Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
04-06-2022 02:50
Static task
static1
Behavioral task
behavioral1
Sample
118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d.exe
Resource
win10v2004-20220414-en
General
-
Target
118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d.exe
-
Size
339KB
-
MD5
7b510ac6a2a91e5ee5ede16619e4f73b
-
SHA1
04ed62ed049e305459d2ca9626a00e909e5add07
-
SHA256
118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d
-
SHA512
cb33e7c884c79d593ad5e6ad9324831a39270581d41f7ec8d14eaf04a38796df20f3bcc5caf9ff750cd33588697445c3440828bb269d9e7f8947c39fbcb4105a
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Executes dropped EXE 42 IoCs
Processes:
igfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exepid process 4148 igfxdwx32.exe 3360 igfxdwx32.exe 1500 igfxdwx32.exe 4740 igfxdwx32.exe 1488 igfxdwx32.exe 2508 igfxdwx32.exe 4804 igfxdwx32.exe 3820 igfxdwx32.exe 4736 igfxdwx32.exe 1672 igfxdwx32.exe 4648 igfxdwx32.exe 5060 igfxdwx32.exe 816 igfxdwx32.exe 2032 igfxdwx32.exe 4084 igfxdwx32.exe 2452 igfxdwx32.exe 4500 igfxdwx32.exe 1120 igfxdwx32.exe 1800 igfxdwx32.exe 4476 igfxdwx32.exe 1860 igfxdwx32.exe 4408 igfxdwx32.exe 4136 igfxdwx32.exe 920 igfxdwx32.exe 4816 igfxdwx32.exe 2328 igfxdwx32.exe 2456 igfxdwx32.exe 3992 igfxdwx32.exe 4928 igfxdwx32.exe 4568 igfxdwx32.exe 2324 igfxdwx32.exe 2300 igfxdwx32.exe 4924 igfxdwx32.exe 1032 igfxdwx32.exe 4480 igfxdwx32.exe 4496 igfxdwx32.exe 204 igfxdwx32.exe 3136 igfxdwx32.exe 2556 igfxdwx32.exe 820 igfxdwx32.exe 1892 igfxdwx32.exe 4816 igfxdwx32.exe -
Checks computer location settings 2 TTPs 42 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
igfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exe118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation igfxdwx32.exe Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation igfxdwx32.exe Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation igfxdwx32.exe Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation igfxdwx32.exe Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation igfxdwx32.exe Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation igfxdwx32.exe Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation igfxdwx32.exe Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation igfxdwx32.exe Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation igfxdwx32.exe Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation igfxdwx32.exe Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation igfxdwx32.exe Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation 118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d.exe Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation igfxdwx32.exe Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation igfxdwx32.exe Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation igfxdwx32.exe Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation igfxdwx32.exe Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation igfxdwx32.exe Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation igfxdwx32.exe Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation igfxdwx32.exe Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation igfxdwx32.exe Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation igfxdwx32.exe Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation igfxdwx32.exe Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation igfxdwx32.exe Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation igfxdwx32.exe Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation igfxdwx32.exe Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation igfxdwx32.exe Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation igfxdwx32.exe Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation igfxdwx32.exe Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation igfxdwx32.exe Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation igfxdwx32.exe Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation igfxdwx32.exe Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation igfxdwx32.exe Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation igfxdwx32.exe Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation igfxdwx32.exe Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation igfxdwx32.exe Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation igfxdwx32.exe Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation igfxdwx32.exe Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation igfxdwx32.exe Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation igfxdwx32.exe Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation igfxdwx32.exe Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation igfxdwx32.exe Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation igfxdwx32.exe -
Maps connected drives based on registry 3 TTPs 64 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
igfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exe118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdwx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdwx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdwx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdwx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdwx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdwx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdwx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdwx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdwx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdwx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdwx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdwx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdwx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdwx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdwx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdwx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdwx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdwx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdwx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdwx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdwx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdwx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdwx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdwx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdwx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdwx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdwx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdwx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdwx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdwx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdwx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdwx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdwx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdwx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdwx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdwx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdwx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdwx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdwx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdwx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdwx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdwx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdwx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdwx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdwx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdwx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdwx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdwx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdwx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdwx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdwx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdwx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdwx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdwx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdwx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdwx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdwx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdwx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdwx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdwx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdwx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdwx32.exe -
Drops file in System32 directory 64 IoCs
Processes:
igfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exe118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exedescription ioc process File opened for modification C:\Windows\SysWOW64\igfxdwx32.exe igfxdwx32.exe File opened for modification C:\Windows\SysWOW64\ igfxdwx32.exe File opened for modification C:\Windows\SysWOW64\ igfxdwx32.exe File opened for modification C:\Windows\SysWOW64\igfxdwx32.exe igfxdwx32.exe File opened for modification C:\Windows\SysWOW64\igfxdwx32.exe igfxdwx32.exe File opened for modification C:\Windows\SysWOW64\igfxdwx32.exe igfxdwx32.exe File opened for modification C:\Windows\SysWOW64\ igfxdwx32.exe File opened for modification C:\Windows\SysWOW64\ igfxdwx32.exe File opened for modification C:\Windows\SysWOW64\ igfxdwx32.exe File created C:\Windows\SysWOW64\igfxdwx32.exe igfxdwx32.exe File opened for modification C:\Windows\SysWOW64\ igfxdwx32.exe File opened for modification C:\Windows\SysWOW64\ igfxdwx32.exe File opened for modification C:\Windows\SysWOW64\igfxdwx32.exe igfxdwx32.exe File created C:\Windows\SysWOW64\igfxdwx32.exe igfxdwx32.exe File opened for modification C:\Windows\SysWOW64\ igfxdwx32.exe File opened for modification C:\Windows\SysWOW64\igfxdwx32.exe igfxdwx32.exe File created C:\Windows\SysWOW64\igfxdwx32.exe igfxdwx32.exe File opened for modification C:\Windows\SysWOW64\igfxdwx32.exe igfxdwx32.exe File created C:\Windows\SysWOW64\igfxdwx32.exe igfxdwx32.exe File created C:\Windows\SysWOW64\igfxdwx32.exe igfxdwx32.exe File opened for modification C:\Windows\SysWOW64\igfxdwx32.exe igfxdwx32.exe File created C:\Windows\SysWOW64\igfxdwx32.exe igfxdwx32.exe File created C:\Windows\SysWOW64\igfxdwx32.exe igfxdwx32.exe File opened for modification C:\Windows\SysWOW64\ igfxdwx32.exe File opened for modification C:\Windows\SysWOW64\ igfxdwx32.exe File opened for modification C:\Windows\SysWOW64\igfxdwx32.exe igfxdwx32.exe File created C:\Windows\SysWOW64\igfxdwx32.exe igfxdwx32.exe File created C:\Windows\SysWOW64\igfxdwx32.exe igfxdwx32.exe File created C:\Windows\SysWOW64\igfxdwx32.exe igfxdwx32.exe File opened for modification C:\Windows\SysWOW64\ igfxdwx32.exe File opened for modification C:\Windows\SysWOW64\ igfxdwx32.exe File opened for modification C:\Windows\SysWOW64\ igfxdwx32.exe File opened for modification C:\Windows\SysWOW64\igfxdwx32.exe igfxdwx32.exe File created C:\Windows\SysWOW64\igfxdwx32.exe igfxdwx32.exe File created C:\Windows\SysWOW64\igfxdwx32.exe igfxdwx32.exe File created C:\Windows\SysWOW64\igfxdwx32.exe igfxdwx32.exe File opened for modification C:\Windows\SysWOW64\igfxdwx32.exe igfxdwx32.exe File opened for modification C:\Windows\SysWOW64\igfxdwx32.exe igfxdwx32.exe File opened for modification C:\Windows\SysWOW64\ igfxdwx32.exe File opened for modification C:\Windows\SysWOW64\ igfxdwx32.exe File created C:\Windows\SysWOW64\igfxdwx32.exe 118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d.exe File opened for modification C:\Windows\SysWOW64\ igfxdwx32.exe File opened for modification C:\Windows\SysWOW64\igfxdwx32.exe igfxdwx32.exe File opened for modification C:\Windows\SysWOW64\ igfxdwx32.exe File opened for modification C:\Windows\SysWOW64\igfxdwx32.exe igfxdwx32.exe File opened for modification C:\Windows\SysWOW64\igfxdwx32.exe igfxdwx32.exe File opened for modification C:\Windows\SysWOW64\igfxdwx32.exe igfxdwx32.exe File created C:\Windows\SysWOW64\igfxdwx32.exe igfxdwx32.exe File opened for modification C:\Windows\SysWOW64\igfxdwx32.exe igfxdwx32.exe File opened for modification C:\Windows\SysWOW64\ igfxdwx32.exe File created C:\Windows\SysWOW64\igfxdwx32.exe igfxdwx32.exe File opened for modification C:\Windows\SysWOW64\ igfxdwx32.exe File created C:\Windows\SysWOW64\igfxdwx32.exe igfxdwx32.exe File opened for modification C:\Windows\SysWOW64\igfxdwx32.exe igfxdwx32.exe File created C:\Windows\SysWOW64\igfxdwx32.exe igfxdwx32.exe File opened for modification C:\Windows\SysWOW64\ igfxdwx32.exe File opened for modification C:\Windows\SysWOW64\ igfxdwx32.exe File opened for modification C:\Windows\SysWOW64\igfxdwx32.exe igfxdwx32.exe File opened for modification C:\Windows\SysWOW64\igfxdwx32.exe igfxdwx32.exe File opened for modification C:\Windows\SysWOW64\igfxdwx32.exe igfxdwx32.exe File opened for modification C:\Windows\SysWOW64\ igfxdwx32.exe File opened for modification C:\Windows\SysWOW64\igfxdwx32.exe igfxdwx32.exe File opened for modification C:\Windows\SysWOW64\ igfxdwx32.exe File opened for modification C:\Windows\SysWOW64\ igfxdwx32.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 43 IoCs
Processes:
118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exepid process 1888 118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d.exe 4148 igfxdwx32.exe 3360 igfxdwx32.exe 1500 igfxdwx32.exe 4740 igfxdwx32.exe 1488 igfxdwx32.exe 2508 igfxdwx32.exe 4804 igfxdwx32.exe 3820 igfxdwx32.exe 4736 igfxdwx32.exe 1672 igfxdwx32.exe 4648 igfxdwx32.exe 5060 igfxdwx32.exe 816 igfxdwx32.exe 2032 igfxdwx32.exe 4084 igfxdwx32.exe 2452 igfxdwx32.exe 4500 igfxdwx32.exe 1120 igfxdwx32.exe 1800 igfxdwx32.exe 4476 igfxdwx32.exe 1860 igfxdwx32.exe 4408 igfxdwx32.exe 4136 igfxdwx32.exe 920 igfxdwx32.exe 4816 igfxdwx32.exe 2328 igfxdwx32.exe 2456 igfxdwx32.exe 3992 igfxdwx32.exe 4928 igfxdwx32.exe 4568 igfxdwx32.exe 2324 igfxdwx32.exe 2300 igfxdwx32.exe 4924 igfxdwx32.exe 1032 igfxdwx32.exe 4480 igfxdwx32.exe 4496 igfxdwx32.exe 204 igfxdwx32.exe 3136 igfxdwx32.exe 2556 igfxdwx32.exe 820 igfxdwx32.exe 1892 igfxdwx32.exe 4816 igfxdwx32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 42 IoCs
Processes:
igfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exe118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d.exeigfxdwx32.exeigfxdwx32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdwx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdwx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdwx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdwx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdwx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdwx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdwx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdwx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdwx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdwx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdwx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdwx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdwx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdwx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdwx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdwx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdwx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdwx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdwx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdwx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdwx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdwx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdwx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdwx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdwx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdwx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdwx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdwx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdwx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdwx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdwx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdwx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdwx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdwx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdwx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdwx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdwx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdwx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdwx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdwx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdwx32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d.exeigfxdwx32.exeigfxdwx32.exepid process 1888 118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d.exe 1888 118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d.exe 1888 118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d.exe 1888 118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d.exe 1888 118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d.exe 1888 118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d.exe 1888 118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d.exe 1888 118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d.exe 1888 118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d.exe 1888 118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d.exe 1888 118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d.exe 1888 118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d.exe 1888 118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d.exe 1888 118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d.exe 1888 118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d.exe 1888 118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d.exe 1888 118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d.exe 1888 118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d.exe 1888 118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d.exe 1888 118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d.exe 1888 118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d.exe 1888 118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d.exe 1888 118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d.exe 1888 118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d.exe 1888 118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d.exe 1888 118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d.exe 1888 118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d.exe 1888 118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d.exe 1888 118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d.exe 1888 118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d.exe 4148 igfxdwx32.exe 4148 igfxdwx32.exe 4148 igfxdwx32.exe 4148 igfxdwx32.exe 4148 igfxdwx32.exe 4148 igfxdwx32.exe 4148 igfxdwx32.exe 4148 igfxdwx32.exe 4148 igfxdwx32.exe 4148 igfxdwx32.exe 4148 igfxdwx32.exe 4148 igfxdwx32.exe 4148 igfxdwx32.exe 4148 igfxdwx32.exe 4148 igfxdwx32.exe 4148 igfxdwx32.exe 4148 igfxdwx32.exe 4148 igfxdwx32.exe 4148 igfxdwx32.exe 4148 igfxdwx32.exe 4148 igfxdwx32.exe 4148 igfxdwx32.exe 4148 igfxdwx32.exe 4148 igfxdwx32.exe 4148 igfxdwx32.exe 4148 igfxdwx32.exe 4148 igfxdwx32.exe 4148 igfxdwx32.exe 4148 igfxdwx32.exe 4148 igfxdwx32.exe 3360 igfxdwx32.exe 3360 igfxdwx32.exe 3360 igfxdwx32.exe 3360 igfxdwx32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exeigfxdwx32.exedescription pid process target process PID 1888 wrote to memory of 4148 1888 118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d.exe igfxdwx32.exe PID 1888 wrote to memory of 4148 1888 118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d.exe igfxdwx32.exe PID 1888 wrote to memory of 4148 1888 118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d.exe igfxdwx32.exe PID 4148 wrote to memory of 3360 4148 igfxdwx32.exe igfxdwx32.exe PID 4148 wrote to memory of 3360 4148 igfxdwx32.exe igfxdwx32.exe PID 4148 wrote to memory of 3360 4148 igfxdwx32.exe igfxdwx32.exe PID 3360 wrote to memory of 1500 3360 igfxdwx32.exe igfxdwx32.exe PID 3360 wrote to memory of 1500 3360 igfxdwx32.exe igfxdwx32.exe PID 3360 wrote to memory of 1500 3360 igfxdwx32.exe igfxdwx32.exe PID 1500 wrote to memory of 4740 1500 igfxdwx32.exe igfxdwx32.exe PID 1500 wrote to memory of 4740 1500 igfxdwx32.exe igfxdwx32.exe PID 1500 wrote to memory of 4740 1500 igfxdwx32.exe igfxdwx32.exe PID 4740 wrote to memory of 1488 4740 igfxdwx32.exe igfxdwx32.exe PID 4740 wrote to memory of 1488 4740 igfxdwx32.exe igfxdwx32.exe PID 4740 wrote to memory of 1488 4740 igfxdwx32.exe igfxdwx32.exe PID 1488 wrote to memory of 2508 1488 igfxdwx32.exe igfxdwx32.exe PID 1488 wrote to memory of 2508 1488 igfxdwx32.exe igfxdwx32.exe PID 1488 wrote to memory of 2508 1488 igfxdwx32.exe igfxdwx32.exe PID 2508 wrote to memory of 4804 2508 igfxdwx32.exe igfxdwx32.exe PID 2508 wrote to memory of 4804 2508 igfxdwx32.exe igfxdwx32.exe PID 2508 wrote to memory of 4804 2508 igfxdwx32.exe igfxdwx32.exe PID 4804 wrote to memory of 3820 4804 igfxdwx32.exe igfxdwx32.exe PID 4804 wrote to memory of 3820 4804 igfxdwx32.exe igfxdwx32.exe PID 4804 wrote to memory of 3820 4804 igfxdwx32.exe igfxdwx32.exe PID 3820 wrote to memory of 4736 3820 igfxdwx32.exe igfxdwx32.exe PID 3820 wrote to memory of 4736 3820 igfxdwx32.exe igfxdwx32.exe PID 3820 wrote to memory of 4736 3820 igfxdwx32.exe igfxdwx32.exe PID 4736 wrote to memory of 1672 4736 igfxdwx32.exe igfxdwx32.exe PID 4736 wrote to memory of 1672 4736 igfxdwx32.exe igfxdwx32.exe PID 4736 wrote to memory of 1672 4736 igfxdwx32.exe igfxdwx32.exe PID 1672 wrote to memory of 4648 1672 igfxdwx32.exe igfxdwx32.exe PID 1672 wrote to memory of 4648 1672 igfxdwx32.exe igfxdwx32.exe PID 1672 wrote to memory of 4648 1672 igfxdwx32.exe igfxdwx32.exe PID 4648 wrote to memory of 5060 4648 igfxdwx32.exe igfxdwx32.exe PID 4648 wrote to memory of 5060 4648 igfxdwx32.exe igfxdwx32.exe PID 4648 wrote to memory of 5060 4648 igfxdwx32.exe igfxdwx32.exe PID 5060 wrote to memory of 816 5060 igfxdwx32.exe igfxdwx32.exe PID 5060 wrote to memory of 816 5060 igfxdwx32.exe igfxdwx32.exe PID 5060 wrote to memory of 816 5060 igfxdwx32.exe igfxdwx32.exe PID 816 wrote to memory of 2032 816 igfxdwx32.exe igfxdwx32.exe PID 816 wrote to memory of 2032 816 igfxdwx32.exe igfxdwx32.exe PID 816 wrote to memory of 2032 816 igfxdwx32.exe igfxdwx32.exe PID 2032 wrote to memory of 4084 2032 igfxdwx32.exe igfxdwx32.exe PID 2032 wrote to memory of 4084 2032 igfxdwx32.exe igfxdwx32.exe PID 2032 wrote to memory of 4084 2032 igfxdwx32.exe igfxdwx32.exe PID 4084 wrote to memory of 2452 4084 igfxdwx32.exe igfxdwx32.exe PID 4084 wrote to memory of 2452 4084 igfxdwx32.exe igfxdwx32.exe PID 4084 wrote to memory of 2452 4084 igfxdwx32.exe igfxdwx32.exe PID 2452 wrote to memory of 4500 2452 igfxdwx32.exe igfxdwx32.exe PID 2452 wrote to memory of 4500 2452 igfxdwx32.exe igfxdwx32.exe PID 2452 wrote to memory of 4500 2452 igfxdwx32.exe igfxdwx32.exe PID 4500 wrote to memory of 1120 4500 igfxdwx32.exe igfxdwx32.exe PID 4500 wrote to memory of 1120 4500 igfxdwx32.exe igfxdwx32.exe PID 4500 wrote to memory of 1120 4500 igfxdwx32.exe igfxdwx32.exe PID 1120 wrote to memory of 1800 1120 igfxdwx32.exe igfxdwx32.exe PID 1120 wrote to memory of 1800 1120 igfxdwx32.exe igfxdwx32.exe PID 1120 wrote to memory of 1800 1120 igfxdwx32.exe igfxdwx32.exe PID 1800 wrote to memory of 4476 1800 igfxdwx32.exe igfxdwx32.exe PID 1800 wrote to memory of 4476 1800 igfxdwx32.exe igfxdwx32.exe PID 1800 wrote to memory of 4476 1800 igfxdwx32.exe igfxdwx32.exe PID 4476 wrote to memory of 1860 4476 igfxdwx32.exe igfxdwx32.exe PID 4476 wrote to memory of 1860 4476 igfxdwx32.exe igfxdwx32.exe PID 4476 wrote to memory of 1860 4476 igfxdwx32.exe igfxdwx32.exe PID 1860 wrote to memory of 4408 1860 igfxdwx32.exe igfxdwx32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d.exe"C:\Users\Admin\AppData\Local\Temp\118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d.exe"1⤵
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Users\Admin\AppData\Local\Temp\118BE7~1.EXE2⤵
- Executes dropped EXE
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE3⤵
- Executes dropped EXE
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE4⤵
- Executes dropped EXE
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE5⤵
- Executes dropped EXE
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE6⤵
- Executes dropped EXE
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE7⤵
- Executes dropped EXE
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE8⤵
- Executes dropped EXE
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE9⤵
- Executes dropped EXE
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE10⤵
- Executes dropped EXE
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE11⤵
- Executes dropped EXE
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE12⤵
- Executes dropped EXE
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE13⤵
- Executes dropped EXE
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE14⤵
- Executes dropped EXE
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE15⤵
- Executes dropped EXE
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE16⤵
- Executes dropped EXE
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE17⤵
- Executes dropped EXE
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE18⤵
- Executes dropped EXE
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE19⤵
- Executes dropped EXE
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE20⤵
- Executes dropped EXE
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE21⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE22⤵
- Executes dropped EXE
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE23⤵
- Executes dropped EXE
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE24⤵
- Executes dropped EXE
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE25⤵
- Executes dropped EXE
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE26⤵
- Executes dropped EXE
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE27⤵
- Executes dropped EXE
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE28⤵
- Executes dropped EXE
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE29⤵
- Executes dropped EXE
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE30⤵
- Executes dropped EXE
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE31⤵
- Executes dropped EXE
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE32⤵
- Executes dropped EXE
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE33⤵
- Executes dropped EXE
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE34⤵
- Executes dropped EXE
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE35⤵
- Executes dropped EXE
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE36⤵
- Executes dropped EXE
- Checks computer location settings
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE37⤵
- Executes dropped EXE
- Checks computer location settings
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE38⤵
- Executes dropped EXE
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE39⤵
- Executes dropped EXE
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE40⤵
- Executes dropped EXE
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE41⤵
- Executes dropped EXE
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE42⤵
- Executes dropped EXE
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE43⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\igfxdwx32.exeFilesize
339KB
MD57b510ac6a2a91e5ee5ede16619e4f73b
SHA104ed62ed049e305459d2ca9626a00e909e5add07
SHA256118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d
SHA512cb33e7c884c79d593ad5e6ad9324831a39270581d41f7ec8d14eaf04a38796df20f3bcc5caf9ff750cd33588697445c3440828bb269d9e7f8947c39fbcb4105a
-
C:\Windows\SysWOW64\igfxdwx32.exeFilesize
339KB
MD57b510ac6a2a91e5ee5ede16619e4f73b
SHA104ed62ed049e305459d2ca9626a00e909e5add07
SHA256118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d
SHA512cb33e7c884c79d593ad5e6ad9324831a39270581d41f7ec8d14eaf04a38796df20f3bcc5caf9ff750cd33588697445c3440828bb269d9e7f8947c39fbcb4105a
-
C:\Windows\SysWOW64\igfxdwx32.exeFilesize
339KB
MD57b510ac6a2a91e5ee5ede16619e4f73b
SHA104ed62ed049e305459d2ca9626a00e909e5add07
SHA256118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d
SHA512cb33e7c884c79d593ad5e6ad9324831a39270581d41f7ec8d14eaf04a38796df20f3bcc5caf9ff750cd33588697445c3440828bb269d9e7f8947c39fbcb4105a
-
C:\Windows\SysWOW64\igfxdwx32.exeFilesize
339KB
MD57b510ac6a2a91e5ee5ede16619e4f73b
SHA104ed62ed049e305459d2ca9626a00e909e5add07
SHA256118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d
SHA512cb33e7c884c79d593ad5e6ad9324831a39270581d41f7ec8d14eaf04a38796df20f3bcc5caf9ff750cd33588697445c3440828bb269d9e7f8947c39fbcb4105a
-
C:\Windows\SysWOW64\igfxdwx32.exeFilesize
339KB
MD57b510ac6a2a91e5ee5ede16619e4f73b
SHA104ed62ed049e305459d2ca9626a00e909e5add07
SHA256118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d
SHA512cb33e7c884c79d593ad5e6ad9324831a39270581d41f7ec8d14eaf04a38796df20f3bcc5caf9ff750cd33588697445c3440828bb269d9e7f8947c39fbcb4105a
-
C:\Windows\SysWOW64\igfxdwx32.exeFilesize
339KB
MD57b510ac6a2a91e5ee5ede16619e4f73b
SHA104ed62ed049e305459d2ca9626a00e909e5add07
SHA256118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d
SHA512cb33e7c884c79d593ad5e6ad9324831a39270581d41f7ec8d14eaf04a38796df20f3bcc5caf9ff750cd33588697445c3440828bb269d9e7f8947c39fbcb4105a
-
C:\Windows\SysWOW64\igfxdwx32.exeFilesize
339KB
MD57b510ac6a2a91e5ee5ede16619e4f73b
SHA104ed62ed049e305459d2ca9626a00e909e5add07
SHA256118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d
SHA512cb33e7c884c79d593ad5e6ad9324831a39270581d41f7ec8d14eaf04a38796df20f3bcc5caf9ff750cd33588697445c3440828bb269d9e7f8947c39fbcb4105a
-
C:\Windows\SysWOW64\igfxdwx32.exeFilesize
339KB
MD57b510ac6a2a91e5ee5ede16619e4f73b
SHA104ed62ed049e305459d2ca9626a00e909e5add07
SHA256118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d
SHA512cb33e7c884c79d593ad5e6ad9324831a39270581d41f7ec8d14eaf04a38796df20f3bcc5caf9ff750cd33588697445c3440828bb269d9e7f8947c39fbcb4105a
-
C:\Windows\SysWOW64\igfxdwx32.exeFilesize
339KB
MD57b510ac6a2a91e5ee5ede16619e4f73b
SHA104ed62ed049e305459d2ca9626a00e909e5add07
SHA256118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d
SHA512cb33e7c884c79d593ad5e6ad9324831a39270581d41f7ec8d14eaf04a38796df20f3bcc5caf9ff750cd33588697445c3440828bb269d9e7f8947c39fbcb4105a
-
C:\Windows\SysWOW64\igfxdwx32.exeFilesize
339KB
MD57b510ac6a2a91e5ee5ede16619e4f73b
SHA104ed62ed049e305459d2ca9626a00e909e5add07
SHA256118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d
SHA512cb33e7c884c79d593ad5e6ad9324831a39270581d41f7ec8d14eaf04a38796df20f3bcc5caf9ff750cd33588697445c3440828bb269d9e7f8947c39fbcb4105a
-
C:\Windows\SysWOW64\igfxdwx32.exeFilesize
339KB
MD57b510ac6a2a91e5ee5ede16619e4f73b
SHA104ed62ed049e305459d2ca9626a00e909e5add07
SHA256118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d
SHA512cb33e7c884c79d593ad5e6ad9324831a39270581d41f7ec8d14eaf04a38796df20f3bcc5caf9ff750cd33588697445c3440828bb269d9e7f8947c39fbcb4105a
-
C:\Windows\SysWOW64\igfxdwx32.exeFilesize
339KB
MD57b510ac6a2a91e5ee5ede16619e4f73b
SHA104ed62ed049e305459d2ca9626a00e909e5add07
SHA256118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d
SHA512cb33e7c884c79d593ad5e6ad9324831a39270581d41f7ec8d14eaf04a38796df20f3bcc5caf9ff750cd33588697445c3440828bb269d9e7f8947c39fbcb4105a
-
C:\Windows\SysWOW64\igfxdwx32.exeFilesize
339KB
MD57b510ac6a2a91e5ee5ede16619e4f73b
SHA104ed62ed049e305459d2ca9626a00e909e5add07
SHA256118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d
SHA512cb33e7c884c79d593ad5e6ad9324831a39270581d41f7ec8d14eaf04a38796df20f3bcc5caf9ff750cd33588697445c3440828bb269d9e7f8947c39fbcb4105a
-
C:\Windows\SysWOW64\igfxdwx32.exeFilesize
339KB
MD57b510ac6a2a91e5ee5ede16619e4f73b
SHA104ed62ed049e305459d2ca9626a00e909e5add07
SHA256118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d
SHA512cb33e7c884c79d593ad5e6ad9324831a39270581d41f7ec8d14eaf04a38796df20f3bcc5caf9ff750cd33588697445c3440828bb269d9e7f8947c39fbcb4105a
-
C:\Windows\SysWOW64\igfxdwx32.exeFilesize
339KB
MD57b510ac6a2a91e5ee5ede16619e4f73b
SHA104ed62ed049e305459d2ca9626a00e909e5add07
SHA256118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d
SHA512cb33e7c884c79d593ad5e6ad9324831a39270581d41f7ec8d14eaf04a38796df20f3bcc5caf9ff750cd33588697445c3440828bb269d9e7f8947c39fbcb4105a
-
C:\Windows\SysWOW64\igfxdwx32.exeFilesize
339KB
MD57b510ac6a2a91e5ee5ede16619e4f73b
SHA104ed62ed049e305459d2ca9626a00e909e5add07
SHA256118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d
SHA512cb33e7c884c79d593ad5e6ad9324831a39270581d41f7ec8d14eaf04a38796df20f3bcc5caf9ff750cd33588697445c3440828bb269d9e7f8947c39fbcb4105a
-
C:\Windows\SysWOW64\igfxdwx32.exeFilesize
339KB
MD57b510ac6a2a91e5ee5ede16619e4f73b
SHA104ed62ed049e305459d2ca9626a00e909e5add07
SHA256118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d
SHA512cb33e7c884c79d593ad5e6ad9324831a39270581d41f7ec8d14eaf04a38796df20f3bcc5caf9ff750cd33588697445c3440828bb269d9e7f8947c39fbcb4105a
-
C:\Windows\SysWOW64\igfxdwx32.exeFilesize
339KB
MD57b510ac6a2a91e5ee5ede16619e4f73b
SHA104ed62ed049e305459d2ca9626a00e909e5add07
SHA256118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d
SHA512cb33e7c884c79d593ad5e6ad9324831a39270581d41f7ec8d14eaf04a38796df20f3bcc5caf9ff750cd33588697445c3440828bb269d9e7f8947c39fbcb4105a
-
C:\Windows\SysWOW64\igfxdwx32.exeFilesize
339KB
MD57b510ac6a2a91e5ee5ede16619e4f73b
SHA104ed62ed049e305459d2ca9626a00e909e5add07
SHA256118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d
SHA512cb33e7c884c79d593ad5e6ad9324831a39270581d41f7ec8d14eaf04a38796df20f3bcc5caf9ff750cd33588697445c3440828bb269d9e7f8947c39fbcb4105a
-
C:\Windows\SysWOW64\igfxdwx32.exeFilesize
339KB
MD57b510ac6a2a91e5ee5ede16619e4f73b
SHA104ed62ed049e305459d2ca9626a00e909e5add07
SHA256118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d
SHA512cb33e7c884c79d593ad5e6ad9324831a39270581d41f7ec8d14eaf04a38796df20f3bcc5caf9ff750cd33588697445c3440828bb269d9e7f8947c39fbcb4105a
-
C:\Windows\SysWOW64\igfxdwx32.exeFilesize
339KB
MD57b510ac6a2a91e5ee5ede16619e4f73b
SHA104ed62ed049e305459d2ca9626a00e909e5add07
SHA256118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d
SHA512cb33e7c884c79d593ad5e6ad9324831a39270581d41f7ec8d14eaf04a38796df20f3bcc5caf9ff750cd33588697445c3440828bb269d9e7f8947c39fbcb4105a
-
C:\Windows\SysWOW64\igfxdwx32.exeFilesize
339KB
MD57b510ac6a2a91e5ee5ede16619e4f73b
SHA104ed62ed049e305459d2ca9626a00e909e5add07
SHA256118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d
SHA512cb33e7c884c79d593ad5e6ad9324831a39270581d41f7ec8d14eaf04a38796df20f3bcc5caf9ff750cd33588697445c3440828bb269d9e7f8947c39fbcb4105a
-
C:\Windows\SysWOW64\igfxdwx32.exeFilesize
339KB
MD57b510ac6a2a91e5ee5ede16619e4f73b
SHA104ed62ed049e305459d2ca9626a00e909e5add07
SHA256118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d
SHA512cb33e7c884c79d593ad5e6ad9324831a39270581d41f7ec8d14eaf04a38796df20f3bcc5caf9ff750cd33588697445c3440828bb269d9e7f8947c39fbcb4105a
-
C:\Windows\SysWOW64\igfxdwx32.exeFilesize
339KB
MD57b510ac6a2a91e5ee5ede16619e4f73b
SHA104ed62ed049e305459d2ca9626a00e909e5add07
SHA256118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d
SHA512cb33e7c884c79d593ad5e6ad9324831a39270581d41f7ec8d14eaf04a38796df20f3bcc5caf9ff750cd33588697445c3440828bb269d9e7f8947c39fbcb4105a
-
C:\Windows\SysWOW64\igfxdwx32.exeFilesize
339KB
MD57b510ac6a2a91e5ee5ede16619e4f73b
SHA104ed62ed049e305459d2ca9626a00e909e5add07
SHA256118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d
SHA512cb33e7c884c79d593ad5e6ad9324831a39270581d41f7ec8d14eaf04a38796df20f3bcc5caf9ff750cd33588697445c3440828bb269d9e7f8947c39fbcb4105a
-
C:\Windows\SysWOW64\igfxdwx32.exeFilesize
339KB
MD57b510ac6a2a91e5ee5ede16619e4f73b
SHA104ed62ed049e305459d2ca9626a00e909e5add07
SHA256118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d
SHA512cb33e7c884c79d593ad5e6ad9324831a39270581d41f7ec8d14eaf04a38796df20f3bcc5caf9ff750cd33588697445c3440828bb269d9e7f8947c39fbcb4105a
-
C:\Windows\SysWOW64\igfxdwx32.exeFilesize
339KB
MD57b510ac6a2a91e5ee5ede16619e4f73b
SHA104ed62ed049e305459d2ca9626a00e909e5add07
SHA256118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d
SHA512cb33e7c884c79d593ad5e6ad9324831a39270581d41f7ec8d14eaf04a38796df20f3bcc5caf9ff750cd33588697445c3440828bb269d9e7f8947c39fbcb4105a
-
C:\Windows\SysWOW64\igfxdwx32.exeFilesize
339KB
MD57b510ac6a2a91e5ee5ede16619e4f73b
SHA104ed62ed049e305459d2ca9626a00e909e5add07
SHA256118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d
SHA512cb33e7c884c79d593ad5e6ad9324831a39270581d41f7ec8d14eaf04a38796df20f3bcc5caf9ff750cd33588697445c3440828bb269d9e7f8947c39fbcb4105a
-
C:\Windows\SysWOW64\igfxdwx32.exeFilesize
339KB
MD57b510ac6a2a91e5ee5ede16619e4f73b
SHA104ed62ed049e305459d2ca9626a00e909e5add07
SHA256118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d
SHA512cb33e7c884c79d593ad5e6ad9324831a39270581d41f7ec8d14eaf04a38796df20f3bcc5caf9ff750cd33588697445c3440828bb269d9e7f8947c39fbcb4105a
-
C:\Windows\SysWOW64\igfxdwx32.exeFilesize
339KB
MD57b510ac6a2a91e5ee5ede16619e4f73b
SHA104ed62ed049e305459d2ca9626a00e909e5add07
SHA256118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d
SHA512cb33e7c884c79d593ad5e6ad9324831a39270581d41f7ec8d14eaf04a38796df20f3bcc5caf9ff750cd33588697445c3440828bb269d9e7f8947c39fbcb4105a
-
C:\Windows\SysWOW64\igfxdwx32.exeFilesize
339KB
MD57b510ac6a2a91e5ee5ede16619e4f73b
SHA104ed62ed049e305459d2ca9626a00e909e5add07
SHA256118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d
SHA512cb33e7c884c79d593ad5e6ad9324831a39270581d41f7ec8d14eaf04a38796df20f3bcc5caf9ff750cd33588697445c3440828bb269d9e7f8947c39fbcb4105a
-
C:\Windows\SysWOW64\igfxdwx32.exeFilesize
339KB
MD57b510ac6a2a91e5ee5ede16619e4f73b
SHA104ed62ed049e305459d2ca9626a00e909e5add07
SHA256118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d
SHA512cb33e7c884c79d593ad5e6ad9324831a39270581d41f7ec8d14eaf04a38796df20f3bcc5caf9ff750cd33588697445c3440828bb269d9e7f8947c39fbcb4105a
-
C:\Windows\SysWOW64\igfxdwx32.exeFilesize
339KB
MD57b510ac6a2a91e5ee5ede16619e4f73b
SHA104ed62ed049e305459d2ca9626a00e909e5add07
SHA256118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d
SHA512cb33e7c884c79d593ad5e6ad9324831a39270581d41f7ec8d14eaf04a38796df20f3bcc5caf9ff750cd33588697445c3440828bb269d9e7f8947c39fbcb4105a
-
C:\Windows\SysWOW64\igfxdwx32.exeFilesize
339KB
MD57b510ac6a2a91e5ee5ede16619e4f73b
SHA104ed62ed049e305459d2ca9626a00e909e5add07
SHA256118be799dbd2f451b4b84584600de318047f1ae26e6585f146067584e344df5d
SHA512cb33e7c884c79d593ad5e6ad9324831a39270581d41f7ec8d14eaf04a38796df20f3bcc5caf9ff750cd33588697445c3440828bb269d9e7f8947c39fbcb4105a
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/204-351-0x0000000000000000-mapping.dmp
-
memory/816-207-0x0000000000000000-mapping.dmp
-
memory/816-211-0x0000000000400000-0x000000000048F000-memory.dmpFilesize
572KB
-
memory/816-212-0x0000000000670000-0x0000000000674000-memory.dmpFilesize
16KB
-
memory/816-216-0x0000000000400000-0x000000000048F000-memory.dmpFilesize
572KB
-
memory/820-366-0x0000000000000000-mapping.dmp
-
memory/920-274-0x0000000000000000-mapping.dmp
-
memory/1032-335-0x0000000000000000-mapping.dmp
-
memory/1120-247-0x0000000000400000-0x000000000048F000-memory.dmpFilesize
572KB
-
memory/1120-238-0x0000000000000000-mapping.dmp
-
memory/1120-242-0x0000000000400000-0x000000000048F000-memory.dmpFilesize
572KB
-
memory/1120-243-0x0000000002280000-0x0000000002284000-memory.dmpFilesize
16KB
-
memory/1488-163-0x0000000000400000-0x000000000048F000-memory.dmpFilesize
572KB
-
memory/1488-159-0x0000000000000000-mapping.dmp
-
memory/1488-164-0x0000000000500000-0x0000000000504000-memory.dmpFilesize
16KB
-
memory/1488-168-0x0000000000400000-0x000000000048F000-memory.dmpFilesize
572KB
-
memory/1500-152-0x0000000000550000-0x0000000000554000-memory.dmpFilesize
16KB
-
memory/1500-151-0x0000000000400000-0x000000000048F000-memory.dmpFilesize
572KB
-
memory/1500-147-0x0000000000000000-mapping.dmp
-
memory/1500-155-0x0000000000400000-0x000000000048F000-memory.dmpFilesize
572KB
-
memory/1672-194-0x0000000000610000-0x0000000000614000-memory.dmpFilesize
16KB
-
memory/1672-189-0x0000000000000000-mapping.dmp
-
memory/1672-198-0x0000000000400000-0x000000000048F000-memory.dmpFilesize
572KB
-
memory/1672-193-0x0000000000400000-0x000000000048F000-memory.dmpFilesize
572KB
-
memory/1800-249-0x0000000000400000-0x000000000048F000-memory.dmpFilesize
572KB
-
memory/1800-253-0x0000000000400000-0x000000000048F000-memory.dmpFilesize
572KB
-
memory/1800-244-0x0000000000000000-mapping.dmp
-
memory/1800-248-0x0000000000660000-0x0000000000664000-memory.dmpFilesize
16KB
-
memory/1860-256-0x0000000000000000-mapping.dmp
-
memory/1888-138-0x0000000000560000-0x0000000000564000-memory.dmpFilesize
16KB
-
memory/1888-132-0x0000000000560000-0x0000000000564000-memory.dmpFilesize
16KB
-
memory/1888-131-0x0000000000400000-0x000000000048F000-memory.dmpFilesize
572KB
-
memory/1888-137-0x0000000000400000-0x000000000048F000-memory.dmpFilesize
572KB
-
memory/1888-130-0x0000000000400000-0x000000000048F000-memory.dmpFilesize
572KB
-
memory/1892-371-0x0000000000000000-mapping.dmp
-
memory/2032-217-0x0000000000400000-0x000000000048F000-memory.dmpFilesize
572KB
-
memory/2032-213-0x0000000000000000-mapping.dmp
-
memory/2032-218-0x00000000005D0000-0x00000000005D4000-memory.dmpFilesize
16KB
-
memory/2032-222-0x0000000000400000-0x000000000048F000-memory.dmpFilesize
572KB
-
memory/2300-323-0x0000000000000000-mapping.dmp
-
memory/2324-316-0x0000000000000000-mapping.dmp
-
memory/2328-286-0x0000000000000000-mapping.dmp
-
memory/2452-234-0x0000000000400000-0x000000000048F000-memory.dmpFilesize
572KB
-
memory/2452-225-0x0000000000000000-mapping.dmp
-
memory/2452-230-0x0000000000500000-0x0000000000504000-memory.dmpFilesize
16KB
-
memory/2452-229-0x0000000000400000-0x000000000048F000-memory.dmpFilesize
572KB
-
memory/2456-292-0x0000000000000000-mapping.dmp
-
memory/2508-170-0x00000000006E0000-0x00000000006E4000-memory.dmpFilesize
16KB
-
memory/2508-165-0x0000000000000000-mapping.dmp
-
memory/2508-174-0x0000000000400000-0x000000000048F000-memory.dmpFilesize
572KB
-
memory/2508-169-0x0000000000400000-0x000000000048F000-memory.dmpFilesize
572KB
-
memory/2556-361-0x0000000000000000-mapping.dmp
-
memory/3136-356-0x0000000000000000-mapping.dmp
-
memory/3360-146-0x00000000006E0000-0x00000000006E4000-memory.dmpFilesize
16KB
-
memory/3360-150-0x0000000000400000-0x000000000048F000-memory.dmpFilesize
572KB
-
memory/3360-145-0x0000000000400000-0x000000000048F000-memory.dmpFilesize
572KB
-
memory/3360-141-0x0000000000000000-mapping.dmp
-
memory/3820-177-0x0000000000000000-mapping.dmp
-
memory/3820-186-0x0000000000400000-0x000000000048F000-memory.dmpFilesize
572KB
-
memory/3820-182-0x0000000000610000-0x0000000000614000-memory.dmpFilesize
16KB
-
memory/3820-181-0x0000000000400000-0x000000000048F000-memory.dmpFilesize
572KB
-
memory/3992-298-0x0000000000000000-mapping.dmp
-
memory/4084-219-0x0000000000000000-mapping.dmp
-
memory/4084-228-0x0000000000400000-0x000000000048F000-memory.dmpFilesize
572KB
-
memory/4084-223-0x0000000000400000-0x000000000048F000-memory.dmpFilesize
572KB
-
memory/4084-224-0x0000000000620000-0x0000000000624000-memory.dmpFilesize
16KB
-
memory/4136-268-0x0000000000000000-mapping.dmp
-
memory/4148-140-0x00000000006A0000-0x00000000006A4000-memory.dmpFilesize
16KB
-
memory/4148-144-0x0000000000400000-0x000000000048F000-memory.dmpFilesize
572KB
-
memory/4148-133-0x0000000000000000-mapping.dmp
-
memory/4148-139-0x0000000000400000-0x000000000048F000-memory.dmpFilesize
572KB
-
memory/4408-262-0x0000000000000000-mapping.dmp
-
memory/4476-259-0x0000000000400000-0x000000000048F000-memory.dmpFilesize
572KB
-
memory/4476-250-0x0000000000000000-mapping.dmp
-
memory/4476-255-0x00000000005E0000-0x00000000005E4000-memory.dmpFilesize
16KB
-
memory/4476-254-0x0000000000400000-0x000000000048F000-memory.dmpFilesize
572KB
-
memory/4480-340-0x0000000000000000-mapping.dmp
-
memory/4496-345-0x0000000000000000-mapping.dmp
-
memory/4500-241-0x0000000000400000-0x000000000048F000-memory.dmpFilesize
572KB
-
memory/4500-236-0x0000000000400000-0x000000000048F000-memory.dmpFilesize
572KB
-
memory/4500-235-0x0000000002D10000-0x0000000002D14000-memory.dmpFilesize
16KB
-
memory/4500-231-0x0000000000000000-mapping.dmp
-
memory/4568-310-0x0000000000000000-mapping.dmp
-
memory/4648-199-0x0000000000400000-0x000000000048F000-memory.dmpFilesize
572KB
-
memory/4648-195-0x0000000000000000-mapping.dmp
-
memory/4648-204-0x0000000000400000-0x000000000048F000-memory.dmpFilesize
572KB
-
memory/4648-200-0x0000000000540000-0x0000000000544000-memory.dmpFilesize
16KB
-
memory/4736-183-0x0000000000000000-mapping.dmp
-
memory/4736-187-0x0000000000400000-0x000000000048F000-memory.dmpFilesize
572KB
-
memory/4736-192-0x0000000000400000-0x000000000048F000-memory.dmpFilesize
572KB
-
memory/4736-188-0x00000000005E0000-0x00000000005E4000-memory.dmpFilesize
16KB
-
memory/4740-153-0x0000000000000000-mapping.dmp
-
memory/4740-158-0x0000000000820000-0x0000000000824000-memory.dmpFilesize
16KB
-
memory/4740-162-0x0000000000400000-0x000000000048F000-memory.dmpFilesize
572KB
-
memory/4740-157-0x0000000000400000-0x000000000048F000-memory.dmpFilesize
572KB
-
memory/4804-171-0x0000000000000000-mapping.dmp
-
memory/4804-176-0x0000000000770000-0x0000000000774000-memory.dmpFilesize
16KB
-
memory/4804-180-0x0000000000400000-0x000000000048F000-memory.dmpFilesize
572KB
-
memory/4804-175-0x0000000000400000-0x000000000048F000-memory.dmpFilesize
572KB
-
memory/4816-280-0x0000000000000000-mapping.dmp
-
memory/4816-376-0x0000000000000000-mapping.dmp
-
memory/4924-329-0x0000000000000000-mapping.dmp
-
memory/4928-304-0x0000000000000000-mapping.dmp
-
memory/5060-201-0x0000000000000000-mapping.dmp
-
memory/5060-205-0x0000000000400000-0x000000000048F000-memory.dmpFilesize
572KB
-
memory/5060-206-0x00000000005D0000-0x00000000005D4000-memory.dmpFilesize
16KB
-
memory/5060-209-0x0000000000400000-0x000000000048F000-memory.dmpFilesize
572KB