Analysis
-
max time kernel
149s -
max time network
50s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 23:46
Static task
static1
Behavioral task
behavioral1
Sample
1cfb51141e5c4f989c3322488251860a_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
1cfb51141e5c4f989c3322488251860a_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
1cfb51141e5c4f989c3322488251860a_JaffaCakes118.exe
-
Size
508KB
-
MD5
1cfb51141e5c4f989c3322488251860a
-
SHA1
63e204959e34ec1a3f071079025ee572859c5c41
-
SHA256
9ca8e3e470787f315cb0f2cfaceba4be7a513f03e5500acf1f58b963aadfe036
-
SHA512
a75e0575273794b0117c574acb3cbb6d4db56758b4fdb06c7155902b1d417e015715417e0aea44b5a24e086c985c1bddeb394f287ff317ede3a61536b5a22579
-
SSDEEP
3072:ijdFX/Bu4p8JEmPg+qqF365EhyUL2GayImQ7STjLWLa8H6sPONTrLZCbd4iFqFA8:iZlBuKZmPg0aO+BLFNorLUlFqFAd6b
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Checks computer location settings 2 TTPs 46 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
igfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exe1cfb51141e5c4f989c3322488251860a_JaffaCakes118.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation igfxdmx32.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation igfxdmx32.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation igfxdmx32.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation igfxdmx32.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation igfxdmx32.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation igfxdmx32.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation 1cfb51141e5c4f989c3322488251860a_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation igfxdmx32.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation igfxdmx32.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation igfxdmx32.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation igfxdmx32.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation igfxdmx32.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation igfxdmx32.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation igfxdmx32.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation igfxdmx32.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation igfxdmx32.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation igfxdmx32.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation igfxdmx32.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation igfxdmx32.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation igfxdmx32.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation igfxdmx32.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation igfxdmx32.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation igfxdmx32.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation igfxdmx32.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation igfxdmx32.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation igfxdmx32.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation igfxdmx32.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation igfxdmx32.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation igfxdmx32.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation igfxdmx32.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation igfxdmx32.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation igfxdmx32.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation igfxdmx32.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation igfxdmx32.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation igfxdmx32.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation igfxdmx32.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation igfxdmx32.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation igfxdmx32.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation igfxdmx32.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation igfxdmx32.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation igfxdmx32.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation igfxdmx32.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation igfxdmx32.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation igfxdmx32.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation igfxdmx32.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation igfxdmx32.exe -
Deletes itself 1 IoCs
Processes:
igfxdmx32.exepid process 3640 igfxdmx32.exe -
Executes dropped EXE 45 IoCs
Processes:
igfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exepid process 3640 igfxdmx32.exe 2256 igfxdmx32.exe 4804 igfxdmx32.exe 1252 igfxdmx32.exe 3916 igfxdmx32.exe 3796 igfxdmx32.exe 2012 igfxdmx32.exe 2164 igfxdmx32.exe 4184 igfxdmx32.exe 4524 igfxdmx32.exe 316 igfxdmx32.exe 2496 igfxdmx32.exe 3652 igfxdmx32.exe 2520 igfxdmx32.exe 4548 igfxdmx32.exe 1304 igfxdmx32.exe 3196 igfxdmx32.exe 2912 igfxdmx32.exe 2828 igfxdmx32.exe 2332 igfxdmx32.exe 3968 igfxdmx32.exe 3404 igfxdmx32.exe 3160 igfxdmx32.exe 4404 igfxdmx32.exe 960 igfxdmx32.exe 2864 igfxdmx32.exe 2932 igfxdmx32.exe 4356 igfxdmx32.exe 3208 igfxdmx32.exe 4276 igfxdmx32.exe 3408 igfxdmx32.exe 2244 igfxdmx32.exe 5068 igfxdmx32.exe 2096 igfxdmx32.exe 212 igfxdmx32.exe 2448 igfxdmx32.exe 3056 igfxdmx32.exe 8 igfxdmx32.exe 544 igfxdmx32.exe 3192 igfxdmx32.exe 3088 igfxdmx32.exe 448 igfxdmx32.exe 4440 igfxdmx32.exe 2912 igfxdmx32.exe 1320 igfxdmx32.exe -
Maps connected drives based on registry 3 TTPs 64 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
igfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exe1cfb51141e5c4f989c3322488251860a_JaffaCakes118.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdmx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdmx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdmx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdmx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdmx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdmx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdmx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdmx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdmx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdmx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdmx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdmx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdmx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdmx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdmx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdmx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdmx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdmx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdmx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdmx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdmx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdmx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdmx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdmx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdmx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdmx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdmx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdmx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdmx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdmx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdmx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdmx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdmx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdmx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdmx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdmx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdmx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdmx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdmx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdmx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdmx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdmx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdmx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdmx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdmx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdmx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdmx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdmx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdmx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdmx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdmx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 1cfb51141e5c4f989c3322488251860a_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdmx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdmx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdmx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdmx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdmx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdmx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdmx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdmx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdmx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdmx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdmx32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdmx32.exe -
Drops file in System32 directory 64 IoCs
Processes:
igfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exe1cfb51141e5c4f989c3322488251860a_JaffaCakes118.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exedescription ioc process File opened for modification C:\Windows\SysWOW64\ igfxdmx32.exe File opened for modification C:\Windows\SysWOW64\igfxdmx32.exe igfxdmx32.exe File opened for modification C:\Windows\SysWOW64\ igfxdmx32.exe File opened for modification C:\Windows\SysWOW64\ igfxdmx32.exe File created C:\Windows\SysWOW64\igfxdmx32.exe igfxdmx32.exe File opened for modification C:\Windows\SysWOW64\igfxdmx32.exe igfxdmx32.exe File created C:\Windows\SysWOW64\igfxdmx32.exe igfxdmx32.exe File opened for modification C:\Windows\SysWOW64\ igfxdmx32.exe File opened for modification C:\Windows\SysWOW64\ igfxdmx32.exe File opened for modification C:\Windows\SysWOW64\ igfxdmx32.exe File created C:\Windows\SysWOW64\igfxdmx32.exe igfxdmx32.exe File created C:\Windows\SysWOW64\igfxdmx32.exe igfxdmx32.exe File opened for modification C:\Windows\SysWOW64\ 1cfb51141e5c4f989c3322488251860a_JaffaCakes118.exe File created C:\Windows\SysWOW64\igfxdmx32.exe igfxdmx32.exe File created C:\Windows\SysWOW64\igfxdmx32.exe igfxdmx32.exe File created C:\Windows\SysWOW64\igfxdmx32.exe igfxdmx32.exe File opened for modification C:\Windows\SysWOW64\igfxdmx32.exe igfxdmx32.exe File created C:\Windows\SysWOW64\igfxdmx32.exe igfxdmx32.exe File opened for modification C:\Windows\SysWOW64\ igfxdmx32.exe File opened for modification C:\Windows\SysWOW64\ igfxdmx32.exe File created C:\Windows\SysWOW64\igfxdmx32.exe igfxdmx32.exe File opened for modification C:\Windows\SysWOW64\igfxdmx32.exe igfxdmx32.exe File created C:\Windows\SysWOW64\igfxdmx32.exe igfxdmx32.exe File opened for modification C:\Windows\SysWOW64\igfxdmx32.exe igfxdmx32.exe File created C:\Windows\SysWOW64\igfxdmx32.exe igfxdmx32.exe File opened for modification C:\Windows\SysWOW64\ igfxdmx32.exe File opened for modification C:\Windows\SysWOW64\igfxdmx32.exe 1cfb51141e5c4f989c3322488251860a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ igfxdmx32.exe File opened for modification C:\Windows\SysWOW64\ igfxdmx32.exe File opened for modification C:\Windows\SysWOW64\igfxdmx32.exe igfxdmx32.exe File created C:\Windows\SysWOW64\igfxdmx32.exe igfxdmx32.exe File opened for modification C:\Windows\SysWOW64\ igfxdmx32.exe File opened for modification C:\Windows\SysWOW64\ igfxdmx32.exe File opened for modification C:\Windows\SysWOW64\igfxdmx32.exe igfxdmx32.exe File opened for modification C:\Windows\SysWOW64\igfxdmx32.exe igfxdmx32.exe File created C:\Windows\SysWOW64\igfxdmx32.exe igfxdmx32.exe File opened for modification C:\Windows\SysWOW64\igfxdmx32.exe igfxdmx32.exe File created C:\Windows\SysWOW64\igfxdmx32.exe igfxdmx32.exe File opened for modification C:\Windows\SysWOW64\igfxdmx32.exe igfxdmx32.exe File opened for modification C:\Windows\SysWOW64\igfxdmx32.exe igfxdmx32.exe File opened for modification C:\Windows\SysWOW64\igfxdmx32.exe igfxdmx32.exe File created C:\Windows\SysWOW64\igfxdmx32.exe igfxdmx32.exe File opened for modification C:\Windows\SysWOW64\ igfxdmx32.exe File opened for modification C:\Windows\SysWOW64\ igfxdmx32.exe File created C:\Windows\SysWOW64\igfxdmx32.exe igfxdmx32.exe File created C:\Windows\SysWOW64\igfxdmx32.exe igfxdmx32.exe File opened for modification C:\Windows\SysWOW64\igfxdmx32.exe igfxdmx32.exe File opened for modification C:\Windows\SysWOW64\igfxdmx32.exe igfxdmx32.exe File opened for modification C:\Windows\SysWOW64\ igfxdmx32.exe File created C:\Windows\SysWOW64\igfxdmx32.exe igfxdmx32.exe File created C:\Windows\SysWOW64\igfxdmx32.exe igfxdmx32.exe File opened for modification C:\Windows\SysWOW64\ igfxdmx32.exe File opened for modification C:\Windows\SysWOW64\igfxdmx32.exe igfxdmx32.exe File opened for modification C:\Windows\SysWOW64\ igfxdmx32.exe File opened for modification C:\Windows\SysWOW64\ igfxdmx32.exe File created C:\Windows\SysWOW64\igfxdmx32.exe igfxdmx32.exe File opened for modification C:\Windows\SysWOW64\ igfxdmx32.exe File created C:\Windows\SysWOW64\igfxdmx32.exe igfxdmx32.exe File opened for modification C:\Windows\SysWOW64\igfxdmx32.exe igfxdmx32.exe File opened for modification C:\Windows\SysWOW64\ igfxdmx32.exe File opened for modification C:\Windows\SysWOW64\igfxdmx32.exe igfxdmx32.exe File opened for modification C:\Windows\SysWOW64\igfxdmx32.exe igfxdmx32.exe File opened for modification C:\Windows\SysWOW64\ igfxdmx32.exe File created C:\Windows\SysWOW64\igfxdmx32.exe igfxdmx32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 46 IoCs
Processes:
igfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exe1cfb51141e5c4f989c3322488251860a_JaffaCakes118.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdmx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdmx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdmx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdmx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdmx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdmx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdmx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdmx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdmx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdmx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdmx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdmx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdmx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 1cfb51141e5c4f989c3322488251860a_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdmx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdmx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdmx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdmx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdmx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdmx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdmx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdmx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdmx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdmx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdmx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdmx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdmx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdmx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdmx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdmx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdmx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdmx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdmx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdmx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdmx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdmx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdmx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdmx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdmx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdmx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdmx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdmx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdmx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdmx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdmx32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdmx32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
1cfb51141e5c4f989c3322488251860a_JaffaCakes118.exeigfxdmx32.exeigfxdmx32.exepid process 4468 1cfb51141e5c4f989c3322488251860a_JaffaCakes118.exe 4468 1cfb51141e5c4f989c3322488251860a_JaffaCakes118.exe 4468 1cfb51141e5c4f989c3322488251860a_JaffaCakes118.exe 4468 1cfb51141e5c4f989c3322488251860a_JaffaCakes118.exe 4468 1cfb51141e5c4f989c3322488251860a_JaffaCakes118.exe 4468 1cfb51141e5c4f989c3322488251860a_JaffaCakes118.exe 4468 1cfb51141e5c4f989c3322488251860a_JaffaCakes118.exe 4468 1cfb51141e5c4f989c3322488251860a_JaffaCakes118.exe 4468 1cfb51141e5c4f989c3322488251860a_JaffaCakes118.exe 4468 1cfb51141e5c4f989c3322488251860a_JaffaCakes118.exe 4468 1cfb51141e5c4f989c3322488251860a_JaffaCakes118.exe 4468 1cfb51141e5c4f989c3322488251860a_JaffaCakes118.exe 4468 1cfb51141e5c4f989c3322488251860a_JaffaCakes118.exe 4468 1cfb51141e5c4f989c3322488251860a_JaffaCakes118.exe 4468 1cfb51141e5c4f989c3322488251860a_JaffaCakes118.exe 4468 1cfb51141e5c4f989c3322488251860a_JaffaCakes118.exe 4468 1cfb51141e5c4f989c3322488251860a_JaffaCakes118.exe 4468 1cfb51141e5c4f989c3322488251860a_JaffaCakes118.exe 4468 1cfb51141e5c4f989c3322488251860a_JaffaCakes118.exe 4468 1cfb51141e5c4f989c3322488251860a_JaffaCakes118.exe 4468 1cfb51141e5c4f989c3322488251860a_JaffaCakes118.exe 4468 1cfb51141e5c4f989c3322488251860a_JaffaCakes118.exe 4468 1cfb51141e5c4f989c3322488251860a_JaffaCakes118.exe 4468 1cfb51141e5c4f989c3322488251860a_JaffaCakes118.exe 4468 1cfb51141e5c4f989c3322488251860a_JaffaCakes118.exe 4468 1cfb51141e5c4f989c3322488251860a_JaffaCakes118.exe 4468 1cfb51141e5c4f989c3322488251860a_JaffaCakes118.exe 4468 1cfb51141e5c4f989c3322488251860a_JaffaCakes118.exe 4468 1cfb51141e5c4f989c3322488251860a_JaffaCakes118.exe 4468 1cfb51141e5c4f989c3322488251860a_JaffaCakes118.exe 3640 igfxdmx32.exe 3640 igfxdmx32.exe 3640 igfxdmx32.exe 3640 igfxdmx32.exe 3640 igfxdmx32.exe 3640 igfxdmx32.exe 3640 igfxdmx32.exe 3640 igfxdmx32.exe 3640 igfxdmx32.exe 3640 igfxdmx32.exe 3640 igfxdmx32.exe 3640 igfxdmx32.exe 3640 igfxdmx32.exe 3640 igfxdmx32.exe 3640 igfxdmx32.exe 3640 igfxdmx32.exe 3640 igfxdmx32.exe 3640 igfxdmx32.exe 3640 igfxdmx32.exe 3640 igfxdmx32.exe 3640 igfxdmx32.exe 3640 igfxdmx32.exe 3640 igfxdmx32.exe 3640 igfxdmx32.exe 3640 igfxdmx32.exe 3640 igfxdmx32.exe 3640 igfxdmx32.exe 3640 igfxdmx32.exe 3640 igfxdmx32.exe 3640 igfxdmx32.exe 2256 igfxdmx32.exe 2256 igfxdmx32.exe 2256 igfxdmx32.exe 2256 igfxdmx32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1cfb51141e5c4f989c3322488251860a_JaffaCakes118.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exeigfxdmx32.exedescription pid process target process PID 4468 wrote to memory of 3640 4468 1cfb51141e5c4f989c3322488251860a_JaffaCakes118.exe igfxdmx32.exe PID 4468 wrote to memory of 3640 4468 1cfb51141e5c4f989c3322488251860a_JaffaCakes118.exe igfxdmx32.exe PID 4468 wrote to memory of 3640 4468 1cfb51141e5c4f989c3322488251860a_JaffaCakes118.exe igfxdmx32.exe PID 3640 wrote to memory of 2256 3640 igfxdmx32.exe igfxdmx32.exe PID 3640 wrote to memory of 2256 3640 igfxdmx32.exe igfxdmx32.exe PID 3640 wrote to memory of 2256 3640 igfxdmx32.exe igfxdmx32.exe PID 2256 wrote to memory of 4804 2256 igfxdmx32.exe igfxdmx32.exe PID 2256 wrote to memory of 4804 2256 igfxdmx32.exe igfxdmx32.exe PID 2256 wrote to memory of 4804 2256 igfxdmx32.exe igfxdmx32.exe PID 4804 wrote to memory of 1252 4804 igfxdmx32.exe igfxdmx32.exe PID 4804 wrote to memory of 1252 4804 igfxdmx32.exe igfxdmx32.exe PID 4804 wrote to memory of 1252 4804 igfxdmx32.exe igfxdmx32.exe PID 1252 wrote to memory of 3916 1252 igfxdmx32.exe igfxdmx32.exe PID 1252 wrote to memory of 3916 1252 igfxdmx32.exe igfxdmx32.exe PID 1252 wrote to memory of 3916 1252 igfxdmx32.exe igfxdmx32.exe PID 3916 wrote to memory of 3796 3916 igfxdmx32.exe igfxdmx32.exe PID 3916 wrote to memory of 3796 3916 igfxdmx32.exe igfxdmx32.exe PID 3916 wrote to memory of 3796 3916 igfxdmx32.exe igfxdmx32.exe PID 3796 wrote to memory of 2012 3796 igfxdmx32.exe igfxdmx32.exe PID 3796 wrote to memory of 2012 3796 igfxdmx32.exe igfxdmx32.exe PID 3796 wrote to memory of 2012 3796 igfxdmx32.exe igfxdmx32.exe PID 2012 wrote to memory of 2164 2012 igfxdmx32.exe igfxdmx32.exe PID 2012 wrote to memory of 2164 2012 igfxdmx32.exe igfxdmx32.exe PID 2012 wrote to memory of 2164 2012 igfxdmx32.exe igfxdmx32.exe PID 2164 wrote to memory of 4184 2164 igfxdmx32.exe igfxdmx32.exe PID 2164 wrote to memory of 4184 2164 igfxdmx32.exe igfxdmx32.exe PID 2164 wrote to memory of 4184 2164 igfxdmx32.exe igfxdmx32.exe PID 4184 wrote to memory of 4524 4184 igfxdmx32.exe igfxdmx32.exe PID 4184 wrote to memory of 4524 4184 igfxdmx32.exe igfxdmx32.exe PID 4184 wrote to memory of 4524 4184 igfxdmx32.exe igfxdmx32.exe PID 4524 wrote to memory of 316 4524 igfxdmx32.exe igfxdmx32.exe PID 4524 wrote to memory of 316 4524 igfxdmx32.exe igfxdmx32.exe PID 4524 wrote to memory of 316 4524 igfxdmx32.exe igfxdmx32.exe PID 316 wrote to memory of 2496 316 igfxdmx32.exe igfxdmx32.exe PID 316 wrote to memory of 2496 316 igfxdmx32.exe igfxdmx32.exe PID 316 wrote to memory of 2496 316 igfxdmx32.exe igfxdmx32.exe PID 2496 wrote to memory of 3652 2496 igfxdmx32.exe igfxdmx32.exe PID 2496 wrote to memory of 3652 2496 igfxdmx32.exe igfxdmx32.exe PID 2496 wrote to memory of 3652 2496 igfxdmx32.exe igfxdmx32.exe PID 3652 wrote to memory of 2520 3652 igfxdmx32.exe igfxdmx32.exe PID 3652 wrote to memory of 2520 3652 igfxdmx32.exe igfxdmx32.exe PID 3652 wrote to memory of 2520 3652 igfxdmx32.exe igfxdmx32.exe PID 2520 wrote to memory of 4548 2520 igfxdmx32.exe igfxdmx32.exe PID 2520 wrote to memory of 4548 2520 igfxdmx32.exe igfxdmx32.exe PID 2520 wrote to memory of 4548 2520 igfxdmx32.exe igfxdmx32.exe PID 4548 wrote to memory of 1304 4548 igfxdmx32.exe igfxdmx32.exe PID 4548 wrote to memory of 1304 4548 igfxdmx32.exe igfxdmx32.exe PID 4548 wrote to memory of 1304 4548 igfxdmx32.exe igfxdmx32.exe PID 1304 wrote to memory of 3196 1304 igfxdmx32.exe igfxdmx32.exe PID 1304 wrote to memory of 3196 1304 igfxdmx32.exe igfxdmx32.exe PID 1304 wrote to memory of 3196 1304 igfxdmx32.exe igfxdmx32.exe PID 3196 wrote to memory of 2912 3196 igfxdmx32.exe igfxdmx32.exe PID 3196 wrote to memory of 2912 3196 igfxdmx32.exe igfxdmx32.exe PID 3196 wrote to memory of 2912 3196 igfxdmx32.exe igfxdmx32.exe PID 2912 wrote to memory of 2828 2912 igfxdmx32.exe igfxdmx32.exe PID 2912 wrote to memory of 2828 2912 igfxdmx32.exe igfxdmx32.exe PID 2912 wrote to memory of 2828 2912 igfxdmx32.exe igfxdmx32.exe PID 2828 wrote to memory of 2332 2828 igfxdmx32.exe igfxdmx32.exe PID 2828 wrote to memory of 2332 2828 igfxdmx32.exe igfxdmx32.exe PID 2828 wrote to memory of 2332 2828 igfxdmx32.exe igfxdmx32.exe PID 2332 wrote to memory of 3968 2332 igfxdmx32.exe igfxdmx32.exe PID 2332 wrote to memory of 3968 2332 igfxdmx32.exe igfxdmx32.exe PID 2332 wrote to memory of 3968 2332 igfxdmx32.exe igfxdmx32.exe PID 3968 wrote to memory of 3404 3968 igfxdmx32.exe igfxdmx32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1cfb51141e5c4f989c3322488251860a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1cfb51141e5c4f989c3322488251860a_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdmx32.exe"C:\Windows\system32\igfxdmx32.exe" C:\Users\Admin\AppData\Local\Temp\1CFB51~1.EXE2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdmx32.exe"C:\Windows\system32\igfxdmx32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE3⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdmx32.exe"C:\Windows\system32\igfxdmx32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE4⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdmx32.exe"C:\Windows\system32\igfxdmx32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE5⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdmx32.exe"C:\Windows\system32\igfxdmx32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE6⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdmx32.exe"C:\Windows\system32\igfxdmx32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE7⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdmx32.exe"C:\Windows\system32\igfxdmx32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE8⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdmx32.exe"C:\Windows\system32\igfxdmx32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE9⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdmx32.exe"C:\Windows\system32\igfxdmx32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE10⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdmx32.exe"C:\Windows\system32\igfxdmx32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE11⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdmx32.exe"C:\Windows\system32\igfxdmx32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE12⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdmx32.exe"C:\Windows\system32\igfxdmx32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE13⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdmx32.exe"C:\Windows\system32\igfxdmx32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE14⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdmx32.exe"C:\Windows\system32\igfxdmx32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE15⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdmx32.exe"C:\Windows\system32\igfxdmx32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE16⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdmx32.exe"C:\Windows\system32\igfxdmx32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE17⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdmx32.exe"C:\Windows\system32\igfxdmx32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE18⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdmx32.exe"C:\Windows\system32\igfxdmx32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE19⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdmx32.exe"C:\Windows\system32\igfxdmx32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE20⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdmx32.exe"C:\Windows\system32\igfxdmx32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE21⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdmx32.exe"C:\Windows\system32\igfxdmx32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE22⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdmx32.exe"C:\Windows\system32\igfxdmx32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE23⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdmx32.exe"C:\Windows\system32\igfxdmx32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE24⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdmx32.exe"C:\Windows\system32\igfxdmx32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE25⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdmx32.exe"C:\Windows\system32\igfxdmx32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE26⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdmx32.exe"C:\Windows\system32\igfxdmx32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE27⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdmx32.exe"C:\Windows\system32\igfxdmx32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE28⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdmx32.exe"C:\Windows\system32\igfxdmx32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE29⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdmx32.exe"C:\Windows\system32\igfxdmx32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE30⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdmx32.exe"C:\Windows\system32\igfxdmx32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE31⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdmx32.exe"C:\Windows\system32\igfxdmx32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE32⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdmx32.exe"C:\Windows\system32\igfxdmx32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE33⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdmx32.exe"C:\Windows\system32\igfxdmx32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE34⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdmx32.exe"C:\Windows\system32\igfxdmx32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE35⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdmx32.exe"C:\Windows\system32\igfxdmx32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE36⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdmx32.exe"C:\Windows\system32\igfxdmx32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE37⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdmx32.exe"C:\Windows\system32\igfxdmx32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE38⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdmx32.exe"C:\Windows\system32\igfxdmx32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE39⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdmx32.exe"C:\Windows\system32\igfxdmx32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE40⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdmx32.exe"C:\Windows\system32\igfxdmx32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE41⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdmx32.exe"C:\Windows\system32\igfxdmx32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE42⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdmx32.exe"C:\Windows\system32\igfxdmx32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE43⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdmx32.exe"C:\Windows\system32\igfxdmx32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE44⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdmx32.exe"C:\Windows\system32\igfxdmx32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE45⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdmx32.exe"C:\Windows\system32\igfxdmx32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE46⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdmx32.exe"C:\Windows\system32\igfxdmx32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE47⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\igfxdmx32.exeFilesize
508KB
MD51cfb51141e5c4f989c3322488251860a
SHA163e204959e34ec1a3f071079025ee572859c5c41
SHA2569ca8e3e470787f315cb0f2cfaceba4be7a513f03e5500acf1f58b963aadfe036
SHA512a75e0575273794b0117c574acb3cbb6d4db56758b4fdb06c7155902b1d417e015715417e0aea44b5a24e086c985c1bddeb394f287ff317ede3a61536b5a22579
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/8-170-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/212-160-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/212-164-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/316-80-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/448-178-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/544-171-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/960-128-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/960-123-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/1252-57-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/1252-50-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/1304-96-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/1320-184-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/2012-63-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/2012-66-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/2096-158-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/2096-162-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/2164-70-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/2244-155-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/2244-150-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/2256-47-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/2256-43-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/2256-44-0x0000000000020000-0x0000000000024000-memory.dmpFilesize
16KB
-
memory/2332-105-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/2332-110-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/2448-166-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/2496-79-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/2496-83-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/2520-88-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/2828-107-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/2864-129-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/2864-134-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/2912-182-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/2912-102-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/2932-138-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/2932-132-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/3056-168-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/3088-175-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/3160-120-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/3192-173-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/3196-99-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/3208-144-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/3404-114-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/3404-117-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/3408-152-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/3408-146-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/3640-42-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/3640-41-0x00000000001C0000-0x00000000001C4000-memory.dmpFilesize
16KB
-
memory/3640-35-0x00000000001C0000-0x00000000001C4000-memory.dmpFilesize
16KB
-
memory/3652-86-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/3796-62-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/3916-59-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/3916-55-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/3968-113-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/4184-73-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/4276-148-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/4356-141-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/4356-136-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/4404-125-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/4404-121-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/4440-180-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/4440-176-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/4468-37-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/4468-0-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/4468-38-0x00000000001C0000-0x00000000001C4000-memory.dmpFilesize
16KB
-
memory/4468-1-0x00000000001C0000-0x00000000001C4000-memory.dmpFilesize
16KB
-
memory/4524-76-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/4548-89-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/4548-92-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/4804-48-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/4804-52-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/5068-157-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB