metasploit | 13cc17771a5fd19aaec69888a4294c6880210173c4ac49f86281832253e0dd9c

Analysis

max time kernel
149s
max time network
103s
platform
windows11-21h2_x64
resource
win11-20250410-en
resource tags

arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system
submitted
15/04/2025, 14:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_b9e32d5abb48fdb60b7992a8f8bc122c.exe
Size

247KB
MD5

b9e32d5abb48fdb60b7992a8f8bc122c
SHA1

e581f862c166d948bbbff20ee34acf4997e56dd1
SHA256

13cc17771a5fd19aaec69888a4294c6880210173c4ac49f86281832253e0dd9c
SHA512

05406b44af1a2b02ecc919b306fc20e88e39451bb459b289eaab2dde9e02da26c3e681d0060c0334ab952d896b74dc1445df09efcd849574d18ebdaea7309467
SSDEEP

3072:lV4upja0uR7JQshBwcb6n0qn6keZou+zYPm2SCO9fWY5VTxrq4GUndT5SMkk20G0:lV4upVq7JQUH60qnnA2omVl5cs5hkQN

Score

10^/10

metasploit backdoor discovery trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Metasploit family
metasploit

Deletes itself 1 IoCs

pid	Process
2252	igfxmxt86.exe

Executes dropped EXE 53 IoCs

pid	Process
2252	igfxmxt86.exe
4736	igfxmxt86.exe
5484	igfxmxt86.exe
3348	igfxmxt86.exe
556	igfxmxt86.exe
3064	igfxmxt86.exe
4240	igfxmxt86.exe
5984	igfxmxt86.exe
1648	igfxmxt86.exe
480	igfxmxt86.exe
3104	igfxmxt86.exe
2596	igfxmxt86.exe
5380	igfxmxt86.exe
5232	igfxmxt86.exe
5508	igfxmxt86.exe
1888	igfxmxt86.exe
1772	igfxmxt86.exe
5580	igfxmxt86.exe
3140	igfxmxt86.exe
3852	igfxmxt86.exe
5972	igfxmxt86.exe
5784	igfxmxt86.exe
5976	igfxmxt86.exe
2528	igfxmxt86.exe
4912	igfxmxt86.exe
4536	igfxmxt86.exe
2452	igfxmxt86.exe
4208	igfxmxt86.exe
5128	igfxmxt86.exe
4684	igfxmxt86.exe
4516	igfxmxt86.exe
5620	igfxmxt86.exe
4076	igfxmxt86.exe
232	igfxmxt86.exe
5900	igfxmxt86.exe
5744	igfxmxt86.exe
2320	igfxmxt86.exe
5680	igfxmxt86.exe
2964	igfxmxt86.exe
1588	igfxmxt86.exe
5420	igfxmxt86.exe
5080	igfxmxt86.exe
4124	igfxmxt86.exe
2568	igfxmxt86.exe
1732	igfxmxt86.exe
1176	igfxmxt86.exe
2824	igfxmxt86.exe
2736	igfxmxt86.exe
3032	igfxmxt86.exe
2504	igfxmxt86.exe
3600	igfxmxt86.exe
4276	igfxmxt86.exe
2452	igfxmxt86.exe

Maps connected drives based on registry 3 TTPs 64 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxmxt86.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	JaffaCakes118_b9e32d5abb48fdb60b7992a8f8bc122c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxmxt86.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxmxt86.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	igfxmxt86.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	igfxmxt86.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxmxt86.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxmxt86.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxmxt86.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxmxt86.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	igfxmxt86.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	igfxmxt86.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxmxt86.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxmxt86.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	igfxmxt86.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	igfxmxt86.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	igfxmxt86.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxmxt86.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxmxt86.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxmxt86.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	igfxmxt86.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxmxt86.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxmxt86.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxmxt86.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxmxt86.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	igfxmxt86.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxmxt86.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	igfxmxt86.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxmxt86.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\igfxmxt86.exe	igfxmxt86.exe
File opened for modification	C:\Windows\SysWOW64\igfxmxt86.exe	igfxmxt86.exe
File created	C:\Windows\SysWOW64\igfxmxt86.exe	igfxmxt86.exe
File opened for modification	C:\Windows\SysWOW64\igfxmxt86.exe	igfxmxt86.exe
File created	C:\Windows\SysWOW64\igfxmxt86.exe	igfxmxt86.exe
File opened for modification	C:\Windows\SysWOW64\	igfxmxt86.exe
File created	C:\Windows\SysWOW64\igfxmxt86.exe	igfxmxt86.exe
File opened for modification	C:\Windows\SysWOW64\	igfxmxt86.exe
File created	C:\Windows\SysWOW64\igfxmxt86.exe	igfxmxt86.exe
File opened for modification	C:\Windows\SysWOW64\	igfxmxt86.exe
File opened for modification	C:\Windows\SysWOW64\	igfxmxt86.exe
File opened for modification	C:\Windows\SysWOW64\igfxmxt86.exe	igfxmxt86.exe
File created	C:\Windows\SysWOW64\igfxmxt86.exe	igfxmxt86.exe
File opened for modification	C:\Windows\SysWOW64\igfxmxt86.exe	igfxmxt86.exe
File opened for modification	C:\Windows\SysWOW64\igfxmxt86.exe	igfxmxt86.exe
File opened for modification	C:\Windows\SysWOW64\igfxmxt86.exe	igfxmxt86.exe
File opened for modification	C:\Windows\SysWOW64\igfxmxt86.exe	igfxmxt86.exe
File created	C:\Windows\SysWOW64\igfxmxt86.exe	igfxmxt86.exe
File opened for modification	C:\Windows\SysWOW64\igfxmxt86.exe	igfxmxt86.exe
File created	C:\Windows\SysWOW64\igfxmxt86.exe	igfxmxt86.exe
File opened for modification	C:\Windows\SysWOW64\igfxmxt86.exe	igfxmxt86.exe
File opened for modification	C:\Windows\SysWOW64\igfxmxt86.exe	igfxmxt86.exe
File opened for modification	C:\Windows\SysWOW64\	igfxmxt86.exe
File created	C:\Windows\SysWOW64\igfxmxt86.exe	igfxmxt86.exe
File opened for modification	C:\Windows\SysWOW64\	igfxmxt86.exe
File opened for modification	C:\Windows\SysWOW64\	igfxmxt86.exe
File created	C:\Windows\SysWOW64\igfxmxt86.exe	igfxmxt86.exe
File opened for modification	C:\Windows\SysWOW64\	igfxmxt86.exe
File opened for modification	C:\Windows\SysWOW64\igfxmxt86.exe	igfxmxt86.exe
File opened for modification	C:\Windows\SysWOW64\igfxmxt86.exe	igfxmxt86.exe
File opened for modification	C:\Windows\SysWOW64\igfxmxt86.exe	igfxmxt86.exe
File opened for modification	C:\Windows\SysWOW64\igfxmxt86.exe	igfxmxt86.exe
File created	C:\Windows\SysWOW64\igfxmxt86.exe	igfxmxt86.exe
File opened for modification	C:\Windows\SysWOW64\	igfxmxt86.exe
File opened for modification	C:\Windows\SysWOW64\igfxmxt86.exe	igfxmxt86.exe
File created	C:\Windows\SysWOW64\igfxmxt86.exe	igfxmxt86.exe
File opened for modification	C:\Windows\SysWOW64\igfxmxt86.exe	igfxmxt86.exe
File opened for modification	C:\Windows\SysWOW64\	igfxmxt86.exe
File opened for modification	C:\Windows\SysWOW64\	igfxmxt86.exe
File opened for modification	C:\Windows\SysWOW64\igfxmxt86.exe	igfxmxt86.exe
File created	C:\Windows\SysWOW64\igfxmxt86.exe	igfxmxt86.exe
File created	C:\Windows\SysWOW64\igfxmxt86.exe	igfxmxt86.exe
File created	C:\Windows\SysWOW64\igfxmxt86.exe	igfxmxt86.exe
File opened for modification	C:\Windows\SysWOW64\	igfxmxt86.exe
File opened for modification	C:\Windows\SysWOW64\igfxmxt86.exe	igfxmxt86.exe
File opened for modification	C:\Windows\SysWOW64\	igfxmxt86.exe
File opened for modification	C:\Windows\SysWOW64\igfxmxt86.exe	igfxmxt86.exe
File created	C:\Windows\SysWOW64\igfxmxt86.exe	igfxmxt86.exe
File opened for modification	C:\Windows\SysWOW64\	JaffaCakes118_b9e32d5abb48fdb60b7992a8f8bc122c.exe
File opened for modification	C:\Windows\SysWOW64\	igfxmxt86.exe
File opened for modification	C:\Windows\SysWOW64\	igfxmxt86.exe
File opened for modification	C:\Windows\SysWOW64\igfxmxt86.exe	igfxmxt86.exe
File created	C:\Windows\SysWOW64\igfxmxt86.exe	igfxmxt86.exe
File opened for modification	C:\Windows\SysWOW64\igfxmxt86.exe	igfxmxt86.exe
File opened for modification	C:\Windows\SysWOW64\	igfxmxt86.exe
File opened for modification	C:\Windows\SysWOW64\igfxmxt86.exe	igfxmxt86.exe
File created	C:\Windows\SysWOW64\igfxmxt86.exe	igfxmxt86.exe
File opened for modification	C:\Windows\SysWOW64\	igfxmxt86.exe
File opened for modification	C:\Windows\SysWOW64\igfxmxt86.exe	igfxmxt86.exe
File created	C:\Windows\SysWOW64\igfxmxt86.exe	igfxmxt86.exe
File opened for modification	C:\Windows\SysWOW64\igfxmxt86.exe	igfxmxt86.exe
File opened for modification	C:\Windows\SysWOW64\	igfxmxt86.exe
File created	C:\Windows\SysWOW64\igfxmxt86.exe	igfxmxt86.exe
File created	C:\Windows\SysWOW64\igfxmxt86.exe	igfxmxt86.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 53 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_b9e32d5abb48fdb60b7992a8f8bc122c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxmxt86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxmxt86.exe

Modifies registry class 53 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxmxt86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxmxt86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxmxt86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxmxt86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxmxt86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxmxt86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxmxt86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxmxt86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxmxt86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxmxt86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxmxt86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxmxt86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxmxt86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxmxt86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxmxt86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxmxt86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	JaffaCakes118_b9e32d5abb48fdb60b7992a8f8bc122c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxmxt86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxmxt86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxmxt86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxmxt86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxmxt86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxmxt86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxmxt86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxmxt86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxmxt86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxmxt86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxmxt86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxmxt86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxmxt86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxmxt86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxmxt86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxmxt86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxmxt86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxmxt86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxmxt86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxmxt86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxmxt86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxmxt86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxmxt86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxmxt86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxmxt86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxmxt86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxmxt86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxmxt86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxmxt86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxmxt86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxmxt86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxmxt86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxmxt86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxmxt86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxmxt86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxmxt86.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2192	JaffaCakes118_b9e32d5abb48fdb60b7992a8f8bc122c.exe
2192	JaffaCakes118_b9e32d5abb48fdb60b7992a8f8bc122c.exe
2252	igfxmxt86.exe
2252	igfxmxt86.exe
4736	igfxmxt86.exe
4736	igfxmxt86.exe
5484	igfxmxt86.exe
5484	igfxmxt86.exe
3348	igfxmxt86.exe
3348	igfxmxt86.exe
556	igfxmxt86.exe
556	igfxmxt86.exe
3064	igfxmxt86.exe
3064	igfxmxt86.exe
4240	igfxmxt86.exe
4240	igfxmxt86.exe
5984	igfxmxt86.exe
5984	igfxmxt86.exe
1648	igfxmxt86.exe
1648	igfxmxt86.exe
480	igfxmxt86.exe
480	igfxmxt86.exe
3104	igfxmxt86.exe
3104	igfxmxt86.exe
2596	igfxmxt86.exe
2596	igfxmxt86.exe
5380	igfxmxt86.exe
5380	igfxmxt86.exe
5232	igfxmxt86.exe
5232	igfxmxt86.exe
5508	igfxmxt86.exe
5508	igfxmxt86.exe
1888	igfxmxt86.exe
1888	igfxmxt86.exe
1772	igfxmxt86.exe
1772	igfxmxt86.exe
5580	igfxmxt86.exe
5580	igfxmxt86.exe
3140	igfxmxt86.exe
3140	igfxmxt86.exe
3852	igfxmxt86.exe
3852	igfxmxt86.exe
5972	igfxmxt86.exe
5972	igfxmxt86.exe
5784	igfxmxt86.exe
5784	igfxmxt86.exe
5976	igfxmxt86.exe
5976	igfxmxt86.exe
2528	igfxmxt86.exe
2528	igfxmxt86.exe
4912	igfxmxt86.exe
4912	igfxmxt86.exe
4536	igfxmxt86.exe
4536	igfxmxt86.exe
2452	igfxmxt86.exe
2452	igfxmxt86.exe
4208	igfxmxt86.exe
4208	igfxmxt86.exe
5128	igfxmxt86.exe
5128	igfxmxt86.exe
4684	igfxmxt86.exe
4684	igfxmxt86.exe
4516	igfxmxt86.exe
4516	igfxmxt86.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 2252	2192	JaffaCakes118_b9e32d5abb48fdb60b7992a8f8bc122c.exe	78
PID 2192 wrote to memory of 2252	2192	JaffaCakes118_b9e32d5abb48fdb60b7992a8f8bc122c.exe	78
PID 2192 wrote to memory of 2252	2192	JaffaCakes118_b9e32d5abb48fdb60b7992a8f8bc122c.exe	78
PID 2252 wrote to memory of 4736	2252	igfxmxt86.exe	79
PID 2252 wrote to memory of 4736	2252	igfxmxt86.exe	79
PID 2252 wrote to memory of 4736	2252	igfxmxt86.exe	79
PID 4736 wrote to memory of 5484	4736	igfxmxt86.exe	80
PID 4736 wrote to memory of 5484	4736	igfxmxt86.exe	80
PID 4736 wrote to memory of 5484	4736	igfxmxt86.exe	80
PID 5484 wrote to memory of 3348	5484	igfxmxt86.exe	81
PID 5484 wrote to memory of 3348	5484	igfxmxt86.exe	81
PID 5484 wrote to memory of 3348	5484	igfxmxt86.exe	81
PID 3348 wrote to memory of 556	3348	igfxmxt86.exe	82
PID 3348 wrote to memory of 556	3348	igfxmxt86.exe	82
PID 3348 wrote to memory of 556	3348	igfxmxt86.exe	82
PID 556 wrote to memory of 3064	556	igfxmxt86.exe	83
PID 556 wrote to memory of 3064	556	igfxmxt86.exe	83
PID 556 wrote to memory of 3064	556	igfxmxt86.exe	83
PID 3064 wrote to memory of 4240	3064	igfxmxt86.exe	84
PID 3064 wrote to memory of 4240	3064	igfxmxt86.exe	84
PID 3064 wrote to memory of 4240	3064	igfxmxt86.exe	84
PID 4240 wrote to memory of 5984	4240	igfxmxt86.exe	85
PID 4240 wrote to memory of 5984	4240	igfxmxt86.exe	85
PID 4240 wrote to memory of 5984	4240	igfxmxt86.exe	85
PID 5984 wrote to memory of 1648	5984	igfxmxt86.exe	86
PID 5984 wrote to memory of 1648	5984	igfxmxt86.exe	86
PID 5984 wrote to memory of 1648	5984	igfxmxt86.exe	86
PID 1648 wrote to memory of 480	1648	igfxmxt86.exe	87
PID 1648 wrote to memory of 480	1648	igfxmxt86.exe	87
PID 1648 wrote to memory of 480	1648	igfxmxt86.exe	87
PID 480 wrote to memory of 3104	480	igfxmxt86.exe	88
PID 480 wrote to memory of 3104	480	igfxmxt86.exe	88
PID 480 wrote to memory of 3104	480	igfxmxt86.exe	88
PID 3104 wrote to memory of 2596	3104	igfxmxt86.exe	89
PID 3104 wrote to memory of 2596	3104	igfxmxt86.exe	89
PID 3104 wrote to memory of 2596	3104	igfxmxt86.exe	89
PID 2596 wrote to memory of 5380	2596	igfxmxt86.exe	90
PID 2596 wrote to memory of 5380	2596	igfxmxt86.exe	90
PID 2596 wrote to memory of 5380	2596	igfxmxt86.exe	90
PID 5380 wrote to memory of 5232	5380	igfxmxt86.exe	91
PID 5380 wrote to memory of 5232	5380	igfxmxt86.exe	91
PID 5380 wrote to memory of 5232	5380	igfxmxt86.exe	91
PID 5232 wrote to memory of 5508	5232	igfxmxt86.exe	92
PID 5232 wrote to memory of 5508	5232	igfxmxt86.exe	92
PID 5232 wrote to memory of 5508	5232	igfxmxt86.exe	92
PID 5508 wrote to memory of 1888	5508	igfxmxt86.exe	93
PID 5508 wrote to memory of 1888	5508	igfxmxt86.exe	93
PID 5508 wrote to memory of 1888	5508	igfxmxt86.exe	93
PID 1888 wrote to memory of 1772	1888	igfxmxt86.exe	94
PID 1888 wrote to memory of 1772	1888	igfxmxt86.exe	94
PID 1888 wrote to memory of 1772	1888	igfxmxt86.exe	94
PID 1772 wrote to memory of 5580	1772	igfxmxt86.exe	95
PID 1772 wrote to memory of 5580	1772	igfxmxt86.exe	95
PID 1772 wrote to memory of 5580	1772	igfxmxt86.exe	95
PID 5580 wrote to memory of 3140	5580	igfxmxt86.exe	96
PID 5580 wrote to memory of 3140	5580	igfxmxt86.exe	96
PID 5580 wrote to memory of 3140	5580	igfxmxt86.exe	96
PID 3140 wrote to memory of 3852	3140	igfxmxt86.exe	97
PID 3140 wrote to memory of 3852	3140	igfxmxt86.exe	97
PID 3140 wrote to memory of 3852	3140	igfxmxt86.exe	97
PID 3852 wrote to memory of 5972	3852	igfxmxt86.exe	98
PID 3852 wrote to memory of 5972	3852	igfxmxt86.exe	98
PID 3852 wrote to memory of 5972	3852	igfxmxt86.exe	98
PID 5972 wrote to memory of 5784	5972	igfxmxt86.exe	99

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b9e32d5abb48fdb60b7992a8f8bc122c.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b9e32d5abb48fdb60b7992a8f8bc122c.exe"
1⤵
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\SysWOW64\igfxmxt86.exe
  "C:\Windows\system32\igfxmxt86.exe" C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.EXE
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Maps connected drives based on registry
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2252
- - C:\Windows\SysWOW64\igfxmxt86.exe
    "C:\Windows\system32\igfxmxt86.exe" C:\Windows\SysWOW64\IGFXMX~1.EXE
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4736
  - - C:\Windows\SysWOW64\igfxmxt86.exe
      "C:\Windows\system32\igfxmxt86.exe" C:\Windows\SysWOW64\IGFXMX~1.EXE
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:5484
    - - C:\Windows\SysWOW64\igfxmxt86.exe
        
        "C:\Windows\system32\igfxmxt86.exe" C:\Windows\SysWOW64\IGFXMX~1.EXE
        5⤵
        Executes dropped EXE
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3348
      - C:\Windows\SysWOW64\igfxmxt86.exe
        
        "C:\Windows\system32\igfxmxt86.exe" C:\Windows\SysWOW64\IGFXMX~1.EXE
        6⤵
        Executes dropped EXE
        Maps connected drives based on registry
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:556
        
        C:\Windows\SysWOW64\igfxmxt86.exe
        
        "C:\Windows\system32\igfxmxt86.exe" C:\Windows\SysWOW64\IGFXMX~1.EXE
        7⤵
        Executes dropped EXE
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3064
        
        C:\Windows\SysWOW64\igfxmxt86.exe
        
        "C:\Windows\system32\igfxmxt86.exe" C:\Windows\SysWOW64\IGFXMX~1.EXE
        8⤵
        Executes dropped EXE
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4240
        
        C:\Windows\SysWOW64\igfxmxt86.exe
        
        "C:\Windows\system32\igfxmxt86.exe" C:\Windows\SysWOW64\IGFXMX~1.EXE
        9⤵
        Executes dropped EXE
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5984
        
        C:\Windows\SysWOW64\igfxmxt86.exe
        
        "C:\Windows\system32\igfxmxt86.exe" C:\Windows\SysWOW64\IGFXMX~1.EXE
        10⤵
        Executes dropped EXE
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1648
        
        C:\Windows\SysWOW64\igfxmxt86.exe
        
        "C:\Windows\system32\igfxmxt86.exe" C:\Windows\SysWOW64\IGFXMX~1.EXE
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:480
        
        C:\Windows\SysWOW64\igfxmxt86.exe
        
        "C:\Windows\system32\igfxmxt86.exe" C:\Windows\SysWOW64\IGFXMX~1.EXE
        12⤵
        Executes dropped EXE
        Maps connected drives based on registry
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3104
        
        C:\Windows\SysWOW64\igfxmxt86.exe
        
        "C:\Windows\system32\igfxmxt86.exe" C:\Windows\SysWOW64\IGFXMX~1.EXE
        13⤵
        Executes dropped EXE
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2596
        
        C:\Windows\SysWOW64\igfxmxt86.exe
        
        "C:\Windows\system32\igfxmxt86.exe" C:\Windows\SysWOW64\IGFXMX~1.EXE
        14⤵
        Executes dropped EXE
        Maps connected drives based on registry
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5380
        
        C:\Windows\SysWOW64\igfxmxt86.exe
        
        "C:\Windows\system32\igfxmxt86.exe" C:\Windows\SysWOW64\IGFXMX~1.EXE
        15⤵
        Executes dropped EXE
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5232
        
        C:\Windows\SysWOW64\igfxmxt86.exe
        
        "C:\Windows\system32\igfxmxt86.exe" C:\Windows\SysWOW64\IGFXMX~1.EXE
        16⤵
        Executes dropped EXE
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5508
        
        C:\Windows\SysWOW64\igfxmxt86.exe
        
        "C:\Windows\system32\igfxmxt86.exe" C:\Windows\SysWOW64\IGFXMX~1.EXE
        17⤵
        Executes dropped EXE
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1888
        
        C:\Windows\SysWOW64\igfxmxt86.exe
        
        "C:\Windows\system32\igfxmxt86.exe" C:\Windows\SysWOW64\IGFXMX~1.EXE
        18⤵
        Executes dropped EXE
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1772
        
        C:\Windows\SysWOW64\igfxmxt86.exe
        
        "C:\Windows\system32\igfxmxt86.exe" C:\Windows\SysWOW64\IGFXMX~1.EXE
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5580
        
        C:\Windows\SysWOW64\igfxmxt86.exe
        
        "C:\Windows\system32\igfxmxt86.exe" C:\Windows\SysWOW64\IGFXMX~1.EXE
        20⤵
        Executes dropped EXE
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3140
        
        C:\Windows\SysWOW64\igfxmxt86.exe
        
        "C:\Windows\system32\igfxmxt86.exe" C:\Windows\SysWOW64\IGFXMX~1.EXE
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3852
        
        C:\Windows\SysWOW64\igfxmxt86.exe
        
        "C:\Windows\system32\igfxmxt86.exe" C:\Windows\SysWOW64\IGFXMX~1.EXE
        22⤵
        Executes dropped EXE
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5972
        
        C:\Windows\SysWOW64\igfxmxt86.exe
        
        "C:\Windows\system32\igfxmxt86.exe" C:\Windows\SysWOW64\IGFXMX~1.EXE
        23⤵
        Executes dropped EXE
        Maps connected drives based on registry
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        
        PID:5784
        
        C:\Windows\SysWOW64\igfxmxt86.exe
        
        "C:\Windows\system32\igfxmxt86.exe" C:\Windows\SysWOW64\IGFXMX~1.EXE
        24⤵
        Executes dropped EXE
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        
        PID:5976
        
        C:\Windows\SysWOW64\igfxmxt86.exe
        
        "C:\Windows\system32\igfxmxt86.exe" C:\Windows\SysWOW64\IGFXMX~1.EXE
        25⤵
        Executes dropped EXE
        Maps connected drives based on registry
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        
        PID:2528
        
        C:\Windows\SysWOW64\igfxmxt86.exe
        
        "C:\Windows\system32\igfxmxt86.exe" C:\Windows\SysWOW64\IGFXMX~1.EXE
        26⤵
        Executes dropped EXE
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        
        PID:4912
        
        C:\Windows\SysWOW64\igfxmxt86.exe
        
        "C:\Windows\system32\igfxmxt86.exe" C:\Windows\SysWOW64\IGFXMX~1.EXE
        27⤵
        Executes dropped EXE
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        
        PID:4536
        
        C:\Windows\SysWOW64\igfxmxt86.exe
        
        "C:\Windows\system32\igfxmxt86.exe" C:\Windows\SysWOW64\IGFXMX~1.EXE
        28⤵
        Executes dropped EXE
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        
        PID:2452
        
        C:\Windows\SysWOW64\igfxmxt86.exe
        
        "C:\Windows\system32\igfxmxt86.exe" C:\Windows\SysWOW64\IGFXMX~1.EXE
        29⤵
        Executes dropped EXE
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        
        PID:4208
        
        C:\Windows\SysWOW64\igfxmxt86.exe
        
        "C:\Windows\system32\igfxmxt86.exe" C:\Windows\SysWOW64\IGFXMX~1.EXE
        30⤵
        Executes dropped EXE
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        
        PID:5128
        
        C:\Windows\SysWOW64\igfxmxt86.exe
        
        "C:\Windows\system32\igfxmxt86.exe" C:\Windows\SysWOW64\IGFXMX~1.EXE
        31⤵
        Executes dropped EXE
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        
        PID:4684
        
        C:\Windows\SysWOW64\igfxmxt86.exe
        
        "C:\Windows\system32\igfxmxt86.exe" C:\Windows\SysWOW64\IGFXMX~1.EXE
        32⤵
        Executes dropped EXE
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        
        PID:4516
        
        C:\Windows\SysWOW64\igfxmxt86.exe
        
        "C:\Windows\system32\igfxmxt86.exe" C:\Windows\SysWOW64\IGFXMX~1.EXE
        33⤵
        Executes dropped EXE
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5620
        
        C:\Windows\SysWOW64\igfxmxt86.exe
        
        "C:\Windows\system32\igfxmxt86.exe" C:\Windows\SysWOW64\IGFXMX~1.EXE
        34⤵
        Executes dropped EXE
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4076
        
        C:\Windows\SysWOW64\igfxmxt86.exe
        
        "C:\Windows\system32\igfxmxt86.exe" C:\Windows\SysWOW64\IGFXMX~1.EXE
        35⤵
        Executes dropped EXE
        Maps connected drives based on registry
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:232
        
        C:\Windows\SysWOW64\igfxmxt86.exe
        
        "C:\Windows\system32\igfxmxt86.exe" C:\Windows\SysWOW64\IGFXMX~1.EXE
        36⤵
        Executes dropped EXE
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5900
        
        C:\Windows\SysWOW64\igfxmxt86.exe
        
        "C:\Windows\system32\igfxmxt86.exe" C:\Windows\SysWOW64\IGFXMX~1.EXE
        37⤵
        Executes dropped EXE
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5744
        
        C:\Windows\SysWOW64\igfxmxt86.exe
        
        "C:\Windows\system32\igfxmxt86.exe" C:\Windows\SysWOW64\IGFXMX~1.EXE
        38⤵
        Executes dropped EXE
        Maps connected drives based on registry
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2320
        
        C:\Windows\SysWOW64\igfxmxt86.exe
        
        "C:\Windows\system32\igfxmxt86.exe" C:\Windows\SysWOW64\IGFXMX~1.EXE
        39⤵
        Executes dropped EXE
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5680
        
        C:\Windows\SysWOW64\igfxmxt86.exe
        
        "C:\Windows\system32\igfxmxt86.exe" C:\Windows\SysWOW64\IGFXMX~1.EXE
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2964
        
        C:\Windows\SysWOW64\igfxmxt86.exe
        
        "C:\Windows\system32\igfxmxt86.exe" C:\Windows\SysWOW64\IGFXMX~1.EXE
        41⤵
        Executes dropped EXE
        Maps connected drives based on registry
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1588
        
        C:\Windows\SysWOW64\igfxmxt86.exe
        
        "C:\Windows\system32\igfxmxt86.exe" C:\Windows\SysWOW64\IGFXMX~1.EXE
        42⤵
        Executes dropped EXE
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5420
        
        C:\Windows\SysWOW64\igfxmxt86.exe
        
        "C:\Windows\system32\igfxmxt86.exe" C:\Windows\SysWOW64\IGFXMX~1.EXE
        43⤵
        Executes dropped EXE
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5080
        
        C:\Windows\SysWOW64\igfxmxt86.exe
        
        "C:\Windows\system32\igfxmxt86.exe" C:\Windows\SysWOW64\IGFXMX~1.EXE
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4124
        
        C:\Windows\SysWOW64\igfxmxt86.exe
        
        "C:\Windows\system32\igfxmxt86.exe" C:\Windows\SysWOW64\IGFXMX~1.EXE
        45⤵
        Executes dropped EXE
        Maps connected drives based on registry
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2568
        
        C:\Windows\SysWOW64\igfxmxt86.exe
        
        "C:\Windows\system32\igfxmxt86.exe" C:\Windows\SysWOW64\IGFXMX~1.EXE
        46⤵
        Executes dropped EXE
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1732
        
        C:\Windows\SysWOW64\igfxmxt86.exe
        
        "C:\Windows\system32\igfxmxt86.exe" C:\Windows\SysWOW64\IGFXMX~1.EXE
        47⤵
        Executes dropped EXE
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1176
        
        C:\Windows\SysWOW64\igfxmxt86.exe
        
        "C:\Windows\system32\igfxmxt86.exe" C:\Windows\SysWOW64\IGFXMX~1.EXE
        48⤵
        Executes dropped EXE
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2824
        
        C:\Windows\SysWOW64\igfxmxt86.exe
        
        "C:\Windows\system32\igfxmxt86.exe" C:\Windows\SysWOW64\IGFXMX~1.EXE
        49⤵
        Executes dropped EXE
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2736
        
        C:\Windows\SysWOW64\igfxmxt86.exe
        
        "C:\Windows\system32\igfxmxt86.exe" C:\Windows\SysWOW64\IGFXMX~1.EXE
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3032
        
        C:\Windows\SysWOW64\igfxmxt86.exe
        
        "C:\Windows\system32\igfxmxt86.exe" C:\Windows\SysWOW64\IGFXMX~1.EXE
        51⤵
        Executes dropped EXE
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2504
        
        C:\Windows\SysWOW64\igfxmxt86.exe
        
        "C:\Windows\system32\igfxmxt86.exe" C:\Windows\SysWOW64\IGFXMX~1.EXE
        52⤵
        Executes dropped EXE
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3600
        
        C:\Windows\SysWOW64\igfxmxt86.exe
        
        "C:\Windows\system32\igfxmxt86.exe" C:\Windows\SysWOW64\IGFXMX~1.EXE
        53⤵
        Executes dropped EXE
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4276
        
        C:\Windows\SysWOW64\igfxmxt86.exe
        
        "C:\Windows\system32\igfxmxt86.exe" C:\Windows\SysWOW64\IGFXMX~1.EXE
        54⤵
        Executes dropped EXE
        
        PID:2452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\igfxmxt86.exe

Filesize
247KB

MD5
b9e32d5abb48fdb60b7992a8f8bc122c

SHA1
e581f862c166d948bbbff20ee34acf4997e56dd1

SHA256
13cc17771a5fd19aaec69888a4294c6880210173c4ac49f86281832253e0dd9c

SHA512
05406b44af1a2b02ecc919b306fc20e88e39451bb459b289eaab2dde9e02da26c3e681d0060c0334ab952d896b74dc1445df09efcd849574d18ebdaea7309467

Download Submit
memory/232-159-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/480-77-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/556-59-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/556-55-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1176-196-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1588-178-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1648-74-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1648-70-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1732-193-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1772-100-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1888-97-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2192-0-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2192-39-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2192-3-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2192-2-0x0000000000477000-0x00000000004B4000-memory.dmp

Filesize
244KB

Download
memory/2192-1-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2252-45-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2252-40-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2252-38-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2320-169-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2452-129-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2452-133-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2504-208-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2528-122-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2528-118-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2568-190-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2596-84-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2736-202-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2824-199-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2964-175-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/3032-205-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/3064-63-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/3104-80-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/3140-106-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/3348-56-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/3600-211-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/3852-109-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4076-155-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4124-187-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4208-136-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4240-66-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4276-214-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4516-145-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4536-130-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4684-143-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4736-44-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4736-43-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4736-48-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4912-124-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/5080-184-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/5128-139-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/5232-90-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/5380-87-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/5420-181-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/5484-52-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/5508-93-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/5580-103-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/5620-150-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/5680-172-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/5744-166-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/5784-115-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/5900-163-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/5972-112-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/5976-119-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/5984-71-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download