metasploit | f53ec0d23818613b780d630e985a96cc27f8c15206bca27480fce13f24b134ea

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/01/2025, 06:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_02bcd02ac649b47c88df945125551f16.exe
Size

224KB
MD5

02bcd02ac649b47c88df945125551f16
SHA1

431a617ff4ff5a5ba599262eec35073fca7f79bd
SHA256

f53ec0d23818613b780d630e985a96cc27f8c15206bca27480fce13f24b134ea
SHA512

046daf4b9732bbf237b541c4fdc88ed0461e20466712cd5ae5359180c78c497c1c7e980cf2f767d92cc98da8db39a0bed9f049ed216f8b6c86344114708faf40
SSDEEP

6144:uqvXfDrFUBEUOK6ielBslV35zErFUBEUOK6+:VrV1B0dErVi

Score

10^/10

metasploit backdoor discovery trojan upx

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Metasploit family
metasploit

Deletes itself 1 IoCs

pid	Process
2644	igfxsvr64.exe

Executes dropped EXE 64 IoCs

pid	Process
2948	igfxsvr64.exe
2644	igfxsvr64.exe
2308	igfxsvr64.exe
2840	igfxsvr64.exe
2504	igfxsvr64.exe
264	igfxsvr64.exe
2296	igfxsvr64.exe
2956	igfxsvr64.exe
1848	igfxsvr64.exe
1152	igfxsvr64.exe
1140	igfxsvr64.exe
2420	igfxsvr64.exe
2180	igfxsvr64.exe
1108	igfxsvr64.exe
956	igfxsvr64.exe
2292	igfxsvr64.exe
924	igfxsvr64.exe
1996	igfxsvr64.exe
536	igfxsvr64.exe
1012	igfxsvr64.exe
2348	igfxsvr64.exe
2812	igfxsvr64.exe
2732	igfxsvr64.exe
2584	igfxsvr64.exe
2712	igfxsvr64.exe
1792	igfxsvr64.exe
1976	igfxsvr64.exe
2936	igfxsvr64.exe
2324	igfxsvr64.exe
2864	igfxsvr64.exe
620	igfxsvr64.exe
1904	igfxsvr64.exe
2240	igfxsvr64.exe
2052	igfxsvr64.exe
2780	igfxsvr64.exe
1040	igfxsvr64.exe
1448	igfxsvr64.exe
296	igfxsvr64.exe
1344	igfxsvr64.exe
600	igfxsvr64.exe
564	igfxsvr64.exe
1676	igfxsvr64.exe
1740	igfxsvr64.exe
1692	igfxsvr64.exe
2748	igfxsvr64.exe
2892	igfxsvr64.exe
2980	igfxsvr64.exe
2616	igfxsvr64.exe
1920	igfxsvr64.exe
2996	igfxsvr64.exe
2416	igfxsvr64.exe
352	igfxsvr64.exe
2988	igfxsvr64.exe
2700	igfxsvr64.exe
2280	igfxsvr64.exe
2868	igfxsvr64.exe
2104	igfxsvr64.exe
1848	igfxsvr64.exe
808	igfxsvr64.exe
3048	igfxsvr64.exe
2252	igfxsvr64.exe
1956	igfxsvr64.exe
1396	igfxsvr64.exe
1252	igfxsvr64.exe

Loads dropped DLL 64 IoCs

pid	Process
2756	JaffaCakes118_02bcd02ac649b47c88df945125551f16.exe
2756	JaffaCakes118_02bcd02ac649b47c88df945125551f16.exe
2644	igfxsvr64.exe
2644	igfxsvr64.exe
2840	igfxsvr64.exe
2840	igfxsvr64.exe
264	igfxsvr64.exe
264	igfxsvr64.exe
2956	igfxsvr64.exe
2956	igfxsvr64.exe
1152	igfxsvr64.exe
1152	igfxsvr64.exe
2420	igfxsvr64.exe
2420	igfxsvr64.exe
1108	igfxsvr64.exe
1108	igfxsvr64.exe
2292	igfxsvr64.exe
2292	igfxsvr64.exe
1996	igfxsvr64.exe
1996	igfxsvr64.exe
1012	igfxsvr64.exe
1012	igfxsvr64.exe
2812	igfxsvr64.exe
2812	igfxsvr64.exe
2584	igfxsvr64.exe
2584	igfxsvr64.exe
1792	igfxsvr64.exe
1792	igfxsvr64.exe
2936	igfxsvr64.exe
2936	igfxsvr64.exe
2864	igfxsvr64.exe
2864	igfxsvr64.exe
1904	igfxsvr64.exe
1904	igfxsvr64.exe
2052	igfxsvr64.exe
2052	igfxsvr64.exe
1040	igfxsvr64.exe
1040	igfxsvr64.exe
296	igfxsvr64.exe
296	igfxsvr64.exe
600	igfxsvr64.exe
600	igfxsvr64.exe
1676	igfxsvr64.exe
1676	igfxsvr64.exe
1692	igfxsvr64.exe
1692	igfxsvr64.exe
2892	igfxsvr64.exe
2892	igfxsvr64.exe
2616	igfxsvr64.exe
2616	igfxsvr64.exe
2996	igfxsvr64.exe
2996	igfxsvr64.exe
352	igfxsvr64.exe
352	igfxsvr64.exe
2700	igfxsvr64.exe
2700	igfxsvr64.exe
2868	igfxsvr64.exe
2868	igfxsvr64.exe
1848	igfxsvr64.exe
1848	igfxsvr64.exe
3048	igfxsvr64.exe
3048	igfxsvr64.exe
1956	igfxsvr64.exe
1956	igfxsvr64.exe

Maps connected drives based on registry 3 TTPs 64 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxsvr64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxsvr64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxsvr64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxsvr64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	JaffaCakes118_02bcd02ac649b47c88df945125551f16.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxsvr64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxsvr64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxsvr64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxsvr64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxsvr64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxsvr64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxsvr64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxsvr64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxsvr64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxsvr64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxsvr64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxsvr64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxsvr64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxsvr64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxsvr64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxsvr64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxsvr64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxsvr64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxsvr64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxsvr64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxsvr64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxsvr64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxsvr64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxsvr64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxsvr64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxsvr64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxsvr64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxsvr64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxsvr64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxsvr64.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\	JaffaCakes118_02bcd02ac649b47c88df945125551f16.exe
File opened for modification	C:\Windows\SysWOW64\igfxsvr64.exe	igfxsvr64.exe
File opened for modification	C:\Windows\SysWOW64\igfxsvr64.exe	igfxsvr64.exe
File opened for modification	C:\Windows\SysWOW64\igfxsvr64.exe	igfxsvr64.exe
File opened for modification	C:\Windows\SysWOW64\igfxsvr64.exe	igfxsvr64.exe
File opened for modification	C:\Windows\SysWOW64\	igfxsvr64.exe
File opened for modification	C:\Windows\SysWOW64\igfxsvr64.exe	igfxsvr64.exe
File created	C:\Windows\SysWOW64\igfxsvr64.exe	igfxsvr64.exe
File opened for modification	C:\Windows\SysWOW64\	igfxsvr64.exe
File created	C:\Windows\SysWOW64\igfxsvr64.exe	igfxsvr64.exe
File opened for modification	C:\Windows\SysWOW64\	igfxsvr64.exe
File created	C:\Windows\SysWOW64\igfxsvr64.exe	igfxsvr64.exe
File created	C:\Windows\SysWOW64\igfxsvr64.exe	igfxsvr64.exe
File created	C:\Windows\SysWOW64\igfxsvr64.exe	igfxsvr64.exe
File opened for modification	C:\Windows\SysWOW64\	igfxsvr64.exe
File opened for modification	C:\Windows\SysWOW64\igfxsvr64.exe	igfxsvr64.exe
File opened for modification	C:\Windows\SysWOW64\igfxsvr64.exe	igfxsvr64.exe
File opened for modification	C:\Windows\SysWOW64\igfxsvr64.exe	igfxsvr64.exe
File opened for modification	C:\Windows\SysWOW64\	igfxsvr64.exe
File opened for modification	C:\Windows\SysWOW64\	igfxsvr64.exe
File created	C:\Windows\SysWOW64\igfxsvr64.exe	igfxsvr64.exe
File opened for modification	C:\Windows\SysWOW64\igfxsvr64.exe	igfxsvr64.exe
File created	C:\Windows\SysWOW64\igfxsvr64.exe	igfxsvr64.exe
File opened for modification	C:\Windows\SysWOW64\	igfxsvr64.exe
File opened for modification	C:\Windows\SysWOW64\	igfxsvr64.exe
File opened for modification	C:\Windows\SysWOW64\	igfxsvr64.exe
File opened for modification	C:\Windows\SysWOW64\	igfxsvr64.exe
File opened for modification	C:\Windows\SysWOW64\	igfxsvr64.exe
File opened for modification	C:\Windows\SysWOW64\	igfxsvr64.exe
File created	C:\Windows\SysWOW64\igfxsvr64.exe	igfxsvr64.exe
File opened for modification	C:\Windows\SysWOW64\	igfxsvr64.exe
File opened for modification	C:\Windows\SysWOW64\igfxsvr64.exe	igfxsvr64.exe
File opened for modification	C:\Windows\SysWOW64\igfxsvr64.exe	igfxsvr64.exe
File created	C:\Windows\SysWOW64\igfxsvr64.exe	igfxsvr64.exe
File created	C:\Windows\SysWOW64\igfxsvr64.exe	igfxsvr64.exe
File opened for modification	C:\Windows\SysWOW64\igfxsvr64.exe	igfxsvr64.exe
File created	C:\Windows\SysWOW64\igfxsvr64.exe	igfxsvr64.exe
File opened for modification	C:\Windows\SysWOW64\	igfxsvr64.exe
File created	C:\Windows\SysWOW64\igfxsvr64.exe	igfxsvr64.exe
File opened for modification	C:\Windows\SysWOW64\igfxsvr64.exe	igfxsvr64.exe
File opened for modification	C:\Windows\SysWOW64\igfxsvr64.exe	igfxsvr64.exe
File opened for modification	C:\Windows\SysWOW64\igfxsvr64.exe	igfxsvr64.exe
File created	C:\Windows\SysWOW64\igfxsvr64.exe	igfxsvr64.exe
File opened for modification	C:\Windows\SysWOW64\igfxsvr64.exe	JaffaCakes118_02bcd02ac649b47c88df945125551f16.exe
File opened for modification	C:\Windows\SysWOW64\igfxsvr64.exe	igfxsvr64.exe
File opened for modification	C:\Windows\SysWOW64\	igfxsvr64.exe
File created	C:\Windows\SysWOW64\igfxsvr64.exe	igfxsvr64.exe
File created	C:\Windows\SysWOW64\igfxsvr64.exe	igfxsvr64.exe
File opened for modification	C:\Windows\SysWOW64\	igfxsvr64.exe
File created	C:\Windows\SysWOW64\igfxsvr64.exe	igfxsvr64.exe
File opened for modification	C:\Windows\SysWOW64\igfxsvr64.exe	igfxsvr64.exe
File opened for modification	C:\Windows\SysWOW64\igfxsvr64.exe	igfxsvr64.exe
File opened for modification	C:\Windows\SysWOW64\	igfxsvr64.exe
File created	C:\Windows\SysWOW64\igfxsvr64.exe	igfxsvr64.exe
File opened for modification	C:\Windows\SysWOW64\igfxsvr64.exe	igfxsvr64.exe
File opened for modification	C:\Windows\SysWOW64\igfxsvr64.exe	igfxsvr64.exe
File opened for modification	C:\Windows\SysWOW64\	igfxsvr64.exe
File opened for modification	C:\Windows\SysWOW64\	igfxsvr64.exe
File created	C:\Windows\SysWOW64\igfxsvr64.exe	igfxsvr64.exe
File created	C:\Windows\SysWOW64\igfxsvr64.exe	igfxsvr64.exe
File opened for modification	C:\Windows\SysWOW64\	igfxsvr64.exe
File opened for modification	C:\Windows\SysWOW64\	igfxsvr64.exe
File created	C:\Windows\SysWOW64\igfxsvr64.exe	igfxsvr64.exe
File opened for modification	C:\Windows\SysWOW64\igfxsvr64.exe	igfxsvr64.exe

Suspicious use of SetThreadContext 60 IoCs

description	pid	Process	procid_target
PID 2448 set thread context of 2756	2448	JaffaCakes118_02bcd02ac649b47c88df945125551f16.exe	30
PID 2948 set thread context of 2644	2948	igfxsvr64.exe	32
PID 2308 set thread context of 2840	2308	igfxsvr64.exe	34
PID 2504 set thread context of 264	2504	igfxsvr64.exe	36
PID 2296 set thread context of 2956	2296	igfxsvr64.exe	38
PID 1848 set thread context of 1152	1848	igfxsvr64.exe	40
PID 1140 set thread context of 2420	1140	igfxsvr64.exe	42
PID 2180 set thread context of 1108	2180	igfxsvr64.exe	44
PID 956 set thread context of 2292	956	igfxsvr64.exe	46
PID 924 set thread context of 1996	924	igfxsvr64.exe	49
PID 536 set thread context of 1012	536	igfxsvr64.exe	51
PID 2348 set thread context of 2812	2348	igfxsvr64.exe	53
PID 2732 set thread context of 2584	2732	igfxsvr64.exe	55
PID 2712 set thread context of 1792	2712	igfxsvr64.exe	57
PID 1976 set thread context of 2936	1976	igfxsvr64.exe	59
PID 2324 set thread context of 2864	2324	igfxsvr64.exe	61
PID 620 set thread context of 1904	620	igfxsvr64.exe	63
PID 2240 set thread context of 2052	2240	igfxsvr64.exe	65
PID 2780 set thread context of 1040	2780	igfxsvr64.exe	67
PID 1448 set thread context of 296	1448	igfxsvr64.exe	69
PID 1344 set thread context of 600	1344	igfxsvr64.exe	71
PID 564 set thread context of 1676	564	igfxsvr64.exe	73
PID 1740 set thread context of 1692	1740	igfxsvr64.exe	75
PID 2748 set thread context of 2892	2748	igfxsvr64.exe	77
PID 2980 set thread context of 2616	2980	igfxsvr64.exe	79
PID 1920 set thread context of 2996	1920	igfxsvr64.exe	81
PID 2416 set thread context of 352	2416	igfxsvr64.exe	83
PID 2988 set thread context of 2700	2988	igfxsvr64.exe	85
PID 2280 set thread context of 2868	2280	igfxsvr64.exe	87
PID 2104 set thread context of 1848	2104	igfxsvr64.exe	89
PID 808 set thread context of 3048	808	igfxsvr64.exe	91
PID 2252 set thread context of 1956	2252	igfxsvr64.exe	93
PID 1396 set thread context of 1252	1396	igfxsvr64.exe	95
PID 924 set thread context of 640	924	igfxsvr64.exe	97
PID 332 set thread context of 3068	332	igfxsvr64.exe	99
PID 2740 set thread context of 2496	2740	igfxsvr64.exe	101
PID 2732 set thread context of 3024	2732	igfxsvr64.exe	103
PID 2712 set thread context of 2012	2712	igfxsvr64.exe	105
PID 532 set thread context of 2516	532	igfxsvr64.exe	107
PID 2932 set thread context of 2760	2932	igfxsvr64.exe	109
PID 2324 set thread context of 1316	2324	igfxsvr64.exe	111
PID 604 set thread context of 2444	604	igfxsvr64.exe	113
PID 2576 set thread context of 2340	2576	igfxsvr64.exe	115
PID 2016 set thread context of 1336	2016	igfxsvr64.exe	117
PID 688 set thread context of 1396	688	igfxsvr64.exe	119
PID 2392 set thread context of 3064	2392	igfxsvr64.exe	121
PID 1588 set thread context of 1584	1588	igfxsvr64.exe	123
PID 2748 set thread context of 2808	2748	igfxsvr64.exe	125
PID 2628 set thread context of 1256	2628	igfxsvr64.exe	127
PID 1612 set thread context of 2076	1612	igfxsvr64.exe	129
PID 2272 set thread context of 2156	2272	igfxsvr64.exe	131
PID 1928 set thread context of 2328	1928	igfxsvr64.exe	133
PID 2128 set thread context of 2944	2128	igfxsvr64.exe	135
PID 2436 set thread context of 2240	2436	igfxsvr64.exe	137
PID 748 set thread context of 2064	748	igfxsvr64.exe	139
PID 1736 set thread context of 956	1736	igfxsvr64.exe	141
PID 896 set thread context of 2336	896	igfxsvr64.exe	143
PID 2384 set thread context of 1932	2384	igfxsvr64.exe	145
PID 1580 set thread context of 920	1580	igfxsvr64.exe	147
PID 2624 set thread context of 2592	2624	igfxsvr64.exe	149

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2756-8-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/2756-11-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/2756-13-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/2756-12-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/2756-10-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/2756-5-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/2756-4-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/2756-26-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/2644-38-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/2644-40-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/2644-39-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/2644-48-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/2840-56-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/2840-64-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/264-76-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/264-82-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/2956-100-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/1152-121-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/2420-140-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/1108-149-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/1108-159-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/2292-167-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/2292-177-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/1996-194-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/1012-206-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/1012-213-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/2812-233-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/2584-250-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/1792-264-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/1792-270-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/2936-284-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/2936-287-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/2864-297-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/2864-302-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/1904-312-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/1904-317-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/2052-331-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/1040-341-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/1040-346-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/296-355-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/296-361-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/600-376-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/1676-389-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/1692-403-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/2892-417-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/2616-431-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/2996-445-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/352-460-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/2700-473-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/2868-488-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/1848-496-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/1848-502-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/3048-516-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/1956-530-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/1252-540-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/1252-545-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/640-559-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/3068-571-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/3068-574-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/2496-582-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/2496-591-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/3024-603-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/3024-606-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/2012-616-0x0000000000400000-0x000000000045E000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_02bcd02ac649b47c88df945125551f16.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxsvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxsvr64.exe

Suspicious behavior: EnumeratesProcesses 59 IoCs

pid	Process
2756	JaffaCakes118_02bcd02ac649b47c88df945125551f16.exe
2644	igfxsvr64.exe
2840	igfxsvr64.exe
264	igfxsvr64.exe
2956	igfxsvr64.exe
1152	igfxsvr64.exe
2420	igfxsvr64.exe
1108	igfxsvr64.exe
2292	igfxsvr64.exe
1996	igfxsvr64.exe
1012	igfxsvr64.exe
2812	igfxsvr64.exe
2584	igfxsvr64.exe
1792	igfxsvr64.exe
2936	igfxsvr64.exe
2864	igfxsvr64.exe
1904	igfxsvr64.exe
2052	igfxsvr64.exe
1040	igfxsvr64.exe
296	igfxsvr64.exe
600	igfxsvr64.exe
1676	igfxsvr64.exe
1692	igfxsvr64.exe
2892	igfxsvr64.exe
2616	igfxsvr64.exe
2996	igfxsvr64.exe
352	igfxsvr64.exe
2700	igfxsvr64.exe
2868	igfxsvr64.exe
1848	igfxsvr64.exe
3048	igfxsvr64.exe
1956	igfxsvr64.exe
1252	igfxsvr64.exe
640	igfxsvr64.exe
3068	igfxsvr64.exe
3024	igfxsvr64.exe
2012	igfxsvr64.exe
2516	igfxsvr64.exe
2760	igfxsvr64.exe
1316	igfxsvr64.exe
2444	igfxsvr64.exe
2340	igfxsvr64.exe
1336	igfxsvr64.exe
1396	igfxsvr64.exe
3064	igfxsvr64.exe
1584	igfxsvr64.exe
2808	igfxsvr64.exe
1256	igfxsvr64.exe
2076	igfxsvr64.exe
2156	igfxsvr64.exe
2328	igfxsvr64.exe
2944	igfxsvr64.exe
2240	igfxsvr64.exe
2064	igfxsvr64.exe
956	igfxsvr64.exe
2336	igfxsvr64.exe
1932	igfxsvr64.exe
920	igfxsvr64.exe
2592	igfxsvr64.exe

Suspicious use of SetWindowsHookEx 60 IoCs

pid	Process
2448	JaffaCakes118_02bcd02ac649b47c88df945125551f16.exe
2948	igfxsvr64.exe
2308	igfxsvr64.exe
2504	igfxsvr64.exe
2296	igfxsvr64.exe
1848	igfxsvr64.exe
1140	igfxsvr64.exe
2180	igfxsvr64.exe
956	igfxsvr64.exe
924	igfxsvr64.exe
536	igfxsvr64.exe
2348	igfxsvr64.exe
2732	igfxsvr64.exe
2712	igfxsvr64.exe
1976	igfxsvr64.exe
2324	igfxsvr64.exe
620	igfxsvr64.exe
2240	igfxsvr64.exe
2780	igfxsvr64.exe
1448	igfxsvr64.exe
1344	igfxsvr64.exe
564	igfxsvr64.exe
1740	igfxsvr64.exe
2748	igfxsvr64.exe
2980	igfxsvr64.exe
1920	igfxsvr64.exe
2416	igfxsvr64.exe
2988	igfxsvr64.exe
2280	igfxsvr64.exe
2104	igfxsvr64.exe
808	igfxsvr64.exe
2252	igfxsvr64.exe
1396	igfxsvr64.exe
924	igfxsvr64.exe
332	igfxsvr64.exe
2740	igfxsvr64.exe
2732	igfxsvr64.exe
2712	igfxsvr64.exe
532	igfxsvr64.exe
2932	igfxsvr64.exe
2324	igfxsvr64.exe
604	igfxsvr64.exe
2576	igfxsvr64.exe
2016	igfxsvr64.exe
688	igfxsvr64.exe
2392	igfxsvr64.exe
1588	igfxsvr64.exe
2748	igfxsvr64.exe
2628	igfxsvr64.exe
1612	igfxsvr64.exe
2272	igfxsvr64.exe
1928	igfxsvr64.exe
2128	igfxsvr64.exe
2436	igfxsvr64.exe
748	igfxsvr64.exe
1736	igfxsvr64.exe
896	igfxsvr64.exe
2384	igfxsvr64.exe
1580	igfxsvr64.exe
2624	igfxsvr64.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 2756	2448	JaffaCakes118_02bcd02ac649b47c88df945125551f16.exe	30
PID 2448 wrote to memory of 2756	2448	JaffaCakes118_02bcd02ac649b47c88df945125551f16.exe	30
PID 2448 wrote to memory of 2756	2448	JaffaCakes118_02bcd02ac649b47c88df945125551f16.exe	30
PID 2448 wrote to memory of 2756	2448	JaffaCakes118_02bcd02ac649b47c88df945125551f16.exe	30
PID 2448 wrote to memory of 2756	2448	JaffaCakes118_02bcd02ac649b47c88df945125551f16.exe	30
PID 2448 wrote to memory of 2756	2448	JaffaCakes118_02bcd02ac649b47c88df945125551f16.exe	30
PID 2448 wrote to memory of 2756	2448	JaffaCakes118_02bcd02ac649b47c88df945125551f16.exe	30
PID 2448 wrote to memory of 2756	2448	JaffaCakes118_02bcd02ac649b47c88df945125551f16.exe	30
PID 2756 wrote to memory of 2948	2756	JaffaCakes118_02bcd02ac649b47c88df945125551f16.exe	31
PID 2756 wrote to memory of 2948	2756	JaffaCakes118_02bcd02ac649b47c88df945125551f16.exe	31
PID 2756 wrote to memory of 2948	2756	JaffaCakes118_02bcd02ac649b47c88df945125551f16.exe	31
PID 2756 wrote to memory of 2948	2756	JaffaCakes118_02bcd02ac649b47c88df945125551f16.exe	31
PID 2948 wrote to memory of 2644	2948	igfxsvr64.exe	32
PID 2948 wrote to memory of 2644	2948	igfxsvr64.exe	32
PID 2948 wrote to memory of 2644	2948	igfxsvr64.exe	32
PID 2948 wrote to memory of 2644	2948	igfxsvr64.exe	32
PID 2948 wrote to memory of 2644	2948	igfxsvr64.exe	32
PID 2948 wrote to memory of 2644	2948	igfxsvr64.exe	32
PID 2948 wrote to memory of 2644	2948	igfxsvr64.exe	32
PID 2948 wrote to memory of 2644	2948	igfxsvr64.exe	32
PID 2644 wrote to memory of 2308	2644	igfxsvr64.exe	33
PID 2644 wrote to memory of 2308	2644	igfxsvr64.exe	33
PID 2644 wrote to memory of 2308	2644	igfxsvr64.exe	33
PID 2644 wrote to memory of 2308	2644	igfxsvr64.exe	33
PID 2308 wrote to memory of 2840	2308	igfxsvr64.exe	34
PID 2308 wrote to memory of 2840	2308	igfxsvr64.exe	34
PID 2308 wrote to memory of 2840	2308	igfxsvr64.exe	34
PID 2308 wrote to memory of 2840	2308	igfxsvr64.exe	34
PID 2308 wrote to memory of 2840	2308	igfxsvr64.exe	34
PID 2308 wrote to memory of 2840	2308	igfxsvr64.exe	34
PID 2308 wrote to memory of 2840	2308	igfxsvr64.exe	34
PID 2308 wrote to memory of 2840	2308	igfxsvr64.exe	34
PID 2840 wrote to memory of 2504	2840	igfxsvr64.exe	35
PID 2840 wrote to memory of 2504	2840	igfxsvr64.exe	35
PID 2840 wrote to memory of 2504	2840	igfxsvr64.exe	35
PID 2840 wrote to memory of 2504	2840	igfxsvr64.exe	35
PID 2504 wrote to memory of 264	2504	igfxsvr64.exe	36
PID 2504 wrote to memory of 264	2504	igfxsvr64.exe	36
PID 2504 wrote to memory of 264	2504	igfxsvr64.exe	36
PID 2504 wrote to memory of 264	2504	igfxsvr64.exe	36
PID 2504 wrote to memory of 264	2504	igfxsvr64.exe	36
PID 2504 wrote to memory of 264	2504	igfxsvr64.exe	36
PID 2504 wrote to memory of 264	2504	igfxsvr64.exe	36
PID 2504 wrote to memory of 264	2504	igfxsvr64.exe	36
PID 264 wrote to memory of 2296	264	igfxsvr64.exe	37
PID 264 wrote to memory of 2296	264	igfxsvr64.exe	37
PID 264 wrote to memory of 2296	264	igfxsvr64.exe	37
PID 264 wrote to memory of 2296	264	igfxsvr64.exe	37
PID 2296 wrote to memory of 2956	2296	igfxsvr64.exe	38
PID 2296 wrote to memory of 2956	2296	igfxsvr64.exe	38
PID 2296 wrote to memory of 2956	2296	igfxsvr64.exe	38
PID 2296 wrote to memory of 2956	2296	igfxsvr64.exe	38
PID 2296 wrote to memory of 2956	2296	igfxsvr64.exe	38
PID 2296 wrote to memory of 2956	2296	igfxsvr64.exe	38
PID 2296 wrote to memory of 2956	2296	igfxsvr64.exe	38
PID 2296 wrote to memory of 2956	2296	igfxsvr64.exe	38
PID 2956 wrote to memory of 1848	2956	igfxsvr64.exe	39
PID 2956 wrote to memory of 1848	2956	igfxsvr64.exe	39
PID 2956 wrote to memory of 1848	2956	igfxsvr64.exe	39
PID 2956 wrote to memory of 1848	2956	igfxsvr64.exe	39
PID 1848 wrote to memory of 1152	1848	igfxsvr64.exe	40
PID 1848 wrote to memory of 1152	1848	igfxsvr64.exe	40
PID 1848 wrote to memory of 1152	1848	igfxsvr64.exe	40
PID 1848 wrote to memory of 1152	1848	igfxsvr64.exe	40

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_02bcd02ac649b47c88df945125551f16.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_02bcd02ac649b47c88df945125551f16.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_02bcd02ac649b47c88df945125551f16.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_02bcd02ac649b47c88df945125551f16.exe
  2⤵
  - Loads dropped DLL
  - Maps connected drives based on registry
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2756
- - C:\Windows\SysWOW64\igfxsvr64.exe
    "C:\Windows\system32\igfxsvr64.exe" C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.EXE
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2948
  - - C:\Windows\SysWOW64\igfxsvr64.exe
      "C:\Windows\SysWOW64\igfxsvr64.exe " C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.EXE
      4⤵
      Deletes itself
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2644
    - - C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2308
      - C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2840
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2504
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:264
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2296
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2956
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE
        11⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1848
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE
        12⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1152
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE
        13⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1140
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE
        14⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2420
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE
        15⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2180
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE
        16⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:1108
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE
        17⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:956
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE
        18⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2292
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE
        19⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:924
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE
        20⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1996
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE
        21⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:536
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE
        22⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1012
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE
        23⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2348
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE
        24⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2812
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE
        25⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2732
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE
        26⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2584
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE
        27⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2712
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE
        28⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1792
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE
        29⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1976
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE
        30⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:2936
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE
        31⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2324
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE
        32⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2864
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE
        33⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:620
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE
        34⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1904
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE
        35⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2240
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE
        36⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2052
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE
        37⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2780
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE
        38⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1040
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE
        39⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1448
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE
        40⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:296
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE
        41⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1344
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE
        42⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:600
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE
        43⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:564
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE
        44⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1676
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE
        45⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1740
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE
        46⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1692
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE
        47⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2748
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE
        48⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2892
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE
        49⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2980
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE
        50⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2616
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE
        51⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1920
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE
        52⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2996
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE
        53⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2416
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE
        54⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:352
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE
        55⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2988
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE
        56⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2700
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE
        57⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2280
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE
        58⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2868
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE
        59⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2104
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE
        60⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1848
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE
        61⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:808
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE
        62⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3048
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE
        63⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2252
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE
        64⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1956
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE
        65⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1396
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE
        66⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1252
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE
        67⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:924
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE
        68⤵
        Maps connected drives based on registry
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:640
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE
        69⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:332
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE
        70⤵
        Maps connected drives based on registry
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3068
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE
        71⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2740
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE
        72⤵
        Maps connected drives based on registry
        System Location Discovery: System Language Discovery
        
        PID:2496
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE
        73⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2732
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE
        74⤵
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3024
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE
        75⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2712
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE
        76⤵
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2012
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE
        77⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:532
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE
        78⤵
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2516
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE
        79⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2932
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE
        80⤵
        Maps connected drives based on registry
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2760
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE
        81⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2324
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE
        82⤵
        Maps connected drives based on registry
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1316
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE
        83⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:604
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE
        84⤵
        Maps connected drives based on registry
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2444
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE
        85⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2576
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE
        86⤵
        Maps connected drives based on registry
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2340
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE
        87⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2016
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE
        88⤵
        Maps connected drives based on registry
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1336
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE
        89⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:688
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE
        90⤵
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1396
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE
        91⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2392
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE
        92⤵
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:3064
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE
        93⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1588
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE
        94⤵
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1584
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE
        95⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2748
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE
        96⤵
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2808
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE
        97⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2628
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE
        98⤵
        Maps connected drives based on registry
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1256
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE
        99⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1612
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE
        100⤵
        Maps connected drives based on registry
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2076
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE
        101⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2272
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE
        102⤵
        Maps connected drives based on registry
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2156
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE
        103⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1928
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE
        104⤵
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2328
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE
        105⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2128
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE
        106⤵
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2944
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE
        107⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2436
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE
        108⤵
        Maps connected drives based on registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:2240
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE
        109⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:748
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE
        110⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2064
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE
        111⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1736
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE
        112⤵
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:956
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE
        113⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:896
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE
        114⤵
        Maps connected drives based on registry
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2336
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE
        115⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2384
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE
        116⤵
        Maps connected drives based on registry
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1932
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE
        117⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1580
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE
        118⤵
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:920
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE
        119⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2624
        
        C:\Windows\SysWOW64\igfxsvr64.exe
        
        "C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE
        120⤵
        Maps connected drives based on registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:2592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\igfxsvr64.exe

Filesize
224KB

MD5
02bcd02ac649b47c88df945125551f16

SHA1
431a617ff4ff5a5ba599262eec35073fca7f79bd

SHA256
f53ec0d23818613b780d630e985a96cc27f8c15206bca27480fce13f24b134ea

SHA512
046daf4b9732bbf237b541c4fdc88ed0461e20466712cd5ae5359180c78c497c1c7e980cf2f767d92cc98da8db39a0bed9f049ed216f8b6c86344114708faf40

Download Submit
memory/264-82-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/264-76-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/296-361-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/296-355-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/352-460-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/600-376-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/640-559-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/920-928-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/920-923-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/956-884-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1012-213-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1012-206-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1040-341-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1040-346-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1108-159-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1108-149-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1152-121-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1252-545-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1252-540-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1256-781-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1256-776-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1316-664-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1336-708-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1336-705-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1396-722-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1584-752-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1584-746-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1676-389-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1692-403-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1792-270-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1792-264-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1848-496-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1848-502-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1904-312-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1904-317-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1932-915-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1956-530-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1996-194-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2012-616-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2012-621-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2052-331-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2064-867-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2064-870-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2076-796-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2076-793-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2156-811-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2156-806-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2240-850-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2240-855-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2292-167-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2292-177-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2328-825-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2336-894-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2336-899-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2340-693-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2420-140-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2444-674-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2444-679-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2496-582-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2496-591-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2516-633-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2516-636-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2584-250-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2592-938-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2616-431-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2644-48-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2644-38-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2644-40-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2644-39-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2700-473-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2756-12-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2756-13-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2756-26-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2756-6-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2756-8-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2756-4-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2756-10-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2756-5-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2756-11-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2756-2-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2760-650-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2808-763-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2808-766-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2812-233-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2840-56-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2840-64-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2864-297-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2864-302-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2868-488-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2892-417-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2936-284-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2936-287-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2944-834-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2944-840-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2956-100-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2996-445-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/3024-606-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/3024-603-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/3048-516-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/3064-736-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/3068-574-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/3068-571-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download