Analysis
-
max time kernel
150s -
max time network
65s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
07-06-2022 18:30
Static task
static1
Behavioral task
behavioral1
Sample
1b845b30483d9a3fa395d610f3f458b90134f8d461657ac97d68fa5cb8df06c7.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
1b845b30483d9a3fa395d610f3f458b90134f8d461657ac97d68fa5cb8df06c7.exe
Resource
win10v2004-20220414-en
General
-
Target
1b845b30483d9a3fa395d610f3f458b90134f8d461657ac97d68fa5cb8df06c7.exe
-
Size
297KB
-
MD5
5303cb67747f5acf1f784b3722946037
-
SHA1
bf6fe9cbae47d4ce27fc5012897b95a0bda2cd1a
-
SHA256
1b845b30483d9a3fa395d610f3f458b90134f8d461657ac97d68fa5cb8df06c7
-
SHA512
5eea1c89d1bb2655ee84d283260c4b808b21e04094b9a599a425f147da67d41db8232de6423df888fbc892e24625e7ef39d814b72d15d5401182583ed5ac3aa1
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Executes dropped EXE 12 IoCs
Processes:
igfxper32.exeigfxper32.exeigfxper32.exeigfxper32.exeigfxper32.exeigfxper32.exeigfxper32.exeigfxper32.exeigfxper32.exeigfxper32.exeigfxper32.exeigfxper32.exepid process 1944 igfxper32.exe 2032 igfxper32.exe 768 igfxper32.exe 1008 igfxper32.exe 1736 igfxper32.exe 1120 igfxper32.exe 624 igfxper32.exe 1436 igfxper32.exe 1524 igfxper32.exe 1932 igfxper32.exe 1252 igfxper32.exe 668 igfxper32.exe -
Processes:
resource yara_rule behavioral1/memory/632-55-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/632-56-0x0000000000400000-0x00000000004A0000-memory.dmp upx \Windows\SysWOW64\igfxper32.exe upx \Windows\SysWOW64\igfxper32.exe upx C:\Windows\SysWOW64\igfxper32.exe upx behavioral1/memory/632-62-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1944-63-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1944-64-0x0000000000400000-0x00000000004A0000-memory.dmp upx C:\Windows\SysWOW64\igfxper32.exe upx \Windows\SysWOW64\igfxper32.exe upx \Windows\SysWOW64\igfxper32.exe upx C:\Windows\SysWOW64\igfxper32.exe upx behavioral1/memory/1944-71-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2032-72-0x0000000000400000-0x00000000004A0000-memory.dmp upx \Windows\SysWOW64\igfxper32.exe upx \Windows\SysWOW64\igfxper32.exe upx C:\Windows\SysWOW64\igfxper32.exe upx behavioral1/memory/2032-78-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/768-79-0x0000000000400000-0x00000000004A0000-memory.dmp upx \Windows\SysWOW64\igfxper32.exe upx \Windows\SysWOW64\igfxper32.exe upx behavioral1/memory/768-85-0x0000000000400000-0x00000000004A0000-memory.dmp upx C:\Windows\SysWOW64\igfxper32.exe upx behavioral1/memory/1008-86-0x0000000000400000-0x00000000004A0000-memory.dmp upx \Windows\SysWOW64\igfxper32.exe upx \Windows\SysWOW64\igfxper32.exe upx C:\Windows\SysWOW64\igfxper32.exe upx behavioral1/memory/1008-92-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1736-93-0x0000000000400000-0x00000000004A0000-memory.dmp upx \Windows\SysWOW64\igfxper32.exe upx \Windows\SysWOW64\igfxper32.exe upx behavioral1/memory/1736-99-0x0000000000400000-0x00000000004A0000-memory.dmp upx C:\Windows\SysWOW64\igfxper32.exe upx behavioral1/memory/1120-101-0x0000000000400000-0x00000000004A0000-memory.dmp upx \Windows\SysWOW64\igfxper32.exe upx C:\Windows\SysWOW64\igfxper32.exe upx behavioral1/memory/1120-106-0x0000000000400000-0x00000000004A0000-memory.dmp upx \Windows\SysWOW64\igfxper32.exe upx behavioral1/memory/624-108-0x0000000000400000-0x00000000004A0000-memory.dmp upx \Windows\SysWOW64\igfxper32.exe upx \Windows\SysWOW64\igfxper32.exe upx C:\Windows\SysWOW64\igfxper32.exe upx behavioral1/memory/624-114-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1436-115-0x0000000000400000-0x00000000004A0000-memory.dmp upx \Windows\SysWOW64\igfxper32.exe upx \Windows\SysWOW64\igfxper32.exe upx behavioral1/memory/1436-118-0x0000000004470000-0x0000000004510000-memory.dmp upx C:\Windows\SysWOW64\igfxper32.exe upx behavioral1/memory/1436-123-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1524-124-0x0000000000400000-0x00000000004A0000-memory.dmp upx \Windows\SysWOW64\igfxper32.exe upx \Windows\SysWOW64\igfxper32.exe upx C:\Windows\SysWOW64\igfxper32.exe upx behavioral1/memory/1524-130-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1932-131-0x0000000000400000-0x00000000004A0000-memory.dmp upx \Windows\SysWOW64\igfxper32.exe upx \Windows\SysWOW64\igfxper32.exe upx C:\Windows\SysWOW64\igfxper32.exe upx behavioral1/memory/1932-138-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1252-139-0x0000000000400000-0x00000000004A0000-memory.dmp upx \Windows\SysWOW64\igfxper32.exe upx \Windows\SysWOW64\igfxper32.exe upx C:\Windows\SysWOW64\igfxper32.exe upx behavioral1/memory/1252-144-0x0000000000400000-0x00000000004A0000-memory.dmp upx -
Deletes itself 1 IoCs
Processes:
igfxper32.exepid process 1944 igfxper32.exe -
Loads dropped DLL 24 IoCs
Processes:
1b845b30483d9a3fa395d610f3f458b90134f8d461657ac97d68fa5cb8df06c7.exeigfxper32.exeigfxper32.exeigfxper32.exeigfxper32.exeigfxper32.exeigfxper32.exeigfxper32.exeigfxper32.exeigfxper32.exeigfxper32.exeigfxper32.exepid process 632 1b845b30483d9a3fa395d610f3f458b90134f8d461657ac97d68fa5cb8df06c7.exe 632 1b845b30483d9a3fa395d610f3f458b90134f8d461657ac97d68fa5cb8df06c7.exe 1944 igfxper32.exe 1944 igfxper32.exe 2032 igfxper32.exe 2032 igfxper32.exe 768 igfxper32.exe 768 igfxper32.exe 1008 igfxper32.exe 1008 igfxper32.exe 1736 igfxper32.exe 1736 igfxper32.exe 1120 igfxper32.exe 1120 igfxper32.exe 624 igfxper32.exe 624 igfxper32.exe 1436 igfxper32.exe 1436 igfxper32.exe 1524 igfxper32.exe 1524 igfxper32.exe 1932 igfxper32.exe 1932 igfxper32.exe 1252 igfxper32.exe 1252 igfxper32.exe -
Maps connected drives based on registry 3 TTPs 26 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
igfxper32.exeigfxper32.exeigfxper32.exeigfxper32.exe1b845b30483d9a3fa395d610f3f458b90134f8d461657ac97d68fa5cb8df06c7.exeigfxper32.exeigfxper32.exeigfxper32.exeigfxper32.exeigfxper32.exeigfxper32.exeigfxper32.exeigfxper32.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxper32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxper32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxper32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxper32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 1b845b30483d9a3fa395d610f3f458b90134f8d461657ac97d68fa5cb8df06c7.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxper32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxper32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxper32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxper32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxper32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxper32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxper32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxper32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxper32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxper32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxper32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxper32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxper32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxper32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxper32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxper32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxper32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 1b845b30483d9a3fa395d610f3f458b90134f8d461657ac97d68fa5cb8df06c7.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxper32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxper32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxper32.exe -
Drops file in System32 directory 36 IoCs
Processes:
igfxper32.exeigfxper32.exeigfxper32.exeigfxper32.exeigfxper32.exeigfxper32.exeigfxper32.exeigfxper32.exeigfxper32.exeigfxper32.exeigfxper32.exe1b845b30483d9a3fa395d610f3f458b90134f8d461657ac97d68fa5cb8df06c7.exedescription ioc process File created C:\Windows\SysWOW64\igfxper32.exe igfxper32.exe File opened for modification C:\Windows\SysWOW64\ igfxper32.exe File opened for modification C:\Windows\SysWOW64\igfxper32.exe igfxper32.exe File opened for modification C:\Windows\SysWOW64\ igfxper32.exe File opened for modification C:\Windows\SysWOW64\igfxper32.exe igfxper32.exe File created C:\Windows\SysWOW64\igfxper32.exe igfxper32.exe File created C:\Windows\SysWOW64\igfxper32.exe igfxper32.exe File opened for modification C:\Windows\SysWOW64\ igfxper32.exe File opened for modification C:\Windows\SysWOW64\ igfxper32.exe File created C:\Windows\SysWOW64\igfxper32.exe igfxper32.exe File opened for modification C:\Windows\SysWOW64\ igfxper32.exe File opened for modification C:\Windows\SysWOW64\ igfxper32.exe File opened for modification C:\Windows\SysWOW64\ igfxper32.exe File created C:\Windows\SysWOW64\igfxper32.exe igfxper32.exe File created C:\Windows\SysWOW64\igfxper32.exe igfxper32.exe File opened for modification C:\Windows\SysWOW64\igfxper32.exe 1b845b30483d9a3fa395d610f3f458b90134f8d461657ac97d68fa5cb8df06c7.exe File created C:\Windows\SysWOW64\igfxper32.exe igfxper32.exe File opened for modification C:\Windows\SysWOW64\igfxper32.exe igfxper32.exe File opened for modification C:\Windows\SysWOW64\ igfxper32.exe File opened for modification C:\Windows\SysWOW64\igfxper32.exe igfxper32.exe File opened for modification C:\Windows\SysWOW64\igfxper32.exe igfxper32.exe File opened for modification C:\Windows\SysWOW64\igfxper32.exe igfxper32.exe File opened for modification C:\Windows\SysWOW64\ igfxper32.exe File opened for modification C:\Windows\SysWOW64\ igfxper32.exe File created C:\Windows\SysWOW64\igfxper32.exe igfxper32.exe File opened for modification C:\Windows\SysWOW64\igfxper32.exe igfxper32.exe File opened for modification C:\Windows\SysWOW64\ 1b845b30483d9a3fa395d610f3f458b90134f8d461657ac97d68fa5cb8df06c7.exe File opened for modification C:\Windows\SysWOW64\igfxper32.exe igfxper32.exe File opened for modification C:\Windows\SysWOW64\ igfxper32.exe File opened for modification C:\Windows\SysWOW64\igfxper32.exe igfxper32.exe File opened for modification C:\Windows\SysWOW64\igfxper32.exe igfxper32.exe File opened for modification C:\Windows\SysWOW64\igfxper32.exe igfxper32.exe File created C:\Windows\SysWOW64\igfxper32.exe igfxper32.exe File created C:\Windows\SysWOW64\igfxper32.exe igfxper32.exe File created C:\Windows\SysWOW64\igfxper32.exe 1b845b30483d9a3fa395d610f3f458b90134f8d461657ac97d68fa5cb8df06c7.exe File created C:\Windows\SysWOW64\igfxper32.exe igfxper32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
1b845b30483d9a3fa395d610f3f458b90134f8d461657ac97d68fa5cb8df06c7.exeigfxper32.exeigfxper32.exeigfxper32.exeigfxper32.exeigfxper32.exeigfxper32.exeigfxper32.exeigfxper32.exeigfxper32.exeigfxper32.exeigfxper32.exeigfxper32.exepid process 632 1b845b30483d9a3fa395d610f3f458b90134f8d461657ac97d68fa5cb8df06c7.exe 1944 igfxper32.exe 2032 igfxper32.exe 768 igfxper32.exe 1008 igfxper32.exe 1736 igfxper32.exe 1120 igfxper32.exe 624 igfxper32.exe 1436 igfxper32.exe 1524 igfxper32.exe 1932 igfxper32.exe 1252 igfxper32.exe 668 igfxper32.exe -
Suspicious use of WriteProcessMemory 48 IoCs
Processes:
1b845b30483d9a3fa395d610f3f458b90134f8d461657ac97d68fa5cb8df06c7.exeigfxper32.exeigfxper32.exeigfxper32.exeigfxper32.exeigfxper32.exeigfxper32.exeigfxper32.exeigfxper32.exeigfxper32.exeigfxper32.exeigfxper32.exedescription pid process target process PID 632 wrote to memory of 1944 632 1b845b30483d9a3fa395d610f3f458b90134f8d461657ac97d68fa5cb8df06c7.exe igfxper32.exe PID 632 wrote to memory of 1944 632 1b845b30483d9a3fa395d610f3f458b90134f8d461657ac97d68fa5cb8df06c7.exe igfxper32.exe PID 632 wrote to memory of 1944 632 1b845b30483d9a3fa395d610f3f458b90134f8d461657ac97d68fa5cb8df06c7.exe igfxper32.exe PID 632 wrote to memory of 1944 632 1b845b30483d9a3fa395d610f3f458b90134f8d461657ac97d68fa5cb8df06c7.exe igfxper32.exe PID 1944 wrote to memory of 2032 1944 igfxper32.exe igfxper32.exe PID 1944 wrote to memory of 2032 1944 igfxper32.exe igfxper32.exe PID 1944 wrote to memory of 2032 1944 igfxper32.exe igfxper32.exe PID 1944 wrote to memory of 2032 1944 igfxper32.exe igfxper32.exe PID 2032 wrote to memory of 768 2032 igfxper32.exe igfxper32.exe PID 2032 wrote to memory of 768 2032 igfxper32.exe igfxper32.exe PID 2032 wrote to memory of 768 2032 igfxper32.exe igfxper32.exe PID 2032 wrote to memory of 768 2032 igfxper32.exe igfxper32.exe PID 768 wrote to memory of 1008 768 igfxper32.exe igfxper32.exe PID 768 wrote to memory of 1008 768 igfxper32.exe igfxper32.exe PID 768 wrote to memory of 1008 768 igfxper32.exe igfxper32.exe PID 768 wrote to memory of 1008 768 igfxper32.exe igfxper32.exe PID 1008 wrote to memory of 1736 1008 igfxper32.exe igfxper32.exe PID 1008 wrote to memory of 1736 1008 igfxper32.exe igfxper32.exe PID 1008 wrote to memory of 1736 1008 igfxper32.exe igfxper32.exe PID 1008 wrote to memory of 1736 1008 igfxper32.exe igfxper32.exe PID 1736 wrote to memory of 1120 1736 igfxper32.exe igfxper32.exe PID 1736 wrote to memory of 1120 1736 igfxper32.exe igfxper32.exe PID 1736 wrote to memory of 1120 1736 igfxper32.exe igfxper32.exe PID 1736 wrote to memory of 1120 1736 igfxper32.exe igfxper32.exe PID 1120 wrote to memory of 624 1120 igfxper32.exe igfxper32.exe PID 1120 wrote to memory of 624 1120 igfxper32.exe igfxper32.exe PID 1120 wrote to memory of 624 1120 igfxper32.exe igfxper32.exe PID 1120 wrote to memory of 624 1120 igfxper32.exe igfxper32.exe PID 624 wrote to memory of 1436 624 igfxper32.exe igfxper32.exe PID 624 wrote to memory of 1436 624 igfxper32.exe igfxper32.exe PID 624 wrote to memory of 1436 624 igfxper32.exe igfxper32.exe PID 624 wrote to memory of 1436 624 igfxper32.exe igfxper32.exe PID 1436 wrote to memory of 1524 1436 igfxper32.exe igfxper32.exe PID 1436 wrote to memory of 1524 1436 igfxper32.exe igfxper32.exe PID 1436 wrote to memory of 1524 1436 igfxper32.exe igfxper32.exe PID 1436 wrote to memory of 1524 1436 igfxper32.exe igfxper32.exe PID 1524 wrote to memory of 1932 1524 igfxper32.exe igfxper32.exe PID 1524 wrote to memory of 1932 1524 igfxper32.exe igfxper32.exe PID 1524 wrote to memory of 1932 1524 igfxper32.exe igfxper32.exe PID 1524 wrote to memory of 1932 1524 igfxper32.exe igfxper32.exe PID 1932 wrote to memory of 1252 1932 igfxper32.exe igfxper32.exe PID 1932 wrote to memory of 1252 1932 igfxper32.exe igfxper32.exe PID 1932 wrote to memory of 1252 1932 igfxper32.exe igfxper32.exe PID 1932 wrote to memory of 1252 1932 igfxper32.exe igfxper32.exe PID 1252 wrote to memory of 668 1252 igfxper32.exe igfxper32.exe PID 1252 wrote to memory of 668 1252 igfxper32.exe igfxper32.exe PID 1252 wrote to memory of 668 1252 igfxper32.exe igfxper32.exe PID 1252 wrote to memory of 668 1252 igfxper32.exe igfxper32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1b845b30483d9a3fa395d610f3f458b90134f8d461657ac97d68fa5cb8df06c7.exe"C:\Users\Admin\AppData\Local\Temp\1b845b30483d9a3fa395d610f3f458b90134f8d461657ac97d68fa5cb8df06c7.exe"1⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxper32.exe"C:\Windows\system32\igfxper32.exe" C:\Users\Admin\AppData\Local\Temp\1B845B~1.EXE2⤵
- Executes dropped EXE
- Deletes itself
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxper32.exe"C:\Windows\system32\igfxper32.exe" C:\Windows\SysWOW64\IGFXPE~1.EXE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxper32.exe"C:\Windows\system32\igfxper32.exe" C:\Windows\SysWOW64\IGFXPE~1.EXE4⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxper32.exe"C:\Windows\system32\igfxper32.exe" C:\Windows\SysWOW64\IGFXPE~1.EXE5⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxper32.exe"C:\Windows\system32\igfxper32.exe" C:\Windows\SysWOW64\IGFXPE~1.EXE6⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxper32.exe"C:\Windows\system32\igfxper32.exe" C:\Windows\SysWOW64\IGFXPE~1.EXE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxper32.exe"C:\Windows\system32\igfxper32.exe" C:\Windows\SysWOW64\IGFXPE~1.EXE8⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxper32.exe"C:\Windows\system32\igfxper32.exe" C:\Windows\SysWOW64\IGFXPE~1.EXE9⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxper32.exe"C:\Windows\system32\igfxper32.exe" C:\Windows\SysWOW64\IGFXPE~1.EXE10⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxper32.exe"C:\Windows\system32\igfxper32.exe" C:\Windows\SysWOW64\IGFXPE~1.EXE11⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxper32.exe"C:\Windows\system32\igfxper32.exe" C:\Windows\SysWOW64\IGFXPE~1.EXE12⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxper32.exe"C:\Windows\system32\igfxper32.exe" C:\Windows\SysWOW64\IGFXPE~1.EXE13⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\igfxper32.exeFilesize
297KB
MD55303cb67747f5acf1f784b3722946037
SHA1bf6fe9cbae47d4ce27fc5012897b95a0bda2cd1a
SHA2561b845b30483d9a3fa395d610f3f458b90134f8d461657ac97d68fa5cb8df06c7
SHA5125eea1c89d1bb2655ee84d283260c4b808b21e04094b9a599a425f147da67d41db8232de6423df888fbc892e24625e7ef39d814b72d15d5401182583ed5ac3aa1
-
C:\Windows\SysWOW64\igfxper32.exeFilesize
297KB
MD55303cb67747f5acf1f784b3722946037
SHA1bf6fe9cbae47d4ce27fc5012897b95a0bda2cd1a
SHA2561b845b30483d9a3fa395d610f3f458b90134f8d461657ac97d68fa5cb8df06c7
SHA5125eea1c89d1bb2655ee84d283260c4b808b21e04094b9a599a425f147da67d41db8232de6423df888fbc892e24625e7ef39d814b72d15d5401182583ed5ac3aa1
-
C:\Windows\SysWOW64\igfxper32.exeFilesize
297KB
MD55303cb67747f5acf1f784b3722946037
SHA1bf6fe9cbae47d4ce27fc5012897b95a0bda2cd1a
SHA2561b845b30483d9a3fa395d610f3f458b90134f8d461657ac97d68fa5cb8df06c7
SHA5125eea1c89d1bb2655ee84d283260c4b808b21e04094b9a599a425f147da67d41db8232de6423df888fbc892e24625e7ef39d814b72d15d5401182583ed5ac3aa1
-
C:\Windows\SysWOW64\igfxper32.exeFilesize
297KB
MD55303cb67747f5acf1f784b3722946037
SHA1bf6fe9cbae47d4ce27fc5012897b95a0bda2cd1a
SHA2561b845b30483d9a3fa395d610f3f458b90134f8d461657ac97d68fa5cb8df06c7
SHA5125eea1c89d1bb2655ee84d283260c4b808b21e04094b9a599a425f147da67d41db8232de6423df888fbc892e24625e7ef39d814b72d15d5401182583ed5ac3aa1
-
C:\Windows\SysWOW64\igfxper32.exeFilesize
297KB
MD55303cb67747f5acf1f784b3722946037
SHA1bf6fe9cbae47d4ce27fc5012897b95a0bda2cd1a
SHA2561b845b30483d9a3fa395d610f3f458b90134f8d461657ac97d68fa5cb8df06c7
SHA5125eea1c89d1bb2655ee84d283260c4b808b21e04094b9a599a425f147da67d41db8232de6423df888fbc892e24625e7ef39d814b72d15d5401182583ed5ac3aa1
-
C:\Windows\SysWOW64\igfxper32.exeFilesize
297KB
MD55303cb67747f5acf1f784b3722946037
SHA1bf6fe9cbae47d4ce27fc5012897b95a0bda2cd1a
SHA2561b845b30483d9a3fa395d610f3f458b90134f8d461657ac97d68fa5cb8df06c7
SHA5125eea1c89d1bb2655ee84d283260c4b808b21e04094b9a599a425f147da67d41db8232de6423df888fbc892e24625e7ef39d814b72d15d5401182583ed5ac3aa1
-
C:\Windows\SysWOW64\igfxper32.exeFilesize
297KB
MD55303cb67747f5acf1f784b3722946037
SHA1bf6fe9cbae47d4ce27fc5012897b95a0bda2cd1a
SHA2561b845b30483d9a3fa395d610f3f458b90134f8d461657ac97d68fa5cb8df06c7
SHA5125eea1c89d1bb2655ee84d283260c4b808b21e04094b9a599a425f147da67d41db8232de6423df888fbc892e24625e7ef39d814b72d15d5401182583ed5ac3aa1
-
C:\Windows\SysWOW64\igfxper32.exeFilesize
297KB
MD55303cb67747f5acf1f784b3722946037
SHA1bf6fe9cbae47d4ce27fc5012897b95a0bda2cd1a
SHA2561b845b30483d9a3fa395d610f3f458b90134f8d461657ac97d68fa5cb8df06c7
SHA5125eea1c89d1bb2655ee84d283260c4b808b21e04094b9a599a425f147da67d41db8232de6423df888fbc892e24625e7ef39d814b72d15d5401182583ed5ac3aa1
-
C:\Windows\SysWOW64\igfxper32.exeFilesize
297KB
MD55303cb67747f5acf1f784b3722946037
SHA1bf6fe9cbae47d4ce27fc5012897b95a0bda2cd1a
SHA2561b845b30483d9a3fa395d610f3f458b90134f8d461657ac97d68fa5cb8df06c7
SHA5125eea1c89d1bb2655ee84d283260c4b808b21e04094b9a599a425f147da67d41db8232de6423df888fbc892e24625e7ef39d814b72d15d5401182583ed5ac3aa1
-
C:\Windows\SysWOW64\igfxper32.exeFilesize
297KB
MD55303cb67747f5acf1f784b3722946037
SHA1bf6fe9cbae47d4ce27fc5012897b95a0bda2cd1a
SHA2561b845b30483d9a3fa395d610f3f458b90134f8d461657ac97d68fa5cb8df06c7
SHA5125eea1c89d1bb2655ee84d283260c4b808b21e04094b9a599a425f147da67d41db8232de6423df888fbc892e24625e7ef39d814b72d15d5401182583ed5ac3aa1
-
C:\Windows\SysWOW64\igfxper32.exeFilesize
297KB
MD55303cb67747f5acf1f784b3722946037
SHA1bf6fe9cbae47d4ce27fc5012897b95a0bda2cd1a
SHA2561b845b30483d9a3fa395d610f3f458b90134f8d461657ac97d68fa5cb8df06c7
SHA5125eea1c89d1bb2655ee84d283260c4b808b21e04094b9a599a425f147da67d41db8232de6423df888fbc892e24625e7ef39d814b72d15d5401182583ed5ac3aa1
-
C:\Windows\SysWOW64\igfxper32.exeFilesize
297KB
MD55303cb67747f5acf1f784b3722946037
SHA1bf6fe9cbae47d4ce27fc5012897b95a0bda2cd1a
SHA2561b845b30483d9a3fa395d610f3f458b90134f8d461657ac97d68fa5cb8df06c7
SHA5125eea1c89d1bb2655ee84d283260c4b808b21e04094b9a599a425f147da67d41db8232de6423df888fbc892e24625e7ef39d814b72d15d5401182583ed5ac3aa1
-
C:\Windows\SysWOW64\igfxper32.exeFilesize
297KB
MD55303cb67747f5acf1f784b3722946037
SHA1bf6fe9cbae47d4ce27fc5012897b95a0bda2cd1a
SHA2561b845b30483d9a3fa395d610f3f458b90134f8d461657ac97d68fa5cb8df06c7
SHA5125eea1c89d1bb2655ee84d283260c4b808b21e04094b9a599a425f147da67d41db8232de6423df888fbc892e24625e7ef39d814b72d15d5401182583ed5ac3aa1
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\Windows\SysWOW64\igfxper32.exeFilesize
297KB
MD55303cb67747f5acf1f784b3722946037
SHA1bf6fe9cbae47d4ce27fc5012897b95a0bda2cd1a
SHA2561b845b30483d9a3fa395d610f3f458b90134f8d461657ac97d68fa5cb8df06c7
SHA5125eea1c89d1bb2655ee84d283260c4b808b21e04094b9a599a425f147da67d41db8232de6423df888fbc892e24625e7ef39d814b72d15d5401182583ed5ac3aa1
-
\Windows\SysWOW64\igfxper32.exeFilesize
297KB
MD55303cb67747f5acf1f784b3722946037
SHA1bf6fe9cbae47d4ce27fc5012897b95a0bda2cd1a
SHA2561b845b30483d9a3fa395d610f3f458b90134f8d461657ac97d68fa5cb8df06c7
SHA5125eea1c89d1bb2655ee84d283260c4b808b21e04094b9a599a425f147da67d41db8232de6423df888fbc892e24625e7ef39d814b72d15d5401182583ed5ac3aa1
-
\Windows\SysWOW64\igfxper32.exeFilesize
297KB
MD55303cb67747f5acf1f784b3722946037
SHA1bf6fe9cbae47d4ce27fc5012897b95a0bda2cd1a
SHA2561b845b30483d9a3fa395d610f3f458b90134f8d461657ac97d68fa5cb8df06c7
SHA5125eea1c89d1bb2655ee84d283260c4b808b21e04094b9a599a425f147da67d41db8232de6423df888fbc892e24625e7ef39d814b72d15d5401182583ed5ac3aa1
-
\Windows\SysWOW64\igfxper32.exeFilesize
297KB
MD55303cb67747f5acf1f784b3722946037
SHA1bf6fe9cbae47d4ce27fc5012897b95a0bda2cd1a
SHA2561b845b30483d9a3fa395d610f3f458b90134f8d461657ac97d68fa5cb8df06c7
SHA5125eea1c89d1bb2655ee84d283260c4b808b21e04094b9a599a425f147da67d41db8232de6423df888fbc892e24625e7ef39d814b72d15d5401182583ed5ac3aa1
-
\Windows\SysWOW64\igfxper32.exeFilesize
297KB
MD55303cb67747f5acf1f784b3722946037
SHA1bf6fe9cbae47d4ce27fc5012897b95a0bda2cd1a
SHA2561b845b30483d9a3fa395d610f3f458b90134f8d461657ac97d68fa5cb8df06c7
SHA5125eea1c89d1bb2655ee84d283260c4b808b21e04094b9a599a425f147da67d41db8232de6423df888fbc892e24625e7ef39d814b72d15d5401182583ed5ac3aa1
-
\Windows\SysWOW64\igfxper32.exeFilesize
297KB
MD55303cb67747f5acf1f784b3722946037
SHA1bf6fe9cbae47d4ce27fc5012897b95a0bda2cd1a
SHA2561b845b30483d9a3fa395d610f3f458b90134f8d461657ac97d68fa5cb8df06c7
SHA5125eea1c89d1bb2655ee84d283260c4b808b21e04094b9a599a425f147da67d41db8232de6423df888fbc892e24625e7ef39d814b72d15d5401182583ed5ac3aa1
-
\Windows\SysWOW64\igfxper32.exeFilesize
297KB
MD55303cb67747f5acf1f784b3722946037
SHA1bf6fe9cbae47d4ce27fc5012897b95a0bda2cd1a
SHA2561b845b30483d9a3fa395d610f3f458b90134f8d461657ac97d68fa5cb8df06c7
SHA5125eea1c89d1bb2655ee84d283260c4b808b21e04094b9a599a425f147da67d41db8232de6423df888fbc892e24625e7ef39d814b72d15d5401182583ed5ac3aa1
-
\Windows\SysWOW64\igfxper32.exeFilesize
297KB
MD55303cb67747f5acf1f784b3722946037
SHA1bf6fe9cbae47d4ce27fc5012897b95a0bda2cd1a
SHA2561b845b30483d9a3fa395d610f3f458b90134f8d461657ac97d68fa5cb8df06c7
SHA5125eea1c89d1bb2655ee84d283260c4b808b21e04094b9a599a425f147da67d41db8232de6423df888fbc892e24625e7ef39d814b72d15d5401182583ed5ac3aa1
-
\Windows\SysWOW64\igfxper32.exeFilesize
297KB
MD55303cb67747f5acf1f784b3722946037
SHA1bf6fe9cbae47d4ce27fc5012897b95a0bda2cd1a
SHA2561b845b30483d9a3fa395d610f3f458b90134f8d461657ac97d68fa5cb8df06c7
SHA5125eea1c89d1bb2655ee84d283260c4b808b21e04094b9a599a425f147da67d41db8232de6423df888fbc892e24625e7ef39d814b72d15d5401182583ed5ac3aa1
-
\Windows\SysWOW64\igfxper32.exeFilesize
297KB
MD55303cb67747f5acf1f784b3722946037
SHA1bf6fe9cbae47d4ce27fc5012897b95a0bda2cd1a
SHA2561b845b30483d9a3fa395d610f3f458b90134f8d461657ac97d68fa5cb8df06c7
SHA5125eea1c89d1bb2655ee84d283260c4b808b21e04094b9a599a425f147da67d41db8232de6423df888fbc892e24625e7ef39d814b72d15d5401182583ed5ac3aa1
-
\Windows\SysWOW64\igfxper32.exeFilesize
297KB
MD55303cb67747f5acf1f784b3722946037
SHA1bf6fe9cbae47d4ce27fc5012897b95a0bda2cd1a
SHA2561b845b30483d9a3fa395d610f3f458b90134f8d461657ac97d68fa5cb8df06c7
SHA5125eea1c89d1bb2655ee84d283260c4b808b21e04094b9a599a425f147da67d41db8232de6423df888fbc892e24625e7ef39d814b72d15d5401182583ed5ac3aa1
-
\Windows\SysWOW64\igfxper32.exeFilesize
297KB
MD55303cb67747f5acf1f784b3722946037
SHA1bf6fe9cbae47d4ce27fc5012897b95a0bda2cd1a
SHA2561b845b30483d9a3fa395d610f3f458b90134f8d461657ac97d68fa5cb8df06c7
SHA5125eea1c89d1bb2655ee84d283260c4b808b21e04094b9a599a425f147da67d41db8232de6423df888fbc892e24625e7ef39d814b72d15d5401182583ed5ac3aa1
-
\Windows\SysWOW64\igfxper32.exeFilesize
297KB
MD55303cb67747f5acf1f784b3722946037
SHA1bf6fe9cbae47d4ce27fc5012897b95a0bda2cd1a
SHA2561b845b30483d9a3fa395d610f3f458b90134f8d461657ac97d68fa5cb8df06c7
SHA5125eea1c89d1bb2655ee84d283260c4b808b21e04094b9a599a425f147da67d41db8232de6423df888fbc892e24625e7ef39d814b72d15d5401182583ed5ac3aa1
-
\Windows\SysWOW64\igfxper32.exeFilesize
297KB
MD55303cb67747f5acf1f784b3722946037
SHA1bf6fe9cbae47d4ce27fc5012897b95a0bda2cd1a
SHA2561b845b30483d9a3fa395d610f3f458b90134f8d461657ac97d68fa5cb8df06c7
SHA5125eea1c89d1bb2655ee84d283260c4b808b21e04094b9a599a425f147da67d41db8232de6423df888fbc892e24625e7ef39d814b72d15d5401182583ed5ac3aa1
-
\Windows\SysWOW64\igfxper32.exeFilesize
297KB
MD55303cb67747f5acf1f784b3722946037
SHA1bf6fe9cbae47d4ce27fc5012897b95a0bda2cd1a
SHA2561b845b30483d9a3fa395d610f3f458b90134f8d461657ac97d68fa5cb8df06c7
SHA5125eea1c89d1bb2655ee84d283260c4b808b21e04094b9a599a425f147da67d41db8232de6423df888fbc892e24625e7ef39d814b72d15d5401182583ed5ac3aa1
-
\Windows\SysWOW64\igfxper32.exeFilesize
297KB
MD55303cb67747f5acf1f784b3722946037
SHA1bf6fe9cbae47d4ce27fc5012897b95a0bda2cd1a
SHA2561b845b30483d9a3fa395d610f3f458b90134f8d461657ac97d68fa5cb8df06c7
SHA5125eea1c89d1bb2655ee84d283260c4b808b21e04094b9a599a425f147da67d41db8232de6423df888fbc892e24625e7ef39d814b72d15d5401182583ed5ac3aa1
-
\Windows\SysWOW64\igfxper32.exeFilesize
297KB
MD55303cb67747f5acf1f784b3722946037
SHA1bf6fe9cbae47d4ce27fc5012897b95a0bda2cd1a
SHA2561b845b30483d9a3fa395d610f3f458b90134f8d461657ac97d68fa5cb8df06c7
SHA5125eea1c89d1bb2655ee84d283260c4b808b21e04094b9a599a425f147da67d41db8232de6423df888fbc892e24625e7ef39d814b72d15d5401182583ed5ac3aa1
-
\Windows\SysWOW64\igfxper32.exeFilesize
297KB
MD55303cb67747f5acf1f784b3722946037
SHA1bf6fe9cbae47d4ce27fc5012897b95a0bda2cd1a
SHA2561b845b30483d9a3fa395d610f3f458b90134f8d461657ac97d68fa5cb8df06c7
SHA5125eea1c89d1bb2655ee84d283260c4b808b21e04094b9a599a425f147da67d41db8232de6423df888fbc892e24625e7ef39d814b72d15d5401182583ed5ac3aa1
-
\Windows\SysWOW64\igfxper32.exeFilesize
297KB
MD55303cb67747f5acf1f784b3722946037
SHA1bf6fe9cbae47d4ce27fc5012897b95a0bda2cd1a
SHA2561b845b30483d9a3fa395d610f3f458b90134f8d461657ac97d68fa5cb8df06c7
SHA5125eea1c89d1bb2655ee84d283260c4b808b21e04094b9a599a425f147da67d41db8232de6423df888fbc892e24625e7ef39d814b72d15d5401182583ed5ac3aa1
-
\Windows\SysWOW64\igfxper32.exeFilesize
297KB
MD55303cb67747f5acf1f784b3722946037
SHA1bf6fe9cbae47d4ce27fc5012897b95a0bda2cd1a
SHA2561b845b30483d9a3fa395d610f3f458b90134f8d461657ac97d68fa5cb8df06c7
SHA5125eea1c89d1bb2655ee84d283260c4b808b21e04094b9a599a425f147da67d41db8232de6423df888fbc892e24625e7ef39d814b72d15d5401182583ed5ac3aa1
-
\Windows\SysWOW64\igfxper32.exeFilesize
297KB
MD55303cb67747f5acf1f784b3722946037
SHA1bf6fe9cbae47d4ce27fc5012897b95a0bda2cd1a
SHA2561b845b30483d9a3fa395d610f3f458b90134f8d461657ac97d68fa5cb8df06c7
SHA5125eea1c89d1bb2655ee84d283260c4b808b21e04094b9a599a425f147da67d41db8232de6423df888fbc892e24625e7ef39d814b72d15d5401182583ed5ac3aa1
-
\Windows\SysWOW64\igfxper32.exeFilesize
297KB
MD55303cb67747f5acf1f784b3722946037
SHA1bf6fe9cbae47d4ce27fc5012897b95a0bda2cd1a
SHA2561b845b30483d9a3fa395d610f3f458b90134f8d461657ac97d68fa5cb8df06c7
SHA5125eea1c89d1bb2655ee84d283260c4b808b21e04094b9a599a425f147da67d41db8232de6423df888fbc892e24625e7ef39d814b72d15d5401182583ed5ac3aa1
-
\Windows\SysWOW64\igfxper32.exeFilesize
297KB
MD55303cb67747f5acf1f784b3722946037
SHA1bf6fe9cbae47d4ce27fc5012897b95a0bda2cd1a
SHA2561b845b30483d9a3fa395d610f3f458b90134f8d461657ac97d68fa5cb8df06c7
SHA5125eea1c89d1bb2655ee84d283260c4b808b21e04094b9a599a425f147da67d41db8232de6423df888fbc892e24625e7ef39d814b72d15d5401182583ed5ac3aa1
-
\Windows\SysWOW64\igfxper32.exeFilesize
297KB
MD55303cb67747f5acf1f784b3722946037
SHA1bf6fe9cbae47d4ce27fc5012897b95a0bda2cd1a
SHA2561b845b30483d9a3fa395d610f3f458b90134f8d461657ac97d68fa5cb8df06c7
SHA5125eea1c89d1bb2655ee84d283260c4b808b21e04094b9a599a425f147da67d41db8232de6423df888fbc892e24625e7ef39d814b72d15d5401182583ed5ac3aa1
-
memory/624-108-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/624-104-0x0000000000000000-mapping.dmp
-
memory/624-114-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/632-54-0x0000000075391000-0x0000000075393000-memory.dmpFilesize
8KB
-
memory/632-55-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/632-56-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/632-62-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/668-142-0x0000000000000000-mapping.dmp
-
memory/668-146-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/768-75-0x0000000000000000-mapping.dmp
-
memory/768-79-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/768-85-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1008-92-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1008-82-0x0000000000000000-mapping.dmp
-
memory/1008-86-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1120-101-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1120-106-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1120-97-0x0000000000000000-mapping.dmp
-
memory/1252-139-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1252-144-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1252-135-0x0000000000000000-mapping.dmp
-
memory/1436-123-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1436-118-0x0000000004470000-0x0000000004510000-memory.dmpFilesize
640KB
-
memory/1436-111-0x0000000000000000-mapping.dmp
-
memory/1436-115-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1524-124-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1524-120-0x0000000000000000-mapping.dmp
-
memory/1524-130-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1736-99-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1736-93-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1736-89-0x0000000000000000-mapping.dmp
-
memory/1932-131-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1932-138-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1932-127-0x0000000000000000-mapping.dmp
-
memory/1944-59-0x0000000000000000-mapping.dmp
-
memory/1944-71-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1944-64-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1944-63-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/2032-78-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/2032-72-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/2032-68-0x0000000000000000-mapping.dmp