3e9ec8cbfc2038af3d2e037ae8a64223af43af7cfb6e531df91a6d889445155e

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-04_62498ac2b9c5f5782982e7a5b5dca441_elex_icedid_njrat.exe
Size 1.0MB
Sample260604-ejj83ahx3x
SHA256 3e9ec8cbfc2038af3d2e037ae8a64223af43af7cfb6e531df91a6d889445155e
MD5 62498ac2b9c5f5782982e7a5b5dca441
SHA1 6704bc9785157393a57ee3494fd09bacb145ea14
SHA512 7351647028f0fe0343c9d0c41bdd6294a6901c38bd4ff167515b4d29d2316d76bf03ca9298d2a0349fda92610ef9c6faca3a203dd1165950c51d9ada28ccbb84
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoz:jxPAPJmt4
TLSH
T1C135A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Executes dropped EXE 44 IoCs

pid	Process
1268	wcpamklt.exe
1832	wyhghkfxt.exe
4424	wvn.exe
3704	wgd.exe
772	wxnjdt.exe
4864	wevql.exe
3360	walmejbrm.exe
4664	wja.exe
396	wpixvswub.exe
1492	wkxuox.exe
4476	wtqiscpdg.exe
5056	wijsoua.exe
768	wqdftxgf.exe
5068	wehyvs.exe
2104	wsbkrnk.exe
4288	wlyqsv.exe
1216	wyelw.exe
2492	wpvrid.exe
2592	waqeogu.exe
2296	welvcsw.exe
4732	wrvrrkak.exe
5084	wxfyyvr.exe
2836	wregyfn.exe
1500	wms.exe
1708	wrbkys.exe
3996	wcuxevy.exe
4868	wgqoq.exe
3384	wtjx.exe
444	wccl.exe
4372	whvdfpt.exe
2480	waohsc.exe
1448	wmt.exe
5076	wwlpayiw.exe
4044	wcvvhj.exe
3164	wtgnpt.exe
4344	wapvv.exe
3244	wntpxa.exe
3992	wncan.exe
4700	wkciuri.exe
3000	wqkod.exe
3084	wfaq.exe
584	wdil.exe
3884	wkolwki.exe
1172	waxlg.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\welvcsw.exe	waqeogu.exe
File opened for modification	C:\Windows\SysWOW64\wms.exe	wregyfn.exe
File opened for modification	C:\Windows\SysWOW64\wgqoq.exe	wcuxevy.exe
File opened for modification	C:\Windows\SysWOW64\wncan.exe	wntpxa.exe
File created	C:\Windows\SysWOW64\wdil.exe	wfaq.exe
File opened for modification	C:\Windows\SysWOW64\wvn.exe	wyhghkfxt.exe
File created	C:\Windows\SysWOW64\wja.exe	walmejbrm.exe
File created	C:\Windows\SysWOW64\wijsoua.exe	wtqiscpdg.exe
File opened for modification	C:\Windows\SysWOW64\wsbkrnk.exe	wehyvs.exe
File opened for modification	C:\Windows\SysWOW64\wpvrid.exe	wyelw.exe
File opened for modification	C:\Windows\SysWOW64\wkciuri.exe	wncan.exe
File opened for modification	C:\Windows\SysWOW64\wfaq.exe	wqkod.exe
File opened for modification	C:\Windows\SysWOW64\wgd.exe	wvn.exe
File created	C:\Windows\SysWOW64\wyelw.exe	wlyqsv.exe
File opened for modification	C:\Windows\SysWOW64\wyelw.exe	wlyqsv.exe
File opened for modification	C:\Windows\SysWOW64\wrbkys.exe	wms.exe
File opened for modification	C:\Windows\SysWOW64\wtjx.exe	wgqoq.exe
File created	C:\Windows\SysWOW64\wpixvswub.exe	wja.exe
File created	C:\Windows\SysWOW64\wkciuri.exe	wncan.exe
File created	C:\Windows\SysWOW64\wcpamklt.exe	2026-06-04_62498ac2b9c5f5782982e7a5b5dca441_elex_icedid_njrat.exe
File opened for modification	C:\Windows\SysWOW64\wtqiscpdg.exe	wkxuox.exe
File created	C:\Windows\SysWOW64\wrbkys.exe	wms.exe
File created	C:\Windows\SysWOW64\wcuxevy.exe	wrbkys.exe
File created	C:\Windows\SysWOW64\waohsc.exe	whvdfpt.exe
File created	C:\Windows\SysWOW64\wmt.exe	waohsc.exe
File created	C:\Windows\SysWOW64\wwlpayiw.exe	wmt.exe
File opened for modification	C:\Windows\SysWOW64\wcvvhj.exe	wwlpayiw.exe
File opened for modification	C:\Windows\SysWOW64\welvcsw.exe	waqeogu.exe
File created	C:\Windows\SysWOW64\wregyfn.exe	wxfyyvr.exe
File created	C:\Windows\SysWOW64\wapvv.exe	wtgnpt.exe
File opened for modification	C:\Windows\SysWOW64\wntpxa.exe	wapvv.exe
File created	C:\Windows\SysWOW64\wqkod.exe	wkciuri.exe
File opened for modification	C:\Windows\SysWOW64\wpixvswub.exe	wja.exe
File created	C:\Windows\SysWOW64\wqdftxgf.exe	wijsoua.exe
File opened for modification	C:\Windows\SysWOW64\wehyvs.exe	wqdftxgf.exe
File opened for modification	C:\Windows\SysWOW64\waohsc.exe	whvdfpt.exe
File opened for modification	C:\Windows\SysWOW64\wwlpayiw.exe	wmt.exe
File opened for modification	C:\Windows\SysWOW64\wqkod.exe	wkciuri.exe
File opened for modification	C:\Windows\SysWOW64\wdil.exe	wfaq.exe
File created	C:\Windows\SysWOW64\wkxuox.exe	wpixvswub.exe
File opened for modification	C:\Windows\SysWOW64\whvdfpt.exe	wccl.exe
File created	C:\Windows\SysWOW64\wcvvhj.exe	wwlpayiw.exe
File created	C:\Windows\SysWOW64\wxnjdt.exe	wgd.exe
File opened for modification	C:\Windows\SysWOW64\wkxuox.exe	wpixvswub.exe
File opened for modification	C:\Windows\SysWOW64\wlyqsv.exe	wsbkrnk.exe
File opened for modification	C:\Windows\SysWOW64\waqeogu.exe	wpvrid.exe
File created	C:\Windows\SysWOW64\wms.exe	wregyfn.exe
File created	C:\Windows\SysWOW64\wntpxa.exe	wapvv.exe
File created	C:\Windows\SysWOW64\wkolwki.exe	wdil.exe
File opened for modification	C:\Windows\SysWOW64\wxnjdt.exe	wgd.exe
File created	C:\Windows\SysWOW64\wpvrid.exe	wyelw.exe
File opened for modification	C:\Windows\SysWOW64\wtgnpt.exe	wcvvhj.exe
File opened for modification	C:\Windows\SysWOW64\waxlg.exe	wkolwki.exe
File opened for modification	C:\Windows\SysWOW64\wcuxevy.exe	wrbkys.exe
File created	C:\Windows\SysWOW64\wtjx.exe	wgqoq.exe
File created	C:\Windows\SysWOW64\wbwoil.exe	waxlg.exe
File created	C:\Windows\SysWOW64\wehyvs.exe	wqdftxgf.exe
File created	C:\Windows\SysWOW64\wevql.exe	wxnjdt.exe
File opened for modification	C:\Windows\SysWOW64\walmejbrm.exe	wevql.exe
File created	C:\Windows\SysWOW64\wrvrrkak.exe	welvcsw.exe
File created	C:\Windows\SysWOW64\wxfyyvr.exe	wrvrrkak.exe
File created	C:\Windows\SysWOW64\wgqoq.exe	wcuxevy.exe
File opened for modification	C:\Windows\SysWOW64\wcpamklt.exe	2026-06-04_62498ac2b9c5f5782982e7a5b5dca441_elex_icedid_njrat.exe
File opened for modification	C:\Windows\SysWOW64\wevql.exe	wxnjdt.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 21 IoCs

pid	pid_target	Process	procid_target
3000	2728	WerFault.exe	79
572	1832	WerFault.exe	86
3520	1832	WerFault.exe	86
1100	4424	WerFault.exe	90
2184	4664	WerFault.exe	111
4364	1492	WerFault.exe	119
2084	4476	WerFault.exe	122
1580	768	WerFault.exe	132
1568	768	WerFault.exe	132
5052	768	WerFault.exe	132
4856	768	WerFault.exe	132
4280	2492	WerFault.exe	155
3924	1500	WerFault.exe	175
3272	4344	WerFault.exe	213
4256	4344	WerFault.exe	213
408	4700	WerFault.exe	226
572	3000	WerFault.exe	229
1340	3084	WerFault.exe	234
1052	584	WerFault.exe	239
4428	584	WerFault.exe	239
1064	3884	WerFault.exe	244

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wncan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcvvhj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcpamklt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wlyqsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wntpxa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wxfyyvr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wxnjdt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wsbkrnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wyelw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wkciuri.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wdil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-04_62498ac2b9c5f5782982e7a5b5dca441_elex_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wvn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wwlpayiw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrbkys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wapvv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	waxlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wehyvs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wijsoua.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	walmejbrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqdftxgf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrvrrkak.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wgqoq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wyhghkfxt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtqiscpdg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	welvcsw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wregyfn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wms.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtjx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	waohsc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wfaq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wpixvswub.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 1268	2728	2026-06-04_62498ac2b9c5f5782982e7a5b5dca441_elex_icedid_njrat.exe	80
PID 2728 wrote to memory of 3980	2728	2026-06-04_62498ac2b9c5f5782982e7a5b5dca441_elex_icedid_njrat.exe	81
PID 1268 wrote to memory of 1832	1268	wcpamklt.exe	86
PID 1268 wrote to memory of 920	1268	wcpamklt.exe	87
PID 1832 wrote to memory of 4424	1832	wyhghkfxt.exe	90
PID 1832 wrote to memory of 5016	1832	wyhghkfxt.exe	91
PID 4424 wrote to memory of 3704	4424	wvn.exe	97
PID 4424 wrote to memory of 5032	4424	wvn.exe	98
PID 3704 wrote to memory of 772	3704	wgd.exe	102
PID 3704 wrote to memory of 704	3704	wgd.exe	103
PID 772 wrote to memory of 4864	772	wxnjdt.exe	105
PID 772 wrote to memory of 4856	772	wxnjdt.exe	106
PID 4864 wrote to memory of 3360	4864	wevql.exe	108
PID 4864 wrote to memory of 2824	4864	wevql.exe	109
PID 3360 wrote to memory of 4664	3360	walmejbrm.exe	111
PID 3360 wrote to memory of 3672	3360	walmejbrm.exe	112
PID 4664 wrote to memory of 396	4664	wja.exe	114
PID 4664 wrote to memory of 2732	4664	wja.exe	115
PID 396 wrote to memory of 1492	396	wpixvswub.exe	119
PID 396 wrote to memory of 1788	396	wpixvswub.exe	120
PID 1492 wrote to memory of 4476	1492	wkxuox.exe	122
PID 1492 wrote to memory of 2632	1492	wkxuox.exe	123
PID 4476 wrote to memory of 5056	4476	wtqiscpdg.exe	127
PID 4476 wrote to memory of 4788	4476	wtqiscpdg.exe	128
PID 5056 wrote to memory of 768	5056	wijsoua.exe	132
PID 5056 wrote to memory of 3948	5056	wijsoua.exe	133
PID 768 wrote to memory of 5068	768	wqdftxgf.exe	135
PID 768 wrote to memory of 4228	768	wqdftxgf.exe	136
PID 5068 wrote to memory of 2104	5068	wehyvs.exe	145
PID 5068 wrote to memory of 3728	5068	wehyvs.exe	147
PID 2104 wrote to memory of 4288	2104	wsbkrnk.exe	149
PID 2104 wrote to memory of 2040	2104	wsbkrnk.exe	150
PID 4288 wrote to memory of 1216	4288	wlyqsv.exe	152
PID 4288 wrote to memory of 1744	4288	wlyqsv.exe	153
PID 1216 wrote to memory of 2492	1216	wyelw.exe	155
PID 1216 wrote to memory of 4512	1216	wyelw.exe	156
PID 2492 wrote to memory of 2592	2492	wpvrid.exe	158
PID 2492 wrote to memory of 4340	2492	wpvrid.exe	159
PID 2592 wrote to memory of 2296	2592	waqeogu.exe	163
PID 2592 wrote to memory of 2960	2592	waqeogu.exe	164
PID 2296 wrote to memory of 4732	2296	welvcsw.exe	166
PID 2296 wrote to memory of 3260	2296	welvcsw.exe	167
PID 4732 wrote to memory of 5084	4732	wrvrrkak.exe	169
PID 4732 wrote to memory of 4572	4732	wrvrrkak.exe	170
PID 5084 wrote to memory of 2836	5084	wxfyyvr.exe	172
PID 5084 wrote to memory of 3772	5084	wxfyyvr.exe	173
PID 2836 wrote to memory of 1500	2836	wregyfn.exe	175
PID 2836 wrote to memory of 1592	2836	wregyfn.exe	176
PID 1500 wrote to memory of 1708	1500	wms.exe	178
PID 1500 wrote to memory of 5060	1500	wms.exe	179
PID 1708 wrote to memory of 3996	1708	wrbkys.exe	183
PID 1708 wrote to memory of 4148	1708	wrbkys.exe	184
PID 3996 wrote to memory of 4868	3996	wcuxevy.exe	186
PID 3996 wrote to memory of 2572	3996	wcuxevy.exe	187
PID 4868 wrote to memory of 3384	4868	wgqoq.exe	189
PID 4868 wrote to memory of 2204	4868	wgqoq.exe	190
PID 3384 wrote to memory of 444	3384	wtjx.exe	192
PID 3384 wrote to memory of 2436	3384	wtjx.exe	193
PID 444 wrote to memory of 4372	444	wccl.exe	195
PID 444 wrote to memory of 3964	444	wccl.exe	196
PID 4372 wrote to memory of 2480	4372	whvdfpt.exe	198
PID 4372 wrote to memory of 3084	4372	whvdfpt.exe	199
PID 2480 wrote to memory of 1448	2480	waohsc.exe	201
PID 2480 wrote to memory of 3388	2480	waohsc.exe	202

C:\Users\Admin\AppData\Local\Temp\2026-06-04_62498ac2b9c5f5782982e7a5b5dca441_elex_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-04_62498ac2b9c5f5782982e7a5b5dca441_elex_icedid_njrat.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Windows\SysWOW64\wcpamklt.exe
  "C:\Windows\system32\wcpamklt.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1268
- - C:\Windows\SysWOW64\wyhghkfxt.exe
    "C:\Windows\system32\wyhghkfxt.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1832
  - - C:\Windows\SysWOW64\wvn.exe
      "C:\Windows\system32\wvn.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4424
    - - C:\Windows\SysWOW64\wgd.exe
        
        "C:\Windows\system32\wgd.exe"
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3704
      - C:\Windows\SysWOW64\wxnjdt.exe
        
        "C:\Windows\system32\wxnjdt.exe"
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:772
        
        C:\Windows\SysWOW64\wevql.exe
        
        "C:\Windows\system32\wevql.exe"
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4864
        
        C:\Windows\SysWOW64\walmejbrm.exe
        
        "C:\Windows\system32\walmejbrm.exe"
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3360
        
        C:\Windows\SysWOW64\wja.exe
        
        "C:\Windows\system32\wja.exe"
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4664
        
        C:\Windows\SysWOW64\wpixvswub.exe
        
        "C:\Windows\system32\wpixvswub.exe"
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:396
        
        C:\Windows\SysWOW64\wkxuox.exe
        
        "C:\Windows\system32\wkxuox.exe"
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1492
        
        C:\Windows\SysWOW64\wtqiscpdg.exe
        
        "C:\Windows\system32\wtqiscpdg.exe"
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4476
        
        C:\Windows\SysWOW64\wijsoua.exe
        
        "C:\Windows\system32\wijsoua.exe"
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5056
        
        C:\Windows\SysWOW64\wqdftxgf.exe
        
        "C:\Windows\system32\wqdftxgf.exe"
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:768
        
        C:\Windows\SysWOW64\wehyvs.exe
        
        "C:\Windows\system32\wehyvs.exe"
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5068
        
        C:\Windows\SysWOW64\wsbkrnk.exe
        
        "C:\Windows\system32\wsbkrnk.exe"
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2104
        
        C:\Windows\SysWOW64\wlyqsv.exe
        
        "C:\Windows\system32\wlyqsv.exe"
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4288
        
        C:\Windows\SysWOW64\wyelw.exe
        
        "C:\Windows\system32\wyelw.exe"
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1216
        
        C:\Windows\SysWOW64\wpvrid.exe
        
        "C:\Windows\system32\wpvrid.exe"
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2492
        
        C:\Windows\SysWOW64\waqeogu.exe
        
        "C:\Windows\system32\waqeogu.exe"
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2592
        
        C:\Windows\SysWOW64\welvcsw.exe
        
        "C:\Windows\system32\welvcsw.exe"
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2296
        
        C:\Windows\SysWOW64\wrvrrkak.exe
        
        "C:\Windows\system32\wrvrrkak.exe"
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4732
        
        C:\Windows\SysWOW64\wxfyyvr.exe
        
        "C:\Windows\system32\wxfyyvr.exe"
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5084
        
        C:\Windows\SysWOW64\wregyfn.exe
        
        "C:\Windows\system32\wregyfn.exe"
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2836
        
        C:\Windows\SysWOW64\wms.exe
        
        "C:\Windows\system32\wms.exe"
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1500
        
        C:\Windows\SysWOW64\wrbkys.exe
        
        "C:\Windows\system32\wrbkys.exe"
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1708
        
        C:\Windows\SysWOW64\wcuxevy.exe
        
        "C:\Windows\system32\wcuxevy.exe"
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3996
        
        C:\Windows\SysWOW64\wgqoq.exe
        
        "C:\Windows\system32\wgqoq.exe"
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4868
        
        C:\Windows\SysWOW64\wtjx.exe
        
        "C:\Windows\system32\wtjx.exe"
        29⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3384
        
        C:\Windows\SysWOW64\wccl.exe
        
        "C:\Windows\system32\wccl.exe"
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:444
        
        C:\Windows\SysWOW64\whvdfpt.exe
        
        "C:\Windows\system32\whvdfpt.exe"
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4372
        
        C:\Windows\SysWOW64\waohsc.exe
        
        "C:\Windows\system32\waohsc.exe"
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2480
        
        C:\Windows\SysWOW64\wmt.exe
        
        "C:\Windows\system32\wmt.exe"
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1448
        
        C:\Windows\SysWOW64\wwlpayiw.exe
        
        "C:\Windows\system32\wwlpayiw.exe"
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5076
        
        C:\Windows\SysWOW64\wcvvhj.exe
        
        "C:\Windows\system32\wcvvhj.exe"
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4044
        
        C:\Windows\SysWOW64\wtgnpt.exe
        
        "C:\Windows\system32\wtgnpt.exe"
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3164
        
        C:\Windows\SysWOW64\wapvv.exe
        
        "C:\Windows\system32\wapvv.exe"
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4344
        
        C:\Windows\SysWOW64\wntpxa.exe
        
        "C:\Windows\system32\wntpxa.exe"
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3244
        
        C:\Windows\SysWOW64\wncan.exe
        
        "C:\Windows\system32\wncan.exe"
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3992
        
        C:\Windows\SysWOW64\wkciuri.exe
        
        "C:\Windows\system32\wkciuri.exe"
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4700
        
        C:\Windows\SysWOW64\wqkod.exe
        
        "C:\Windows\system32\wqkod.exe"
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3000
        
        C:\Windows\SysWOW64\wfaq.exe
        
        "C:\Windows\system32\wfaq.exe"
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3084
        
        C:\Windows\SysWOW64\wdil.exe
        
        "C:\Windows\system32\wdil.exe"
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:584
        
        C:\Windows\SysWOW64\wkolwki.exe
        
        "C:\Windows\system32\wkolwki.exe"
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3884
        
        C:\Windows\SysWOW64\waxlg.exe
        
        "C:\Windows\system32\waxlg.exe"
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1172
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wkolwki.exe"
        45⤵
        System Location Discovery: System Language Discovery
        
        PID:4856
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3884 -s 1704
        45⤵
        Program crash
        
        PID:1064
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wdil.exe"
        44⤵
        System Location Discovery: System Language Discovery
        
        PID:4884
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 584 -s 1748
        44⤵
        Program crash
        
        PID:1052
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 584 -s 1772
        44⤵
        Program crash
        
        PID:4428
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wfaq.exe"
        43⤵
        
        PID:1336
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 116
        43⤵
        Program crash
        
        PID:1340
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wqkod.exe"
        42⤵
        System Location Discovery: System Language Discovery
        
        PID:1256
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3000 -s 116
        42⤵
        Program crash
        
        PID:572
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wkciuri.exe"
        41⤵
        System Location Discovery: System Language Discovery
        
        PID:792
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4700 -s 1740
        41⤵
        Program crash
        
        PID:408
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wncan.exe"
        40⤵
        System Location Discovery: System Language Discovery
        
        PID:3532
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wntpxa.exe"
        39⤵
        System Location Discovery: System Language Discovery
        
        PID:4104
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wapvv.exe"
        38⤵
        System Location Discovery: System Language Discovery
        
        PID:944
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4344 -s 8
        38⤵
        Program crash
        
        PID:3272
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4344 -s 116
        38⤵
        Program crash
        
        PID:4256
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wtgnpt.exe"
        37⤵
        
        PID:5092
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wcvvhj.exe"
        36⤵
        
        PID:356
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wwlpayiw.exe"
        35⤵
        System Location Discovery: System Language Discovery
        
        PID:4744
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wmt.exe"
        34⤵
        System Location Discovery: System Language Discovery
        
        PID:1100
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\waohsc.exe"
        33⤵
        System Location Discovery: System Language Discovery
        
        PID:3388
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\whvdfpt.exe"
        32⤵
        System Location Discovery: System Language Discovery
        
        PID:3084
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wccl.exe"
        31⤵
        
        PID:3964
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wtjx.exe"
        30⤵
        
        PID:2436
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wgqoq.exe"
        29⤵
        
        PID:2204
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wcuxevy.exe"
        28⤵
        System Location Discovery: System Language Discovery
        
        PID:2572
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wrbkys.exe"
        27⤵
        System Location Discovery: System Language Discovery
        
        PID:4148
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wms.exe"
        26⤵
        System Location Discovery: System Language Discovery
        
        PID:5060
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1500 -s 1440
        26⤵
        Program crash
        
        PID:3924
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wregyfn.exe"
        25⤵
        System Location Discovery: System Language Discovery
        
        PID:1592
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wxfyyvr.exe"
        24⤵
        System Location Discovery: System Language Discovery
        
        PID:3772
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wrvrrkak.exe"
        23⤵
        System Location Discovery: System Language Discovery
        
        PID:4572
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\welvcsw.exe"
        22⤵
        
        PID:3260
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\waqeogu.exe"
        21⤵
        System Location Discovery: System Language Discovery
        
        PID:2960
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wpvrid.exe"
        20⤵
        System Location Discovery: System Language Discovery
        
        PID:4340
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2492 -s 1396
        20⤵
        Program crash
        
        PID:4280
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wyelw.exe"
        19⤵
        
        PID:4512
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wlyqsv.exe"
        18⤵
        System Location Discovery: System Language Discovery
        
        PID:1744
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wsbkrnk.exe"
        17⤵
        System Location Discovery: System Language Discovery
        
        PID:2040
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wehyvs.exe"
        16⤵
        
        PID:3728
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wqdftxgf.exe"
        15⤵
        System Location Discovery: System Language Discovery
        
        PID:4228
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 768 -s 1708
        15⤵
        Program crash
        
        PID:1580
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 768 -s 1520
        15⤵
        Program crash
        
        PID:1568
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 768 -s 1460
        15⤵
        Program crash
        
        PID:5052
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 768 -s 1584
        15⤵
        Program crash
        
        PID:4856
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wijsoua.exe"
        14⤵
        System Location Discovery: System Language Discovery
        
        PID:3948
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wtqiscpdg.exe"
        13⤵
        System Location Discovery: System Language Discovery
        
        PID:4788
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4476 -s 1456
        13⤵
        Program crash
        
        PID:2084
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wkxuox.exe"
        12⤵
        System Location Discovery: System Language Discovery
        
        PID:2632
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1492 -s 1480
        12⤵
        Program crash
        
        PID:4364
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wpixvswub.exe"
        11⤵
        
        PID:1788
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wja.exe"
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:2732
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4664 -s 116
        10⤵
        Program crash
        
        PID:2184
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\walmejbrm.exe"
        9⤵
        
        PID:3672
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wevql.exe"
        8⤵
        
        PID:2824
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wxnjdt.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4856
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wgd.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:704
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wvn.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5032
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4424 -s 1708
        5⤵
        Program crash
        
        PID:1100
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wyhghkfxt.exe"
      4⤵
      PID:5016
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 1676
      4⤵
      Program crash
      PID:572
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 1688
      4⤵
      Program crash
      PID:3520
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wcpamklt.exe"
    3⤵
    PID:920
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\2026-06-04_62498ac2b9c5f5782982e7a5b5dca441_elex_icedid_njrat.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3980
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 8
  2⤵
  - Program crash
  PID:3000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2728 -ip 2728
1⤵
PID:2856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2728 -ip 2728
1⤵
PID:4048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1832 -ip 1832
1⤵
PID:2032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1832 -ip 1832
1⤵
PID:1132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4424 -ip 4424
1⤵
PID:948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4664 -ip 4664
1⤵
PID:2204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 1492 -ip 1492
1⤵
PID:3820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4476 -ip 4476
1⤵
PID:2032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 768 -ip 768
1⤵
PID:2892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 768 -ip 768
1⤵
PID:4064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 768 -ip 768
1⤵
PID:1340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 768 -ip 768
1⤵
PID:240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 2492 -ip 2492
1⤵
PID:916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 1500 -ip 1500
1⤵
PID:1600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4344 -ip 4344
1⤵
PID:4328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4344 -ip 4344
1⤵
PID:4432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 4700 -ip 4700
1⤵
PID:4448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3000 -ip 3000
1⤵
PID:1344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3084 -ip 3084
1⤵
PID:4560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 584 -ip 584
1⤵
PID:3204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 584 -ip 584
1⤵
PID:3740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 3884 -ip 3884
1⤵
PID:2716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

walmejbrm.exe

Path C:\Windows\SysWOW64\walmejbrm.exe
Size 1.0MB
SHA256 a91e66b781d6693e949836afb4737fc9a617b050b7822987b383affafac488be
MD5 e90de0653c409b320056cbbb9e37ab5c
SHA1 153bba0644b4297740f24f27e348804c011b4b42
SHA512 4cda918a6e9fe3e7d49579f7572efab1c2a290be83a1bd4cdbe1eb3ba9ad7eaebd696e7cf10a4eccb2d05dfb3f1b0d332894df06f72c55471dd8c89b0b942d84
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoT:jxPAPJmtw
TLSH
T11335A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

waohsc.exe

Path C:\Windows\SysWOW64\waohsc.exe
Size 1.0MB
SHA256 c1097cfdeb3d7106c376f6f3d93e434f0af4ffc002244b386c94e0063d28129b
MD5 213c28958946a93fdf29da8334041647
SHA1 b6bba1e312cbd4349284412e44bb88a37ff17452
SHA512 7e72a78accf90b1130702f07c19ff2913f30915dff0ad038cd9aa29220cadc42094c93b8bee243109b018291e755eca524a7dc165081aacfcd9450d4a3712f01
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsol:jxPAPJmte
TLSH
T12035A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

waqeogu.exe

Path C:\Windows\SysWOW64\waqeogu.exe
Size 1.0MB
SHA256 369011c25ad9ac536a1f3372125cc99d456680a7431c72996e4b900c045c8686
MD5 33f8986435d684a6c253c37bc1a9a10e
SHA1 06bdda1281656959f6fec965c950b8dd70826aa9
SHA512 7610562c5a3bf2a1a3a92e1d4c369ee1868ffd5d36820fd412c7c7b6b8dbe566df03f6b2890a9c2e085cc71def79844b4bff02cc5441acfec80aba8a9d0f8eb1
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsob:jxPAPJmtw
TLSH
T1DA35A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wccl.exe

Path C:\Windows\SysWOW64\wccl.exe
Size 1.0MB
SHA256 95cad5f238aa5c6e49db097c9470b160b218fcb33923eddff9bd600aa91e8aec
MD5 66ee47f9aaf4cddc0ebb5e74cdd5a4f9
SHA1 2f6fbec6c284496f767ddb753dec74d5c41f2e21
SHA512 1fb928e2edab81dc869e10507c3eb585119b3c0d8b86e7ed21b255a53735db1e5ce59ea8cc36593e6db59713a07eeb4ca554167f60bad264ec2ad5eddfc07b8f
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsos:jxPAPJmtH
TLSH
T10535A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wcpamklt.exe

Path C:\Windows\SysWOW64\wcpamklt.exe
Size 1.0MB
SHA256 1c93f90553023a71260c4c3d93183240506c304bca5dc859f4263d88c462ec57
MD5 433cfee372192254dd17561ac501c6cd
SHA1 d60fd39d8689f6c6478abf580b32e6def504f7b6
SHA512 99002efed2de049776a848eaff0c6fe87682f49b048690302d17f039021e92731e523cdea051bb8a5587b26f7b42540cecbde0784e84196210ef5a8fe8457574
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoV:jxPAPJmtK
TLSH
T19835A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wcuxevy.exe

Path C:\Windows\SysWOW64\wcuxevy.exe
Size 1.0MB
SHA256 0eb04e2ec8f0f67679e4c9f9be409eaa2ec747bb731417f8b9479061577da833
MD5 b08b46747835653daa5f90f8d8e764d8
SHA1 52e9fbb2d03f6acb78a183c21dca4a356f2f5c9f
SHA512 3443e8c9c1ec709e8d1fc9ec8d456f5b62dba58b3791090e2c1b68624c41ca1a38c4152b8f801489b71dc29a73387b0ab696750ec297183f32a02260dc01fc76
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoW:jxPAPJmtF
TLSH
T1F635A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wehyvs.exe

Path C:\Windows\SysWOW64\wehyvs.exe
Size 1.0MB
SHA256 1d2d12ca910faa84121951f8b8c7c2a48d2e5103746c6f6366c35c179d1402c6
MD5 bb2990bd129b2453a9872763df109708
SHA1 6edcfbc7eddfc0952bc24453383cb2a0b97d9c00
SHA512 52c08c84b842252357513ba3a01bd9b3fa63cfd5e66221922c67c3523343913d993763c19842170b4a1c0ed368cec23a6af724770ce69211fdcf3f83eb9ce0c6
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoS:jxPAPJmtN
TLSH
T1B235A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

welvcsw.exe

Path C:\Windows\SysWOW64\welvcsw.exe
Size 1.0MB
SHA256 7431907da8a6fb0311d79c9d3907df409a6a75b8f565872aebfc88973d5e7368
MD5 e536fc520b0b580c9bf9ba618a86ad13
SHA1 bb9f37e09342ef3d452fba82aee0c9a9eedb301c
SHA512 549ca531333ee553f98b84730482db7f5b4378a68edc28033b05a5072e5a7231619e7cb199e006d3b5c0fc5ebaa1e74c04374929468dec072c898f75d1b4a00a
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nso+:jxPAPJmth
TLSH
T10435A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wevql.exe

Path C:\Windows\SysWOW64\wevql.exe
Size 1.0MB
SHA256 b896e48f93f4dd17f0bd43120213209fa8b4cd5c1a9823c88537ced84d7b4f76
MD5 a5bf2f4eb77df322c81b0c05c5438155
SHA1 bb067e7aeac6263901948cb37dc96d332796314a
SHA512 12e584832278fee81349393fd6712df7c1746d728fc4468f9a42850befeca2ea12173051d5614b3e626ad03869e0b3ab5893064308f537230fa6cc29ba6d0ac0
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoo:jxPAPJmtT
TLSH
T19335A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wgd.exe

Path C:\Windows\SysWOW64\wgd.exe
Size 1.0MB
SHA256 bde446d45229e9c301d7d5732bc3f4ab2e2fc2ae45a75b8b4e3929fd662ae129
MD5 32789dee5dd7c7d8a000a63f7d54c444
SHA1 150d6e827f25858430b794cf8175d1c6060d3c06
SHA512 d2f1b0d9ea99e6bc88a485ec43ee50ffc8f1d13f25dd0c790d92c2ad8dbb3ba4b23fa980a3eff38ea3bf7b8d5e1ad16cfd20284ddb0bbd7c3113f3c54c75f02c
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nso1:jxPAPJmt6
TLSH
T1E735A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wgqoq.exe

Path C:\Windows\SysWOW64\wgqoq.exe
Size 1.0MB
SHA256 6a71427294809a88ee38ae7ce508e3f05ad94724ee3caa41d3fc6b0c670b74c9
MD5 bf4af7056df21c40560ce16ae296dbc3
SHA1 16b66174844298d4fb6456448ce8dac1f327e1ec
SHA512 a9de2532901aea19b9e5f055ccb1618622a0e82ebea8c1c0ad6654aee01ee629763b224c26796486197cdd770e3ba440e3d5cd2926573bf3fbbef895de5d4be1
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoJ:jxPAPJmty
TLSH
T18E35A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

whvdfpt.exe

Path C:\Windows\SysWOW64\whvdfpt.exe
Size 1.0MB
SHA256 3bb1d358af77da567b15e750782b40e20141d8666d27410c2db86591d288cc3b
MD5 a9654ca79de067d8578375a8f15927ea
SHA1 066eb86157f803ad52cd8e4e72fdb019a47c7205
SHA512 cc545eb39005f509e4a30c954e54eae1c63de7d3cfc38f87f482050e8ed043521a81ffe772d4cdd4cf8f0c860bdaa6cbc469a5008bbba268c96494cfadae9949
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoI:jxPAPJmtr
TLSH
T11B35A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wijsoua.exe

Path C:\Windows\SysWOW64\wijsoua.exe
Size 1.0MB
SHA256 a6546571ce96f6285c793e103e600e3b7b261cc4c1fbf2501a42e9ad4f51a4ce
MD5 e67acd986cc06738c8e9880d73fa65c9
SHA1 af3f7d04c2adfb23b44b4e87ddf58eb39dc72206
SHA512 e9498939cd6f3146368022bc6d3d6101248dbfbaf1d60c95f12b1ae7dec48e1acafde495407c359e5959cb0a05800eb3d423966987b84dd3000dc079c9706edf
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nso7:jxPAPJmtA
TLSH
T14C35A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wja.exe

Path C:\Windows\SysWOW64\wja.exe
Size 1.0MB
SHA256 2ed8efacc3e6361e11f2b82c4d81a532f8423ac8e2e4db89369b05a41d929853
MD5 f776b711940578250afde03d41673204
SHA1 282721c89bf85fcf4189075b5d4b483c22af7759
SHA512 69743098c0bf7f8cf42284d1b1a97c550b832982b171449499e083dc249e2d2fccd054244e1e97aa740fba6ca98a5b70e4101cce704f76b3364c036395195947
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoO:jxPAPJmt5
TLSH
T12535A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wkxuox.exe

Path C:\Windows\SysWOW64\wkxuox.exe
Size 1.0MB
SHA256 4cd830ce63c856e5f2b6d3f893fd7482e6117b301303990d272e0852482d0291
MD5 2670edd7b33c040e8fc3f1f61db13bb6
SHA1 bef7cc8da3896add4285b02aaa851aa58b78040c
SHA512 074b2b477f3785c3744a5dc291b9955eaf9817318a7c74235f6696c7dc81627e28062110e80504340dcdabe091a253d1b5f5ed7bee1f4e27c48e07aad609a932
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsog:jxPAPJmtf
TLSH
T1C435A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wlyqsv.exe

Path C:\Windows\SysWOW64\wlyqsv.exe
Size 1.0MB
SHA256 a815848f3436b358441ab594bd3307aeb3a77baaf267bafcaa8d039c5e068640
MD5 d1d13d2f887a1c65238e5e2d7f6e448f
SHA1 4c68ae0ed9ce762ee9d02ee90150883b306eb2d0
SHA512 5c685fc165461717b0ab3e6a771e38352fdc26d2c702772b810ba277190c4c0350185d51febffccdbfd7f21f2360053fce8d05561c010bc3fde6111f38cd342a
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsos:jxPAPJmtH
TLSH
T15635A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wms.exe

Path C:\Windows\SysWOW64\wms.exe
Size 1.0MB
SHA256 814f10b9937f2ff7932e13223cdefaed8023c8435a8202f7e60814ca84604678
MD5 a78c830366df8de90b1e1fd9a31eb944
SHA1 2e6e0445e20ecf41b82bf913b4a91173adb0b314
SHA512 e39dbde7af10b4625b730f1448f7d0b2cfcef001df099af0ec60e127c2eefa86962f7542a9671d82ed2b45372ea1b3c05b409a2487d78009086df9da40d070f5
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoL:jxPAPJmtg
TLSH
T1F035A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmt.exe

Path C:\Windows\SysWOW64\wmt.exe
Size 1.0MB
SHA256 3602f36f56ec93fb273aff3f97ca4386ec149ee7bb5a2e52605334f0520dcca2
MD5 5518fde4560c5d3a5b06517364fd78bc
SHA1 78d3972fc57e5e2fd3515f36826238c96fe6609a
SHA512 0e398cd77e8eec8d036c3ec8d71cbda60b99f958048d165ee430b61c5c662ef324e94763335650f67dc7640ce1df63f15ca9fbc41e0c481cceba3b25f4198b0a
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoO:jxPAPJmtx
TLSH
T15935A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpixvswub.exe

Path C:\Windows\SysWOW64\wpixvswub.exe
Size 1.0MB
SHA256 b64c2de441c77a947ceeb3a585616bb60a645bc1d896d9a53249ed4f0603e778
MD5 d15d49ad112eade0165ad7bd993a4b8b
SHA1 9e9e53d1a5596d7e3ba78ab18b1eceec1b6ab342
SHA512 e1da481f507f3a51ff56104705c8c07cd00b2edfc8c267abbd76a879e7806607ba5ffda380cc2f38d4f055b82c7ead4052b97445788c6d1e900197566da8d472
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoF:jxPAPJmt+
TLSH
T1CC35A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpvrid.exe

Path C:\Windows\SysWOW64\wpvrid.exe
Size 1.0MB
SHA256 2aaa9b83825f882bec9f4892519bfaaa182f39d477a5ef0d66e1c211a31c50af
MD5 ea45c7cf33931ec0b4b3ab7fe9189e92
SHA1 a8e2b684063515cce68d9b0810b3e9c6256c6f2d
SHA512 588efe414228ef11c7be667f317c64c329a9ccb0d31030c51d181e84179242b06fdd2ff186bf1bccdcfe30a6848b9965c4eba9cfdee7277c454bd58d353c704b
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoO:jxPAPJmt5
TLSH
T1F635A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wqdftxgf.exe

Path C:\Windows\SysWOW64\wqdftxgf.exe
Size 1.0MB
SHA256 c20de1bb6b15ced30aaa3406dc705ed630e6e64d16770492e643947d5f5f2cff
MD5 2238009cd969f417ed7445cc8287609c
SHA1 19ed3689d01585bda473d25bd165fa9bbe1620fd
SHA512 a815875c97978ba8f10e0a5b3ae2406b41cf2b77a6f84d885fe2b10fefaa22cf6ea6fb4e2d1a040daa3eb687d5622150dad58fda94708178ed1986eb1f8f4679
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsol:jxPAPJmtu
TLSH
T1E235A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrbkys.exe

Path C:\Windows\SysWOW64\wrbkys.exe
Size 1.0MB
SHA256 016826effee860e1e5f350e6c5f5701dcc91d5762ef9253c5aac60edd78c7895
MD5 32dbabcdcc695b807ed27a2722673e6c
SHA1 dead9d7f15c4c46c47cefe5d949eacbfad62528e
SHA512 bdac677412c6c5d45f3e0eed51b75508a781a9b48e9aece0056de4ff23d41a7369cdebd37c07dea947253a540e22c46ade16ba158fc4e31b479e389ef08c249c
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nso6:jxPAPJmtt
TLSH
T1FE35A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wregyfn.exe

Path C:\Windows\SysWOW64\wregyfn.exe
Size 1.0MB
SHA256 f07a38bcbc295cc88d1a76fbf39cf5335b6b470206a632e04087851dda5dd3f9
MD5 5a2f6844aded92bc6f73764604d5bae5
SHA1 dbf83318d701fc2d9fff5d17c6a8de82096de476
SHA512 b7aa108c9cecd733d6c3d9856328c11df49decaac480cc03ad70ba5204397717b024198075feb23d715a586ade5ab0ef2d148d95ecc90c72be5867777b1e764a
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoM:jxPAPJmtb
TLSH
T1C535A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrvrrkak.exe

Path C:\Windows\SysWOW64\wrvrrkak.exe
Size 1.0MB
SHA256 f98f396f104af7c12dbe717bcf77a8db8f24e751b354c66eee6a398f6a30e467
MD5 adbb00ebb36ca861b8d35fa8627c2ce1
SHA1 fbbb7de5cacc629b7cb0712782159e633353a723
SHA512 3fe7dc2fb4390ce09ba1fbab75a6b9fcc7226f54684b0bcf2241fb0cc039f16939a72b3f2b5ba48177b755e0b210d0175812a4e93c6f7b2c27c7ef32a418c281
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoB:jxPAPJmtO
TLSH
T12935A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsbkrnk.exe

Path C:\Windows\SysWOW64\wsbkrnk.exe
Size 1.0MB
SHA256 d15ab004e231bf4098c04dd4c48c9a259df52920d42e1fed9c323e34050c449c
MD5 0c9f3695cbd1505eca9078ebb51ad419
SHA1 4d78017c382ec06e795d3402ad0b7e5640bd7500
SHA512 9d3098800930b1961755da670a49665c7fe733107aae92ea0b9f970dbe6c5b391a4981e02bd6faad50104e6fc662e72db9f30ee997636dbecec0f262da7a6f74
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsof:jxPAPJmtA
TLSH
T13735A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtjx.exe

Path C:\Windows\SysWOW64\wtjx.exe
Size 1.0MB
SHA256 a62705049a4ed2021b20030e27f94ee549ad6b79479a15bb524f2b8e852c0ef2
MD5 271d7f8e8105581e5eee9d193984f36f
SHA1 c6bc80f43ce18769d874d75e0298e6874a886c4e
SHA512 981f374b1863b01ecaa04b5f964e16393662cbbdf68bfd04a43aa48f4b382dac2b48368ad61713f67cc61fbde1d62b84dfcc1cbdb19852ddbf71d29fbde23e3d
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoA:jxPAPJmtX
TLSH
T1DA35A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtqiscpdg.exe

Path C:\Windows\SysWOW64\wtqiscpdg.exe
Size 1.0MB
SHA256 c27ef6b8b05e0052da19c744221790116bdbf192e4f58f2b728adeea1f118554
MD5 5c087beb72bfa148f66a97c42005e5b0
SHA1 080a2b91962c98b4a077a3ee43a450029b0f742f
SHA512 9280761b08667b5436ec33cca1d8a0b5848cbf45e1e5be31c3a92a7934a8f00626905efcd0be98f09b9cbc440ef3313c2b6e46902f94c01f74a256f0501788c5
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoh:jxPAPJmt+
TLSH
T15335A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wvn.exe

Path C:\Windows\SysWOW64\wvn.exe
Size 1.0MB
SHA256 f5ed333d42f2121ec2825c32a0d460b414c4e8f16f6c993e8e39e242eadc6b69
MD5 66bb6f9a193d1fbae9da4668946dfa8f
SHA1 931fa9b7a4c772f886131575758f464c402e79e1
SHA512 c5eb2dad166fb648917a2eec83ca841e33cde9ed80cbae7212aad57a79e9223711e61ae6acc739d46f517fea51c3a272f025624c37999f026b51f4184be30441
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoN:jxPAPJmt6
TLSH
T19335A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wxfyyvr.exe

Path C:\Windows\SysWOW64\wxfyyvr.exe
Size 1.0MB
SHA256 2beb81e7aadf5a2c98a579c9e723de55a02b1d1c9e187668c5f9b416f12514b9
MD5 fa883524726799d8bba293a94b08bf17
SHA1 1717df34b02d6c827b8be8b10531a962e8bdcafa
SHA512 8b950bb2ea07d67dc316169e3bbb1694899ea7fefe2bbd77f0613116ed17c4d9b32cc1179c50891d2dca466f44552d79ed1ef6799878ce9e4fc208a7539e5819
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoq:jxPAPJmtN
TLSH
T16635A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wxnjdt.exe

Path C:\Windows\SysWOW64\wxnjdt.exe
Size 1.0MB
SHA256 b6a80addd0810381e93cda4056cb9ed3d58f049853cf68aa548ffb8f1267d255
MD5 4a554a32f3206385b10ca3da06cf7099
SHA1 d7058367a8df7aed149382341677a502eae2d3d9
SHA512 cb2f070374a26f404e6ad25d633961a8b6a4cba12fbde3cc5bd0f9cb2a317b2dd98008db91c0442a74a568b8d1f28abde268e06b0dacd2a865210ee9f41249a7
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoj:jxPAPJmt0
TLSH
T17135A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wyelw.exe

Path C:\Windows\SysWOW64\wyelw.exe
Size 1.0MB
SHA256 26449dd1a6d771f04c586252ea9c55720c4e3356cec52037570fb4953acc2b3d
MD5 ff236b5efb5346b195b9d4a4d5a89e68
SHA1 366882e4a83eeb68483e4643f10aa2eafbe8c8dd
SHA512 1051d6623ddbe0b2416f988962e6b8aa70577ba1bb17f0ce93caf14e28f947720c74bec9a4b804f186ec45970cbbb463bb1fd82d1139d3519cdfa7e6989c9d14
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoL:jxPAPJmtU
TLSH
T10835A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wyhghkfxt.exe

Path C:\Windows\SysWOW64\wyhghkfxt.exe
Size 1.0MB
SHA256 e4eba7ddba3d5321f3b62ab76af3db149e2d3b365d525dbff33211bca61fa318
MD5 7550776e8a26826219b82bd53ab67b8e
SHA1 6dff3b3f967deba733b14af3931436262e9be330
SHA512 3d2b666a52325ac7a838d749bd315ef851b6309029e12d2670b37ae029a060364c53f407d8d5c662e5788fa9ea697f09ea408ab647b2f2bfe24cfef1332032ca
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsox:jxPAPJmtG
TLSH
T18735A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/396-111-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/396-99-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/444-330-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/444-317-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/584-444-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/584-455-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/584-446-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/768-142-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/768-165-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/772-55-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/772-67-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/1172-464-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/1216-199-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/1216-187-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/1268-11-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/1268-22-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/1448-351-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/1448-361-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/1492-172-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/1492-110-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/1500-327-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/1500-263-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/1708-285-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/1708-274-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/1832-34-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/1832-21-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2104-177-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2104-163-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2296-231-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2296-218-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2480-340-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2480-352-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2492-198-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2592-220-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2592-209-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2728-0-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2728-23-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2728-1-0x0000000000414000-0x0000000000415000-memory.dmp

Download

memory/2836-264-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2836-252-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3000-435-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3000-424-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3000-426-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3084-434-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3084-436-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3084-445-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3164-388-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3164-378-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3244-396-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3244-406-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3360-77-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3360-89-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3384-318-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3384-306-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3704-56-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3704-44-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3884-454-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3884-465-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3884-456-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3992-405-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3992-415-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3996-296-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3996-284-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4044-369-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4044-379-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4288-176-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4288-188-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4344-397-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4344-387-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4372-341-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4372-329-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4424-45-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4424-33-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4476-121-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4476-132-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4664-88-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4664-100-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4700-414-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4700-416-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4700-425-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4732-242-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4732-230-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4864-78-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4864-66-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4868-307-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4868-295-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5056-131-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5056-143-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5068-153-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5068-164-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5076-360-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5076-370-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5084-253-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5084-241-0x0000000000400000-0x000000000050A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads