metasploit | 6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f

Analysis

max time kernel
154s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 21:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f.exe
Size

194KB
MD5

2f41b7aab2850309eb5388e82d96f697
SHA1

61b31a361593c6281b4f1ef839183203206d3e24
SHA256

6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f
SHA512

5add6f206135b7c3d8a0e3e15e0031c28d72cda0f82e25f18d4b5b00c167e18f642afc126fb7aae051490e63e0dcc75b3c8bf7ed48ddbfb8a5c95c02535e37c9
SSDEEP

6144:f3Yz5I0geFR0QiHm2fn4xPBcqeHzYHNBTZWA:/YVIaR0QRw4YqeTYHTAA

Score

10^/10

metasploit backdoor trojan upx

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Executes dropped EXE 26 IoCs

Processes:

igfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exe

pid	process
3524	igfxwd32.exe
1404	igfxwd32.exe
1880	igfxwd32.exe
3796	igfxwd32.exe
4660	igfxwd32.exe
3148	igfxwd32.exe
3660	igfxwd32.exe
4524	igfxwd32.exe
3400	igfxwd32.exe
3536	igfxwd32.exe
3284	igfxwd32.exe
3768	igfxwd32.exe
728	igfxwd32.exe
760	igfxwd32.exe
1676	igfxwd32.exe
808	igfxwd32.exe
4748	igfxwd32.exe
2712	igfxwd32.exe
5096	igfxwd32.exe
3292	igfxwd32.exe
908	igfxwd32.exe
1052	igfxwd32.exe
3704	igfxwd32.exe
4688	igfxwd32.exe
4724	igfxwd32.exe
2628	igfxwd32.exe

UPX packed file 29 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2368-133-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral2/memory/2368-135-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral2/memory/2368-136-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral2/memory/2368-137-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral2/memory/2368-141-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral2/memory/1404-148-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral2/memory/1404-151-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral2/memory/3796-158-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral2/memory/3796-161-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral2/memory/3148-168-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral2/memory/3148-171-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral2/memory/4524-178-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral2/memory/4524-181-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral2/memory/3536-188-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral2/memory/3536-191-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral2/memory/3768-198-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral2/memory/3768-201-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral2/memory/760-208-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral2/memory/760-211-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral2/memory/808-218-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral2/memory/808-221-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral2/memory/2712-228-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral2/memory/2712-231-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral2/memory/3292-238-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral2/memory/3292-241-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral2/memory/1052-248-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral2/memory/1052-251-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral2/memory/4688-258-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral2/memory/4688-261-0x0000000000400000-0x0000000000466000-memory.dmp	upx

Checks computer location settings 2 TTPs 13 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

igfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exe6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	igfxwd32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	igfxwd32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	igfxwd32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	igfxwd32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	igfxwd32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	igfxwd32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	igfxwd32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	igfxwd32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	igfxwd32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	igfxwd32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	igfxwd32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	igfxwd32.exe

Maps connected drives based on registry 3 TTPs 28 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

igfxwd32.exe6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	igfxwd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxwd32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	igfxwd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxwd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxwd32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	igfxwd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxwd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxwd32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	igfxwd32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	igfxwd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxwd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxwd32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	igfxwd32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	igfxwd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxwd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxwd32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	igfxwd32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	igfxwd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxwd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxwd32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	igfxwd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxwd32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	igfxwd32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	igfxwd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxwd32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	igfxwd32.exe

Drops file in System32 directory 39 IoCs

Processes:

igfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exe6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f.exeigfxwd32.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\	igfxwd32.exe
File created	C:\Windows\SysWOW64\igfxwd32.exe	igfxwd32.exe
File created	C:\Windows\SysWOW64\igfxwd32.exe	igfxwd32.exe
File opened for modification	C:\Windows\SysWOW64\igfxwd32.exe	igfxwd32.exe
File created	C:\Windows\SysWOW64\igfxwd32.exe	igfxwd32.exe
File created	C:\Windows\SysWOW64\igfxwd32.exe	igfxwd32.exe
File opened for modification	C:\Windows\SysWOW64\	igfxwd32.exe
File opened for modification	C:\Windows\SysWOW64\	igfxwd32.exe
File created	C:\Windows\SysWOW64\igfxwd32.exe	igfxwd32.exe
File opened for modification	C:\Windows\SysWOW64\igfxwd32.exe	igfxwd32.exe
File opened for modification	C:\Windows\SysWOW64\	igfxwd32.exe
File created	C:\Windows\SysWOW64\igfxwd32.exe	igfxwd32.exe
File opened for modification	C:\Windows\SysWOW64\igfxwd32.exe	igfxwd32.exe
File created	C:\Windows\SysWOW64\igfxwd32.exe	igfxwd32.exe
File created	C:\Windows\SysWOW64\igfxwd32.exe	igfxwd32.exe
File created	C:\Windows\SysWOW64\igfxwd32.exe	igfxwd32.exe
File opened for modification	C:\Windows\SysWOW64\	igfxwd32.exe
File created	C:\Windows\SysWOW64\igfxwd32.exe	6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f.exe
File opened for modification	C:\Windows\SysWOW64\	igfxwd32.exe
File created	C:\Windows\SysWOW64\igfxwd32.exe	igfxwd32.exe
File opened for modification	C:\Windows\SysWOW64\igfxwd32.exe	igfxwd32.exe
File created	C:\Windows\SysWOW64\igfxwd32.exe	igfxwd32.exe
File opened for modification	C:\Windows\SysWOW64\igfxwd32.exe	6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f.exe
File opened for modification	C:\Windows\SysWOW64\	igfxwd32.exe
File opened for modification	C:\Windows\SysWOW64\igfxwd32.exe	igfxwd32.exe
File opened for modification	C:\Windows\SysWOW64\	igfxwd32.exe
File opened for modification	C:\Windows\SysWOW64\igfxwd32.exe	igfxwd32.exe
File opened for modification	C:\Windows\SysWOW64\	6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f.exe
File opened for modification	C:\Windows\SysWOW64\	igfxwd32.exe
File opened for modification	C:\Windows\SysWOW64\	igfxwd32.exe
File opened for modification	C:\Windows\SysWOW64\igfxwd32.exe	igfxwd32.exe
File opened for modification	C:\Windows\SysWOW64\igfxwd32.exe	igfxwd32.exe
File opened for modification	C:\Windows\SysWOW64\igfxwd32.exe	igfxwd32.exe
File opened for modification	C:\Windows\SysWOW64\igfxwd32.exe	igfxwd32.exe
File opened for modification	C:\Windows\SysWOW64\igfxwd32.exe	igfxwd32.exe
File opened for modification	C:\Windows\SysWOW64\igfxwd32.exe	igfxwd32.exe
File opened for modification	C:\Windows\SysWOW64\	igfxwd32.exe
File created	C:\Windows\SysWOW64\igfxwd32.exe	igfxwd32.exe
File opened for modification	C:\Windows\SysWOW64\	igfxwd32.exe

Suspicious use of SetThreadContext 14 IoCs

Processes:

6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exe

description	pid	process	target process
PID 904 set thread context of 2368	904	6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f.exe	6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f.exe
PID 3524 set thread context of 1404	3524	igfxwd32.exe	igfxwd32.exe
PID 1880 set thread context of 3796	1880	igfxwd32.exe	igfxwd32.exe
PID 4660 set thread context of 3148	4660	igfxwd32.exe	igfxwd32.exe
PID 3660 set thread context of 4524	3660	igfxwd32.exe	igfxwd32.exe
PID 3400 set thread context of 3536	3400	igfxwd32.exe	igfxwd32.exe
PID 3284 set thread context of 3768	3284	igfxwd32.exe	igfxwd32.exe
PID 728 set thread context of 760	728	igfxwd32.exe	igfxwd32.exe
PID 1676 set thread context of 808	1676	igfxwd32.exe	igfxwd32.exe
PID 4748 set thread context of 2712	4748	igfxwd32.exe	igfxwd32.exe
PID 5096 set thread context of 3292	5096	igfxwd32.exe	igfxwd32.exe
PID 908 set thread context of 1052	908	igfxwd32.exe	igfxwd32.exe
PID 3704 set thread context of 4688	3704	igfxwd32.exe	igfxwd32.exe
PID 4724 set thread context of 2628	4724	igfxwd32.exe	igfxwd32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 13 IoCs

Processes:

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxwd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxwd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxwd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxwd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxwd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxwd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxwd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxwd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxwd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxwd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxwd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxwd32.exe

Suspicious behavior: EnumeratesProcesses 54 IoCs

Processes:

pid	process
2368	6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f.exe
2368	6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f.exe
2368	6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f.exe
2368	6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f.exe
1404	igfxwd32.exe
1404	igfxwd32.exe
1404	igfxwd32.exe
1404	igfxwd32.exe
3796	igfxwd32.exe
3796	igfxwd32.exe
3796	igfxwd32.exe
3796	igfxwd32.exe
3148	igfxwd32.exe
3148	igfxwd32.exe
3148	igfxwd32.exe
3148	igfxwd32.exe
4524	igfxwd32.exe
4524	igfxwd32.exe
4524	igfxwd32.exe
4524	igfxwd32.exe
3536	igfxwd32.exe
3536	igfxwd32.exe
3536	igfxwd32.exe
3536	igfxwd32.exe
3768	igfxwd32.exe
3768	igfxwd32.exe
3768	igfxwd32.exe
3768	igfxwd32.exe
760	igfxwd32.exe
760	igfxwd32.exe
760	igfxwd32.exe
760	igfxwd32.exe
808	igfxwd32.exe
808	igfxwd32.exe
808	igfxwd32.exe
808	igfxwd32.exe
2712	igfxwd32.exe
2712	igfxwd32.exe
2712	igfxwd32.exe
2712	igfxwd32.exe
3292	igfxwd32.exe
3292	igfxwd32.exe
3292	igfxwd32.exe
3292	igfxwd32.exe
1052	igfxwd32.exe
1052	igfxwd32.exe
1052	igfxwd32.exe
1052	igfxwd32.exe
4688	igfxwd32.exe
4688	igfxwd32.exe
4688	igfxwd32.exe
4688	igfxwd32.exe
2628	igfxwd32.exe
2628	igfxwd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f.exe6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exe

description	pid	process	target process
PID 904 wrote to memory of 2368	904	6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f.exe	6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f.exe
PID 904 wrote to memory of 2368	904	6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f.exe	6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f.exe
PID 904 wrote to memory of 2368	904	6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f.exe	6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f.exe
PID 904 wrote to memory of 2368	904	6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f.exe	6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f.exe
PID 904 wrote to memory of 2368	904	6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f.exe	6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f.exe
PID 904 wrote to memory of 2368	904	6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f.exe	6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f.exe
PID 904 wrote to memory of 2368	904	6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f.exe	6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f.exe
PID 2368 wrote to memory of 3524	2368	6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f.exe	igfxwd32.exe
PID 2368 wrote to memory of 3524	2368	6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f.exe	igfxwd32.exe
PID 2368 wrote to memory of 3524	2368	6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f.exe	igfxwd32.exe
PID 3524 wrote to memory of 1404	3524	igfxwd32.exe	igfxwd32.exe
PID 3524 wrote to memory of 1404	3524	igfxwd32.exe	igfxwd32.exe
PID 3524 wrote to memory of 1404	3524	igfxwd32.exe	igfxwd32.exe
PID 3524 wrote to memory of 1404	3524	igfxwd32.exe	igfxwd32.exe
PID 3524 wrote to memory of 1404	3524	igfxwd32.exe	igfxwd32.exe
PID 3524 wrote to memory of 1404	3524	igfxwd32.exe	igfxwd32.exe
PID 3524 wrote to memory of 1404	3524	igfxwd32.exe	igfxwd32.exe
PID 1404 wrote to memory of 1880	1404	igfxwd32.exe	igfxwd32.exe
PID 1404 wrote to memory of 1880	1404	igfxwd32.exe	igfxwd32.exe
PID 1404 wrote to memory of 1880	1404	igfxwd32.exe	igfxwd32.exe
PID 1880 wrote to memory of 3796	1880	igfxwd32.exe	igfxwd32.exe
PID 1880 wrote to memory of 3796	1880	igfxwd32.exe	igfxwd32.exe
PID 1880 wrote to memory of 3796	1880	igfxwd32.exe	igfxwd32.exe
PID 1880 wrote to memory of 3796	1880	igfxwd32.exe	igfxwd32.exe
PID 1880 wrote to memory of 3796	1880	igfxwd32.exe	igfxwd32.exe
PID 1880 wrote to memory of 3796	1880	igfxwd32.exe	igfxwd32.exe
PID 1880 wrote to memory of 3796	1880	igfxwd32.exe	igfxwd32.exe
PID 3796 wrote to memory of 4660	3796	igfxwd32.exe	igfxwd32.exe
PID 3796 wrote to memory of 4660	3796	igfxwd32.exe	igfxwd32.exe
PID 3796 wrote to memory of 4660	3796	igfxwd32.exe	igfxwd32.exe
PID 4660 wrote to memory of 3148	4660	igfxwd32.exe	igfxwd32.exe
PID 4660 wrote to memory of 3148	4660	igfxwd32.exe	igfxwd32.exe
PID 4660 wrote to memory of 3148	4660	igfxwd32.exe	igfxwd32.exe
PID 4660 wrote to memory of 3148	4660	igfxwd32.exe	igfxwd32.exe
PID 4660 wrote to memory of 3148	4660	igfxwd32.exe	igfxwd32.exe
PID 4660 wrote to memory of 3148	4660	igfxwd32.exe	igfxwd32.exe
PID 4660 wrote to memory of 3148	4660	igfxwd32.exe	igfxwd32.exe
PID 3148 wrote to memory of 3660	3148	igfxwd32.exe	igfxwd32.exe
PID 3148 wrote to memory of 3660	3148	igfxwd32.exe	igfxwd32.exe
PID 3148 wrote to memory of 3660	3148	igfxwd32.exe	igfxwd32.exe
PID 3660 wrote to memory of 4524	3660	igfxwd32.exe	igfxwd32.exe
PID 3660 wrote to memory of 4524	3660	igfxwd32.exe	igfxwd32.exe
PID 3660 wrote to memory of 4524	3660	igfxwd32.exe	igfxwd32.exe
PID 3660 wrote to memory of 4524	3660	igfxwd32.exe	igfxwd32.exe
PID 3660 wrote to memory of 4524	3660	igfxwd32.exe	igfxwd32.exe
PID 3660 wrote to memory of 4524	3660	igfxwd32.exe	igfxwd32.exe
PID 3660 wrote to memory of 4524	3660	igfxwd32.exe	igfxwd32.exe
PID 4524 wrote to memory of 3400	4524	igfxwd32.exe	igfxwd32.exe
PID 4524 wrote to memory of 3400	4524	igfxwd32.exe	igfxwd32.exe
PID 4524 wrote to memory of 3400	4524	igfxwd32.exe	igfxwd32.exe
PID 3400 wrote to memory of 3536	3400	igfxwd32.exe	igfxwd32.exe
PID 3400 wrote to memory of 3536	3400	igfxwd32.exe	igfxwd32.exe
PID 3400 wrote to memory of 3536	3400	igfxwd32.exe	igfxwd32.exe
PID 3400 wrote to memory of 3536	3400	igfxwd32.exe	igfxwd32.exe
PID 3400 wrote to memory of 3536	3400	igfxwd32.exe	igfxwd32.exe
PID 3400 wrote to memory of 3536	3400	igfxwd32.exe	igfxwd32.exe
PID 3400 wrote to memory of 3536	3400	igfxwd32.exe	igfxwd32.exe
PID 3536 wrote to memory of 3284	3536	igfxwd32.exe	igfxwd32.exe
PID 3536 wrote to memory of 3284	3536	igfxwd32.exe	igfxwd32.exe
PID 3536 wrote to memory of 3284	3536	igfxwd32.exe	igfxwd32.exe
PID 3284 wrote to memory of 3768	3284	igfxwd32.exe	igfxwd32.exe
PID 3284 wrote to memory of 3768	3284	igfxwd32.exe	igfxwd32.exe
PID 3284 wrote to memory of 3768	3284	igfxwd32.exe	igfxwd32.exe
PID 3284 wrote to memory of 3768	3284	igfxwd32.exe	igfxwd32.exe

C:\Users\Admin\AppData\Local\Temp\6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f.exe
"C:\Users\Admin\AppData\Local\Temp\6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:904

C:\Users\Admin\AppData\Local\Temp\6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f.exe
"C:\Users\Admin\AppData\Local\Temp\6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f.exe"
2⤵
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2368

C:\Windows\SysWOW64\igfxwd32.exe
"C:\Windows\system32\igfxwd32.exe" C:\Users\Admin\AppData\Local\Temp\6B0639~1.EXE
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3524

C:\Windows\SysWOW64\igfxwd32.exe
"C:\Windows\system32\igfxwd32.exe" C:\Users\Admin\AppData\Local\Temp\6B0639~1.EXE
4⤵
- Executes dropped EXE
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1404

C:\Windows\SysWOW64\igfxwd32.exe
"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1880

C:\Windows\SysWOW64\igfxwd32.exe
"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe
6⤵
- Executes dropped EXE
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3796

C:\Windows\SysWOW64\igfxwd32.exe
"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4660

C:\Windows\SysWOW64\igfxwd32.exe
"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe
8⤵
- Executes dropped EXE
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3148

C:\Windows\SysWOW64\igfxwd32.exe
"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe
9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3660

C:\Windows\SysWOW64\igfxwd32.exe
"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe
10⤵
- Executes dropped EXE
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4524

C:\Windows\SysWOW64\igfxwd32.exe
"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe
11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3400

C:\Windows\SysWOW64\igfxwd32.exe
"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe
12⤵
- Executes dropped EXE
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3536

C:\Windows\SysWOW64\igfxwd32.exe
"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe
13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3284

C:\Windows\SysWOW64\igfxwd32.exe
"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe
14⤵
- Executes dropped EXE
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3768

C:\Windows\SysWOW64\igfxwd32.exe
"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe
15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:728

C:\Windows\SysWOW64\igfxwd32.exe
"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe
16⤵
- Executes dropped EXE
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:760

C:\Windows\SysWOW64\igfxwd32.exe
"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe
17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1676

C:\Windows\SysWOW64\igfxwd32.exe
"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe
18⤵
- Executes dropped EXE
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:808

C:\Windows\SysWOW64\igfxwd32.exe
"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe
19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4748

C:\Windows\SysWOW64\igfxwd32.exe
"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe
20⤵
- Executes dropped EXE
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2712

C:\Windows\SysWOW64\igfxwd32.exe
"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe
21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5096

C:\Windows\SysWOW64\igfxwd32.exe
"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe
22⤵
- Executes dropped EXE
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3292

C:\Windows\SysWOW64\igfxwd32.exe
"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe
23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:908

C:\Windows\SysWOW64\igfxwd32.exe
"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe
24⤵
- Executes dropped EXE
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1052

C:\Windows\SysWOW64\igfxwd32.exe
"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe
25⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3704

C:\Windows\SysWOW64\igfxwd32.exe
"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe
26⤵
- Executes dropped EXE
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4688

C:\Windows\SysWOW64\igfxwd32.exe
"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe
27⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4724

C:\Windows\SysWOW64\igfxwd32.exe
"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe
28⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:2628

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\igfxwd32.exe

Filesize
194KB

MD5
2f41b7aab2850309eb5388e82d96f697

SHA1
61b31a361593c6281b4f1ef839183203206d3e24

SHA256
6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f

SHA512
5add6f206135b7c3d8a0e3e15e0031c28d72cda0f82e25f18d4b5b00c167e18f642afc126fb7aae051490e63e0dcc75b3c8bf7ed48ddbfb8a5c95c02535e37c9

Download Submit
C:\Windows\SysWOW64\igfxwd32.exe

Filesize
194KB

MD5
2f41b7aab2850309eb5388e82d96f697

SHA1
61b31a361593c6281b4f1ef839183203206d3e24

SHA256
6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f

SHA512
5add6f206135b7c3d8a0e3e15e0031c28d72cda0f82e25f18d4b5b00c167e18f642afc126fb7aae051490e63e0dcc75b3c8bf7ed48ddbfb8a5c95c02535e37c9

Download Submit
C:\Windows\SysWOW64\igfxwd32.exe

Filesize
194KB

MD5
2f41b7aab2850309eb5388e82d96f697

SHA1
61b31a361593c6281b4f1ef839183203206d3e24

SHA256
6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f

SHA512
5add6f206135b7c3d8a0e3e15e0031c28d72cda0f82e25f18d4b5b00c167e18f642afc126fb7aae051490e63e0dcc75b3c8bf7ed48ddbfb8a5c95c02535e37c9

Download Submit
C:\Windows\SysWOW64\igfxwd32.exe

Filesize
194KB

MD5
2f41b7aab2850309eb5388e82d96f697

SHA1
61b31a361593c6281b4f1ef839183203206d3e24

SHA256
6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f

SHA512
5add6f206135b7c3d8a0e3e15e0031c28d72cda0f82e25f18d4b5b00c167e18f642afc126fb7aae051490e63e0dcc75b3c8bf7ed48ddbfb8a5c95c02535e37c9

Download Submit
C:\Windows\SysWOW64\igfxwd32.exe

Filesize
194KB

MD5
2f41b7aab2850309eb5388e82d96f697

SHA1
61b31a361593c6281b4f1ef839183203206d3e24

SHA256
6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f

SHA512
5add6f206135b7c3d8a0e3e15e0031c28d72cda0f82e25f18d4b5b00c167e18f642afc126fb7aae051490e63e0dcc75b3c8bf7ed48ddbfb8a5c95c02535e37c9

Download Submit
C:\Windows\SysWOW64\igfxwd32.exe

Filesize
194KB

MD5
2f41b7aab2850309eb5388e82d96f697

SHA1
61b31a361593c6281b4f1ef839183203206d3e24

SHA256
6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f

SHA512
5add6f206135b7c3d8a0e3e15e0031c28d72cda0f82e25f18d4b5b00c167e18f642afc126fb7aae051490e63e0dcc75b3c8bf7ed48ddbfb8a5c95c02535e37c9

Download Submit
C:\Windows\SysWOW64\igfxwd32.exe

Filesize
194KB

MD5
2f41b7aab2850309eb5388e82d96f697

SHA1
61b31a361593c6281b4f1ef839183203206d3e24

SHA256
6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f

SHA512
5add6f206135b7c3d8a0e3e15e0031c28d72cda0f82e25f18d4b5b00c167e18f642afc126fb7aae051490e63e0dcc75b3c8bf7ed48ddbfb8a5c95c02535e37c9

Download Submit
C:\Windows\SysWOW64\igfxwd32.exe

Filesize
194KB

MD5
2f41b7aab2850309eb5388e82d96f697

SHA1
61b31a361593c6281b4f1ef839183203206d3e24

SHA256
6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f

SHA512
5add6f206135b7c3d8a0e3e15e0031c28d72cda0f82e25f18d4b5b00c167e18f642afc126fb7aae051490e63e0dcc75b3c8bf7ed48ddbfb8a5c95c02535e37c9

Download Submit
C:\Windows\SysWOW64\igfxwd32.exe

Filesize
194KB

MD5
2f41b7aab2850309eb5388e82d96f697

SHA1
61b31a361593c6281b4f1ef839183203206d3e24

SHA256
6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f

SHA512
5add6f206135b7c3d8a0e3e15e0031c28d72cda0f82e25f18d4b5b00c167e18f642afc126fb7aae051490e63e0dcc75b3c8bf7ed48ddbfb8a5c95c02535e37c9

Download Submit
C:\Windows\SysWOW64\igfxwd32.exe

Filesize
194KB

MD5
2f41b7aab2850309eb5388e82d96f697

SHA1
61b31a361593c6281b4f1ef839183203206d3e24

SHA256
6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f

SHA512
5add6f206135b7c3d8a0e3e15e0031c28d72cda0f82e25f18d4b5b00c167e18f642afc126fb7aae051490e63e0dcc75b3c8bf7ed48ddbfb8a5c95c02535e37c9

Download Submit
C:\Windows\SysWOW64\igfxwd32.exe

Filesize
194KB

MD5
2f41b7aab2850309eb5388e82d96f697

SHA1
61b31a361593c6281b4f1ef839183203206d3e24

SHA256
6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f

SHA512
5add6f206135b7c3d8a0e3e15e0031c28d72cda0f82e25f18d4b5b00c167e18f642afc126fb7aae051490e63e0dcc75b3c8bf7ed48ddbfb8a5c95c02535e37c9

Download Submit
C:\Windows\SysWOW64\igfxwd32.exe

Filesize
194KB

MD5
2f41b7aab2850309eb5388e82d96f697

SHA1
61b31a361593c6281b4f1ef839183203206d3e24

SHA256
6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f

SHA512
5add6f206135b7c3d8a0e3e15e0031c28d72cda0f82e25f18d4b5b00c167e18f642afc126fb7aae051490e63e0dcc75b3c8bf7ed48ddbfb8a5c95c02535e37c9

Download Submit
C:\Windows\SysWOW64\igfxwd32.exe

Filesize
194KB

MD5
2f41b7aab2850309eb5388e82d96f697

SHA1
61b31a361593c6281b4f1ef839183203206d3e24

SHA256
6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f

SHA512
5add6f206135b7c3d8a0e3e15e0031c28d72cda0f82e25f18d4b5b00c167e18f642afc126fb7aae051490e63e0dcc75b3c8bf7ed48ddbfb8a5c95c02535e37c9

Download Submit
C:\Windows\SysWOW64\igfxwd32.exe

Filesize
194KB

MD5
2f41b7aab2850309eb5388e82d96f697

SHA1
61b31a361593c6281b4f1ef839183203206d3e24

SHA256
6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f

SHA512
5add6f206135b7c3d8a0e3e15e0031c28d72cda0f82e25f18d4b5b00c167e18f642afc126fb7aae051490e63e0dcc75b3c8bf7ed48ddbfb8a5c95c02535e37c9

Download Submit
C:\Windows\SysWOW64\igfxwd32.exe

Filesize
194KB

MD5
2f41b7aab2850309eb5388e82d96f697

SHA1
61b31a361593c6281b4f1ef839183203206d3e24

SHA256
6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f

SHA512
5add6f206135b7c3d8a0e3e15e0031c28d72cda0f82e25f18d4b5b00c167e18f642afc126fb7aae051490e63e0dcc75b3c8bf7ed48ddbfb8a5c95c02535e37c9

Download Submit
C:\Windows\SysWOW64\igfxwd32.exe

Filesize
194KB

MD5
2f41b7aab2850309eb5388e82d96f697

SHA1
61b31a361593c6281b4f1ef839183203206d3e24

SHA256
6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f

SHA512
5add6f206135b7c3d8a0e3e15e0031c28d72cda0f82e25f18d4b5b00c167e18f642afc126fb7aae051490e63e0dcc75b3c8bf7ed48ddbfb8a5c95c02535e37c9

Download Submit
C:\Windows\SysWOW64\igfxwd32.exe

Filesize
194KB

MD5
2f41b7aab2850309eb5388e82d96f697

SHA1
61b31a361593c6281b4f1ef839183203206d3e24

SHA256
6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f

SHA512
5add6f206135b7c3d8a0e3e15e0031c28d72cda0f82e25f18d4b5b00c167e18f642afc126fb7aae051490e63e0dcc75b3c8bf7ed48ddbfb8a5c95c02535e37c9

Download Submit
C:\Windows\SysWOW64\igfxwd32.exe

Filesize
194KB

MD5
2f41b7aab2850309eb5388e82d96f697

SHA1
61b31a361593c6281b4f1ef839183203206d3e24

SHA256
6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f

SHA512
5add6f206135b7c3d8a0e3e15e0031c28d72cda0f82e25f18d4b5b00c167e18f642afc126fb7aae051490e63e0dcc75b3c8bf7ed48ddbfb8a5c95c02535e37c9

Download Submit
C:\Windows\SysWOW64\igfxwd32.exe

Filesize
194KB

MD5
2f41b7aab2850309eb5388e82d96f697

SHA1
61b31a361593c6281b4f1ef839183203206d3e24

SHA256
6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f

SHA512
5add6f206135b7c3d8a0e3e15e0031c28d72cda0f82e25f18d4b5b00c167e18f642afc126fb7aae051490e63e0dcc75b3c8bf7ed48ddbfb8a5c95c02535e37c9

Download Submit
C:\Windows\SysWOW64\igfxwd32.exe

Filesize
194KB

MD5
2f41b7aab2850309eb5388e82d96f697

SHA1
61b31a361593c6281b4f1ef839183203206d3e24

SHA256
6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f

SHA512
5add6f206135b7c3d8a0e3e15e0031c28d72cda0f82e25f18d4b5b00c167e18f642afc126fb7aae051490e63e0dcc75b3c8bf7ed48ddbfb8a5c95c02535e37c9

Download Submit
C:\Windows\SysWOW64\igfxwd32.exe

Filesize
194KB

MD5
2f41b7aab2850309eb5388e82d96f697

SHA1
61b31a361593c6281b4f1ef839183203206d3e24

SHA256
6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f

SHA512
5add6f206135b7c3d8a0e3e15e0031c28d72cda0f82e25f18d4b5b00c167e18f642afc126fb7aae051490e63e0dcc75b3c8bf7ed48ddbfb8a5c95c02535e37c9

Download Submit
C:\Windows\SysWOW64\igfxwd32.exe

Filesize
194KB

MD5
2f41b7aab2850309eb5388e82d96f697

SHA1
61b31a361593c6281b4f1ef839183203206d3e24

SHA256
6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f

SHA512
5add6f206135b7c3d8a0e3e15e0031c28d72cda0f82e25f18d4b5b00c167e18f642afc126fb7aae051490e63e0dcc75b3c8bf7ed48ddbfb8a5c95c02535e37c9

Download Submit
C:\Windows\SysWOW64\igfxwd32.exe

Filesize
194KB

MD5
2f41b7aab2850309eb5388e82d96f697

SHA1
61b31a361593c6281b4f1ef839183203206d3e24

SHA256
6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f

SHA512
5add6f206135b7c3d8a0e3e15e0031c28d72cda0f82e25f18d4b5b00c167e18f642afc126fb7aae051490e63e0dcc75b3c8bf7ed48ddbfb8a5c95c02535e37c9

Download Submit
C:\Windows\SysWOW64\igfxwd32.exe

Filesize
194KB

MD5
2f41b7aab2850309eb5388e82d96f697

SHA1
61b31a361593c6281b4f1ef839183203206d3e24

SHA256
6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f

SHA512
5add6f206135b7c3d8a0e3e15e0031c28d72cda0f82e25f18d4b5b00c167e18f642afc126fb7aae051490e63e0dcc75b3c8bf7ed48ddbfb8a5c95c02535e37c9

Download Submit
C:\Windows\SysWOW64\igfxwd32.exe

Filesize
194KB

MD5
2f41b7aab2850309eb5388e82d96f697

SHA1
61b31a361593c6281b4f1ef839183203206d3e24

SHA256
6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f

SHA512
5add6f206135b7c3d8a0e3e15e0031c28d72cda0f82e25f18d4b5b00c167e18f642afc126fb7aae051490e63e0dcc75b3c8bf7ed48ddbfb8a5c95c02535e37c9

Download Submit
C:\Windows\SysWOW64\igfxwd32.exe

Filesize
194KB

MD5
2f41b7aab2850309eb5388e82d96f697

SHA1
61b31a361593c6281b4f1ef839183203206d3e24

SHA256
6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f

SHA512
5add6f206135b7c3d8a0e3e15e0031c28d72cda0f82e25f18d4b5b00c167e18f642afc126fb7aae051490e63e0dcc75b3c8bf7ed48ddbfb8a5c95c02535e37c9

Download Submit
C:\Windows\SysWOW64\igfxwd32.exe

Filesize
194KB

MD5
2f41b7aab2850309eb5388e82d96f697

SHA1
61b31a361593c6281b4f1ef839183203206d3e24

SHA256
6b0639a7a10e9b4fefda9fc19834f237d44a0086a1e37d254f637a445b3a514f

SHA512
5add6f206135b7c3d8a0e3e15e0031c28d72cda0f82e25f18d4b5b00c167e18f642afc126fb7aae051490e63e0dcc75b3c8bf7ed48ddbfb8a5c95c02535e37c9

Download Submit
memory/728-199-0x0000000000000000-mapping.dmp

Download
memory/760-208-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/760-211-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/760-202-0x0000000000000000-mapping.dmp

Download
memory/808-221-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/808-218-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/808-212-0x0000000000000000-mapping.dmp

Download
memory/908-239-0x0000000000000000-mapping.dmp

Download
memory/1052-248-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1052-242-0x0000000000000000-mapping.dmp

Download
memory/1052-251-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1404-151-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1404-142-0x0000000000000000-mapping.dmp

Download
memory/1404-148-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1676-209-0x0000000000000000-mapping.dmp

Download
memory/1880-149-0x0000000000000000-mapping.dmp

Download
memory/2368-137-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2368-132-0x0000000000000000-mapping.dmp

Download
memory/2368-141-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2368-136-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2368-135-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2368-133-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2628-262-0x0000000000000000-mapping.dmp

Download
memory/2712-222-0x0000000000000000-mapping.dmp

Download
memory/2712-228-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2712-231-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3148-162-0x0000000000000000-mapping.dmp

Download
memory/3148-168-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3148-171-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3284-189-0x0000000000000000-mapping.dmp

Download
memory/3292-232-0x0000000000000000-mapping.dmp

Download
memory/3292-241-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3292-238-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3400-179-0x0000000000000000-mapping.dmp

Download
memory/3524-138-0x0000000000000000-mapping.dmp

Download
memory/3536-188-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3536-191-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3536-182-0x0000000000000000-mapping.dmp

Download
memory/3660-169-0x0000000000000000-mapping.dmp

Download
memory/3704-249-0x0000000000000000-mapping.dmp

Download
memory/3768-192-0x0000000000000000-mapping.dmp

Download
memory/3768-198-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3768-201-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3796-158-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3796-161-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3796-152-0x0000000000000000-mapping.dmp

Download
memory/4524-172-0x0000000000000000-mapping.dmp

Download
memory/4524-181-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/4524-178-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/4660-159-0x0000000000000000-mapping.dmp

Download
memory/4688-252-0x0000000000000000-mapping.dmp

Download
memory/4688-258-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/4688-261-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/4724-259-0x0000000000000000-mapping.dmp

Download
memory/4748-219-0x0000000000000000-mapping.dmp

Download
memory/5096-229-0x0000000000000000-mapping.dmp

Download