Analysis
-
max time kernel
149s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
06-07-2024 06:12
Behavioral task
behavioral1
Sample
27839c95f6b9e8880490863d3f2b34bf_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
27839c95f6b9e8880490863d3f2b34bf_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
27839c95f6b9e8880490863d3f2b34bf_JaffaCakes118.exe
-
Size
200KB
-
MD5
27839c95f6b9e8880490863d3f2b34bf
-
SHA1
311903d366ce09b2de0f0cdc482c06ec7414871f
-
SHA256
3669b7a140bd6a99ab15c276044875c80b00b70a10e7813913bbba62dda20e36
-
SHA512
dc02a72d5daf6bb7213f5c8adeda92f3898bedf4a974426c5b75a34d87657e2c5b5f71be577921cf451eae2d9bdce3f3eb3fe2be2a5b77e8c6592d42ad470a6c
-
SSDEEP
3072:Hli8jd28TnTwEM7ASIKu39U10Sl+y9ewRuWsaTOSuoq0p5I8jKRb1dAW:Hlico2wnMSny0XMWsiODopRj01dB
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Deletes itself 1 IoCs
pid Process 2636 igfxpx32.exe -
Executes dropped EXE 64 IoCs
pid Process 2636 igfxpx32.exe 2720 igfxpx32.exe 2484 igfxpx32.exe 2540 igfxpx32.exe 2788 igfxpx32.exe 2376 igfxpx32.exe 2172 igfxpx32.exe 2380 igfxpx32.exe 2176 igfxpx32.exe 3016 igfxpx32.exe 2912 igfxpx32.exe 680 igfxpx32.exe 1740 igfxpx32.exe 1244 igfxpx32.exe 2348 igfxpx32.exe 1976 igfxpx32.exe 916 igfxpx32.exe 2004 igfxpx32.exe 2168 igfxpx32.exe 904 igfxpx32.exe 2596 igfxpx32.exe 1868 igfxpx32.exe 2524 igfxpx32.exe 2512 igfxpx32.exe 2044 igfxpx32.exe 2592 igfxpx32.exe 776 igfxpx32.exe 1552 igfxpx32.exe 1764 igfxpx32.exe 1556 igfxpx32.exe 3004 igfxpx32.exe 1548 igfxpx32.exe 2112 igfxpx32.exe 2052 igfxpx32.exe 2036 igfxpx32.exe 1800 igfxpx32.exe 1576 igfxpx32.exe 748 igfxpx32.exe 1508 igfxpx32.exe 2348 igfxpx32.exe 1596 igfxpx32.exe 2336 igfxpx32.exe 2364 igfxpx32.exe 2208 igfxpx32.exe 1988 igfxpx32.exe 1880 igfxpx32.exe 1688 igfxpx32.exe 2744 igfxpx32.exe 2508 igfxpx32.exe 2504 igfxpx32.exe 1932 igfxpx32.exe 2800 igfxpx32.exe 2864 igfxpx32.exe 1884 igfxpx32.exe 2408 igfxpx32.exe 2136 igfxpx32.exe 2944 igfxpx32.exe 2548 igfxpx32.exe 1444 igfxpx32.exe 2784 igfxpx32.exe 356 igfxpx32.exe 484 igfxpx32.exe 956 igfxpx32.exe 2460 igfxpx32.exe -
Loads dropped DLL 64 IoCs
pid Process 1988 27839c95f6b9e8880490863d3f2b34bf_JaffaCakes118.exe 1988 27839c95f6b9e8880490863d3f2b34bf_JaffaCakes118.exe 2636 igfxpx32.exe 2636 igfxpx32.exe 2720 igfxpx32.exe 2720 igfxpx32.exe 2484 igfxpx32.exe 2484 igfxpx32.exe 2540 igfxpx32.exe 2540 igfxpx32.exe 2788 igfxpx32.exe 2788 igfxpx32.exe 2376 igfxpx32.exe 2376 igfxpx32.exe 2172 igfxpx32.exe 2172 igfxpx32.exe 2380 igfxpx32.exe 2380 igfxpx32.exe 2176 igfxpx32.exe 2176 igfxpx32.exe 3016 igfxpx32.exe 3016 igfxpx32.exe 2912 igfxpx32.exe 2912 igfxpx32.exe 680 igfxpx32.exe 680 igfxpx32.exe 1740 igfxpx32.exe 1740 igfxpx32.exe 1244 igfxpx32.exe 1244 igfxpx32.exe 2348 igfxpx32.exe 2348 igfxpx32.exe 1976 igfxpx32.exe 1976 igfxpx32.exe 916 igfxpx32.exe 916 igfxpx32.exe 2004 igfxpx32.exe 2004 igfxpx32.exe 2168 igfxpx32.exe 2168 igfxpx32.exe 904 igfxpx32.exe 904 igfxpx32.exe 2596 igfxpx32.exe 2596 igfxpx32.exe 1868 igfxpx32.exe 1868 igfxpx32.exe 2524 igfxpx32.exe 2524 igfxpx32.exe 2512 igfxpx32.exe 2512 igfxpx32.exe 2044 igfxpx32.exe 2044 igfxpx32.exe 2592 igfxpx32.exe 2592 igfxpx32.exe 776 igfxpx32.exe 776 igfxpx32.exe 1552 igfxpx32.exe 1552 igfxpx32.exe 1764 igfxpx32.exe 1764 igfxpx32.exe 1556 igfxpx32.exe 1556 igfxpx32.exe 3004 igfxpx32.exe 3004 igfxpx32.exe -
resource yara_rule behavioral1/memory/1988-0-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/files/0x000c0000000122eb-6.dat upx behavioral1/memory/2720-22-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2540-36-0x0000000003440000-0x00000000034CC000-memory.dmp upx behavioral1/memory/2376-47-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2380-59-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/3016-70-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/916-115-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2004-118-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2004-119-0x00000000036D0000-0x000000000375C000-memory.dmp upx behavioral1/memory/904-128-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2596-132-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2524-137-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/776-149-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/1764-156-0x0000000000400000-0x000000000048C000-memory.dmp upx -
Maps connected drives based on registry 3 TTPs 64 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpx32.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\igfxpx32.exe igfxpx32.exe File opened for modification C:\Windows\SysWOW64\igfxpx32.exe igfxpx32.exe File opened for modification C:\Windows\SysWOW64\igfxpx32.exe igfxpx32.exe File created C:\Windows\SysWOW64\igfxpx32.exe igfxpx32.exe File opened for modification C:\Windows\SysWOW64\igfxpx32.exe igfxpx32.exe File opened for modification C:\Windows\SysWOW64\igfxpx32.exe igfxpx32.exe File created C:\Windows\SysWOW64\igfxpx32.exe igfxpx32.exe File opened for modification C:\Windows\SysWOW64\igfxpx32.exe igfxpx32.exe File opened for modification C:\Windows\SysWOW64\igfxpx32.exe igfxpx32.exe File created C:\Windows\SysWOW64\igfxpx32.exe igfxpx32.exe File opened for modification C:\Windows\SysWOW64\igfxpx32.exe igfxpx32.exe File opened for modification C:\Windows\SysWOW64\ igfxpx32.exe File opened for modification C:\Windows\SysWOW64\ igfxpx32.exe File created C:\Windows\SysWOW64\igfxpx32.exe igfxpx32.exe File opened for modification C:\Windows\SysWOW64\ igfxpx32.exe File created C:\Windows\SysWOW64\igfxpx32.exe igfxpx32.exe File opened for modification C:\Windows\SysWOW64\igfxpx32.exe igfxpx32.exe File opened for modification C:\Windows\SysWOW64\ igfxpx32.exe File created C:\Windows\SysWOW64\igfxpx32.exe igfxpx32.exe File opened for modification C:\Windows\SysWOW64\ igfxpx32.exe File created C:\Windows\SysWOW64\igfxpx32.exe igfxpx32.exe File opened for modification C:\Windows\SysWOW64\igfxpx32.exe igfxpx32.exe File opened for modification C:\Windows\SysWOW64\igfxpx32.exe igfxpx32.exe File opened for modification C:\Windows\SysWOW64\ igfxpx32.exe File created C:\Windows\SysWOW64\igfxpx32.exe igfxpx32.exe File opened for modification C:\Windows\SysWOW64\ igfxpx32.exe File created C:\Windows\SysWOW64\igfxpx32.exe igfxpx32.exe File opened for modification C:\Windows\SysWOW64\ igfxpx32.exe File opened for modification C:\Windows\SysWOW64\ igfxpx32.exe File opened for modification C:\Windows\SysWOW64\ igfxpx32.exe File created C:\Windows\SysWOW64\igfxpx32.exe igfxpx32.exe File opened for modification C:\Windows\SysWOW64\igfxpx32.exe igfxpx32.exe File created C:\Windows\SysWOW64\igfxpx32.exe igfxpx32.exe File opened for modification C:\Windows\SysWOW64\igfxpx32.exe igfxpx32.exe File opened for modification C:\Windows\SysWOW64\ igfxpx32.exe File opened for modification C:\Windows\SysWOW64\ igfxpx32.exe File opened for modification C:\Windows\SysWOW64\ igfxpx32.exe File opened for modification C:\Windows\SysWOW64\igfxpx32.exe igfxpx32.exe File opened for modification C:\Windows\SysWOW64\igfxpx32.exe igfxpx32.exe File created C:\Windows\SysWOW64\igfxpx32.exe igfxpx32.exe File created C:\Windows\SysWOW64\igfxpx32.exe igfxpx32.exe File opened for modification C:\Windows\SysWOW64\ igfxpx32.exe File opened for modification C:\Windows\SysWOW64\ igfxpx32.exe File opened for modification C:\Windows\SysWOW64\ igfxpx32.exe File created C:\Windows\SysWOW64\igfxpx32.exe igfxpx32.exe File opened for modification C:\Windows\SysWOW64\igfxpx32.exe igfxpx32.exe File created C:\Windows\SysWOW64\igfxpx32.exe igfxpx32.exe File opened for modification C:\Windows\SysWOW64\igfxpx32.exe igfxpx32.exe File created C:\Windows\SysWOW64\igfxpx32.exe igfxpx32.exe File opened for modification C:\Windows\SysWOW64\igfxpx32.exe igfxpx32.exe File opened for modification C:\Windows\SysWOW64\ igfxpx32.exe File opened for modification C:\Windows\SysWOW64\igfxpx32.exe igfxpx32.exe File created C:\Windows\SysWOW64\igfxpx32.exe igfxpx32.exe File opened for modification C:\Windows\SysWOW64\ igfxpx32.exe File opened for modification C:\Windows\SysWOW64\igfxpx32.exe igfxpx32.exe File created C:\Windows\SysWOW64\igfxpx32.exe igfxpx32.exe File opened for modification C:\Windows\SysWOW64\ igfxpx32.exe File opened for modification C:\Windows\SysWOW64\igfxpx32.exe igfxpx32.exe File created C:\Windows\SysWOW64\igfxpx32.exe igfxpx32.exe File opened for modification C:\Windows\SysWOW64\igfxpx32.exe igfxpx32.exe File created C:\Windows\SysWOW64\igfxpx32.exe igfxpx32.exe File opened for modification C:\Windows\SysWOW64\igfxpx32.exe igfxpx32.exe File opened for modification C:\Windows\SysWOW64\ igfxpx32.exe File opened for modification C:\Windows\SysWOW64\igfxpx32.exe igfxpx32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1988 27839c95f6b9e8880490863d3f2b34bf_JaffaCakes118.exe 1988 27839c95f6b9e8880490863d3f2b34bf_JaffaCakes118.exe 2636 igfxpx32.exe 2636 igfxpx32.exe 2720 igfxpx32.exe 2720 igfxpx32.exe 2484 igfxpx32.exe 2484 igfxpx32.exe 2540 igfxpx32.exe 2540 igfxpx32.exe 2788 igfxpx32.exe 2788 igfxpx32.exe 2376 igfxpx32.exe 2376 igfxpx32.exe 2172 igfxpx32.exe 2172 igfxpx32.exe 2380 igfxpx32.exe 2380 igfxpx32.exe 2176 igfxpx32.exe 2176 igfxpx32.exe 3016 igfxpx32.exe 3016 igfxpx32.exe 2912 igfxpx32.exe 2912 igfxpx32.exe 680 igfxpx32.exe 680 igfxpx32.exe 1740 igfxpx32.exe 1740 igfxpx32.exe 1244 igfxpx32.exe 1244 igfxpx32.exe 2348 igfxpx32.exe 2348 igfxpx32.exe 1976 igfxpx32.exe 1976 igfxpx32.exe 916 igfxpx32.exe 916 igfxpx32.exe 2004 igfxpx32.exe 2004 igfxpx32.exe 2168 igfxpx32.exe 2168 igfxpx32.exe 904 igfxpx32.exe 904 igfxpx32.exe 2596 igfxpx32.exe 2596 igfxpx32.exe 1868 igfxpx32.exe 1868 igfxpx32.exe 2524 igfxpx32.exe 2524 igfxpx32.exe 2512 igfxpx32.exe 2512 igfxpx32.exe 2044 igfxpx32.exe 2044 igfxpx32.exe 2592 igfxpx32.exe 2592 igfxpx32.exe 776 igfxpx32.exe 776 igfxpx32.exe 1552 igfxpx32.exe 1552 igfxpx32.exe 1764 igfxpx32.exe 1764 igfxpx32.exe 1556 igfxpx32.exe 1556 igfxpx32.exe 3004 igfxpx32.exe 3004 igfxpx32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1988 wrote to memory of 2636 1988 27839c95f6b9e8880490863d3f2b34bf_JaffaCakes118.exe 28 PID 1988 wrote to memory of 2636 1988 27839c95f6b9e8880490863d3f2b34bf_JaffaCakes118.exe 28 PID 1988 wrote to memory of 2636 1988 27839c95f6b9e8880490863d3f2b34bf_JaffaCakes118.exe 28 PID 1988 wrote to memory of 2636 1988 27839c95f6b9e8880490863d3f2b34bf_JaffaCakes118.exe 28 PID 2636 wrote to memory of 2720 2636 igfxpx32.exe 29 PID 2636 wrote to memory of 2720 2636 igfxpx32.exe 29 PID 2636 wrote to memory of 2720 2636 igfxpx32.exe 29 PID 2636 wrote to memory of 2720 2636 igfxpx32.exe 29 PID 2720 wrote to memory of 2484 2720 igfxpx32.exe 30 PID 2720 wrote to memory of 2484 2720 igfxpx32.exe 30 PID 2720 wrote to memory of 2484 2720 igfxpx32.exe 30 PID 2720 wrote to memory of 2484 2720 igfxpx32.exe 30 PID 2484 wrote to memory of 2540 2484 igfxpx32.exe 31 PID 2484 wrote to memory of 2540 2484 igfxpx32.exe 31 PID 2484 wrote to memory of 2540 2484 igfxpx32.exe 31 PID 2484 wrote to memory of 2540 2484 igfxpx32.exe 31 PID 2540 wrote to memory of 2788 2540 igfxpx32.exe 32 PID 2540 wrote to memory of 2788 2540 igfxpx32.exe 32 PID 2540 wrote to memory of 2788 2540 igfxpx32.exe 32 PID 2540 wrote to memory of 2788 2540 igfxpx32.exe 32 PID 2788 wrote to memory of 2376 2788 igfxpx32.exe 33 PID 2788 wrote to memory of 2376 2788 igfxpx32.exe 33 PID 2788 wrote to memory of 2376 2788 igfxpx32.exe 33 PID 2788 wrote to memory of 2376 2788 igfxpx32.exe 33 PID 2376 wrote to memory of 2172 2376 igfxpx32.exe 34 PID 2376 wrote to memory of 2172 2376 igfxpx32.exe 34 PID 2376 wrote to memory of 2172 2376 igfxpx32.exe 34 PID 2376 wrote to memory of 2172 2376 igfxpx32.exe 34 PID 2172 wrote to memory of 2380 2172 igfxpx32.exe 35 PID 2172 wrote to memory of 2380 2172 igfxpx32.exe 35 PID 2172 wrote to memory of 2380 2172 igfxpx32.exe 35 PID 2172 wrote to memory of 2380 2172 igfxpx32.exe 35 PID 2380 wrote to memory of 2176 2380 igfxpx32.exe 36 PID 2380 wrote to memory of 2176 2380 igfxpx32.exe 36 PID 2380 wrote to memory of 2176 2380 igfxpx32.exe 36 PID 2380 wrote to memory of 2176 2380 igfxpx32.exe 36 PID 2176 wrote to memory of 3016 2176 igfxpx32.exe 37 PID 2176 wrote to memory of 3016 2176 igfxpx32.exe 37 PID 2176 wrote to memory of 3016 2176 igfxpx32.exe 37 PID 2176 wrote to memory of 3016 2176 igfxpx32.exe 37 PID 3016 wrote to memory of 2912 3016 igfxpx32.exe 38 PID 3016 wrote to memory of 2912 3016 igfxpx32.exe 38 PID 3016 wrote to memory of 2912 3016 igfxpx32.exe 38 PID 3016 wrote to memory of 2912 3016 igfxpx32.exe 38 PID 2912 wrote to memory of 680 2912 igfxpx32.exe 39 PID 2912 wrote to memory of 680 2912 igfxpx32.exe 39 PID 2912 wrote to memory of 680 2912 igfxpx32.exe 39 PID 2912 wrote to memory of 680 2912 igfxpx32.exe 39 PID 680 wrote to memory of 1740 680 igfxpx32.exe 40 PID 680 wrote to memory of 1740 680 igfxpx32.exe 40 PID 680 wrote to memory of 1740 680 igfxpx32.exe 40 PID 680 wrote to memory of 1740 680 igfxpx32.exe 40 PID 1740 wrote to memory of 1244 1740 igfxpx32.exe 41 PID 1740 wrote to memory of 1244 1740 igfxpx32.exe 41 PID 1740 wrote to memory of 1244 1740 igfxpx32.exe 41 PID 1740 wrote to memory of 1244 1740 igfxpx32.exe 41 PID 1244 wrote to memory of 2348 1244 igfxpx32.exe 42 PID 1244 wrote to memory of 2348 1244 igfxpx32.exe 42 PID 1244 wrote to memory of 2348 1244 igfxpx32.exe 42 PID 1244 wrote to memory of 2348 1244 igfxpx32.exe 42 PID 2348 wrote to memory of 1976 2348 igfxpx32.exe 43 PID 2348 wrote to memory of 1976 2348 igfxpx32.exe 43 PID 2348 wrote to memory of 1976 2348 igfxpx32.exe 43 PID 2348 wrote to memory of 1976 2348 igfxpx32.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\27839c95f6b9e8880490863d3f2b34bf_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\27839c95f6b9e8880490863d3f2b34bf_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\SysWOW64\igfxpx32.exe"C:\Windows\system32\igfxpx32.exe" C:\Users\Admin\AppData\Local\Temp\27839C~1.EXE2⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\SysWOW64\igfxpx32.exe"C:\Windows\system32\igfxpx32.exe" C:\Windows\SysWOW64\igfxpx32.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\SysWOW64\igfxpx32.exe"C:\Windows\system32\igfxpx32.exe" C:\Windows\SysWOW64\igfxpx32.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\SysWOW64\igfxpx32.exe"C:\Windows\system32\igfxpx32.exe" C:\Windows\SysWOW64\igfxpx32.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\SysWOW64\igfxpx32.exe"C:\Windows\system32\igfxpx32.exe" C:\Windows\SysWOW64\igfxpx32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\SysWOW64\igfxpx32.exe"C:\Windows\system32\igfxpx32.exe" C:\Windows\SysWOW64\igfxpx32.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\SysWOW64\igfxpx32.exe"C:\Windows\system32\igfxpx32.exe" C:\Windows\SysWOW64\igfxpx32.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Windows\SysWOW64\igfxpx32.exe"C:\Windows\system32\igfxpx32.exe" C:\Windows\SysWOW64\igfxpx32.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Windows\SysWOW64\igfxpx32.exe"C:\Windows\system32\igfxpx32.exe" C:\Windows\SysWOW64\igfxpx32.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Windows\SysWOW64\igfxpx32.exe"C:\Windows\system32\igfxpx32.exe" C:\Windows\SysWOW64\igfxpx32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Windows\SysWOW64\igfxpx32.exe"C:\Windows\system32\igfxpx32.exe" C:\Windows\SysWOW64\igfxpx32.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\SysWOW64\igfxpx32.exe"C:\Windows\system32\igfxpx32.exe" C:\Windows\SysWOW64\igfxpx32.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:680 -
C:\Windows\SysWOW64\igfxpx32.exe"C:\Windows\system32\igfxpx32.exe" C:\Windows\SysWOW64\igfxpx32.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\SysWOW64\igfxpx32.exe"C:\Windows\system32\igfxpx32.exe" C:\Windows\SysWOW64\igfxpx32.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Windows\SysWOW64\igfxpx32.exe"C:\Windows\system32\igfxpx32.exe" C:\Windows\SysWOW64\igfxpx32.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Windows\SysWOW64\igfxpx32.exe"C:\Windows\system32\igfxpx32.exe" C:\Windows\SysWOW64\igfxpx32.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1976 -
C:\Windows\SysWOW64\igfxpx32.exe"C:\Windows\system32\igfxpx32.exe" C:\Windows\SysWOW64\igfxpx32.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:916 -
C:\Windows\SysWOW64\igfxpx32.exe"C:\Windows\system32\igfxpx32.exe" C:\Windows\SysWOW64\igfxpx32.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2004 -
C:\Windows\SysWOW64\igfxpx32.exe"C:\Windows\system32\igfxpx32.exe" C:\Windows\SysWOW64\igfxpx32.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:2168 -
C:\Windows\SysWOW64\igfxpx32.exe"C:\Windows\system32\igfxpx32.exe" C:\Windows\SysWOW64\igfxpx32.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:904 -
C:\Windows\SysWOW64\igfxpx32.exe"C:\Windows\system32\igfxpx32.exe" C:\Windows\SysWOW64\igfxpx32.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2596 -
C:\Windows\SysWOW64\igfxpx32.exe"C:\Windows\system32\igfxpx32.exe" C:\Windows\SysWOW64\igfxpx32.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1868 -
C:\Windows\SysWOW64\igfxpx32.exe"C:\Windows\system32\igfxpx32.exe" C:\Windows\SysWOW64\igfxpx32.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2524 -
C:\Windows\SysWOW64\igfxpx32.exe"C:\Windows\system32\igfxpx32.exe" C:\Windows\SysWOW64\igfxpx32.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2512 -
C:\Windows\SysWOW64\igfxpx32.exe"C:\Windows\system32\igfxpx32.exe" C:\Windows\SysWOW64\igfxpx32.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2044 -
C:\Windows\SysWOW64\igfxpx32.exe"C:\Windows\system32\igfxpx32.exe" C:\Windows\SysWOW64\igfxpx32.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2592 -
C:\Windows\SysWOW64\igfxpx32.exe"C:\Windows\system32\igfxpx32.exe" C:\Windows\SysWOW64\igfxpx32.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:776 -
C:\Windows\SysWOW64\igfxpx32.exe"C:\Windows\system32\igfxpx32.exe" C:\Windows\SysWOW64\igfxpx32.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1552 -
C:\Windows\SysWOW64\igfxpx32.exe"C:\Windows\system32\igfxpx32.exe" C:\Windows\SysWOW64\igfxpx32.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:1764 -
C:\Windows\SysWOW64\igfxpx32.exe"C:\Windows\system32\igfxpx32.exe" C:\Windows\SysWOW64\igfxpx32.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1556 -
C:\Windows\SysWOW64\igfxpx32.exe"C:\Windows\system32\igfxpx32.exe" C:\Windows\SysWOW64\igfxpx32.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:3004 -
C:\Windows\SysWOW64\igfxpx32.exe"C:\Windows\system32\igfxpx32.exe" C:\Windows\SysWOW64\igfxpx32.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1548 -
C:\Windows\SysWOW64\igfxpx32.exe"C:\Windows\system32\igfxpx32.exe" C:\Windows\SysWOW64\igfxpx32.exe34⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
PID:2112 -
C:\Windows\SysWOW64\igfxpx32.exe"C:\Windows\system32\igfxpx32.exe" C:\Windows\SysWOW64\igfxpx32.exe35⤵
- Executes dropped EXE
- Maps connected drives based on registry
PID:2052 -
C:\Windows\SysWOW64\igfxpx32.exe"C:\Windows\system32\igfxpx32.exe" C:\Windows\SysWOW64\igfxpx32.exe36⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
PID:2036 -
C:\Windows\SysWOW64\igfxpx32.exe"C:\Windows\system32\igfxpx32.exe" C:\Windows\SysWOW64\igfxpx32.exe37⤵
- Executes dropped EXE
PID:1800 -
C:\Windows\SysWOW64\igfxpx32.exe"C:\Windows\system32\igfxpx32.exe" C:\Windows\SysWOW64\igfxpx32.exe38⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
PID:1576 -
C:\Windows\SysWOW64\igfxpx32.exe"C:\Windows\system32\igfxpx32.exe" C:\Windows\SysWOW64\igfxpx32.exe39⤵
- Executes dropped EXE
- Maps connected drives based on registry
PID:748 -
C:\Windows\SysWOW64\igfxpx32.exe"C:\Windows\system32\igfxpx32.exe" C:\Windows\SysWOW64\igfxpx32.exe40⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1508 -
C:\Windows\SysWOW64\igfxpx32.exe"C:\Windows\system32\igfxpx32.exe" C:\Windows\SysWOW64\igfxpx32.exe41⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
PID:2348 -
C:\Windows\SysWOW64\igfxpx32.exe"C:\Windows\system32\igfxpx32.exe" C:\Windows\SysWOW64\igfxpx32.exe42⤵
- Executes dropped EXE
- Maps connected drives based on registry
PID:1596 -
C:\Windows\SysWOW64\igfxpx32.exe"C:\Windows\system32\igfxpx32.exe" C:\Windows\SysWOW64\igfxpx32.exe43⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
PID:2336 -
C:\Windows\SysWOW64\igfxpx32.exe"C:\Windows\system32\igfxpx32.exe" C:\Windows\SysWOW64\igfxpx32.exe44⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
PID:2364 -
C:\Windows\SysWOW64\igfxpx32.exe"C:\Windows\system32\igfxpx32.exe" C:\Windows\SysWOW64\igfxpx32.exe45⤵
- Executes dropped EXE
- Maps connected drives based on registry
PID:2208 -
C:\Windows\SysWOW64\igfxpx32.exe"C:\Windows\system32\igfxpx32.exe" C:\Windows\SysWOW64\igfxpx32.exe46⤵
- Executes dropped EXE
- Maps connected drives based on registry
PID:1988 -
C:\Windows\SysWOW64\igfxpx32.exe"C:\Windows\system32\igfxpx32.exe" C:\Windows\SysWOW64\igfxpx32.exe47⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
PID:1880 -
C:\Windows\SysWOW64\igfxpx32.exe"C:\Windows\system32\igfxpx32.exe" C:\Windows\SysWOW64\igfxpx32.exe48⤵
- Executes dropped EXE
PID:1688 -
C:\Windows\SysWOW64\igfxpx32.exe"C:\Windows\system32\igfxpx32.exe" C:\Windows\SysWOW64\igfxpx32.exe49⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
PID:2744 -
C:\Windows\SysWOW64\igfxpx32.exe"C:\Windows\system32\igfxpx32.exe" C:\Windows\SysWOW64\igfxpx32.exe50⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
PID:2508 -
C:\Windows\SysWOW64\igfxpx32.exe"C:\Windows\system32\igfxpx32.exe" C:\Windows\SysWOW64\igfxpx32.exe51⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
PID:2504 -
C:\Windows\SysWOW64\igfxpx32.exe"C:\Windows\system32\igfxpx32.exe" C:\Windows\SysWOW64\igfxpx32.exe52⤵
- Executes dropped EXE
- Maps connected drives based on registry
PID:1932 -
C:\Windows\SysWOW64\igfxpx32.exe"C:\Windows\system32\igfxpx32.exe" C:\Windows\SysWOW64\igfxpx32.exe53⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
PID:2800 -
C:\Windows\SysWOW64\igfxpx32.exe"C:\Windows\system32\igfxpx32.exe" C:\Windows\SysWOW64\igfxpx32.exe54⤵
- Executes dropped EXE
- Maps connected drives based on registry
PID:2864 -
C:\Windows\SysWOW64\igfxpx32.exe"C:\Windows\system32\igfxpx32.exe" C:\Windows\SysWOW64\igfxpx32.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1884 -
C:\Windows\SysWOW64\igfxpx32.exe"C:\Windows\system32\igfxpx32.exe" C:\Windows\SysWOW64\igfxpx32.exe56⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
PID:2408 -
C:\Windows\SysWOW64\igfxpx32.exe"C:\Windows\system32\igfxpx32.exe" C:\Windows\SysWOW64\igfxpx32.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2136 -
C:\Windows\SysWOW64\igfxpx32.exe"C:\Windows\system32\igfxpx32.exe" C:\Windows\SysWOW64\igfxpx32.exe58⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
PID:2944 -
C:\Windows\SysWOW64\igfxpx32.exe"C:\Windows\system32\igfxpx32.exe" C:\Windows\SysWOW64\igfxpx32.exe59⤵
- Executes dropped EXE
PID:2548 -
C:\Windows\SysWOW64\igfxpx32.exe"C:\Windows\system32\igfxpx32.exe" C:\Windows\SysWOW64\igfxpx32.exe60⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1444 -
C:\Windows\SysWOW64\igfxpx32.exe"C:\Windows\system32\igfxpx32.exe" C:\Windows\SysWOW64\igfxpx32.exe61⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
PID:2784 -
C:\Windows\SysWOW64\igfxpx32.exe"C:\Windows\system32\igfxpx32.exe" C:\Windows\SysWOW64\igfxpx32.exe62⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
PID:356 -
C:\Windows\SysWOW64\igfxpx32.exe"C:\Windows\system32\igfxpx32.exe" C:\Windows\SysWOW64\igfxpx32.exe63⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
PID:484 -
C:\Windows\SysWOW64\igfxpx32.exe"C:\Windows\system32\igfxpx32.exe" C:\Windows\SysWOW64\igfxpx32.exe64⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
PID:956 -
C:\Windows\SysWOW64\igfxpx32.exe"C:\Windows\system32\igfxpx32.exe" C:\Windows\SysWOW64\igfxpx32.exe65⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
PID:2460 -
C:\Windows\SysWOW64\igfxpx32.exe"C:\Windows\system32\igfxpx32.exe" C:\Windows\SysWOW64\igfxpx32.exe66⤵
- Drops file in System32 directory
PID:1712 -
C:\Windows\SysWOW64\igfxpx32.exe"C:\Windows\system32\igfxpx32.exe" C:\Windows\SysWOW64\igfxpx32.exe67⤵
- Drops file in System32 directory
PID:1956 -
C:\Windows\SysWOW64\igfxpx32.exe"C:\Windows\system32\igfxpx32.exe" C:\Windows\SysWOW64\igfxpx32.exe68⤵
- Maps connected drives based on registry
- Drops file in System32 directory
PID:1544 -
C:\Windows\SysWOW64\igfxpx32.exe"C:\Windows\system32\igfxpx32.exe" C:\Windows\SysWOW64\igfxpx32.exe69⤵
- Maps connected drives based on registry
PID:1872
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
200KB
MD527839c95f6b9e8880490863d3f2b34bf
SHA1311903d366ce09b2de0f0cdc482c06ec7414871f
SHA2563669b7a140bd6a99ab15c276044875c80b00b70a10e7813913bbba62dda20e36
SHA512dc02a72d5daf6bb7213f5c8adeda92f3898bedf4a974426c5b75a34d87657e2c5b5f71be577921cf451eae2d9bdce3f3eb3fe2be2a5b77e8c6592d42ad470a6c