ab62db3714bee4832e655fb48d9408250e94e4f7556f2bf7e51cef7f739bbe8752c444e67dc6dfcd392ddb5dcf4a4171fa2ef415c8fa0bdf489
-
SSDEEP
768:gdfizkgCGOI4rHDH+ExgxRZpIizM7/bM1iW9Qwh:gdfizWGd4rkxnzKM1b
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3328 imag.exe 4880 imag.exe 3112 imag.exe 4288 imag.exe 1468 imag.exe 4884 imag.exe 4832 imag.exe 3740 imag.exe 2296 imag.exe 4968 imag.exe 4440 imag.exe 956 imag.exe 2516 imag.exe 3668 imag.exe 2620 imag.exe 5036 imag.exe 4452 imag.exe 4400 imag.exe 1440 imag.exe 1204 imag.exe 4068 imag.exe 4344 imag.exe 1376 imag.exe 2116 imag.exe 4560 imag.exe 4980 imag.exe 1088 imag.exe 2756 imag.exe 1424 imag.exe 1860 imag.exe 4996 imag.exe 328 imag.exe 184 imag.exe 4360 imag.exe 2512 imag.exe 2596 imag.exe 4476 imag.exe 2528 imag.exe 4520 imag.exe 2884 imag.exe 1668 imag.exe 2784 imag.exe 4752 imag.exe 5072 imag.exe 1824 imag.exe 1352 imag.exe 996 imag.exe 388 imag.exe 2208 imag.exe 4000 imag.exe 3020 imag.exe 1436 imag.exe 5104 imag.exe 520 imag.exe 1308 imag.exe 1184 imag.exe 1856 imag.exe 4816 imag.exe 2300 imag.exe 3148 imag.exe 2576 imag.exe 3504 imag.exe 880 imag.exe 1996 imag.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe imag.exe File created C:\Windows\SysWOW64\imag.exe imag.exe File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe imag.exe File created C:\Windows\SysWOW64\imag.exe imag.exe File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe imag.exe File created C:\Windows\SysWOW64\imag.exe imag.exe File created C:\Windows\SysWOW64\imag.exe imag.exe File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe imag.exe File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe imag.exe File created C:\Windows\SysWOW64\imag.exe imag.exe File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe imag.exe File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe imag.exe File created C:\Windows\SysWOW64\imag.exe imag.exe File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe imag.exe File created C:\Windows\SysWOW64\imag.exe imag.exe File created C:\Windows\SysWOW64\imag.exe imag.exe File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe imag.exe File created C:\Windows\SysWOW64\imag.exe imag.exe File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe Process not Found File created C:\Windows\SysWOW64\imag.exe imag.exe File created C:\Windows\SysWOW64\imag.exe Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3260 wrote to memory of 3328 3260 31fc550c1f570f6a9bb29fcb49690164_JaffaCakes118.exe 82 PID 3260 wrote to memory of 3328 3260 31fc550c1f570f6a9bb29fcb49690164_JaffaCakes118.exe 82 PID 3260 wrote to memory of 3328 3260 31fc550c1f570f6a9bb29fcb49690164_JaffaCakes118.exe 82 PID 3328 wrote to memory of 4880 3328 imag.exe 83 PID 3328 wrote to memory of 4880 3328 imag.exe 83 PID 3328 wrote to memory of 4880 3328 imag.exe 83 PID 4880 wrote to memory of 3112 4880 imag.exe 84 PID 4880 wrote to memory of 3112 4880 imag.exe 84 PID 4880 wrote to memory of 3112 4880 imag.exe 84 PID 3112 wrote to memory of 4288 3112 imag.exe 85 PID 3112 wrote to memory of 4288 3112 imag.exe 85 PID 3112 wrote to memory of 4288 3112 imag.exe 85 PID 4288 wrote to memory of 1468 4288 imag.exe 86 PID 4288 wrote to memory of 1468 4288 imag.exe 86 PID 4288 wrote to memory of 1468 4288 imag.exe 86 PID 1468 wrote to memory of 4884 1468 imag.exe 87 PID 1468 wrote to memory of 4884 1468 imag.exe 87 PID 1468 wrote to memory of 4884 1468 imag.exe 87 PID 4884 wrote to memory of 4832 4884 imag.exe 88 PID 4884 wrote to memory of 4832 4884 imag.exe 88 PID 4884 wrote to memory of 4832 4884 imag.exe 88 PID 4832 wrote to memory of 3740 4832 imag.exe 89 PID 4832 wrote to memory of 3740 4832 imag.exe 89 PID 4832 wrote to memory of 3740 4832 imag.exe 89 PID 3740 wrote to memory of 2296 3740 imag.exe 90 PID 3740 wrote to memory of 2296 3740 imag.exe 90 PID 3740 wrote to memory of 2296 3740 imag.exe 90 PID 2296 wrote to memory of 4968 2296 imag.exe 91 PID 2296 wrote to memory of 4968 2296 imag.exe 91 PID 2296 wrote to memory of 4968 2296 imag.exe 91 PID 4968 wrote to memory of 4440 4968 imag.exe 92 PID 4968 wrote to memory of 4440 4968 imag.exe 92 PID 4968 wrote to memory of 4440 4968 imag.exe 92 PID 4440 wrote to memory of 956 4440 imag.exe 93 PID 4440 wrote to memory of 956 4440 imag.exe 93 PID 4440 wrote to memory of 956 4440 imag.exe 93 PID 956 wrote to memory of 2516 956 imag.exe 94 PID 956 wrote to memory of 2516 956 imag.exe 94 PID 956 wrote to memory of 2516 956 imag.exe 94 PID 2516 wrote to memory of 3668 2516 imag.exe 95 PID 2516 wrote to memory of 3668 2516 imag.exe 95 PID 2516 wrote to memory of 3668 2516 imag.exe 95 PID 3668 wrote to memory of 2620 3668 imag.exe 96 PID 3668 wrote to memory of 2620 3668 imag.exe 96 PID 3668 wrote to memory of 2620 3668 imag.exe 96 PID 2620 wrote to memory of 5036 2620 imag.exe 97 PID 2620 wrote to memory of 5036 2620 imag.exe 97 PID 2620 wrote to memory of 5036 2620 imag.exe 97 PID 5036 wrote to memory of 4452 5036 imag.exe 98 PID 5036 wrote to memory of 4452 5036 imag.exe 98 PID 5036 wrote to memory of 4452 5036 imag.exe 98 PID 4452 wrote to memory of 4400 4452 imag.exe 99 PID 4452 wrote to memory of 4400 4452 imag.exe 99 PID 4452 wrote to memory of 4400 4452 imag.exe 99 PID 4400 wrote to memory of 1440 4400 imag.exe 100 PID 4400 wrote to memory of 1440 4400 imag.exe 100 PID 4400 wrote to memory of 1440 4400 imag.exe 100 PID 1440 wrote to memory of 1204 1440 imag.exe 101 PID 1440 wrote to memory of 1204 1440 imag.exe 101 PID 1440 wrote to memory of 1204 1440 imag.exe 101 PID 1204 wrote to memory of 4068 1204 imag.exe 102 PID 1204 wrote to memory of 4068 1204 imag.exe 102 PID 1204 wrote to memory of 4068 1204 imag.exe 102 PID 4068 wrote to memory of 4344 4068 imag.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\31fc550c1f570f6a9bb29fcb49690164_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\31fc550c1f570f6a9bb29fcb49690164_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"23⤵
- Executes dropped EXE
PID:4344 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"24⤵
- Executes dropped EXE
PID:1376 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"25⤵
- Executes dropped EXE
PID:2116 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"26⤵
- Executes dropped EXE
PID:4560 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"27⤵
- Executes dropped EXE
PID:4980 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"28⤵
- Executes dropped EXE
PID:1088 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"29⤵
- Executes dropped EXE
PID:2756 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"30⤵
- Executes dropped EXE
PID:1424 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"31⤵
- Executes dropped EXE
PID:1860 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"32⤵
- Executes dropped EXE
PID:4996 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"33⤵
- Executes dropped EXE
PID:328 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"34⤵
- Executes dropped EXE
PID:184 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"35⤵
- Executes dropped EXE
PID:4360 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"36⤵
- Executes dropped EXE
PID:2512 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"37⤵
- Executes dropped EXE
PID:2596 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"38⤵
- Executes dropped EXE
PID:4476 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"39⤵
- Executes dropped EXE
PID:2528 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"40⤵
- Executes dropped EXE
PID:4520 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"41⤵
- Executes dropped EXE
PID:2884 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"42⤵
- Executes dropped EXE
PID:1668 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"43⤵
- Executes dropped EXE
PID:2784 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"44⤵
- Executes dropped EXE
PID:4752 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"45⤵
- Executes dropped EXE
PID:5072 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"46⤵
- Executes dropped EXE
PID:1824 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"47⤵
- Executes dropped EXE
PID:1352 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"48⤵
- Executes dropped EXE
PID:996 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"49⤵
- Executes dropped EXE
PID:388 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"50⤵
- Executes dropped EXE
PID:2208 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"51⤵
- Executes dropped EXE
PID:4000 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"52⤵
- Executes dropped EXE
PID:3020 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"53⤵
- Executes dropped EXE
PID:1436 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"54⤵
- Executes dropped EXE
PID:5104 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"55⤵
- Executes dropped EXE
PID:520 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"56⤵
- Executes dropped EXE
PID:1308 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"57⤵
- Executes dropped EXE
PID:1184 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"58⤵
- Executes dropped EXE
PID:1856 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"59⤵
- Executes dropped EXE
PID:4816 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"60⤵
- Executes dropped EXE
PID:2300 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"61⤵
- Executes dropped EXE
PID:3148 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"62⤵
- Executes dropped EXE
PID:2576 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"63⤵
- Executes dropped EXE
PID:3504 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"64⤵
- Executes dropped EXE
PID:880 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"65⤵
- Executes dropped EXE
PID:1996 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"66⤵PID:2976
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"67⤵PID:4088
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"68⤵PID:3232
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"69⤵PID:2200
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"70⤵PID:3012
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"71⤵PID:4272
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"72⤵PID:4056
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"73⤵PID:396
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"74⤵PID:2476
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"75⤵PID:4316
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"76⤵PID:1192
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"77⤵PID:2900
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"78⤵PID:1208
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"79⤵PID:3160
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"80⤵PID:2440
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"81⤵PID:4148
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"82⤵PID:3720
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"83⤵PID:840
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"84⤵PID:1676
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"85⤵PID:1100
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"86⤵PID:1484
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"87⤵PID:1512
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"88⤵PID:4208
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"89⤵PID:2960
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"90⤵PID:4576
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"91⤵PID:944
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"92⤵PID:1704
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"93⤵PID:3660
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"94⤵PID:4724
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"95⤵PID:3304
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"96⤵PID:4324
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"97⤵PID:1972
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"98⤵PID:3296
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"99⤵PID:3936
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"100⤵PID:3328
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"101⤵PID:3316
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"102⤵PID:1612
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"103⤵PID:4388
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"104⤵PID:3508
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"105⤵PID:656
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"106⤵PID:644
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"107⤵PID:4832
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"108⤵PID:1564
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"109⤵PID:1060
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"110⤵PID:3836
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"111⤵PID:5096
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"112⤵PID:4824
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"113⤵PID:4540
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"114⤵
- Drops file in System32 directory
PID:4956 -
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"115⤵PID:3376
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"116⤵PID:4544
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"117⤵PID:3696
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"118⤵PID:3764
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"119⤵PID:1672
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"120⤵PID:424
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"121⤵PID:1488
-
C:\Windows\SysWOW64\imag.exe"C:\Windows\system32\imag.exe"122⤵PID:1196
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-